Blame - docs/dyn/iam_v1.projects.serviceAccounts.html - platform/external/python/google-api-python-client

2016-02-19 16:02:29 -0800

[diff] [blame]

76

<h2>Instance Methods</h2>

</p>

<p class="firstline">Returns the keys Resource.</p>

81

82

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

83

<code><a href="#create">create(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

84

<p class="firstline">Creates a ServiceAccount.</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

85

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

86

<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2016-10-12 14:05:53 -0700

[diff] [blame]

87

<p class="firstline">Deletes a ServiceAccount.</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

88

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

89

<code><a href="#disable">disable(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

90

<p class="firstline">Disables a ServiceAccount immediately.</p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

91

92

<code><a href="#enable">enable(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

93

<p class="firstline">Enables a ServiceAccount that was disabled by</p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

94

Thomas Coffee

2f24537

2017-03-27 10:39:26 -0700

[diff] [blame]

95

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2016-10-12 14:05:53 -0700

[diff] [blame]

96

<p class="firstline">Gets a ServiceAccount.</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

97

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

98

<code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

99

<p class="firstline">Gets the IAM policy that is attached to a ServiceAccount. This IAM</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

100

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

101

<code><a href="#list">list(name, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p>

102

<p class="firstline">Lists every ServiceAccount that belongs to a specific project.</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

103

104

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

105

<p class="firstline">Retrieves the next page of results.</p>

106

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

107

<code><a href="#patch">patch(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

108

<p class="firstline">Patches a ServiceAccount.</p>

109

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

110

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

111

<p class="firstline">Sets the IAM policy that is attached to a ServiceAccount.</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

112

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

113

<code><a href="#signBlob">signBlob(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

114

<p class="firstline">**Note:** This method is deprecated and will stop working on July 1, 2021.</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

115

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

116

<code><a href="#signJwt">signJwt(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

117

<p class="firstline">**Note:** This method is deprecated and will stop working on July 1, 2021.</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

118

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

119

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

120

<p class="firstline">Tests whether the caller has the specified permissions on a</p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

121

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

122

<code><a href="#undelete">undelete(name, body=None, x__xgafv=None)</a></code></p>

123

<p class="firstline">Restores a deleted ServiceAccount.</p>

124

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

125

<code><a href="#update">update(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

126

<p class="firstline">**Note:** We are in the process of deprecating this method. Use</p>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

127

<h3>Method Details</h3>

128

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

129

<code class="details" id="create">create(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

130

<pre>Creates a ServiceAccount.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

131

132

Args:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

133

name: string, Required. The resource name of the project associated with the service

134

accounts, such as `projects/my-project-123`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

135

body: object, The request body.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

136

The object takes the form of:

137

138

{ # The service account create request.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame]

139

"accountId": "A String", # Required. The account id that is used to generate the service account

140

# email address and a stable unique id. It is unique within a project,

141

# must be 6-30 characters long, and match the regular expression

142

# `[a-z]([-a-z0-9]*[a-z0-9])` to comply with RFC1035.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

143

"serviceAccount": { # An IAM service account. # The ServiceAccount resource to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

144

# create. Currently, only the following values are user assignable:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

145

# `display_name` and `description`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

146

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

147

# A service account is an account for an application or a virtual machine (VM)

148

# instance, not a person. You can use a service account to call Google APIs. To

149

# learn more, read the [overview of service

150

# accounts](https://cloud.google.com/iam/help/service-accounts/overview).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

151

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

152

# When you create a service account, you specify the project ID that owns the

153

# service account, as well as a name that must be unique within the project.

154

# IAM uses these values to create an email address that identifies the service

155

# account.

156

"disabled": True or False, # Output only. Whether the service account is disabled.

157

"uniqueId": "A String", # Output only. The unique, stable numeric ID for the service account.

158

#

159

# Each service account retains its unique ID even if you delete the service

160

# account. For example, if you delete a service account, then create a new

161

# service account with the same name, the new service account has a different

162

# unique ID than the deleted service account.

163

"projectId": "A String", # Output only. The ID of the project that owns the service account.

164

"etag": "A String", # Deprecated. Do not use.

165

"email": "A String", # Output only. The email address of the service account.

166

"name": "A String", # The resource name of the service account.

167

#

168

# Use one of the following formats:

169

#

170

# * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

171

# * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

172

#

173

# As an alternative, you can use the `-` wildcard character instead of the

174

# project ID:

175

#

176

# * `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

177

# * `projects/-/serviceAccounts/{UNIQUE_ID}`

178

#

179

# When possible, avoid using the `-` wildcard character, because it can cause

180

# response messages to contain misleading error codes. For example, if you

181

# try to get the service account

182

# `projects/-/serviceAccounts/fake@example.com`, which does not exist, the

183

# response contains an HTTP `403 Forbidden` error instead of a `404 Not

184

# Found` error.

185

"displayName": "A String", # Optional. A user-specified, human-readable name for the service account. The maximum

186

# length is 100 UTF-8 bytes.

187

"oauth2ClientId": "A String", # Output only. The OAuth 2.0 client ID for the service account.

188

"description": "A String", # Optional. A user-specified, human-readable description of the service account. The

189

# maximum length is 256 UTF-8 bytes.

190

},

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

191

}

192

193

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

194

Allowed values

195

1 - v1 error format

196

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

197

198

Returns:

199

An object of the form:

200

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

201

{ # An IAM service account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

202

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

203

# A service account is an account for an application or a virtual machine (VM)

204

# instance, not a person. You can use a service account to call Google APIs. To

205

# learn more, read the [overview of service

206

# accounts](https://cloud.google.com/iam/help/service-accounts/overview).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

207

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

208

# When you create a service account, you specify the project ID that owns the

209

# service account, as well as a name that must be unique within the project.

210

# IAM uses these values to create an email address that identifies the service

211

# account.

212

"disabled": True or False, # Output only. Whether the service account is disabled.

213

"uniqueId": "A String", # Output only. The unique, stable numeric ID for the service account.

214

#

215

# Each service account retains its unique ID even if you delete the service

216

# account. For example, if you delete a service account, then create a new

217

# service account with the same name, the new service account has a different

218

# unique ID than the deleted service account.

219

"projectId": "A String", # Output only. The ID of the project that owns the service account.

220

"etag": "A String", # Deprecated. Do not use.

221

"email": "A String", # Output only. The email address of the service account.

222

"name": "A String", # The resource name of the service account.

