blob: acd49ce4852230ae1c98e017af5e9fc35b6d2dca [file] [log] [blame]
Bu Sun Kim715bd7f2019-06-14 16:50:42 -07001<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
75<h1><a href="iap_v1beta1.html">Cloud Identity-Aware Proxy API</a> . <a href="iap_v1beta1.v1beta1.html">v1beta1</a></h1>
76<h2>Instance Methods</h2>
77<p class="toc_element">
78 <code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
79<p class="firstline">Gets the access control policy for an Identity-Aware Proxy protected</p>
80<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -070081 <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -070082<p class="firstline">Sets the access control policy for an Identity-Aware Proxy protected</p>
83<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -070084 <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -070085<p class="firstline">Returns permissions that a caller has on the Identity-Aware Proxy protected</p>
86<h3>Method Details</h3>
87<div class="method">
88 <code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>
89 <pre>Gets the access control policy for an Identity-Aware Proxy protected
90resource.
91More information about managing access via IAP can be found at:
92https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
93
94Args:
95 resource: string, REQUIRED: The resource for which the policy is being requested.
96See the operation documentation for the appropriate value for this field. (required)
97 body: object, The request body.
98 The object takes the form of:
99
100{ # Request message for `GetIamPolicy` method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700101 &quot;options&quot;: { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to
102 # `GetIamPolicy`.
103 &quot;requestedPolicyVersion&quot;: 42, # Optional. The policy format version to be returned.
Dan O'Mearadd494642020-05-01 07:42:23 -0700104 #
105 # Valid values are 0, 1, and 3. Requests specifying an invalid value will be
106 # rejected.
107 #
108 # Requests for policies with any conditional bindings must specify version 3.
109 # Policies without any conditional bindings may specify any valid value or
110 # leave the field unset.
Bu Sun Kim65020912020-05-20 12:08:20 -0700111 #
112 # To learn which resources support conditions in their IAM policies, see the
113 # [IAM
114 # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700115 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700116 }
117
118 x__xgafv: string, V1 error format.
119 Allowed values
120 1 - v1 error format
121 2 - v2 error format
122
123Returns:
124 An object of the form:
125
Dan O'Mearadd494642020-05-01 07:42:23 -0700126 { # An Identity and Access Management (IAM) policy, which specifies access
127 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700128 #
129 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700130 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
131 # `members` to a single `role`. Members can be user accounts, service accounts,
132 # Google groups, and domains (such as G Suite). A `role` is a named list of
133 # permissions; each `role` can be an IAM predefined role or a user-created
134 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700135 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700136 # For some types of Google Cloud resources, a `binding` can also specify a
137 # `condition`, which is a logical expression that allows access to a resource
138 # only if the expression evaluates to `true`. A condition can add constraints
139 # based on attributes of the request, the resource, or both. To learn which
140 # resources support conditions in their IAM policies, see the
141 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700142 #
143 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700144 #
145 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700146 # &quot;bindings&quot;: [
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700147 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700148 # &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;,
149 # &quot;members&quot;: [
150 # &quot;user:mike@example.com&quot;,
151 # &quot;group:admins@example.com&quot;,
152 # &quot;domain:google.com&quot;,
153 # &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700154 # ]
155 # },
156 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700157 # &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;,
158 # &quot;members&quot;: [
159 # &quot;user:eve@example.com&quot;
160 # ],
161 # &quot;condition&quot;: {
162 # &quot;title&quot;: &quot;expirable access&quot;,
163 # &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;,
164 # &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;,
Dan O'Mearadd494642020-05-01 07:42:23 -0700165 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700166 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700167 # ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700168 # &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;,
169 # &quot;version&quot;: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700170 # }
171 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700172 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700173 #
174 # bindings:
175 # - members:
176 # - user:mike@example.com
177 # - group:admins@example.com
178 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700179 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
180 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700181 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700182 # - user:eve@example.com
183 # role: roles/resourcemanager.organizationViewer
184 # condition:
185 # title: expirable access
186 # description: Does not grant access after Sep 2020
Bu Sun Kim65020912020-05-20 12:08:20 -0700187 # expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)
Dan O'Mearadd494642020-05-01 07:42:23 -0700188 # - etag: BwWWja0YfJA=
189 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700190 #
191 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700192 # [IAM documentation](https://cloud.google.com/iam/docs/).
