Blame - docs/dyn/iam_v1.projects.serviceAccounts.html - platform/external/python/google-api-python-client

2016-02-19 16:02:29 -0800

[diff] [blame]

76

<h2>Instance Methods</h2>

</p>

<p class="firstline">Returns the keys Resource.</p>

81

82

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

83

<code><a href="#create">create(name, body=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

84

<p class="firstline">Creates a ServiceAccount</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

85

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

86

<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2016-10-12 14:05:53 -0700

[diff] [blame]

87

<p class="firstline">Deletes a ServiceAccount.</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

88

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

89

<code><a href="#disable">disable(name, body=None, x__xgafv=None)</a></code></p>

90

<p class="firstline">DisableServiceAccount is currently in the alpha launch stage.</p>

91

92

<code><a href="#enable">enable(name, body=None, x__xgafv=None)</a></code></p>

93

<p class="firstline">EnableServiceAccount is currently in the alpha launch stage.</p>

94

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

95

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2016-10-12 14:05:53 -0700

[diff] [blame]

96

<p class="firstline">Gets a ServiceAccount.</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

97

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

98

<code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

99

<p class="firstline">Returns the Cloud IAM access control policy for a</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

100

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

101

<code><a href="#list">list(name, pageToken=None, pageSize=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2016-10-12 14:05:53 -0700

[diff] [blame]

102

<p class="firstline">Lists ServiceAccounts for a project.</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

103

104

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

105

<p class="firstline">Retrieves the next page of results.</p>

106

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

107

<code><a href="#patch">patch(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

108

<p class="firstline">Patches a ServiceAccount.</p>

109

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

110

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

111

<p class="firstline">Sets the Cloud IAM access control policy for a</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

112

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

113

<code><a href="#signBlob">signBlob(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

114

<p class="firstline">**Note**: This method is in the process of being deprecated. Call the</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

115

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

116

<code><a href="#signJwt">signJwt(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

117

<p class="firstline">**Note**: This method is in the process of being deprecated. Call the</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

118

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

119

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

120

<p class="firstline">Tests the specified permissions against the IAM access control policy</p>

121

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

122

<code><a href="#undelete">undelete(name, body=None, x__xgafv=None)</a></code></p>

123

<p class="firstline">Restores a deleted ServiceAccount.</p>

124

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

125

<code><a href="#update">update(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

126

<p class="firstline">Note: This method is in the process of being deprecated. Use</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

127

<h3>Method Details</h3>

128

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

129

<code class="details" id="create">create(name, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

130

<pre>Creates a ServiceAccount

131

and returns it.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

132

133

Args:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

134

name: string, Required. The resource name of the project associated with the service

135

accounts, such as `projects/my-project-123`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

136

body: object, The request body.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

137

The object takes the form of:

138

139

{ # The service account create request.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

140

"accountId": "A String", # Required. The account id that is used to generate the service account

141

# email address and a stable unique id. It is unique within a project,

142

# must be 6-30 characters long, and match the regular expression

143

# `[a-z]([-a-z0-9]*[a-z0-9])` to comply with RFC1035.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

144

"serviceAccount": { # A service account in the Identity and Access Management API. # The ServiceAccount resource to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

145

# create. Currently, only the following values are user assignable:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

146

# `display_name` and `description`.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

147

#

148

# To create a service account, specify the `project_id` and the `account_id`

149

# for the account. The `account_id` is unique within the project, and is used

150

# to generate the service account email address and a stable

151

# `unique_id`.

152

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

153

# If the account already exists, the account's resource name is returned

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

154

# in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller

155

# can use the name in other methods to access the account.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

156

#

157

# All other methods can identify the service account using the format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

158

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

159

# Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

160

# the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

161

# `unique_id` of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

162

"email": "A String", # @OutputOnly The email address of the service account.

163

"name": "A String", # The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

164

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

165

#

166

# Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

167

# project from the `account` and the `ACCOUNT` value can be the `email`

168

# address or the `unique_id` of the service account.

169

#

170

# In responses the resource name will always be in the format

171

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

172

"projectId": "A String", # @OutputOnly The id of the project that owns the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

173

"oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.

174

# This is used in conjunction with the OAuth2 clientconfig API to make

175

# three legged OAuth2 (3LO) flows to access the data of Google users.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

176

"uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

177

"description": "A String", # Optional. A user-specified opaque description of the service account.

178

# Must be less than or equal to 256 UTF-8 bytes.

179

"displayName": "A String", # Optional. A user-specified name for the service account.

180

# Must be less than or equal to 100 UTF-8 bytes.

181

"etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned

182

# for backwards compatibility.

183

"disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.

184

# The field is currently in alpha phase.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

185

},

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

186

}

187

188

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

189

Allowed values

190

1 - v1 error format

191

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

192

193

Returns:

194

An object of the form:

195

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

196

{ # A service account in the Identity and Access Management API.

197

#

198

# To create a service account, specify the `project_id` and the `account_id`

199

# for the account. The `account_id` is unique within the project, and is used

200

# to generate the service account email address and a stable

201

# `unique_id`.

202

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

203

# If the account already exists, the account's resource name is returned

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

204

# in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller

205

# can use the name in other methods to access the account.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

206

#

207

# All other methods can identify the service account using the format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

208

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

209

# Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

210

# the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

211

# `unique_id` of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

212

"email": "A String", # @OutputOnly The email address of the service account.

213

"name": "A String", # The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

214

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

215

#

216

# Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

217

# project from the `account` and the `ACCOUNT` value can be the `email`

218

# address or the `unique_id` of the service account.

219

#

220

# In responses the resource name will always be in the format

221

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

222

"projectId": "A String", # @OutputOnly The id of the project that owns the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

223

"oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.

224

# This is used in conjunction with the OAuth2 clientconfig API to make

225

# three legged OAuth2 (3LO) flows to access the data of Google users.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

226

"uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

227

"description": "A String", # Optional. A user-specified opaque description of the service account.

228

# Must be less than or equal to 256 UTF-8 bytes.

229

"displayName": "A String", # Optional. A user-specified name for the service account.

230

# Must be less than or equal to 100 UTF-8 bytes.

231

"etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned

232

# for backwards compatibility.

233

"disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.