223

#

224

# Use one of the following formats:

225

#

226

# * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

227

# * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

228

#

229

# As an alternative, you can use the `-` wildcard character instead of the

230

# project ID:

231

#

232

# * `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

233

# * `projects/-/serviceAccounts/{UNIQUE_ID}`

234

#

235

# When possible, avoid using the `-` wildcard character, because it can cause

236

# response messages to contain misleading error codes. For example, if you

237

# try to get the service account

238

# `projects/-/serviceAccounts/fake@example.com`, which does not exist, the

239

# response contains an HTTP `403 Forbidden` error instead of a `404 Not

240

# Found` error.

241

"displayName": "A String", # Optional. A user-specified, human-readable name for the service account. The maximum

242

# length is 100 UTF-8 bytes.

243

"oauth2ClientId": "A String", # Output only. The OAuth 2.0 client ID for the service account.

244

"description": "A String", # Optional. A user-specified, human-readable description of the service account. The

245

# maximum length is 256 UTF-8 bytes.

246

}</pre>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

250

<code class="details" id="delete">delete(name, x__xgafv=None)</code>

Sai Cheemalapati

2016-10-12 14:05:53 -0700

[diff] [blame]

251

<pre>Deletes a ServiceAccount.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

252

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

253

**Warning:** After you delete a service account, you might not be able to

254

undelete it. If you know that you need to re-enable the service account in

255

the future, use DisableServiceAccount instead.

256

257

If you delete a service account, IAM permanently removes the service

258

account 30 days later. Google Cloud cannot recover the service account

259

after it is permanently removed, even if you file a support request.

260

261

To help avoid unplanned outages, we recommend that you disable the service

262

account before you delete it. Use DisableServiceAccount to disable the

263

service account, then wait at least 24 hours and watch for unintended

264

consequences. If there are no unintended consequences, you can delete the

265

service account.

266

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

267

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

268

name: string, Required. The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

269

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

270

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

271

the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

272

`unique_id` of the service account. (required)

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

273

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

274

Allowed values

275

1 - v1 error format

276

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

277

278

Returns:

279

An object of the form:

280

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

281

{ # A generic empty message that you can re-use to avoid defining duplicated

282

# empty messages in your APIs. A typical example is to use it as the request

283

# or the response type of an API method. For instance:

284

#

285

# service Foo {

286

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

287

# }

288

#

289

# The JSON representation for `Empty` is empty JSON object `{}`.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

294

<code class="details" id="disable">disable(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

295

<pre>Disables a ServiceAccount immediately.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

296

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

297

If an application uses the service account to authenticate, that

298

application can no longer call Google APIs or access Google Cloud

299

resources. Existing access tokens for the service account are rejected, and

300

requests for new access tokens will fail.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

301

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

302

To re-enable the service account, use EnableServiceAccount. After you

303

re-enable the service account, its existing access tokens will be accepted,

304

and you can request new access tokens.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

305

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

306

To help avoid unplanned outages, we recommend that you disable the service

307

account before you delete it. Use this method to disable the service

308

account, then wait at least 24 hours and watch for unintended consequences.

309

If there are no unintended consequences, you can delete the service account

310

with DeleteServiceAccount.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

Args:

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

315

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

316

the account. The `ACCOUNT` value can be the `email` address or the

317

`unique_id` of the service account. (required)

318

body: object, The request body.

319

The object takes the form of:

320

321

{ # The service account disable request.

322

}

323

324

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

331

332

{ # A generic empty message that you can re-use to avoid defining duplicated

333

# empty messages in your APIs. A typical example is to use it as the request

334

# or the response type of an API method. For instance:

335

#

336

# service Foo {

337

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

338

# }

339

#

340

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

<code class="details" id="enable">enable(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

346

<pre>Enables a ServiceAccount that was disabled by

347

DisableServiceAccount.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

348

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

349

If the service account is already enabled, then this method has no effect.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

350

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

351

If the service account was disabled by other means—for example, if Google

352

disabled the service account because it was compromised—you cannot use this

353

method to enable the service account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

357

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

358

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

359

the account. The `ACCOUNT` value can be the `email` address or the

360

`unique_id` of the service account. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

361

body: object, The request body.

362

The object takes the form of:

363

364

{ # The service account enable request.

365

}

366

367

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

374

375

{ # A generic empty message that you can re-use to avoid defining duplicated

376

# empty messages in your APIs. A typical example is to use it as the request

377

# or the response type of an API method. For instance:

378

#

379

# service Foo {

380

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

381

# }

382

#

383

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

Thomas Coffee

2017-03-27 10:39:26 -0700

[diff] [blame]

388

<code class="details" id="get">get(name, x__xgafv=None)</code>

Sai Cheemalapati

2016-10-12 14:05:53 -0700

[diff] [blame]

389

<pre>Gets a ServiceAccount.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

390

391

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

392

name: string, Required. The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

393

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

394

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

395

the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

396

`unique_id` of the service account. (required)

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

397

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

398

Allowed values

399

1 - v1 error format

400

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

401

402

Returns:

403

An object of the form:

404

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

405

{ # An IAM service account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

406

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

407

# A service account is an account for an application or a virtual machine (VM)

408

# instance, not a person. You can use a service account to call Google APIs. To

409

# learn more, read the [overview of service

410

# accounts](https://cloud.google.com/iam/help/service-accounts/overview).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

411

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

412

# When you create a service account, you specify the project ID that owns the

413

# service account, as well as a name that must be unique within the project.

414

# IAM uses these values to create an email address that identifies the service

415

# account.

416

"disabled": True or False, # Output only. Whether the service account is disabled.

417

"uniqueId": "A String", # Output only. The unique, stable numeric ID for the service account.

418

#

419

# Each service account retains its unique ID even if you delete the service

420

# account. For example, if you delete a service account, then create a new

421

# service account with the same name, the new service account has a different

422

# unique ID than the deleted service account.

423

"projectId": "A String", # Output only. The ID of the project that owns the service account.

424

"etag": "A String", # Deprecated. Do not use.

425

"email": "A String", # Output only. The email address of the service account.

426

"name": "A String", # The resource name of the service account.

427

#

428

# Use one of the following formats:

429

#

430

# * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

431

# * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

432

#

433

# As an alternative, you can use the `-` wildcard character instead of the

434

# project ID:

435

#

436

# * `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

437

# * `projects/-/serviceAccounts/{UNIQUE_ID}`

438

#

439

# When possible, avoid using the `-` wildcard character, because it can cause

440

# response messages to contain misleading error codes. For example, if you

441

# try to get the service account

442

# `projects/-/serviceAccounts/fake@example.com`, which does not exist, the

443

# response contains an HTTP `403 Forbidden` error instead of a `404 Not

444

# Found` error.

445

"displayName": "A String", # Optional. A user-specified, human-readable name for the service account. The maximum

446

# length is 100 UTF-8 bytes.

447

"oauth2ClientId": "A String", # Output only. The OAuth 2.0 client ID for the service account.