Bu Sun Kim65020912020-05-20 12:08:20 -0700193 &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
194 # prevent simultaneous updates of a policy from overwriting each other.
195 # It is strongly suggested that systems make use of the `etag` in the
196 # read-modify-write cycle to perform policy updates in order to avoid race
197 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
198 # systems are expected to put that etag in the request to `setIamPolicy` to
199 # ensure that their change will be applied to the same version of the policy.
200 #
201 # **Important:** If you use IAM Conditions, you must include the `etag` field
202 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
203 # you to overwrite a version `3` policy with a version `1` policy, and all of
204 # the conditions in the version `3` policy are lost.
205 &quot;version&quot;: 42, # Specifies the format of the policy.
206 #
207 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
208 # are rejected.
209 #
210 # Any operation that affects conditional role bindings must specify version
211 # `3`. This requirement applies to the following operations:
212 #
213 # * Getting a policy that includes a conditional role binding
214 # * Adding a conditional role binding to a policy
215 # * Changing a conditional role binding in a policy
216 # * Removing any role binding, with or without a condition, from a policy
217 # that includes conditions
218 #
219 # **Important:** If you use IAM Conditions, you must include the `etag` field
220 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
221 # you to overwrite a version `3` policy with a version `1` policy, and all of
222 # the conditions in the version `3` policy are lost.
223 #
224 # If a policy does not include any conditions, operations on that policy may
225 # specify any valid version or leave the field unset.
226 #
227 # To learn which resources support conditions in their IAM policies, see the
228 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
229 &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a
Dan O'Mearadd494642020-05-01 07:42:23 -0700230 # `condition` that determines how and when the `bindings` are applied. Each
231 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700232 { # Associates `members` with a `role`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700233 &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
234 #
235 # If the condition evaluates to `true`, then this binding applies to the
236 # current request.
237 #
238 # If the condition evaluates to `false`, then this binding does not apply to
239 # the current request. However, a different role binding might grant the same
240 # role to one or more of the members in this binding.
241 #
242 # To learn which resources support conditions in their IAM policies, see the
243 # [IAM
244 # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700245 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
246 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700247 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700248 # Example (Comparison):
249 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700250 # title: &quot;Summary size limit&quot;
251 # description: &quot;Determines if a summary is less than 100 chars&quot;
252 # expression: &quot;document.summary.size() &lt; 100&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700253 #
254 # Example (Equality):
255 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700256 # title: &quot;Requestor is owner&quot;
257 # description: &quot;Determines if requestor is the document owner&quot;
258 # expression: &quot;document.owner == request.auth.claims.email&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700259 #
260 # Example (Logic):
261 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700262 # title: &quot;Public documents&quot;
263 # description: &quot;Determine whether the document should be publicly visible&quot;
264 # expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700265 #
266 # Example (Data Manipulation):
267 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700268 # title: &quot;Notification string&quot;
269 # description: &quot;Create a notification string with a timestamp.&quot;
270 # expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700271 #
272 # The exact variables and functions that may be referenced within an expression
273 # are determined by the service that evaluates it. See the service
274 # documentation for additional information.
Bu Sun Kim65020912020-05-20 12:08:20 -0700275 &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700276 # describes the expression, e.g. when hovered over it in a UI.
Bu Sun Kim65020912020-05-20 12:08:20 -0700277 &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
Dan O'Mearadd494642020-05-01 07:42:23 -0700278 # syntax.
Bu Sun Kim65020912020-05-20 12:08:20 -0700279 &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700280 # its purpose. This can be used e.g. in UIs which allow to enter the
281 # expression.
Bu Sun Kim65020912020-05-20 12:08:20 -0700282 &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
283 # reporting, e.g. a file name and a position in the file.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700284 },
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700285 &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
286 # `members` can have the following values:
287 #
288 # * `allUsers`: A special identifier that represents anyone who is
289 # on the internet; with or without a Google account.