234

# The field is currently in alpha phase.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

239

<code class="details" id="delete">delete(name, x__xgafv=None)</code>

Sai Cheemalapati

2016-10-12 14:05:53 -0700

[diff] [blame]

240

<pre>Deletes a ServiceAccount.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

241

242

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

243

name: string, Required. The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

244

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

245

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

246

the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

247

`unique_id` of the service account. (required)

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

248

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

249

Allowed values

250

1 - v1 error format

251

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

252

253

Returns:

254

An object of the form:

255

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

256

{ # A generic empty message that you can re-use to avoid defining duplicated

257

# empty messages in your APIs. A typical example is to use it as the request

258

# or the response type of an API method. For instance:

259

#

260

# service Foo {

261

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

262

# }

263

#

264

# The JSON representation for `Empty` is empty JSON object `{}`.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

269

<code class="details" id="disable">disable(name, body=None, x__xgafv=None)</code>

270

<pre>DisableServiceAccount is currently in the alpha launch stage.

271

272

Disables a ServiceAccount,

273

which immediately prevents the service account from authenticating and

274

gaining access to APIs.

275

276

Disabled service accounts can be safely restored by using

277

EnableServiceAccount at any point. Deleted service accounts cannot be

278

restored using this method.

279

280

Disabling a service account that is bound to VMs, Apps, Functions, or

281

other jobs will cause those jobs to lose access to resources if they are

282

using the disabled service account.

283

284

To improve reliability of your services and avoid unexpected outages, it

285

is recommended to first disable a service account rather than delete it.

286

After disabling the service account, wait at least 24 hours to verify there

287

are no unintended consequences, and then delete the service account.

Args:

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

292

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

293

the account. The `ACCOUNT` value can be the `email` address or the

294

`unique_id` of the service account. (required)

295

body: object, The request body.

296

The object takes the form of:

297

298

{ # The service account disable request.

299

}

300

301

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

308

309

{ # A generic empty message that you can re-use to avoid defining duplicated

310

# empty messages in your APIs. A typical example is to use it as the request

311

# or the response type of an API method. For instance:

312

#

313

# service Foo {

314

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

315

# }

316

#

317

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

<code class="details" id="enable">enable(name, body=None, x__xgafv=None)</code>

323

<pre>EnableServiceAccount is currently in the alpha launch stage.

324

325

Restores a disabled ServiceAccount

326

that has been manually disabled by using DisableServiceAccount. Service

327

accounts that have been disabled by other means or for other reasons,

328

such as abuse, cannot be restored using this method.

329

330

EnableServiceAccount will have no effect on a service account that is

331

not disabled. Enabling an already enabled service account will have no

effect.

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

336

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

337

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

338

the account. The `ACCOUNT` value can be the `email` address or the

339

`unique_id` of the service account. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

340

body: object, The request body.

341

The object takes the form of:

342

343

{ # The service account enable request.

344

}

345

346

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

353

354

{ # A generic empty message that you can re-use to avoid defining duplicated

355

# empty messages in your APIs. A typical example is to use it as the request

356

# or the response type of an API method. For instance:

357

#

358

# service Foo {

359

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

360

# }

361

#

362

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

367

<code class="details" id="get">get(name, x__xgafv=None)</code>

Sai Cheemalapati

2016-10-12 14:05:53 -0700

[diff] [blame]

368

<pre>Gets a ServiceAccount.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

369

370

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

371

name: string, Required. The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

372

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

373

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

374

the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

375

`unique_id` of the service account. (required)

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

376

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

377

Allowed values

378

1 - v1 error format

379

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

380

381

Returns:

382

An object of the form:

383

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

384

{ # A service account in the Identity and Access Management API.

385

#

386

# To create a service account, specify the `project_id` and the `account_id`

387

# for the account. The `account_id` is unique within the project, and is used

388

# to generate the service account email address and a stable

389

# `unique_id`.

390

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

391

# If the account already exists, the account's resource name is returned

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

392

# in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller

393

# can use the name in other methods to access the account.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

394

#

395

# All other methods can identify the service account using the format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

396

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

397

# Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

398

# the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

399

# `unique_id` of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

400

"email": "A String", # @OutputOnly The email address of the service account.

401

"name": "A String", # The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

402

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

403

#

404

# Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

405

# project from the `account` and the `ACCOUNT` value can be the `email`

406

# address or the `unique_id` of the service account.

407

#

408

# In responses the resource name will always be in the format

409

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

410

"projectId": "A String", # @OutputOnly The id of the project that owns the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

411

"oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.

412

# This is used in conjunction with the OAuth2 clientconfig API to make

413

# three legged OAuth2 (3LO) flows to access the data of Google users.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

414

"uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

415

"description": "A String", # Optional. A user-specified opaque description of the service account.

416

# Must be less than or equal to 256 UTF-8 bytes.

417

"displayName": "A String", # Optional. A user-specified name for the service account.

418

# Must be less than or equal to 100 UTF-8 bytes.

419

"etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned

420

# for backwards compatibility.

421

"disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.

422

# The field is currently in alpha phase.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

427

<code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

428

<pre>Returns the Cloud IAM access control policy for a

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

429

ServiceAccount.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

430

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

431

Note: Service accounts are both

432

[resources and

433

identities](/iam/docs/service-accounts#service_account_permissions). This

434

method treats the service account as a resource. It returns the Cloud IAM

435

policy that reflects what members have access to the service account.

436

437

This method does not return what resources the service account has access

438

to. To see if a service account has access to a resource, call the

439

`getIamPolicy` method on the target resource. For example, to view grants

440

for a project, call the

441

[projects.getIamPolicy](/resource-manager/reference/rest/v1/projects/getIamPolicy)

442

method.

443

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

444

Args:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

445

resource: string, REQUIRED: The resource for which the policy is being requested.

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

446

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

447

options_requestedPolicyVersion: integer, Optional. The policy format version to be returned.

448

449

Valid values are 0, 1, and 3. Requests specifying an invalid value will be

450

rejected.

451

452

Requests for policies with any conditional bindings must specify version 3.