448

"description": "A String", # Optional. A user-specified, human-readable description of the service account. The

449

# maximum length is 256 UTF-8 bytes.

450

}</pre>

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

454

<code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

455

<pre>Gets the IAM policy that is attached to a ServiceAccount. This IAM

456

policy specifies which members have access to the service account.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

457

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

458

This method does not tell you whether the service account has been granted

459

any roles on other resources. To check whether a service account has role

460

grants on a resource, use the `getIamPolicy` method for that resource. For

461

example, to view the role grants for a project, call the Resource Manager

462

API's

463

[`projects.getIamPolicy`](https://cloud.google.com/resource-manager/reference/rest/v1/projects/getIamPolicy)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

464

method.

465

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

466

Args:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

467

resource: string, REQUIRED: The resource for which the policy is being requested.

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

468

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

469

options_requestedPolicyVersion: integer, Optional. The policy format version to be returned.

470

471

Valid values are 0, 1, and 3. Requests specifying an invalid value will be

472

rejected.

473

474

Requests for policies with any conditional bindings must specify version 3.

475

Policies without any conditional bindings may specify any valid value or

476

leave the field unset.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

477

478

To learn which resources support conditions in their IAM policies, see the

479

[IAM

480

documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

481

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

482

Allowed values

483

1 - v1 error format

484

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

485

486

Returns:

487

An object of the form:

488

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

489

{ # An Identity and Access Management (IAM) policy, which specifies access

490

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

491

#

492

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

493

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

494

# `members` to a single `role`. Members can be user accounts, service accounts,

495

# Google groups, and domains (such as G Suite). A `role` is a named list of

496

# permissions; each `role` can be an IAM predefined role or a user-created

497

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

498

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

499

# For some types of Google Cloud resources, a `binding` can also specify a

500

# `condition`, which is a logical expression that allows access to a resource

501

# only if the expression evaluates to `true`. A condition can add constraints

502

# based on attributes of the request, the resource, or both. To learn which

503

# resources support conditions in their IAM policies, see the

504

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

505

#

506

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

507

#

508

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

509

# "bindings": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

510

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

511

# "role": "roles/resourcemanager.organizationAdmin",

512

# "members": [

513

# "user:mike@example.com",

514

# "group:admins@example.com",

515

# "domain:google.com",

516

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

517

# ]

518

# },

519

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

520

# "role": "roles/resourcemanager.organizationViewer",

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

521

# "members": [

522

# "user:eve@example.com"

523

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

524

# "condition": {

525

# "title": "expirable access",

526

# "description": "Does not grant access after Sep 2020",

527

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

528

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

529

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

530

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

531

# "etag": "BwWWja0YfJA=",

532

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

533

# }

534

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

535

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

540

# - group:admins@example.com

541

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

542

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

543

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

544

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

545

# - user:eve@example.com

546

# role: roles/resourcemanager.organizationViewer

547

# condition:

548

# title: expirable access

549

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

550

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

551

# - etag: BwWWja0YfJA=

552

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

553

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

554

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

555

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

556

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

557

# prevent simultaneous updates of a policy from overwriting each other.

558

# It is strongly suggested that systems make use of the `etag` in the

559

# read-modify-write cycle to perform policy updates in order to avoid race

560

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

561

# systems are expected to put that etag in the request to `setIamPolicy` to

562

# ensure that their change will be applied to the same version of the policy.

563

#

564

# **Important:** If you use IAM Conditions, you must include the `etag` field

565

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

566

# you to overwrite a version `3` policy with a version `1` policy, and all of

567

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

568

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

569

{ # Specifies the audit configuration for a service.

570

# The configuration determines which permission types are logged, and what

571

# identities, if any, are exempted from logging.

572

# An AuditConfig must have one or more AuditLogConfigs.

573

#

574

# If there are AuditConfigs for both `allServices` and a specific service,

575

# the union of the two AuditConfigs is used for that service: the log_types

576

# specified in each AuditConfig are enabled, and the exempted_members in each

577

# AuditLogConfig are exempted.

578

#

579

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices",

585

# "audit_log_configs": [

586

# {

587

# "log_type": "DATA_READ",

588

# "exempted_members": [

589

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

594

# },

595

# {

596

# "log_type": "ADMIN_READ"

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com",

602

# "audit_log_configs": [

603

# {

604

# "log_type": "DATA_READ"

605

# },

606

# {

607

# "log_type": "DATA_WRITE",

608

# "exempted_members": [

609

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

618

# logging. It also exempts jose@example.com from DATA_READ logging, and

619

# aliya@example.com from DATA_WRITE logging.

620

"auditLogConfigs": [ # The configuration for logging of each type of permission.

621

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

626

# {

627

# "log_type": "DATA_READ",

628

# "exempted_members": [

629

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

639

# jose@example.com from DATA_READ logging.

640

"logType": "A String", # The log type that this config enables.

641

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

642

# permission.

643

# Follows the same format of Binding.members.

"A String",

],

},

],

"service": "A String", # Specifies a service that will be enabled for audit logging.

649

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

650

# `allServices` is a special value that covers all services.

651

},

652

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

653

"version": 42, # Specifies the format of the policy.

654

#

655

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

656

# are rejected.

657

#

658

# Any operation that affects conditional role bindings must specify version

659

# `3`. This requirement applies to the following operations:

660

#

661

# * Getting a policy that includes a conditional role binding

662

# * Adding a conditional role binding to a policy

663

# * Changing a conditional role binding in a policy

664

# * Removing any role binding, with or without a condition, from a policy

665

# that includes conditions

666

#

667

# **Important:** If you use IAM Conditions, you must include the `etag` field

668

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

669

# you to overwrite a version `3` policy with a version `1` policy, and all of

670

# the conditions in the version `3` policy are lost.

671

#

672

# If a policy does not include any conditions, operations on that policy may

673

# specify any valid version or leave the field unset.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

674

#

675

# To learn which resources support conditions in their IAM policies, see the

676

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

677

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

678

# `condition` that determines how and when the `bindings` are applied. Each

679

# of the `bindings` must contain at least one member.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

680

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

681

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

682

# `members` can have the following values:

683

#

684

# * `allUsers`: A special identifier that represents anyone who is

685

# on the internet; with or without a Google account.

686

#

687

# * `allAuthenticatedUsers`: A special identifier that represents anyone

688

# who is authenticated with a Google account or a service account.

689

#

690

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

691

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

692

#

693

#

694

# * `serviceAccount:{emailid}`: An email address that represents a service

695

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

696

#

697

# * `group:{emailid}`: An email address that represents a Google group.

698

# For example, `admins@example.com`.

699

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

700

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

701

# identifier) representing a user that has been recently deleted. For

702

# example, `alice@example.com?uid=123456789012345678901`. If the user is

703

# recovered, this value reverts to `user:{emailid}` and the recovered user

704

# retains the role in the binding.

705

#

706

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

707

# unique identifier) representing a service account that has been recently

708

# deleted. For example,

709

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

710

# If the service account is undeleted, this value reverts to

711

# `serviceAccount:{emailid}` and the undeleted service account retains the

712

# role in the binding.

713

#

714

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

715

# identifier) representing a Google group that has been recently

716

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

717

# the group is recovered, this value reverts to `group:{emailid}` and the

718

# recovered group retains the role in the binding.

719

#

Sai Cheemalapati

4ba8c23

2017-06-06 18:46:08 -0400

[diff] [blame]

720

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

721

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

722

# users of that domain. For example, `google.com` or `example.com`.

723

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

724

"A String",

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

725

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

726

"role": "A String", # Role that is assigned to `members`.