290 #
291 # * `allAuthenticatedUsers`: A special identifier that represents anyone
292 # who is authenticated with a Google account or a service account.
293 #
294 # * `user:{emailid}`: An email address that represents a specific Google
295 # account. For example, `alice@example.com` .
296 #
297 #
298 # * `serviceAccount:{emailid}`: An email address that represents a service
299 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
300 #
301 # * `group:{emailid}`: An email address that represents a Google group.
302 # For example, `admins@example.com`.
303 #
304 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
305 # identifier) representing a user that has been recently deleted. For
306 # example, `alice@example.com?uid=123456789012345678901`. If the user is
307 # recovered, this value reverts to `user:{emailid}` and the recovered user
308 # retains the role in the binding.
309 #
310 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
311 # unique identifier) representing a service account that has been recently
312 # deleted. For example,
313 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
314 # If the service account is undeleted, this value reverts to
315 # `serviceAccount:{emailid}` and the undeleted service account retains the
316 # role in the binding.
317 #
318 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
319 # identifier) representing a Google group that has been recently
320 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
321 # the group is recovered, this value reverts to `group:{emailid}` and the
322 # recovered group retains the role in the binding.
323 #
324 #
325 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
326 # users of that domain. For example, `google.com` or `example.com`.
327 #
328 &quot;A String&quot;,
329 ],
330 &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
331 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700332 },
333 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700334 }</pre>
335</div>
336
337<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700338 <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700339 <pre>Sets the access control policy for an Identity-Aware Proxy protected
340resource. Replaces any existing policy.
341More information about managing access via IAP can be found at:
342https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
343
344Args:
345 resource: string, REQUIRED: The resource for which the policy is being specified.
346See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700347 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700348 The object takes the form of:
349
350{ # Request message for `SetIamPolicy` method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700351 &quot;policy&quot;: { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700352 # the policy is limited to a few 10s of KB. An empty policy is a
353 # valid policy but certain Cloud Platform services (such as Projects)
354 # might reject them.
Dan O'Mearadd494642020-05-01 07:42:23 -0700355 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700356 #
357 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700358 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
359 # `members` to a single `role`. Members can be user accounts, service accounts,
360 # Google groups, and domains (such as G Suite). A `role` is a named list of
361 # permissions; each `role` can be an IAM predefined role or a user-created
362 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700363 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700364 # For some types of Google Cloud resources, a `binding` can also specify a
365 # `condition`, which is a logical expression that allows access to a resource
366 # only if the expression evaluates to `true`. A condition can add constraints
367 # based on attributes of the request, the resource, or both. To learn which
368 # resources support conditions in their IAM policies, see the
369 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700370 #
371 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700372 #
373 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700374 # &quot;bindings&quot;: [
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700375 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700376 # &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;,
377 # &quot;members&quot;: [
378 # &quot;user:mike@example.com&quot;,
379 # &quot;group:admins@example.com&quot;,
380 # &quot;domain:google.com&quot;,
381 # &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700382 # ]
383 # },
384 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700385 # &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;,
386 # &quot;members&quot;: [
387 # &quot;user:eve@example.com&quot;
388 # ],
389 # &quot;condition&quot;: {
390 # &quot;title&quot;: &quot;expirable access&quot;,
391 # &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;,
392 # &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;,
Dan O'Mearadd494642020-05-01 07:42:23 -0700393 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700394 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700395 # ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700396 # &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;,
397 # &quot;version&quot;: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700398 # }
399 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700400 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700401 #
402 # bindings:
403 # - members:
404 # - user:mike@example.com
405 # - group:admins@example.com
406 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700407 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
408 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700409 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700410 # - user:eve@example.com
411 # role: roles/resourcemanager.organizationViewer
412 # condition:
413 # title: expirable access
414 # description: Does not grant access after Sep 2020
Bu Sun Kim65020912020-05-20 12:08:20 -0700415 # expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)
Dan O'Mearadd494642020-05-01 07:42:23 -0700416 # - etag: BwWWja0YfJA=
417 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700418 #
419 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700420 # [IAM documentation](https://cloud.google.com/iam/docs/).