453

Policies without any conditional bindings may specify any valid value or

454

leave the field unset.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

455

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

456

Allowed values

457

1 - v1 error format

458

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

459

460

Returns:

461

An object of the form:

462

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

463

{ # An Identity and Access Management (IAM) policy, which specifies access

464

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

465

#

466

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

467

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

468

# `members` to a single `role`. Members can be user accounts, service accounts,

469

# Google groups, and domains (such as G Suite). A `role` is a named list of

470

# permissions; each `role` can be an IAM predefined role or a user-created

471

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

472

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

473

# Optionally, a `binding` can specify a `condition`, which is a logical

474

# expression that allows access to a resource only if the expression evaluates

475

# to `true`. A condition can add constraints based on attributes of the

476

# request, the resource, or both.

477

#

478

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

479

#

480

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

481

# "bindings": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

482

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

483

# "role": "roles/resourcemanager.organizationAdmin",

484

# "members": [

485

# "user:mike@example.com",

486

# "group:admins@example.com",

487

# "domain:google.com",

488

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

489

# ]

490

# },

491

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

492

# "role": "roles/resourcemanager.organizationViewer",

493

# "members": ["user:eve@example.com"],

494

# "condition": {

495

# "title": "expirable access",

496

# "description": "Does not grant access after Sep 2020",

497

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

498

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

499

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

500

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

501

# "etag": "BwWWja0YfJA=",

502

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

503

# }

504

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

505

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

510

# - group:admins@example.com

511

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

512

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

513

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

514

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

515

# - user:eve@example.com

516

# role: roles/resourcemanager.organizationViewer

517

# condition:

518

# title: expirable access

519

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

520

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

521

# - etag: BwWWja0YfJA=

522

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

523

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

524

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

525

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

526

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

527

# prevent simultaneous updates of a policy from overwriting each other.

528

# It is strongly suggested that systems make use of the `etag` in the

529

# read-modify-write cycle to perform policy updates in order to avoid race

530

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

531

# systems are expected to put that etag in the request to `setIamPolicy` to

532

# ensure that their change will be applied to the same version of the policy.

533

#

534

# **Important:** If you use IAM Conditions, you must include the `etag` field

535

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

536

# you to overwrite a version `3` policy with a version `1` policy, and all of

537

# the conditions in the version `3` policy are lost.

538

"version": 42, # Specifies the format of the policy.

539

#

540

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

541

# are rejected.

542

#

543

# Any operation that affects conditional role bindings must specify version

544

# `3`. This requirement applies to the following operations:

545

#

546

# * Getting a policy that includes a conditional role binding

547

# * Adding a conditional role binding to a policy

548

# * Changing a conditional role binding in a policy

549

# * Removing any role binding, with or without a condition, from a policy

550

# that includes conditions

551

#

552

# **Important:** If you use IAM Conditions, you must include the `etag` field

553

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

554

# you to overwrite a version `3` policy with a version `1` policy, and all of

555

# the conditions in the version `3` policy are lost.

556

#

557

# If a policy does not include any conditions, operations on that policy may

558

# specify any valid version or leave the field unset.

559

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

560

{ # Specifies the audit configuration for a service.

561

# The configuration determines which permission types are logged, and what

562

# identities, if any, are exempted from logging.

563

# An AuditConfig must have one or more AuditLogConfigs.

564

#

565

# If there are AuditConfigs for both `allServices` and a specific service,

566

# the union of the two AuditConfigs is used for that service: the log_types

567

# specified in each AuditConfig are enabled, and the exempted_members in each

568

# AuditLogConfig are exempted.

569

#

570

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

576

# "audit_log_configs": [

577

# {

578

# "log_type": "DATA_READ",

579

# "exempted_members": [

580

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

585

# },

586

# {

587

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com"

593

# "audit_log_configs": [

594

# {

595

# "log_type": "DATA_READ",

596

# },

597

# {

598

# "log_type": "DATA_WRITE",

599

# "exempted_members": [

600

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

609

# logging. It also exempts jose@example.com from DATA_READ logging, and

610

# aliya@example.com from DATA_WRITE logging.

611

"service": "A String", # Specifies a service that will be enabled for audit logging.

612

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

613

# `allServices` is a special value that covers all services.

614

"auditLogConfigs": [ # The configuration for logging of each type of permission.

615

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

620

# {

621

# "log_type": "DATA_READ",

622

# "exempted_members": [

623

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

633

# jose@example.com from DATA_READ logging.

634

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

635

# permission.

636

# Follows the same format of Binding.members.

637

"A String",

638

],

639

"logType": "A String", # The log type that this config enables.

},

],

},

],

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

645

# `condition` that determines how and when the `bindings` are applied. Each

646

# of the `bindings` must contain at least one member.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

647

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

648

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

649

# NOTE: An unsatisfied condition will not allow user access via current

650

# binding. Different bindings, including their conditions, are examined

651

# independently.

652

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

653

# are documented at https://github.com/google/cel-spec.

654

#

655

# Example (Comparison):

656

#

657

# title: "Summary size limit"

658

# description: "Determines if a summary is less than 100 chars"

659

# expression: "document.summary.size() < 100"

660

#

661

# Example (Equality):

662

#

663

# title: "Requestor is owner"

664

# description: "Determines if requestor is the document owner"

665

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

670

# description: "Determine whether the document should be publicly visible"

671

# expression: "document.type != 'private' && document.type != 'internal'"

672

#

673

# Example (Data Manipulation):

674

#

675

# title: "Notification string"

676

# description: "Create a notification string with a timestamp."

677

# expression: "'New message received at ' + string(document.create_time)"

678

#

679

# The exact variables and functions that may be referenced within an expression

680

# are determined by the service that evaluates it. See the service

681

# documentation for additional information.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

682

"description": "A String", # Optional. Description of the expression. This is a longer text which

683

# describes the expression, e.g. when hovered over it in a UI.

684

"expression": "A String", # Textual representation of an expression in Common Expression Language

685

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

686

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

687

# its purpose. This can be used e.g. in UIs which allow to enter the

688

# expression.

689

"location": "A String", # Optional. String indicating the location of the expression for error

690

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

691

},

692

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

693

# `members` can have the following values:

694

#

695

# * `allUsers`: A special identifier that represents anyone who is

696

# on the internet; with or without a Google account.

697

#

698

# * `allAuthenticatedUsers`: A special identifier that represents anyone

699

# who is authenticated with a Google account or a service account.

700

#

701

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

702

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

703

#

704

#

705

# * `serviceAccount:{emailid}`: An email address that represents a service

706

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

707

#

708

# * `group:{emailid}`: An email address that represents a Google group.

709

# For example, `admins@example.com`.

710

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

711

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

712

# identifier) representing a user that has been recently deleted. For

713

# example, `alice@example.com?uid=123456789012345678901`. If the user is

714

# recovered, this value reverts to `user:{emailid}` and the recovered user

715

# retains the role in the binding.

716

#

717

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

718

# unique identifier) representing a service account that has been recently

719

# deleted. For example,

720

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

721

# If the service account is undeleted, this value reverts to

722

# `serviceAccount:{emailid}` and the undeleted service account retains the

723

# role in the binding.

724

#

725

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

726

# identifier) representing a Google group that has been recently

727

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

728

# the group is recovered, this value reverts to `group:{emailid}` and the

729

# recovered group retains the role in the binding.

730

#

Sai Cheemalapati

4ba8c23

2017-06-06 18:46:08 -0400

[diff] [blame]

731

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

732

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

733

# users of that domain. For example, `google.com` or `example.com`.

734

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

735

"A String",

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

736

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

737

"role": "A String", # Role that is assigned to `members`.