727

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

728

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

729

#

730

# If the condition evaluates to `true`, then this binding applies to the

731

# current request.

732

#

733

# If the condition evaluates to `false`, then this binding does not apply to

734

# the current request. However, a different role binding might grant the same

735

# role to one or more of the members in this binding.

736

#

737

# To learn which resources support conditions in their IAM policies, see the

738

# [IAM

739

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

740

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

741

# are documented at https://github.com/google/cel-spec.

742

#

743

# Example (Comparison):

744

#

745

# title: "Summary size limit"

746

# description: "Determines if a summary is less than 100 chars"

747

# expression: "document.summary.size() < 100"

748

#

749

# Example (Equality):

750

#

751

# title: "Requestor is owner"

752

# description: "Determines if requestor is the document owner"

753

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

758

# description: "Determine whether the document should be publicly visible"

759

# expression: "document.type != 'private' && document.type != 'internal'"

760

#

761

# Example (Data Manipulation):

762

#

763

# title: "Notification string"

764

# description: "Create a notification string with a timestamp."

765

# expression: "'New message received at ' + string(document.create_time)"

766

#

767

# The exact variables and functions that may be referenced within an expression

768

# are determined by the service that evaluates it. See the service

769

# documentation for additional information.

770

"description": "A String", # Optional. Description of the expression. This is a longer text which

771

# describes the expression, e.g. when hovered over it in a UI.

772

"location": "A String", # Optional. String indicating the location of the expression for error

773

# reporting, e.g. a file name and a position in the file.

774

"expression": "A String", # Textual representation of an expression in Common Expression Language

775

# syntax.

776

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

777

# its purpose. This can be used e.g. in UIs which allow to enter the

778

# expression.

779

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

780

},

781

],

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

786

<code class="details" id="list">list(name, pageSize=None, pageToken=None, x__xgafv=None)</code>

787

<pre>Lists every ServiceAccount that belongs to a specific project.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

788

789

Args:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

790

name: string, Required. The resource name of the project associated with the service

791

accounts, such as `projects/my-project-123`. (required)

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

792

pageSize: integer, Optional limit on the number of service accounts to include in the

793

response. Further accounts can subsequently be obtained by including the

794

ListServiceAccountsResponse.next_page_token

795

in a subsequent request.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

796

797

The default is 20, and the maximum is 100.

798

pageToken: string, Optional pagination token returned in an earlier

799

ListServiceAccountsResponse.next_page_token.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

800

x__xgafv: string, V1 error format.

801

Allowed values

802

1 - v1 error format

803

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

804

805

Returns:

806

An object of the form:

807

808

{ # The service account list response.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

809

"nextPageToken": "A String", # To retrieve the next page of results, set

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

810

# ListServiceAccountsRequest.page_token

811

# to this value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

812

"accounts": [ # The list of matching service accounts.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

813

{ # An IAM service account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

814

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

815

# A service account is an account for an application or a virtual machine (VM)

816

# instance, not a person. You can use a service account to call Google APIs. To

817

# learn more, read the [overview of service

818

# accounts](https://cloud.google.com/iam/help/service-accounts/overview).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

819

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

820

# When you create a service account, you specify the project ID that owns the

821

# service account, as well as a name that must be unique within the project.

822

# IAM uses these values to create an email address that identifies the service

823

# account.

824

"disabled": True or False, # Output only. Whether the service account is disabled.

825

"uniqueId": "A String", # Output only. The unique, stable numeric ID for the service account.

826

#

827

# Each service account retains its unique ID even if you delete the service

828

# account. For example, if you delete a service account, then create a new

829

# service account with the same name, the new service account has a different

830

# unique ID than the deleted service account.

831

"projectId": "A String", # Output only. The ID of the project that owns the service account.

832

"etag": "A String", # Deprecated. Do not use.

833

"email": "A String", # Output only. The email address of the service account.

834

"name": "A String", # The resource name of the service account.

835

#

836

# Use one of the following formats:

837

#

838

# * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

839

# * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

840

#

841

# As an alternative, you can use the `-` wildcard character instead of the

842

# project ID:

843

#

844

# * `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

845

# * `projects/-/serviceAccounts/{UNIQUE_ID}`

846

#

847

# When possible, avoid using the `-` wildcard character, because it can cause

848

# response messages to contain misleading error codes. For example, if you

849

# try to get the service account

850

# `projects/-/serviceAccounts/fake@example.com`, which does not exist, the

851

# response contains an HTTP `403 Forbidden` error instead of a `404 Not

852

# Found` error.

853

"displayName": "A String", # Optional. A user-specified, human-readable name for the service account. The maximum

854

# length is 100 UTF-8 bytes.

855

"oauth2ClientId": "A String", # Output only. The OAuth 2.0 client ID for the service account.

856

"description": "A String", # Optional. A user-specified, human-readable description of the service account. The

857

# maximum length is 256 UTF-8 bytes.

858

},

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

],

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

865

<pre>Retrieves the next page of results.

866

867

Args:

868

previous_request: The request for the previous page. (required)

869

previous_response: The response from the request for the previous page. (required)

870

871

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

872

A request object that you can call 'execute()' on to request the next

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

873

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

878

<code class="details" id="patch">patch(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

879

<pre>Patches a ServiceAccount.

880

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

881

Args:

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

882

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

883

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

884

Use one of the following formats:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

885

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

886

* `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

887

* `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

888

889

As an alternative, you can use the `-` wildcard character instead of the

890

project ID:

891

892

* `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

893

* `projects/-/serviceAccounts/{UNIQUE_ID}`

894

895

When possible, avoid using the `-` wildcard character, because it can cause

896

response messages to contain misleading error codes. For example, if you

897

try to get the service account

898

`projects/-/serviceAccounts/fake@example.com`, which does not exist, the

899

response contains an HTTP `403 Forbidden` error instead of a `404 Not

900

Found` error. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

901

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

902

The object takes the form of:

903

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

904

{ # The request for

905

# PatchServiceAccount.

906

#

907

# You can patch only the `display_name` and `description` fields. You must use

908

# the `update_mask` field to specify which of these fields you want to patch.

909

#

910

# Only the fields specified in the request are guaranteed to be returned in

911

# the response. Other fields may be empty in the response.

912

"serviceAccount": { # An IAM service account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

913

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

914

# A service account is an account for an application or a virtual machine (VM)

915

# instance, not a person. You can use a service account to call Google APIs. To

916

# learn more, read the [overview of service

917

# accounts](https://cloud.google.com/iam/help/service-accounts/overview).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

918

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

919

# When you create a service account, you specify the project ID that owns the

920

# service account, as well as a name that must be unique within the project.

921

# IAM uses these values to create an email address that identifies the service

922

# account.

923

"disabled": True or False, # Output only. Whether the service account is disabled.