Bu Sun Kim65020912020-05-20 12:08:20 -0700421 &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
422 # prevent simultaneous updates of a policy from overwriting each other.
423 # It is strongly suggested that systems make use of the `etag` in the
424 # read-modify-write cycle to perform policy updates in order to avoid race
425 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
426 # systems are expected to put that etag in the request to `setIamPolicy` to
427 # ensure that their change will be applied to the same version of the policy.
428 #
429 # **Important:** If you use IAM Conditions, you must include the `etag` field
430 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
431 # you to overwrite a version `3` policy with a version `1` policy, and all of
432 # the conditions in the version `3` policy are lost.
433 &quot;version&quot;: 42, # Specifies the format of the policy.
434 #
435 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
436 # are rejected.
437 #
438 # Any operation that affects conditional role bindings must specify version
439 # `3`. This requirement applies to the following operations:
440 #
441 # * Getting a policy that includes a conditional role binding
442 # * Adding a conditional role binding to a policy
443 # * Changing a conditional role binding in a policy
444 # * Removing any role binding, with or without a condition, from a policy
445 # that includes conditions
446 #
447 # **Important:** If you use IAM Conditions, you must include the `etag` field
448 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
449 # you to overwrite a version `3` policy with a version `1` policy, and all of
450 # the conditions in the version `3` policy are lost.
451 #
452 # If a policy does not include any conditions, operations on that policy may
453 # specify any valid version or leave the field unset.
454 #
455 # To learn which resources support conditions in their IAM policies, see the
456 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
457 &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a
Dan O'Mearadd494642020-05-01 07:42:23 -0700458 # `condition` that determines how and when the `bindings` are applied. Each
459 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700460 { # Associates `members` with a `role`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700461 &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
462 #
463 # If the condition evaluates to `true`, then this binding applies to the
464 # current request.
465 #
466 # If the condition evaluates to `false`, then this binding does not apply to
467 # the current request. However, a different role binding might grant the same
468 # role to one or more of the members in this binding.
469 #
470 # To learn which resources support conditions in their IAM policies, see the
471 # [IAM
472 # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700473 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
474 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700475 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700476 # Example (Comparison):
477 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700478 # title: &quot;Summary size limit&quot;
479 # description: &quot;Determines if a summary is less than 100 chars&quot;
480 # expression: &quot;document.summary.size() &lt; 100&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700481 #
482 # Example (Equality):
483 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700484 # title: &quot;Requestor is owner&quot;
485 # description: &quot;Determines if requestor is the document owner&quot;
486 # expression: &quot;document.owner == request.auth.claims.email&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700487 #
488 # Example (Logic):
489 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700490 # title: &quot;Public documents&quot;
491 # description: &quot;Determine whether the document should be publicly visible&quot;
492 # expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700493 #
494 # Example (Data Manipulation):
495 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700496 # title: &quot;Notification string&quot;
497 # description: &quot;Create a notification string with a timestamp.&quot;
498 # expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700499 #
500 # The exact variables and functions that may be referenced within an expression
501 # are determined by the service that evaluates it. See the service
502 # documentation for additional information.
Bu Sun Kim65020912020-05-20 12:08:20 -0700503 &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700504 # describes the expression, e.g. when hovered over it in a UI.
Bu Sun Kim65020912020-05-20 12:08:20 -0700505 &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
Dan O'Mearadd494642020-05-01 07:42:23 -0700506 # syntax.
Bu Sun Kim65020912020-05-20 12:08:20 -0700507 &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700508 # its purpose. This can be used e.g. in UIs which allow to enter the
509 # expression.
Bu Sun Kim65020912020-05-20 12:08:20 -0700510 &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
511 # reporting, e.g. a file name and a position in the file.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700512 },
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700513 &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
514 # `members` can have the following values:
515 #
516 # * `allUsers`: A special identifier that represents anyone who is
517 # on the internet; with or without a Google account.
518 #
519 # * `allAuthenticatedUsers`: A special identifier that represents anyone
520 # who is authenticated with a Google account or a service account.
