Blame - docs/dyn/iap_v1beta1.v1beta1.html - platform/external/python/google-api-python-client

2019-06-14 16:50:42 -0700

[diff] [blame]

352

# the policy is limited to a few 10s of KB. An empty policy is a

353

# valid policy but certain Cloud Platform services (such as Projects)

354

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

355

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

356

#

357

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

358

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

359

# `members` to a single `role`. Members can be user accounts, service accounts,

360

# Google groups, and domains (such as G Suite). A `role` is a named list of

361

# permissions; each `role` can be an IAM predefined role or a user-created

362

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

363

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

364

# For some types of Google Cloud resources, a `binding` can also specify a

365

# `condition`, which is a logical expression that allows access to a resource

366

# only if the expression evaluates to `true`. A condition can add constraints

367

# based on attributes of the request, the resource, or both. To learn which

368

# resources support conditions in their IAM policies, see the

369

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

370

#

371

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

372

#

373

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

374

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

375

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

376

# "role": "roles/resourcemanager.organizationAdmin",

377

# "members": [

378

# "user:mike@example.com",

379

# "group:admins@example.com",

380

# "domain:google.com",

381

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

382

# ]

383

# },

384

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

385

# "role": "roles/resourcemanager.organizationViewer",

386

# "members": [

387

# "user:eve@example.com"

388

# ],

389

# "condition": {

390

# "title": "expirable access",

391

# "description": "Does not grant access after Sep 2020",

392

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

393

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

394

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

395

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

396

# "etag": "BwWWja0YfJA=",

397

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

398

# }

399

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

400

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

405

# - group:admins@example.com

406

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

407

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

408

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

409

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

410

# - user:eve@example.com

411

# role: roles/resourcemanager.organizationViewer

412

# condition:

413

# title: expirable access

414

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

415

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

416

# - etag: BwWWja0YfJA=

417

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

418

#

419

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

420

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

421

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

422

# prevent simultaneous updates of a policy from overwriting each other.

423

# It is strongly suggested that systems make use of the `etag` in the

424

# read-modify-write cycle to perform policy updates in order to avoid race

425

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

426

# systems are expected to put that etag in the request to `setIamPolicy` to

427

# ensure that their change will be applied to the same version of the policy.

428

#

429

# **Important:** If you use IAM Conditions, you must include the `etag` field

430

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

431

# you to overwrite a version `3` policy with a version `1` policy, and all of

432

# the conditions in the version `3` policy are lost.

433

"version": 42, # Specifies the format of the policy.

434

#

435

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

436

# are rejected.

437

#

438

# Any operation that affects conditional role bindings must specify version

439

# `3`. This requirement applies to the following operations:

440

#

441

# * Getting a policy that includes a conditional role binding

442

# * Adding a conditional role binding to a policy

443

# * Changing a conditional role binding in a policy

444

# * Removing any role binding, with or without a condition, from a policy

445

# that includes conditions

446

#

447

# **Important:** If you use IAM Conditions, you must include the `etag` field

448

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

449

# you to overwrite a version `3` policy with a version `1` policy, and all of

450

# the conditions in the version `3` policy are lost.

451

#

452

# If a policy does not include any conditions, operations on that policy may

453

# specify any valid version or leave the field unset.

454

#

455

# To learn which resources support conditions in their IAM policies, see the

456

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

457

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

458

# `condition` that determines how and when the `bindings` are applied. Each

459

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

460

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

461

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

462

#

463

# If the condition evaluates to `true`, then this binding applies to the

464

# current request.

465

#

466

# If the condition evaluates to `false`, then this binding does not apply to

467

# the current request. However, a different role binding might grant the same

468

# role to one or more of the members in this binding.

469

#

470

# To learn which resources support conditions in their IAM policies, see the

471

# [IAM

472

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

473

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

474

# are documented at https://github.com/google/cel-spec.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

475

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

476

# Example (Comparison):

477

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

478

# title: "Summary size limit"

479

# description: "Determines if a summary is less than 100 chars"

480

# expression: "document.summary.size() < 100"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

481

#

482

# Example (Equality):

483

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

484

# title: "Requestor is owner"

485

# description: "Determines if requestor is the document owner"

486

# expression: "document.owner == request.auth.claims.email"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

487

#

488

# Example (Logic):

489

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

490

# title: "Public documents"

491

# description: "Determine whether the document should be publicly visible"

492

# expression: "document.type != 'private' && document.type != 'internal'"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

493

#

494

# Example (Data Manipulation):

495

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

496

# title: "Notification string"

497

# description: "Create a notification string with a timestamp."

498

# expression: "'New message received at ' + string(document.create_time)"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