924

"uniqueId": "A String", # Output only. The unique, stable numeric ID for the service account.

925

#

926

# Each service account retains its unique ID even if you delete the service

927

# account. For example, if you delete a service account, then create a new

928

# service account with the same name, the new service account has a different

929

# unique ID than the deleted service account.

930

"projectId": "A String", # Output only. The ID of the project that owns the service account.

931

"etag": "A String", # Deprecated. Do not use.

932

"email": "A String", # Output only. The email address of the service account.

933

"name": "A String", # The resource name of the service account.

934

#

935

# Use one of the following formats:

936

#

937

# * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

938

# * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

939

#

940

# As an alternative, you can use the `-` wildcard character instead of the

941

# project ID:

942

#

943

# * `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

944

# * `projects/-/serviceAccounts/{UNIQUE_ID}`

945

#

946

# When possible, avoid using the `-` wildcard character, because it can cause

947

# response messages to contain misleading error codes. For example, if you

948

# try to get the service account

949

# `projects/-/serviceAccounts/fake@example.com`, which does not exist, the

950

# response contains an HTTP `403 Forbidden` error instead of a `404 Not

951

# Found` error.

952

"displayName": "A String", # Optional. A user-specified, human-readable name for the service account. The maximum

953

# length is 100 UTF-8 bytes.

954

"oauth2ClientId": "A String", # Output only. The OAuth 2.0 client ID for the service account.

955

"description": "A String", # Optional. A user-specified, human-readable description of the service account. The

956

# maximum length is 256 UTF-8 bytes.

957

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

958

"updateMask": "A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

959

}

960

961

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

968

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

969

{ # An IAM service account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

970

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

971

# A service account is an account for an application or a virtual machine (VM)

972

# instance, not a person. You can use a service account to call Google APIs. To

973

# learn more, read the [overview of service

974

# accounts](https://cloud.google.com/iam/help/service-accounts/overview).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

975

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

976

# When you create a service account, you specify the project ID that owns the

977

# service account, as well as a name that must be unique within the project.

978

# IAM uses these values to create an email address that identifies the service

979

# account.

980

"disabled": True or False, # Output only. Whether the service account is disabled.

981

"uniqueId": "A String", # Output only. The unique, stable numeric ID for the service account.

982

#

983

# Each service account retains its unique ID even if you delete the service

984

# account. For example, if you delete a service account, then create a new

985

# service account with the same name, the new service account has a different

986

# unique ID than the deleted service account.

987

"projectId": "A String", # Output only. The ID of the project that owns the service account.

988

"etag": "A String", # Deprecated. Do not use.

989

"email": "A String", # Output only. The email address of the service account.

990

"name": "A String", # The resource name of the service account.

991

#

992

# Use one of the following formats:

993

#

994

# * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

995

# * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

996

#

997

# As an alternative, you can use the `-` wildcard character instead of the

998

# project ID:

999

#

1000

# * `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

1001

# * `projects/-/serviceAccounts/{UNIQUE_ID}`

1002

#

1003

# When possible, avoid using the `-` wildcard character, because it can cause

1004

# response messages to contain misleading error codes. For example, if you

1005

# try to get the service account

1006

# `projects/-/serviceAccounts/fake@example.com`, which does not exist, the

1007

# response contains an HTTP `403 Forbidden` error instead of a `404 Not

1008

# Found` error.

1009

"displayName": "A String", # Optional. A user-specified, human-readable name for the service account. The maximum

1010

# length is 100 UTF-8 bytes.

1011

"oauth2ClientId": "A String", # Output only. The OAuth 2.0 client ID for the service account.

1012

"description": "A String", # Optional. A user-specified, human-readable description of the service account. The

1013

# maximum length is 256 UTF-8 bytes.

1014

}</pre>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1018

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1019

<pre>Sets the IAM policy that is attached to a ServiceAccount.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1020

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1021

Use this method to grant or revoke access to the service account. For

1022

example, you could grant a member the ability to impersonate the service

1023

account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1024

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1025

This method does not enable the service account to access other resources.

1026

To grant roles to a service account on a resource, follow these steps:

1027

1028

1. Call the resource's `getIamPolicy` method to get its current IAM policy.

1029

2. Edit the policy so that it binds the service account to an IAM role for

1030

the resource.

1031

3. Call the resource's `setIamPolicy` method to update its IAM policy.

1032

1033

For detailed instructions, see

1034

[Granting roles to a service account for specific

1035

resources](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1036

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1037

Args:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1038

resource: string, REQUIRED: The resource for which the policy is being specified.

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1039

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1040

body: object, The request body.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1041

The object takes the form of:

1042

1043

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1044

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1045

# the policy is limited to a few 10s of KB. An empty policy is a

1046

# valid policy but certain Cloud Platform services (such as Projects)

1047

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1048

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1049

#

1050

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1051

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1052

# `members` to a single `role`. Members can be user accounts, service accounts,

1053

# Google groups, and domains (such as G Suite). A `role` is a named list of

1054

# permissions; each `role` can be an IAM predefined role or a user-created

1055

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1056

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1057

# For some types of Google Cloud resources, a `binding` can also specify a

1058

# `condition`, which is a logical expression that allows access to a resource

1059

# only if the expression evaluates to `true`. A condition can add constraints

1060

# based on attributes of the request, the resource, or both. To learn which

1061

# resources support conditions in their IAM policies, see the

1062

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1063

#

1064

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1065

#

1066

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1067

# "bindings": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1068

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1069

# "role": "roles/resourcemanager.organizationAdmin",

1070

# "members": [

1071

# "user:mike@example.com",

1072

# "group:admins@example.com",

1073

# "domain:google.com",

1074

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1075

# ]

1076

# },

1077

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1078

# "role": "roles/resourcemanager.organizationViewer",

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1079

# "members": [

1080

# "user:eve@example.com"

1081

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1082

# "condition": {

1083

# "title": "expirable access",

1084

# "description": "Does not grant access after Sep 2020",

1085

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1086

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1087

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1088

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1089

# "etag": "BwWWja0YfJA=",

1090

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1091

# }

1092

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1093

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1098

# - group:admins@example.com

1099

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1100

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1101

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1102

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1103

# - user:eve@example.com

1104

# role: roles/resourcemanager.organizationViewer

1105

# condition:

1106

# title: expirable access

1107

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1108

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1109

# - etag: BwWWja0YfJA=

1110

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1111

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1112

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1113

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1114

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1115

# prevent simultaneous updates of a policy from overwriting each other.

1116

# It is strongly suggested that systems make use of the `etag` in the

1117

# read-modify-write cycle to perform policy updates in order to avoid race

1118

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1119

# systems are expected to put that etag in the request to `setIamPolicy` to

1120

# ensure that their change will be applied to the same version of the policy.

1121

#

1122

# **Important:** If you use IAM Conditions, you must include the `etag` field

1123

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1124

# you to overwrite a version `3` policy with a version `1` policy, and all of

1125

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1126

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1127

{ # Specifies the audit configuration for a service.