738

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

739

},

740

],

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

745

<code class="details" id="list">list(name, pageToken=None, pageSize=None, x__xgafv=None)</code>

Sai Cheemalapati

2016-10-12 14:05:53 -0700

[diff] [blame]

746

<pre>Lists ServiceAccounts for a project.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

747

748

Args:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

749

name: string, Required. The resource name of the project associated with the service

750

accounts, such as `projects/my-project-123`. (required)

751

pageToken: string, Optional pagination token returned in an earlier

752

ListServiceAccountsResponse.next_page_token.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

753

pageSize: integer, Optional limit on the number of service accounts to include in the

754

response. Further accounts can subsequently be obtained by including the

755

ListServiceAccountsResponse.next_page_token

756

in a subsequent request.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

757

x__xgafv: string, V1 error format.

758

Allowed values

759

1 - v1 error format

760

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

761

762

Returns:

763

An object of the form:

764

765

{ # The service account list response.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

766

"nextPageToken": "A String", # To retrieve the next page of results, set

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

767

# ListServiceAccountsRequest.page_token

768

# to this value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

769

"accounts": [ # The list of matching service accounts.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

770

{ # A service account in the Identity and Access Management API.

771

#

772

# To create a service account, specify the `project_id` and the `account_id`

773

# for the account. The `account_id` is unique within the project, and is used

774

# to generate the service account email address and a stable

775

# `unique_id`.

776

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

777

# If the account already exists, the account's resource name is returned

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

778

# in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller

779

# can use the name in other methods to access the account.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

780

#

781

# All other methods can identify the service account using the format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

782

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

783

# Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

784

# the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

785

# `unique_id` of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

786

"email": "A String", # @OutputOnly The email address of the service account.

787

"name": "A String", # The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

788

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

789

#

790

# Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

791

# project from the `account` and the `ACCOUNT` value can be the `email`

792

# address or the `unique_id` of the service account.

793

#

794

# In responses the resource name will always be in the format

795

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

796

"projectId": "A String", # @OutputOnly The id of the project that owns the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

797

"oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.

798

# This is used in conjunction with the OAuth2 clientconfig API to make

799

# three legged OAuth2 (3LO) flows to access the data of Google users.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

800

"uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

801

"description": "A String", # Optional. A user-specified opaque description of the service account.

802

# Must be less than or equal to 256 UTF-8 bytes.

803

"displayName": "A String", # Optional. A user-specified name for the service account.

804

# Must be less than or equal to 100 UTF-8 bytes.

805

"etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned

806

# for backwards compatibility.

807

"disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.

808

# The field is currently in alpha phase.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

},

],

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

816

<pre>Retrieves the next page of results.

817

818

Args:

819

previous_request: The request for the previous page. (required)

820

previous_response: The response from the request for the previous page. (required)

821

822

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

823

A request object that you can call 'execute()' on to request the next

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

824

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

829

<code class="details" id="patch">patch(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

830

<pre>Patches a ServiceAccount.

831

832

Currently, only the following fields are updatable:

833

`display_name` and `description`.

834

835

Only fields specified in the request are guaranteed to be returned in

836

the response. Other fields in the response may be empty.

837

838

Note: The field mask is required.

Args:

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

843

844

Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

845

project from the `account` and the `ACCOUNT` value can be the `email`

846

address or the `unique_id` of the service account.

847

848

In responses the resource name will always be in the format

849

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

850

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

851

The object takes the form of:

852

853

{ # The patch service account request.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

854

"serviceAccount": { # A service account in the Identity and Access Management API.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

855

#

856

# To create a service account, specify the `project_id` and the `account_id`

857

# for the account. The `account_id` is unique within the project, and is used

858

# to generate the service account email address and a stable

859

# `unique_id`.

860

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

861

# If the account already exists, the account's resource name is returned

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

862

# in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller

863

# can use the name in other methods to access the account.

864

#

865

# All other methods can identify the service account using the format

866

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

867

# Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

868

# the account. The `ACCOUNT` value can be the `email` address or the

869

# `unique_id` of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

870

"email": "A String", # @OutputOnly The email address of the service account.

871

"name": "A String", # The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

872

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

873

#

874

# Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

875

# project from the `account` and the `ACCOUNT` value can be the `email`

876

# address or the `unique_id` of the service account.

877

#

878

# In responses the resource name will always be in the format

879

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

880

"projectId": "A String", # @OutputOnly The id of the project that owns the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

881

"oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.

882

# This is used in conjunction with the OAuth2 clientconfig API to make

883

# three legged OAuth2 (3LO) flows to access the data of Google users.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

884

"uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

885

"description": "A String", # Optional. A user-specified opaque description of the service account.

886

# Must be less than or equal to 256 UTF-8 bytes.

887

"displayName": "A String", # Optional. A user-specified name for the service account.

888

# Must be less than or equal to 100 UTF-8 bytes.

889

"etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned

890

# for backwards compatibility.

891

"disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.

892

# The field is currently in alpha phase.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

893

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

894

"updateMask": "A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

895

}

896

897

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

904

905

{ # A service account in the Identity and Access Management API.

906

#

907

# To create a service account, specify the `project_id` and the `account_id`

908

# for the account. The `account_id` is unique within the project, and is used

909

# to generate the service account email address and a stable

910

# `unique_id`.

911

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

912

# If the account already exists, the account's resource name is returned

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

913

# in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller

914

# can use the name in other methods to access the account.

915

#

916

# All other methods can identify the service account using the format

917

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

918

# Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

919

# the account. The `ACCOUNT` value can be the `email` address or the

920

# `unique_id` of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

921

"email": "A String", # @OutputOnly The email address of the service account.

922

"name": "A String", # The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

923

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

924

#

925

# Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

926

# project from the `account` and the `ACCOUNT` value can be the `email`

927

# address or the `unique_id` of the service account.

928

#

929

# In responses the resource name will always be in the format

930

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

931

"projectId": "A String", # @OutputOnly The id of the project that owns the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

932

"oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.