499

#

500

# The exact variables and functions that may be referenced within an expression

501

# are determined by the service that evaluates it. See the service

502

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

503

"description": "A String", # Optional. Description of the expression. This is a longer text which

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

504

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

505

"expression": "A String", # Textual representation of an expression in Common Expression Language

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

506

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

507

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

508

# its purpose. This can be used e.g. in UIs which allow to enter the

509

# expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

510

"location": "A String", # Optional. String indicating the location of the expression for error

511

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

512

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame]

513

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

514

# `members` can have the following values:

515

#

516

# * `allUsers`: A special identifier that represents anyone who is

517

# on the internet; with or without a Google account.

518

#

519

# * `allAuthenticatedUsers`: A special identifier that represents anyone

520

# who is authenticated with a Google account or a service account.

521

#

522

# * `user:{emailid}`: An email address that represents a specific Google

523

# account. For example, `alice@example.com` .

524

#

525

#

526

# * `serviceAccount:{emailid}`: An email address that represents a service

527

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

528

#

529

# * `group:{emailid}`: An email address that represents a Google group.

530

# For example, `admins@example.com`.

531

#

532

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

533

# identifier) representing a user that has been recently deleted. For

534

# example, `alice@example.com?uid=123456789012345678901`. If the user is

535

# recovered, this value reverts to `user:{emailid}` and the recovered user

536

# retains the role in the binding.

537

#

538

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

539

# unique identifier) representing a service account that has been recently

540

# deleted. For example,

541

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

542

# If the service account is undeleted, this value reverts to

543

# `serviceAccount:{emailid}` and the undeleted service account retains the

544

# role in the binding.

545

#

546

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

547

# identifier) representing a Google group that has been recently

548

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

549

# the group is recovered, this value reverts to `group:{emailid}` and the

550

# recovered group retains the role in the binding.

551

#

552

#

553

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

554

# users of that domain. For example, `google.com` or `example.com`.

#

"A String",

],

"role": "A String", # Role that is assigned to `members`.

559

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

560

},

561

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

572

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

573

{ # An Identity and Access Management (IAM) policy, which specifies access

574

# controls for Google Cloud resources.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

575

#

576

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

577

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

578

# `members` to a single `role`. Members can be user accounts, service accounts,

579

# Google groups, and domains (such as G Suite). A `role` is a named list of

580

# permissions; each `role` can be an IAM predefined role or a user-created

581

# custom role.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

582

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

583

# For some types of Google Cloud resources, a `binding` can also specify a

584

# `condition`, which is a logical expression that allows access to a resource

585

# only if the expression evaluates to `true`. A condition can add constraints

586

# based on attributes of the request, the resource, or both. To learn which

587

# resources support conditions in their IAM policies, see the

588

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

589

#

590

# **JSON example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

591

#

592

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

593

# "bindings": [

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

594

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

595

# "role": "roles/resourcemanager.organizationAdmin",

596

# "members": [

597

# "user:mike@example.com",

598

# "group:admins@example.com",

599

# "domain:google.com",

600

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

601

# ]

602

# },

603

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

604

# "role": "roles/resourcemanager.organizationViewer",

605

# "members": [

606

# "user:eve@example.com"

607

# ],

608

# "condition": {

609

# "title": "expirable access",

610

# "description": "Does not grant access after Sep 2020",

611

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

612

# }

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

613

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

614

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

615

# "etag": "BwWWja0YfJA=",

616

# "version": 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

617

# }

618

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

619

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

624

# - group:admins@example.com

625

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

626

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

627

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

628

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

629

# - user:eve@example.com

630

# role: roles/resourcemanager.organizationViewer

631

# condition:

632

# title: expirable access

633

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

634

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

635

# - etag: BwWWja0YfJA=

636

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

637

#

638

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

639

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

640

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

641

# prevent simultaneous updates of a policy from overwriting each other.

642

# It is strongly suggested that systems make use of the `etag` in the

643

# read-modify-write cycle to perform policy updates in order to avoid race

644

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

645

# systems are expected to put that etag in the request to `setIamPolicy` to

646

# ensure that their change will be applied to the same version of the policy.

647

#

648

# **Important:** If you use IAM Conditions, you must include the `etag` field

649

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

650

# you to overwrite a version `3` policy with a version `1` policy, and all of

651

# the conditions in the version `3` policy are lost.

652

"version": 42, # Specifies the format of the policy.