521 #
522 # * `user:{emailid}`: An email address that represents a specific Google
523 # account. For example, `alice@example.com` .
524 #
525 #
526 # * `serviceAccount:{emailid}`: An email address that represents a service
527 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
528 #
529 # * `group:{emailid}`: An email address that represents a Google group.
530 # For example, `admins@example.com`.
531 #
532 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
533 # identifier) representing a user that has been recently deleted. For
534 # example, `alice@example.com?uid=123456789012345678901`. If the user is
535 # recovered, this value reverts to `user:{emailid}` and the recovered user
536 # retains the role in the binding.
537 #
538 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
539 # unique identifier) representing a service account that has been recently
540 # deleted. For example,
541 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
542 # If the service account is undeleted, this value reverts to
543 # `serviceAccount:{emailid}` and the undeleted service account retains the
544 # role in the binding.
545 #
546 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
547 # identifier) representing a Google group that has been recently
548 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
549 # the group is recovered, this value reverts to `group:{emailid}` and the
550 # recovered group retains the role in the binding.
551 #
552 #
553 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
554 # users of that domain. For example, `google.com` or `example.com`.
555 #
556 &quot;A String&quot;,
557 ],
558 &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
559 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700560 },
561 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700562 },
563 }
564
565 x__xgafv: string, V1 error format.
566 Allowed values
567 1 - v1 error format
568 2 - v2 error format
569
570Returns:
571 An object of the form:
572
Dan O'Mearadd494642020-05-01 07:42:23 -0700573 { # An Identity and Access Management (IAM) policy, which specifies access
574 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700575 #
576 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700577 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
578 # `members` to a single `role`. Members can be user accounts, service accounts,
579 # Google groups, and domains (such as G Suite). A `role` is a named list of
580 # permissions; each `role` can be an IAM predefined role or a user-created
581 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700582 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700583 # For some types of Google Cloud resources, a `binding` can also specify a
584 # `condition`, which is a logical expression that allows access to a resource
585 # only if the expression evaluates to `true`. A condition can add constraints
586 # based on attributes of the request, the resource, or both. To learn which
587 # resources support conditions in their IAM policies, see the
588 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700589 #
590 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700591 #
592 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700593 # &quot;bindings&quot;: [
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700594 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700595 # &quot;role&quot;: &quot;roles/resourcemanager.organizationAdmin&quot;,
596 # &quot;members&quot;: [
597 # &quot;user:mike@example.com&quot;,
598 # &quot;group:admins@example.com&quot;,
599 # &quot;domain:google.com&quot;,
600 # &quot;serviceAccount:my-project-id@appspot.gserviceaccount.com&quot;
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700601 # ]
602 # },
603 # {
Bu Sun Kim65020912020-05-20 12:08:20 -0700604 # &quot;role&quot;: &quot;roles/resourcemanager.organizationViewer&quot;,
605 # &quot;members&quot;: [
606 # &quot;user:eve@example.com&quot;
607 # ],
608 # &quot;condition&quot;: {
609 # &quot;title&quot;: &quot;expirable access&quot;,
610 # &quot;description&quot;: &quot;Does not grant access after Sep 2020&quot;,
611 # &quot;expression&quot;: &quot;request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)&quot;,
Dan O'Mearadd494642020-05-01 07:42:23 -0700612 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700613 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700614 # ],
Bu Sun Kim65020912020-05-20 12:08:20 -0700615 # &quot;etag&quot;: &quot;BwWWja0YfJA=&quot;,
616 # &quot;version&quot;: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700617 # }
618 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700619 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700620 #
621 # bindings:
622 # - members:
623 # - user:mike@example.com
624 # - group:admins@example.com
625 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700626 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
627 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700628 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700629 # - user:eve@example.com
630 # role: roles/resourcemanager.organizationViewer
631 # condition:
632 # title: expirable access
633 # description: Does not grant access after Sep 2020
Bu Sun Kim65020912020-05-20 12:08:20 -0700634 # expression: request.time &lt; timestamp(&#x27;2020-10-01T00:00:00.000Z&#x27;)
Dan O'Mearadd494642020-05-01 07:42:23 -0700635 # - etag: BwWWja0YfJA=
636 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700637 #
638 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700639 # [IAM documentation](https://cloud.google.com/iam/docs/).