933

# This is used in conjunction with the OAuth2 clientconfig API to make

934

# three legged OAuth2 (3LO) flows to access the data of Google users.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

935

"uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

936

"description": "A String", # Optional. A user-specified opaque description of the service account.

937

# Must be less than or equal to 256 UTF-8 bytes.

938

"displayName": "A String", # Optional. A user-specified name for the service account.

939

# Must be less than or equal to 100 UTF-8 bytes.

940

"etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned

941

# for backwards compatibility.

942

"disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.

943

# The field is currently in alpha phase.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

948

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

949

<pre>Sets the Cloud IAM access control policy for a

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

950

ServiceAccount.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

951

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

952

Note: Service accounts are both

953

[resources and

954

identities](/iam/docs/service-accounts#service_account_permissions). This

955

method treats the service account as a resource. Use it to grant members

956

access to the service account, such as when they need to impersonate it.

957

958

This method does not grant the service account access to other resources,

959

such as projects. To grant a service account access to resources, include

960

the service account in the Cloud IAM policy for the desired resource, then

961

call the appropriate `setIamPolicy` method on the target resource. For

962

example, to grant a service account access to a project, call the

963

[projects.setIamPolicy](/resource-manager/reference/rest/v1/projects/setIamPolicy)

964

method.

965

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

966

Args:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

967

resource: string, REQUIRED: The resource for which the policy is being specified.

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

968

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

969

body: object, The request body.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

970

The object takes the form of:

971

972

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

973

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

974

# the policy is limited to a few 10s of KB. An empty policy is a

975

# valid policy but certain Cloud Platform services (such as Projects)

976

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

977

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

978

#

979

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

980

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

981

# `members` to a single `role`. Members can be user accounts, service accounts,

982

# Google groups, and domains (such as G Suite). A `role` is a named list of

983

# permissions; each `role` can be an IAM predefined role or a user-created

984

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

985

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

986

# Optionally, a `binding` can specify a `condition`, which is a logical

987

# expression that allows access to a resource only if the expression evaluates

988

# to `true`. A condition can add constraints based on attributes of the

989

# request, the resource, or both.

990

#

991

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

992

#

993

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

994

# "bindings": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

995

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

996

# "role": "roles/resourcemanager.organizationAdmin",

997

# "members": [

998

# "user:mike@example.com",

999

# "group:admins@example.com",

1000

# "domain:google.com",

1001

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1002

# ]

1003

# },

1004

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1005

# "role": "roles/resourcemanager.organizationViewer",

1006

# "members": ["user:eve@example.com"],

1007

# "condition": {

1008

# "title": "expirable access",

1009

# "description": "Does not grant access after Sep 2020",

1010

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1011

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1012

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1013

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1014

# "etag": "BwWWja0YfJA=",

1015

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1016

# }

1017

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1018

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1023

# - group:admins@example.com

1024

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1025

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1026

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1027

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1028

# - user:eve@example.com

1029

# role: roles/resourcemanager.organizationViewer

1030

# condition:

1031

# title: expirable access

1032

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1033

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1034

# - etag: BwWWja0YfJA=

1035

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1036

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1037

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1038

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1039

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1040

# prevent simultaneous updates of a policy from overwriting each other.

1041

# It is strongly suggested that systems make use of the `etag` in the

1042

# read-modify-write cycle to perform policy updates in order to avoid race

1043

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1044

# systems are expected to put that etag in the request to `setIamPolicy` to

1045

# ensure that their change will be applied to the same version of the policy.

1046

#

1047

# **Important:** If you use IAM Conditions, you must include the `etag` field

1048

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1049

# you to overwrite a version `3` policy with a version `1` policy, and all of

1050

# the conditions in the version `3` policy are lost.

1051

"version": 42, # Specifies the format of the policy.

1052

#

1053

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1054

# are rejected.

1055

#

1056

# Any operation that affects conditional role bindings must specify version

1057

# `3`. This requirement applies to the following operations:

1058

#

1059

# * Getting a policy that includes a conditional role binding

1060

# * Adding a conditional role binding to a policy

1061

# * Changing a conditional role binding in a policy

1062

# * Removing any role binding, with or without a condition, from a policy

1063

# that includes conditions

1064

#

1065

# **Important:** If you use IAM Conditions, you must include the `etag` field

1066

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1067

# you to overwrite a version `3` policy with a version `1` policy, and all of

1068

# the conditions in the version `3` policy are lost.

1069

#

1070

# If a policy does not include any conditions, operations on that policy may

1071

# specify any valid version or leave the field unset.

1072

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1073

{ # Specifies the audit configuration for a service.

1074

# The configuration determines which permission types are logged, and what

1075

# identities, if any, are exempted from logging.

1076

# An AuditConfig must have one or more AuditLogConfigs.

1077

#

1078

# If there are AuditConfigs for both `allServices` and a specific service,

1079

# the union of the two AuditConfigs is used for that service: the log_types

1080

# specified in each AuditConfig are enabled, and the exempted_members in each

1081

# AuditLogConfig are exempted.

1082

#

1083

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

1089

# "audit_log_configs": [

1090

# {

1091

# "log_type": "DATA_READ",

1092

# "exempted_members": [

1093

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

1098

# },

1099

# {

1100

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com"

1106

# "audit_log_configs": [

1107

# {

1108

# "log_type": "DATA_READ",

1109

# },

1110

# {

1111

# "log_type": "DATA_WRITE",

1112

# "exempted_members": [

1113

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

1122

# logging. It also exempts jose@example.com from DATA_READ logging, and

1123

# aliya@example.com from DATA_WRITE logging.

1124

"service": "A String", # Specifies a service that will be enabled for audit logging.

1125

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

1126

# `allServices` is a special value that covers all services.

1127

"auditLogConfigs": [ # The configuration for logging of each type of permission.

1128

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1133

# {

1134

# "log_type": "DATA_READ",

1135

# "exempted_members": [

1136

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1146

# jose@example.com from DATA_READ logging.

1147

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1148

# permission.

1149

# Follows the same format of Binding.members.

1150

"A String",

1151

],

1152

"logType": "A String", # The log type that this config enables.