1128

# The configuration determines which permission types are logged, and what

1129

# identities, if any, are exempted from logging.

1130

# An AuditConfig must have one or more AuditLogConfigs.

1131

#

1132

# If there are AuditConfigs for both `allServices` and a specific service,

1133

# the union of the two AuditConfigs is used for that service: the log_types

1134

# specified in each AuditConfig are enabled, and the exempted_members in each

1135

# AuditLogConfig are exempted.

1136

#

1137

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices",

1143

# "audit_log_configs": [

1144

# {

1145

# "log_type": "DATA_READ",

1146

# "exempted_members": [

1147

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

1152

# },

1153

# {

1154

# "log_type": "ADMIN_READ"

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com",

1160

# "audit_log_configs": [

1161

# {

1162

# "log_type": "DATA_READ"

1163

# },

1164

# {

1165

# "log_type": "DATA_WRITE",

1166

# "exempted_members": [

1167

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

1176

# logging. It also exempts jose@example.com from DATA_READ logging, and

1177

# aliya@example.com from DATA_WRITE logging.

1178

"auditLogConfigs": [ # The configuration for logging of each type of permission.

1179

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1184

# {

1185

# "log_type": "DATA_READ",

1186

# "exempted_members": [

1187

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1197

# jose@example.com from DATA_READ logging.

1198

"logType": "A String", # The log type that this config enables.

1199

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1200

# permission.

1201

# Follows the same format of Binding.members.

"A String",

],

},

],

"service": "A String", # Specifies a service that will be enabled for audit logging.

1207

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

1208

# `allServices` is a special value that covers all services.

1209

},

1210

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1211

"version": 42, # Specifies the format of the policy.

1212

#

1213

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1214

# are rejected.

1215

#

1216

# Any operation that affects conditional role bindings must specify version

1217

# `3`. This requirement applies to the following operations:

1218

#

1219

# * Getting a policy that includes a conditional role binding

1220

# * Adding a conditional role binding to a policy

1221

# * Changing a conditional role binding in a policy

1222

# * Removing any role binding, with or without a condition, from a policy

1223

# that includes conditions

1224

#

1225

# **Important:** If you use IAM Conditions, you must include the `etag` field

1226

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1227

# you to overwrite a version `3` policy with a version `1` policy, and all of

1228

# the conditions in the version `3` policy are lost.

1229

#

1230

# If a policy does not include any conditions, operations on that policy may

1231

# specify any valid version or leave the field unset.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1232

#

1233

# To learn which resources support conditions in their IAM policies, see the

1234

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1235

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1236

# `condition` that determines how and when the `bindings` are applied. Each

1237

# of the `bindings` must contain at least one member.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1238

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1239

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1240

# `members` can have the following values:

1241

#

1242

# * `allUsers`: A special identifier that represents anyone who is

1243

# on the internet; with or without a Google account.

1244

#

1245

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1246

# who is authenticated with a Google account or a service account.

1247

#

1248

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1249

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1250

#

1251

#

1252

# * `serviceAccount:{emailid}`: An email address that represents a service

1253

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1254

#

1255

# * `group:{emailid}`: An email address that represents a Google group.

1256

# For example, `admins@example.com`.

1257

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1258

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1259

# identifier) representing a user that has been recently deleted. For

1260

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1261

# recovered, this value reverts to `user:{emailid}` and the recovered user

1262

# retains the role in the binding.

1263

#

1264

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1265

# unique identifier) representing a service account that has been recently

1266

# deleted. For example,

1267

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1268

# If the service account is undeleted, this value reverts to

1269

# `serviceAccount:{emailid}` and the undeleted service account retains the

1270

# role in the binding.

1271

#

1272

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1273

# identifier) representing a Google group that has been recently

1274

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1275

# the group is recovered, this value reverts to `group:{emailid}` and the

1276

# recovered group retains the role in the binding.

1277

#

Sai Cheemalapati

4ba8c23

2017-06-06 18:46:08 -0400

[diff] [blame]

1278

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1279

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1280

# users of that domain. For example, `google.com` or `example.com`.

1281

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1282

"A String",

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1283

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1284

"role": "A String", # Role that is assigned to `members`.

1285

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1286

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1287

#

1288

# If the condition evaluates to `true`, then this binding applies to the

1289

# current request.

1290

#

1291

# If the condition evaluates to `false`, then this binding does not apply to

1292

# the current request. However, a different role binding might grant the same

1293

# role to one or more of the members in this binding.

1294

#

1295

# To learn which resources support conditions in their IAM policies, see the

1296

# [IAM

1297

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1298

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1299

# are documented at https://github.com/google/cel-spec.

1300

#

1301

# Example (Comparison):

1302

#

1303

# title: "Summary size limit"

1304

# description: "Determines if a summary is less than 100 chars"

1305

# expression: "document.summary.size() < 100"

1306

#

1307

# Example (Equality):

1308

#

1309

# title: "Requestor is owner"

1310

# description: "Determines if requestor is the document owner"

1311

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1316

# description: "Determine whether the document should be publicly visible"

1317

# expression: "document.type != 'private' && document.type != 'internal'"

1318

#

1319

# Example (Data Manipulation):

1320

#

1321

# title: "Notification string"

1322

# description: "Create a notification string with a timestamp."

1323

# expression: "'New message received at ' + string(document.create_time)"

1324

#

1325

# The exact variables and functions that may be referenced within an expression

1326

# are determined by the service that evaluates it. See the service

1327

# documentation for additional information.

1328

"description": "A String", # Optional. Description of the expression. This is a longer text which

1329

# describes the expression, e.g. when hovered over it in a UI.

1330

"location": "A String", # Optional. String indicating the location of the expression for error

1331

# reporting, e.g. a file name and a position in the file.

1332

"expression": "A String", # Textual representation of an expression in Common Expression Language

1333

# syntax.

1334

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1335

# its purpose. This can be used e.g. in UIs which allow to enter the

1336

# expression.

1337

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1338

},

1339

],

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1340

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1341

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1342

# the fields in the mask will be modified. If no mask is provided, the

1343

# following default mask is used:

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1344

#

1345

# `paths: "bindings, etag"`

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1346

}

1347

1348

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1349

Allowed values

1350

1 - v1 error format

1351

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1352

1353

Returns:

1354

An object of the form:

1355

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1356

{ # An Identity and Access Management (IAM) policy, which specifies access

1357

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1358

#

1359

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1360

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1361

# `members` to a single `role`. Members can be user accounts, service accounts,

1362

# Google groups, and domains (such as G Suite). A `role` is a named list of

1363

# permissions; each `role` can be an IAM predefined role or a user-created

1364

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1365

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1366

# For some types of Google Cloud resources, a `binding` can also specify a

1367

# `condition`, which is a logical expression that allows access to a resource

1368

# only if the expression evaluates to `true`. A condition can add constraints

1369

# based on attributes of the request, the resource, or both. To learn which

1370

# resources support conditions in their IAM policies, see the

1371

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1372

#

1373

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1374

#

1375

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1376

# "bindings": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1377

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1378

# "role": "roles/resourcemanager.organizationAdmin",

1379

# "members": [

1380

# "user:mike@example.com",

1381

# "group:admins@example.com",

1382

# "domain:google.com",

1383

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1384

# ]

1385

# },

1386

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1387

# "role": "roles/resourcemanager.organizationViewer",

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1388

# "members": [

1389

# "user:eve@example.com"

1390

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1391

# "condition": {

1392

# "title": "expirable access",

1393

# "description": "Does not grant access after Sep 2020",

1394

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1395

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1396

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1397

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1398

# "etag": "BwWWja0YfJA=",

1399

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1400

# }

1401

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1402

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1407

# - group:admins@example.com

1408

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1409

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1410

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1411

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1412

# - user:eve@example.com

1413

# role: roles/resourcemanager.organizationViewer

1414

# condition:

1415

# title: expirable access

1416

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1417

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1418

# - etag: BwWWja0YfJA=

1419

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1420

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1421

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1422

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1423

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1424

# prevent simultaneous updates of a policy from overwriting each other.

1425

# It is strongly suggested that systems make use of the `etag` in the

1426

# read-modify-write cycle to perform policy updates in order to avoid race

1427

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1428

# systems are expected to put that etag in the request to `setIamPolicy` to

1429

# ensure that their change will be applied to the same version of the policy.

1430

#

1431

# **Important:** If you use IAM Conditions, you must include the `etag` field

1432

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1433

# you to overwrite a version `3` policy with a version `1` policy, and all of

1434

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1435

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1436

{ # Specifies the audit configuration for a service.

1437

# The configuration determines which permission types are logged, and what

1438

# identities, if any, are exempted from logging.

1439

# An AuditConfig must have one or more AuditLogConfigs.

1440

#

1441

# If there are AuditConfigs for both `allServices` and a specific service,

1442

# the union of the two AuditConfigs is used for that service: the log_types

1443

# specified in each AuditConfig are enabled, and the exempted_members in each

1444

# AuditLogConfig are exempted.

1445

#

1446

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices",

1452

# "audit_log_configs": [

1453

# {

1454

# "log_type": "DATA_READ",

1455

# "exempted_members": [

1456

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

1461

# },

1462

# {

1463

# "log_type": "ADMIN_READ"

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com",

1469

# "audit_log_configs": [

1470

# {

1471

# "log_type": "DATA_READ"

1472

# },

1473

# {

1474

# "log_type": "DATA_WRITE",

1475

# "exempted_members": [

1476

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

1485

# logging. It also exempts jose@example.com from DATA_READ logging, and

1486

# aliya@example.com from DATA_WRITE logging.

1487

"auditLogConfigs": [ # The configuration for logging of each type of permission.

1488

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1493

# {

1494

# "log_type": "DATA_READ",

1495

# "exempted_members": [

1496

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1506

# jose@example.com from DATA_READ logging.

1507

"logType": "A String", # The log type that this config enables.

1508

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1509

# permission.

1510

# Follows the same format of Binding.members.

"A String",

],

},

],

"service": "A String", # Specifies a service that will be enabled for audit logging.

1516

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

1517

# `allServices` is a special value that covers all services.

1518

},

1519

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1520

"version": 42, # Specifies the format of the policy.

1521

#

1522

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1523

# are rejected.

1524

#

1525

# Any operation that affects conditional role bindings must specify version

1526

# `3`. This requirement applies to the following operations:

1527

#

1528

# * Getting a policy that includes a conditional role binding

1529

# * Adding a conditional role binding to a policy

1530

# * Changing a conditional role binding in a policy

1531

# * Removing any role binding, with or without a condition, from a policy

1532

# that includes conditions

1533

#

1534

# **Important:** If you use IAM Conditions, you must include the `etag` field

1535

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1536

# you to overwrite a version `3` policy with a version `1` policy, and all of

1537

# the conditions in the version `3` policy are lost.

1538

#

1539

# If a policy does not include any conditions, operations on that policy may

1540

# specify any valid version or leave the field unset.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1541

#

1542

# To learn which resources support conditions in their IAM policies, see the

1543

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1544

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1545

# `condition` that determines how and when the `bindings` are applied. Each

1546

# of the `bindings` must contain at least one member.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1547

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1548

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1549

# `members` can have the following values:

1550

#

1551

# * `allUsers`: A special identifier that represents anyone who is

1552

# on the internet; with or without a Google account.

1553

#

1554

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1555

# who is authenticated with a Google account or a service account.

1556

#

1557

# * `user:{emailid}`: An email address that represents a specific Google

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1558

# account. For example, `alice@example.com` .

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1559

#

1560

#

1561

# * `serviceAccount:{emailid}`: An email address that represents a service

1562

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1563

#

1564

# * `group:{emailid}`: An email address that represents a Google group.

1565

# For example, `admins@example.com`.

1566

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1567

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1568

# identifier) representing a user that has been recently deleted. For

1569

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1570

# recovered, this value reverts to `user:{emailid}` and the recovered user

1571

# retains the role in the binding.

1572

#

1573

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1574

# unique identifier) representing a service account that has been recently

1575

# deleted. For example,

1576

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1577

# If the service account is undeleted, this value reverts to

1578

# `serviceAccount:{emailid}` and the undeleted service account retains the

1579

# role in the binding.

1580

#

1581

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1582

# identifier) representing a Google group that has been recently

1583

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1584

# the group is recovered, this value reverts to `group:{emailid}` and the

1585

# recovered group retains the role in the binding.

1586

#

Sai Cheemalapati

4ba8c23

2017-06-06 18:46:08 -0400

[diff] [blame]

1587

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1588

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1589

# users of that domain. For example, `google.com` or `example.com`.

1590

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1591

"A String",

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1592

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1593

"role": "A String", # Role that is assigned to `members`.