Bu Sun Kim65020912020-05-20 12:08:20 -0700640 &quot;etag&quot;: &quot;A String&quot;, # `etag` is used for optimistic concurrency control as a way to help
641 # prevent simultaneous updates of a policy from overwriting each other.
642 # It is strongly suggested that systems make use of the `etag` in the
643 # read-modify-write cycle to perform policy updates in order to avoid race
644 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
645 # systems are expected to put that etag in the request to `setIamPolicy` to
646 # ensure that their change will be applied to the same version of the policy.
647 #
648 # **Important:** If you use IAM Conditions, you must include the `etag` field
649 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
650 # you to overwrite a version `3` policy with a version `1` policy, and all of
651 # the conditions in the version `3` policy are lost.
652 &quot;version&quot;: 42, # Specifies the format of the policy.
653 #
654 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
655 # are rejected.
656 #
657 # Any operation that affects conditional role bindings must specify version
658 # `3`. This requirement applies to the following operations:
659 #
660 # * Getting a policy that includes a conditional role binding
661 # * Adding a conditional role binding to a policy
662 # * Changing a conditional role binding in a policy
663 # * Removing any role binding, with or without a condition, from a policy
664 # that includes conditions
665 #
666 # **Important:** If you use IAM Conditions, you must include the `etag` field
667 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
668 # you to overwrite a version `3` policy with a version `1` policy, and all of
669 # the conditions in the version `3` policy are lost.
670 #
671 # If a policy does not include any conditions, operations on that policy may
672 # specify any valid version or leave the field unset.
673 #
674 # To learn which resources support conditions in their IAM policies, see the
675 # [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
676 &quot;bindings&quot;: [ # Associates a list of `members` to a `role`. Optionally, may specify a
Dan O'Mearadd494642020-05-01 07:42:23 -0700677 # `condition` that determines how and when the `bindings` are applied. Each
678 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700679 { # Associates `members` with a `role`.
Bu Sun Kim65020912020-05-20 12:08:20 -0700680 &quot;condition&quot;: { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
681 #
682 # If the condition evaluates to `true`, then this binding applies to the
683 # current request.
684 #
685 # If the condition evaluates to `false`, then this binding does not apply to
686 # the current request. However, a different role binding might grant the same
687 # role to one or more of the members in this binding.
688 #
689 # To learn which resources support conditions in their IAM policies, see the
690 # [IAM
691 # documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
Dan O'Mearadd494642020-05-01 07:42:23 -0700692 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
693 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700694 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700695 # Example (Comparison):
696 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700697 # title: &quot;Summary size limit&quot;
698 # description: &quot;Determines if a summary is less than 100 chars&quot;
699 # expression: &quot;document.summary.size() &lt; 100&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700700 #
701 # Example (Equality):
702 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700703 # title: &quot;Requestor is owner&quot;
704 # description: &quot;Determines if requestor is the document owner&quot;
705 # expression: &quot;document.owner == request.auth.claims.email&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700706 #
707 # Example (Logic):
708 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700709 # title: &quot;Public documents&quot;
710 # description: &quot;Determine whether the document should be publicly visible&quot;
711 # expression: &quot;document.type != &#x27;private&#x27; &amp;&amp; document.type != &#x27;internal&#x27;&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700712 #
713 # Example (Data Manipulation):
714 #
Bu Sun Kim65020912020-05-20 12:08:20 -0700715 # title: &quot;Notification string&quot;
716 # description: &quot;Create a notification string with a timestamp.&quot;
717 # expression: &quot;&#x27;New message received at &#x27; + string(document.create_time)&quot;
Dan O'Mearadd494642020-05-01 07:42:23 -0700718 #
719 # The exact variables and functions that may be referenced within an expression
720 # are determined by the service that evaluates it. See the service
721 # documentation for additional information.
Bu Sun Kim65020912020-05-20 12:08:20 -0700722 &quot;description&quot;: &quot;A String&quot;, # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700723 # describes the expression, e.g. when hovered over it in a UI.