},

],

},

],

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1158

# `condition` that determines how and when the `bindings` are applied. Each

1159

# of the `bindings` must contain at least one member.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1160

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1161

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1162

# NOTE: An unsatisfied condition will not allow user access via current

1163

# binding. Different bindings, including their conditions, are examined

1164

# independently.

1165

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1166

# are documented at https://github.com/google/cel-spec.

1167

#

1168

# Example (Comparison):

1169

#

1170

# title: "Summary size limit"

1171

# description: "Determines if a summary is less than 100 chars"

1172

# expression: "document.summary.size() < 100"

1173

#

1174

# Example (Equality):

1175

#

1176

# title: "Requestor is owner"

1177

# description: "Determines if requestor is the document owner"

1178

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1183

# description: "Determine whether the document should be publicly visible"

1184

# expression: "document.type != 'private' && document.type != 'internal'"

1185

#

1186

# Example (Data Manipulation):

1187

#

1188

# title: "Notification string"

1189

# description: "Create a notification string with a timestamp."

1190

# expression: "'New message received at ' + string(document.create_time)"

1191

#

1192

# The exact variables and functions that may be referenced within an expression

1193

# are determined by the service that evaluates it. See the service

1194

# documentation for additional information.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1195

"description": "A String", # Optional. Description of the expression. This is a longer text which

1196

# describes the expression, e.g. when hovered over it in a UI.

1197

"expression": "A String", # Textual representation of an expression in Common Expression Language

1198

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1199

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1200

# its purpose. This can be used e.g. in UIs which allow to enter the

1201

# expression.

1202

"location": "A String", # Optional. String indicating the location of the expression for error

1203

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1204

},

1205

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1206

# `members` can have the following values:

1207

#

1208

# * `allUsers`: A special identifier that represents anyone who is

1209

# on the internet; with or without a Google account.

1210

#

1211

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1212

# who is authenticated with a Google account or a service account.

1213

#

1214

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1215

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1216

#

1217

#

1218

# * `serviceAccount:{emailid}`: An email address that represents a service

1219

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1220

#

1221

# * `group:{emailid}`: An email address that represents a Google group.

1222

# For example, `admins@example.com`.

1223

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1224

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1225

# identifier) representing a user that has been recently deleted. For

1226

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1227

# recovered, this value reverts to `user:{emailid}` and the recovered user

1228

# retains the role in the binding.

1229

#

1230

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1231

# unique identifier) representing a service account that has been recently

1232

# deleted. For example,

1233

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1234

# If the service account is undeleted, this value reverts to

1235

# `serviceAccount:{emailid}` and the undeleted service account retains the

1236

# role in the binding.

1237

#

1238

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1239

# identifier) representing a Google group that has been recently

1240

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1241

# the group is recovered, this value reverts to `group:{emailid}` and the

1242

# recovered group retains the role in the binding.

1243

#

Sai Cheemalapati

4ba8c23

2017-06-06 18:46:08 -0400

[diff] [blame]

1244

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1245

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1246

# users of that domain. For example, `google.com` or `example.com`.

1247

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1248

"A String",

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1249

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1250

"role": "A String", # Role that is assigned to `members`.

1251

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1252

},

1253

],

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1254

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1255

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1256

# the fields in the mask will be modified. If no mask is provided, the

1257

# following default mask is used:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1258

# paths: "bindings, etag"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1259

# This field is only used by Cloud IAM.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1260

}

1261

1262

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1263

Allowed values

1264

1 - v1 error format

1265

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1266

1267

Returns:

1268

An object of the form:

1269

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1270

{ # An Identity and Access Management (IAM) policy, which specifies access

1271

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1272

#

1273

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1274

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1275

# `members` to a single `role`. Members can be user accounts, service accounts,

1276

# Google groups, and domains (such as G Suite). A `role` is a named list of

1277

# permissions; each `role` can be an IAM predefined role or a user-created

1278

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1279

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1280

# Optionally, a `binding` can specify a `condition`, which is a logical

1281

# expression that allows access to a resource only if the expression evaluates

1282

# to `true`. A condition can add constraints based on attributes of the

1283

# request, the resource, or both.

1284

#

1285

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1286

#

1287

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1288

# "bindings": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1289

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1290

# "role": "roles/resourcemanager.organizationAdmin",

1291

# "members": [

1292

# "user:mike@example.com",

1293

# "group:admins@example.com",

1294

# "domain:google.com",

1295

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1296

# ]

1297

# },

1298

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1299

# "role": "roles/resourcemanager.organizationViewer",

1300

# "members": ["user:eve@example.com"],

1301

# "condition": {

1302

# "title": "expirable access",

1303

# "description": "Does not grant access after Sep 2020",

1304

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1305

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1306

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1307

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1308

# "etag": "BwWWja0YfJA=",

1309

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1310

# }

1311

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1312

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1317

# - group:admins@example.com

1318

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1319

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1320

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1321

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1322

# - user:eve@example.com

1323

# role: roles/resourcemanager.organizationViewer

1324

# condition:

1325

# title: expirable access

1326

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1327

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1328

# - etag: BwWWja0YfJA=

1329

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1330

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1331

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1332

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1333

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1334

# prevent simultaneous updates of a policy from overwriting each other.

1335

# It is strongly suggested that systems make use of the `etag` in the

1336

# read-modify-write cycle to perform policy updates in order to avoid race

1337

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1338

# systems are expected to put that etag in the request to `setIamPolicy` to

1339

# ensure that their change will be applied to the same version of the policy.

1340

#

1341

# **Important:** If you use IAM Conditions, you must include the `etag` field

1342

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1343

# you to overwrite a version `3` policy with a version `1` policy, and all of

1344

# the conditions in the version `3` policy are lost.

1345

"version": 42, # Specifies the format of the policy.

1346

#

1347

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1348

# are rejected.

1349

#

1350

# Any operation that affects conditional role bindings must specify version

1351

# `3`. This requirement applies to the following operations:

1352

#

1353

# * Getting a policy that includes a conditional role binding

1354

# * Adding a conditional role binding to a policy

1355

# * Changing a conditional role binding in a policy

1356

# * Removing any role binding, with or without a condition, from a policy

1357

# that includes conditions

1358

#

1359

# **Important:** If you use IAM Conditions, you must include the `etag` field

1360

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1361

# you to overwrite a version `3` policy with a version `1` policy, and all of

1362

# the conditions in the version `3` policy are lost.

1363

#

1364

# If a policy does not include any conditions, operations on that policy may

1365

# specify any valid version or leave the field unset.

1366

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1367

{ # Specifies the audit configuration for a service.