653

#

654

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

655

# are rejected.

656

#

657

# Any operation that affects conditional role bindings must specify version

658

# `3`. This requirement applies to the following operations:

659

#

660

# * Getting a policy that includes a conditional role binding

661

# * Adding a conditional role binding to a policy

662

# * Changing a conditional role binding in a policy

663

# * Removing any role binding, with or without a condition, from a policy

664

# that includes conditions

665

#

666

# **Important:** If you use IAM Conditions, you must include the `etag` field

667

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

668

# you to overwrite a version `3` policy with a version `1` policy, and all of

669

# the conditions in the version `3` policy are lost.

670

#

671

# If a policy does not include any conditions, operations on that policy may

672

# specify any valid version or leave the field unset.

673

#

674

# To learn which resources support conditions in their IAM policies, see the

675

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

676

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

677

# `condition` that determines how and when the `bindings` are applied. Each

678

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

679

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

680

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

681

#

682

# If the condition evaluates to `true`, then this binding applies to the

683

# current request.

684

#

685

# If the condition evaluates to `false`, then this binding does not apply to

686

# the current request. However, a different role binding might grant the same

687

# role to one or more of the members in this binding.

688

#

689

# To learn which resources support conditions in their IAM policies, see the

690

# [IAM

691

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

692

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

693

# are documented at https://github.com/google/cel-spec.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

694

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

695

# Example (Comparison):

696

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

697

# title: "Summary size limit"

698

# description: "Determines if a summary is less than 100 chars"

699

# expression: "document.summary.size() < 100"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

700

#

701

# Example (Equality):

702

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

703

# title: "Requestor is owner"

704

# description: "Determines if requestor is the document owner"

705

# expression: "document.owner == request.auth.claims.email"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

706

#

707

# Example (Logic):

708

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

709

# title: "Public documents"

710

# description: "Determine whether the document should be publicly visible"

711

# expression: "document.type != 'private' && document.type != 'internal'"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

712

#

713

# Example (Data Manipulation):

714

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

715

# title: "Notification string"

716

# description: "Create a notification string with a timestamp."

717

# expression: "'New message received at ' + string(document.create_time)"

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

718

#

719

# The exact variables and functions that may be referenced within an expression

720

# are determined by the service that evaluates it. See the service

721

# documentation for additional information.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

722

"description": "A String", # Optional. Description of the expression. This is a longer text which

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

723

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

724

"expression": "A String", # Textual representation of an expression in Common Expression Language

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

725

# syntax.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

726

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

727

# its purpose. This can be used e.g. in UIs which allow to enter the

728

# expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

729

"location": "A String", # Optional. String indicating the location of the expression for error

730

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

731

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame]

732

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

733

# `members` can have the following values:

734

#

735

# * `allUsers`: A special identifier that represents anyone who is

736

# on the internet; with or without a Google account.

737

#

738

# * `allAuthenticatedUsers`: A special identifier that represents anyone

739

# who is authenticated with a Google account or a service account.

740

#

741

# * `user:{emailid}`: An email address that represents a specific Google

742

# account. For example, `alice@example.com` .

743

#

744

#

745

# * `serviceAccount:{emailid}`: An email address that represents a service

746

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

747

#

748

# * `group:{emailid}`: An email address that represents a Google group.

749

# For example, `admins@example.com`.

750

#

751

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

752

# identifier) representing a user that has been recently deleted. For

753

# example, `alice@example.com?uid=123456789012345678901`. If the user is

754

# recovered, this value reverts to `user:{emailid}` and the recovered user

755

# retains the role in the binding.

756

#

757

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

758

# unique identifier) representing a service account that has been recently

759

# deleted. For example,

760

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

761

# If the service account is undeleted, this value reverts to

762

# `serviceAccount:{emailid}` and the undeleted service account retains the

763

# role in the binding.

764

#

765

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

766

# identifier) representing a Google group that has been recently

767

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

768

# the group is recovered, this value reverts to `group:{emailid}` and the

769

# recovered group retains the role in the binding.

770

#

771

#

772

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

773

# users of that domain. For example, `google.com` or `example.com`.

#

"A String",

],

"role": "A String", # Role that is assigned to `members`.

778

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

779

},

780

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

785

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

786

<pre>Returns permissions that a caller has on the Identity-Aware Proxy protected

787

resource. If the resource does not exist or the caller does not have

788

Identity-Aware Proxy permissions a [google.rpc.Code.PERMISSION_DENIED]

789

will be returned.

790

More information about managing access via IAP can be found at:

791

https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api

792

793

Args:

794

resource: string, REQUIRED: The resource for which the policy detail is being requested.

795

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

796

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

797

The object takes the form of:

798

799

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

800

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

801

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

802

# information see

803

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

804

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

815

816

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

817

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

818

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

819

"A String",

Bu Sun Kim