Bu Sun Kim65020912020-05-20 12:08:20 -0700724 &quot;expression&quot;: &quot;A String&quot;, # Textual representation of an expression in Common Expression Language
Dan O'Mearadd494642020-05-01 07:42:23 -0700725 # syntax.
Bu Sun Kim65020912020-05-20 12:08:20 -0700726 &quot;title&quot;: &quot;A String&quot;, # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700727 # its purpose. This can be used e.g. in UIs which allow to enter the
728 # expression.
Bu Sun Kim65020912020-05-20 12:08:20 -0700729 &quot;location&quot;: &quot;A String&quot;, # Optional. String indicating the location of the expression for error
730 # reporting, e.g. a file name and a position in the file.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700731 },
Bu Sun Kim4ed7d3f2020-05-27 12:20:54 -0700732 &quot;members&quot;: [ # Specifies the identities requesting access for a Cloud Platform resource.
733 # `members` can have the following values:
734 #
735 # * `allUsers`: A special identifier that represents anyone who is
736 # on the internet; with or without a Google account.
737 #
738 # * `allAuthenticatedUsers`: A special identifier that represents anyone
739 # who is authenticated with a Google account or a service account.
740 #
741 # * `user:{emailid}`: An email address that represents a specific Google
742 # account. For example, `alice@example.com` .
743 #
744 #
745 # * `serviceAccount:{emailid}`: An email address that represents a service
746 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
747 #
748 # * `group:{emailid}`: An email address that represents a Google group.
749 # For example, `admins@example.com`.
750 #
751 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
752 # identifier) representing a user that has been recently deleted. For
753 # example, `alice@example.com?uid=123456789012345678901`. If the user is
754 # recovered, this value reverts to `user:{emailid}` and the recovered user
755 # retains the role in the binding.
756 #
757 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
758 # unique identifier) representing a service account that has been recently
759 # deleted. For example,
760 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
761 # If the service account is undeleted, this value reverts to
762 # `serviceAccount:{emailid}` and the undeleted service account retains the
763 # role in the binding.
764 #
765 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
766 # identifier) representing a Google group that has been recently
767 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
768 # the group is recovered, this value reverts to `group:{emailid}` and the
769 # recovered group retains the role in the binding.
770 #
771 #
772 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
773 # users of that domain. For example, `google.com` or `example.com`.
774 #
775 &quot;A String&quot;,
776 ],
777 &quot;role&quot;: &quot;A String&quot;, # Role that is assigned to `members`.
778 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700779 },
780 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700781 }</pre>
782</div>
783
784<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700785 <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700786 <pre>Returns permissions that a caller has on the Identity-Aware Proxy protected
787resource. If the resource does not exist or the caller does not have
788Identity-Aware Proxy permissions a [google.rpc.Code.PERMISSION_DENIED]
789will be returned.
790More information about managing access via IAP can be found at:
791https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
792
793Args:
794 resource: string, REQUIRED: The resource for which the policy detail is being requested.
795See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700796 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700797 The object takes the form of:
798
799{ # Request message for `TestIamPermissions` method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700800 &quot;permissions&quot;: [ # The set of permissions to check for the `resource`. Permissions with
801 # wildcards (such as &#x27;*&#x27; or &#x27;storage.*&#x27;) are not allowed. For more
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700802 # information see
803 # [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
Bu Sun Kim65020912020-05-20 12:08:20 -0700804 &quot;A String&quot;,
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700805 ],
806 }
807
808 x__xgafv: string, V1 error format.
809 Allowed values
810 1 - v1 error format
811 2 - v2 error format
812
813Returns:
814 An object of the form:
815
816 { # Response message for `TestIamPermissions` method.
Bu Sun Kim65020912020-05-20 12:08:20 -0700817 &quot;permissions&quot;: [ # A subset of `TestPermissionsRequest.permissions` that the caller is
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700818 # allowed.
Bu Sun Kim65020912020-05-20 12:08:20 -0700819 &quot;A String&quot;,
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700820 ],
821 }</pre>
822</div>
823
824</body></html>