1368

# The configuration determines which permission types are logged, and what

1369

# identities, if any, are exempted from logging.

1370

# An AuditConfig must have one or more AuditLogConfigs.

1371

#

1372

# If there are AuditConfigs for both `allServices` and a specific service,

1373

# the union of the two AuditConfigs is used for that service: the log_types

1374

# specified in each AuditConfig are enabled, and the exempted_members in each

1375

# AuditLogConfig are exempted.

1376

#

1377

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices"

1383

# "audit_log_configs": [

1384

# {

1385

# "log_type": "DATA_READ",

1386

# "exempted_members": [

1387

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

1392

# },

1393

# {

1394

# "log_type": "ADMIN_READ",

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com"

1400

# "audit_log_configs": [

1401

# {

1402

# "log_type": "DATA_READ",

1403

# },

1404

# {

1405

# "log_type": "DATA_WRITE",

1406

# "exempted_members": [

1407

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

1416

# logging. It also exempts jose@example.com from DATA_READ logging, and

1417

# aliya@example.com from DATA_WRITE logging.

1418

"service": "A String", # Specifies a service that will be enabled for audit logging.

1419

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

1420

# `allServices` is a special value that covers all services.

1421

"auditLogConfigs": [ # The configuration for logging of each type of permission.

1422

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1427

# {

1428

# "log_type": "DATA_READ",

1429

# "exempted_members": [

1430

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE",

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1440

# jose@example.com from DATA_READ logging.

1441

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1442

# permission.

1443

# Follows the same format of Binding.members.

1444

"A String",

1445

],

1446

"logType": "A String", # The log type that this config enables.

},

],

},

],

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1452

# `condition` that determines how and when the `bindings` are applied. Each

1453

# of the `bindings` must contain at least one member.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1454

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1455

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1456

# NOTE: An unsatisfied condition will not allow user access via current

1457

# binding. Different bindings, including their conditions, are examined

1458

# independently.

1459

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1460

# are documented at https://github.com/google/cel-spec.

1461

#

1462

# Example (Comparison):

1463

#

1464

# title: "Summary size limit"

1465

# description: "Determines if a summary is less than 100 chars"

1466

# expression: "document.summary.size() < 100"

1467

#

1468

# Example (Equality):

1469

#

1470

# title: "Requestor is owner"

1471

# description: "Determines if requestor is the document owner"

1472

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1477

# description: "Determine whether the document should be publicly visible"

1478

# expression: "document.type != 'private' && document.type != 'internal'"

1479

#

1480

# Example (Data Manipulation):

1481

#

1482

# title: "Notification string"

1483

# description: "Create a notification string with a timestamp."

1484

# expression: "'New message received at ' + string(document.create_time)"

1485

#

1486

# The exact variables and functions that may be referenced within an expression

1487

# are determined by the service that evaluates it. See the service

1488

# documentation for additional information.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1489

"description": "A String", # Optional. Description of the expression. This is a longer text which

1490

# describes the expression, e.g. when hovered over it in a UI.

1491

"expression": "A String", # Textual representation of an expression in Common Expression Language

1492

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1493

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1494

# its purpose. This can be used e.g. in UIs which allow to enter the

1495

# expression.

1496

"location": "A String", # Optional. String indicating the location of the expression for error

1497

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1498

},

1499

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1500

# `members` can have the following values:

1501

#

1502

# * `allUsers`: A special identifier that represents anyone who is

1503

# on the internet; with or without a Google account.

1504

#

1505

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1506

# who is authenticated with a Google account or a service account.

1507

#

1508

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1509

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1510

#

1511

#

1512

# * `serviceAccount:{emailid}`: An email address that represents a service

1513

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1514

#

1515

# * `group:{emailid}`: An email address that represents a Google group.

1516

# For example, `admins@example.com`.

1517

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1518

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1519

# identifier) representing a user that has been recently deleted. For

1520

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1521

# recovered, this value reverts to `user:{emailid}` and the recovered user

1522

# retains the role in the binding.

1523

#

1524

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1525

# unique identifier) representing a service account that has been recently

1526

# deleted. For example,

1527

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1528

# If the service account is undeleted, this value reverts to

1529

# `serviceAccount:{emailid}` and the undeleted service account retains the

1530

# role in the binding.

1531

#

1532

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1533

# identifier) representing a Google group that has been recently

1534

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1535

# the group is recovered, this value reverts to `group:{emailid}` and the

1536

# recovered group retains the role in the binding.

1537

#

Sai Cheemalapati

4ba8c23

2017-06-06 18:46:08 -0400

[diff] [blame]

1538

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1539

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1540

# users of that domain. For example, `google.com` or `example.com`.

1541

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1542

"A String",

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1543

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1544

"role": "A String", # Role that is assigned to `members`.

1545

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1546

},

1547

],

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1552

<code class="details" id="signBlob">signBlob(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1553

<pre>**Note**: This method is in the process of being deprecated. Call the

1554

[`signBlob()`](/iam/credentials/reference/rest/v1/projects.serviceAccounts/signBlob)

1555

method of the Cloud IAM Service Account Credentials API instead.

1556

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1557

Signs a blob using a service account's system-managed private key.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1558

1559

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1560

name: string, Required. The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1561

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1562

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

1563

the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1564

`unique_id` of the service account. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1565

body: object, The request body.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1566

The object takes the form of:

1567

1568

{ # The service account sign blob request.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1569

"bytesToSign": "A String", # Required. The bytes to sign.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1570

}

1571

1572

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1573

Allowed values

1574

1 - v1 error format

1575

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1576

1577

Returns:

1578

An object of the form:

1579

1580

{ # The service account sign blob response.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1581

"signature": "A String", # The signed blob.

1582

"keyId": "A String", # The id of the key used to sign the blob.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1587

<code class="details" id="signJwt">signJwt(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1588

<pre>**Note**: This method is in the process of being deprecated. Call the

1589

[`signJwt()`](/iam/credentials/reference/rest/v1/projects.serviceAccounts/signJwt)

1590

method of the Cloud IAM Service Account Credentials API instead.

1591

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1592

Signs a JWT using a service account's system-managed private key.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1593

1594

If no expiry time (`exp`) is provided in the `SignJwtRequest`, IAM sets an

1595

an expiry time of one hour by default. If you request an expiry time of

1596

more than one hour, the request will fail.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1597

1598

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1599

name: string, Required. The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1600

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1601

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

1602

the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1603

`unique_id` of the service account. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1604

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1605

The object takes the form of:

1606

1607

{ # The service account sign JWT request.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1608

"payload": "A String", # Required. The JWT payload to sign, a JSON JWT Claim set.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1609

}

1610

1611

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1618

1619

{ # The service account sign JWT response.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1620

"keyId": "A String", # The id of the key used to sign the JWT.

1621

"signedJwt": "A String", # The signed JWT.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1626

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1627

<pre>Tests the specified permissions against the IAM access control policy

1628

for a ServiceAccount.

1629

1630

Args:

1631

resource: string, REQUIRED: The resource for which the policy detail is being requested.

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1632

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1633

body: object, The request body.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1634

The object takes the form of:

1635

1636

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1637

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

1638

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1639

# information see

1640

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1641

"A String",

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1646

Allowed values

1647

1 - v1 error format

1648

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1649

1650

Returns:

1651

An object of the form:

1652

1653

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1654

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1655

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1656

"A String",

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

],

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1662

<code class="details" id="undelete">undelete(name, body=None, x__xgafv=None)</code>

1663

<pre>Restores a deleted ServiceAccount.

1664

This is to be used as an action of last resort. A service account may

1665

not always be restorable.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1666

1667

Args:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1668

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1669

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_UNIQUE_ID}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1670

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

1671

the account. (required)

1672

body: object, The request body.

1673

The object takes the form of:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1674

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1675

{ # The service account undelete request.

1676

}

1677

1678

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1685

1686

{

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1687

"restoredAccount": { # A service account in the Identity and Access Management API. # Metadata for the restored service account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1688

#

1689

# To create a service account, specify the `project_id` and the `account_id`

1690

# for the account. The `account_id` is unique within the project, and is used

1691

# to generate the service account email address and a stable

1692

# `unique_id`.

1693

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1694

# If the account already exists, the account's resource name is returned

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1695

# in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller

1696

# can use the name in other methods to access the account.

1697

#

1698

# All other methods can identify the service account using the format

1699

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1700

# Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

1701

# the account. The `ACCOUNT` value can be the `email` address or the

1702

# `unique_id` of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1703

"email": "A String", # @OutputOnly The email address of the service account.

1704

"name": "A String", # The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1705

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1706

#

1707

# Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

1708

# project from the `account` and the `ACCOUNT` value can be the `email`

1709

# address or the `unique_id` of the service account.

1710

#

1711

# In responses the resource name will always be in the format

1712

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1713

"projectId": "A String", # @OutputOnly The id of the project that owns the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1714

"oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.

1715

# This is used in conjunction with the OAuth2 clientconfig API to make

1716

# three legged OAuth2 (3LO) flows to access the data of Google users.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1717

"uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1718

"description": "A String", # Optional. A user-specified opaque description of the service account.

1719

# Must be less than or equal to 256 UTF-8 bytes.

1720

"displayName": "A String", # Optional. A user-specified name for the service account.

1721

# Must be less than or equal to 100 UTF-8 bytes.

1722

"etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned

1723

# for backwards compatibility.

1724

"disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.

1725

# The field is currently in alpha phase.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1731

<code class="details" id="update">update(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1732

<pre>Note: This method is in the process of being deprecated. Use

1733

PatchServiceAccount instead.

1734

1735

Updates a ServiceAccount.

1736

1737

Currently, only the following fields are updatable:

1738

`display_name` and `description`.

Args:

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1743

1744

Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

1745

project from the `account` and the `ACCOUNT` value can be the `email`

1746

address or the `unique_id` of the service account.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1747

1748

In responses the resource name will always be in the format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1749

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1750

body: object, The request body.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1751

The object takes the form of:

1752

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1753

{ # A service account in the Identity and Access Management API.

1754

#

1755

# To create a service account, specify the `project_id` and the `account_id`

1756

# for the account. The `account_id` is unique within the project, and is used

1757

# to generate the service account email address and a stable

1758

# `unique_id`.

1759

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1760

# If the account already exists, the account's resource name is returned

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1761

# in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller

1762

# can use the name in other methods to access the account.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1763

#

1764

# All other methods can identify the service account using the format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1765

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1766

# Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

1767

# the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1768

# `unique_id` of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1769

"email": "A String", # @OutputOnly The email address of the service account.

1770

"name": "A String", # The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1771

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1772

#

1773

# Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

1774

# project from the `account` and the `ACCOUNT` value can be the `email`

1775

# address or the `unique_id` of the service account.

1776

#

1777

# In responses the resource name will always be in the format

1778

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1779

"projectId": "A String", # @OutputOnly The id of the project that owns the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1780

"oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.

1781

# This is used in conjunction with the OAuth2 clientconfig API to make

1782

# three legged OAuth2 (3LO) flows to access the data of Google users.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1783

"uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1784

"description": "A String", # Optional. A user-specified opaque description of the service account.

1785

# Must be less than or equal to 256 UTF-8 bytes.

1786

"displayName": "A String", # Optional. A user-specified name for the service account.

1787

# Must be less than or equal to 100 UTF-8 bytes.

1788

"etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned

1789

# for backwards compatibility.

1790

"disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.

1791

# The field is currently in alpha phase.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1792

}

1793

1794

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1795

Allowed values

1796

1 - v1 error format

1797

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1798

1799

Returns:

1800

An object of the form:

1801

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1802

{ # A service account in the Identity and Access Management API.

1803

#

1804

# To create a service account, specify the `project_id` and the `account_id`

1805

# for the account. The `account_id` is unique within the project, and is used

1806

# to generate the service account email address and a stable

1807

# `unique_id`.

1808

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1809

# If the account already exists, the account's resource name is returned

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1810

# in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller

1811

# can use the name in other methods to access the account.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1812

#

1813

# All other methods can identify the service account using the format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1814

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1815

# Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

1816

# the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1817

# `unique_id` of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1818

"email": "A String", # @OutputOnly The email address of the service account.

1819

"name": "A String", # The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1820

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1821

#

1822

# Requests using `-` as a wildcard for the `PROJECT_ID` will infer the

1823

# project from the `account` and the `ACCOUNT` value can be the `email`

1824

# address or the `unique_id` of the service account.

1825

#

1826

# In responses the resource name will always be in the format

1827

# `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1828

"projectId": "A String", # @OutputOnly The id of the project that owns the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1829

"oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.

1830

# This is used in conjunction with the OAuth2 clientconfig API to make

1831

# three legged OAuth2 (3LO) flows to access the data of Google users.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1832

"uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1833

"description": "A String", # Optional. A user-specified opaque description of the service account.

1834

# Must be less than or equal to 256 UTF-8 bytes.

1835

"displayName": "A String", # Optional. A user-specified name for the service account.

1836

# Must be less than or equal to 100 UTF-8 bytes.

1837

"etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned

1838

# for backwards compatibility.

1839

"disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.

1840

# The field is currently in alpha phase.

Jon Wayne Parrott