1594

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1595

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1596

#

1597

# If the condition evaluates to `true`, then this binding applies to the

1598

# current request.

1599

#

1600

# If the condition evaluates to `false`, then this binding does not apply to

1601

# the current request. However, a different role binding might grant the same

1602

# role to one or more of the members in this binding.

1603

#

1604

# To learn which resources support conditions in their IAM policies, see the

1605

# [IAM

1606

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1607

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1608

# are documented at https://github.com/google/cel-spec.

1609

#

1610

# Example (Comparison):

1611

#

1612

# title: "Summary size limit"

1613

# description: "Determines if a summary is less than 100 chars"

1614

# expression: "document.summary.size() < 100"

1615

#

1616

# Example (Equality):

1617

#

1618

# title: "Requestor is owner"

1619

# description: "Determines if requestor is the document owner"

1620

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1625

# description: "Determine whether the document should be publicly visible"

1626

# expression: "document.type != 'private' && document.type != 'internal'"

1627

#

1628

# Example (Data Manipulation):

1629

#

1630

# title: "Notification string"

1631

# description: "Create a notification string with a timestamp."

1632

# expression: "'New message received at ' + string(document.create_time)"

1633

#

1634

# The exact variables and functions that may be referenced within an expression

1635

# are determined by the service that evaluates it. See the service

1636

# documentation for additional information.

1637

"description": "A String", # Optional. Description of the expression. This is a longer text which

1638

# describes the expression, e.g. when hovered over it in a UI.

1639

"location": "A String", # Optional. String indicating the location of the expression for error

1640

# reporting, e.g. a file name and a position in the file.

1641

"expression": "A String", # Textual representation of an expression in Common Expression Language

1642

# syntax.

1643

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1644

# its purpose. This can be used e.g. in UIs which allow to enter the

1645

# expression.

1646

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1647

},

1648

],

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1653

<code class="details" id="signBlob">signBlob(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1654

<pre>**Note:** This method is deprecated and will stop working on July 1, 2021.

1655

Use the

1656

[`signBlob`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signBlob)

1657

method in the IAM Service Account Credentials API instead. If you currently

1658

use this method, see the [migration

1659

guide](https://cloud.google.com/iam/help/credentials/migrate-api) for

1660

instructions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1661

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1662

Signs a blob using the system-managed private key for a ServiceAccount.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1663

1664

Args:

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1665

1666

API](https://cloud.google.com/iam/help/credentials/migrate-api).

1667

1668

The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1669

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1670

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

1671

the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1672

`unique_id` of the service account. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1673

body: object, The request body.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1674

The object takes the form of:

1675

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1676

{ # Deprecated. [Migrate to Service Account Credentials

1677

# API](https://cloud.google.com/iam/help/credentials/migrate-api).

1678

#

1679

# The service account sign blob request.

1680

"bytesToSign": "A String", # Required. Deprecated. [Migrate to Service Account Credentials

1681

# API](https://cloud.google.com/iam/help/credentials/migrate-api).

1682

#

1683

# The bytes to sign.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1684

}

1685

1686

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1687

Allowed values

1688

1 - v1 error format

1689

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1690

1691

Returns:

1692

An object of the form:

1693

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1694

{ # Deprecated. [Migrate to Service Account Credentials

1695

# API](https://cloud.google.com/iam/help/credentials/migrate-api).

1696

#

1697

# The service account sign blob response.

1698

"signature": "A String", # Deprecated. [Migrate to Service Account Credentials

1699

# API](https://cloud.google.com/iam/help/credentials/migrate-api).

1700

#

1701

# The signed blob.

1702

"keyId": "A String", # Deprecated. [Migrate to Service Account Credentials

1703

# API](https://cloud.google.com/iam/help/credentials/migrate-api).

1704

#

1705

# The id of the key used to sign the blob.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1710

<code class="details" id="signJwt">signJwt(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1711

<pre>**Note:** This method is deprecated and will stop working on July 1, 2021.

1712

Use the

1713

[`signJwt`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signJwt)

1714

method in the IAM Service Account Credentials API instead. If you currently

1715

use this method, see the [migration

1716

guide](https://cloud.google.com/iam/help/credentials/migrate-api) for

1717

instructions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1718

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1719

Signs a JSON Web Token (JWT) using the system-managed private key for a

1720

ServiceAccount.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1721

1722

Args:

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1723

1724

API](https://cloud.google.com/iam/help/credentials/migrate-api).

1725

1726

The resource name of the service account in the following format:

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1727

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

1728

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

1729

the account. The `ACCOUNT` value can be the `email` address or the

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1730

`unique_id` of the service account. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1731

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1732

The object takes the form of:

1733

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1734

{ # Deprecated. [Migrate to Service Account Credentials

1735

# API](https://cloud.google.com/iam/help/credentials/migrate-api).

1736

#

1737

# The service account sign JWT request.

1738

"payload": "A String", # Required. Deprecated. [Migrate to Service Account Credentials

1739

# API](https://cloud.google.com/iam/help/credentials/migrate-api).

1740

#

1741

# The JWT payload to sign. Must be a serialized JSON object that contains a

1742

# JWT Claims Set. For example: `{"sub": "user@example.com", "iat": 313435}`

1743

#

1744

# If the JWT Claims Set contains an expiration time (`exp`) claim, it must be

1745

# an integer timestamp that is not in the past and no more than 1 hour in the

1746

# future.

1747

#

1748

# If the JWT Claims Set does not contain an expiration time (`exp`) claim,

1749

# this claim is added automatically, with a timestamp that is 1 hour in the

1750

# future.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1751

}

1752

1753

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1760

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1761

{ # Deprecated. [Migrate to Service Account Credentials

1762

# API](https://cloud.google.com/iam/help/credentials/migrate-api).

1763

#

1764

# The service account sign JWT response.

1765

"signedJwt": "A String", # Deprecated. [Migrate to Service Account Credentials

1766

# API](https://cloud.google.com/iam/help/credentials/migrate-api).

1767

#

1768

# The signed JWT.

1769

"keyId": "A String", # Deprecated. [Migrate to Service Account Credentials

1770

# API](https://cloud.google.com/iam/help/credentials/migrate-api).

1771

#

1772

# The id of the key used to sign the JWT.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1777

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1778

<pre>Tests whether the caller has the specified permissions on a

1779

ServiceAccount.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1780

1781

Args:

1782

resource: string, REQUIRED: The resource for which the policy detail is being requested.

Sai Cheemalapati

e833b79

2017-03-24 15:06:46 -0700

[diff] [blame]

1783

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1784

body: object, The request body.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1785

The object takes the form of:

1786

1787

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1788

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

1789

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1790

# information see

1791

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1792

"A String",

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1797

Allowed values

1798

1 - v1 error format

1799

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1800

1801

Returns:

1802

An object of the form:

1803

1804

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1805

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1806

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1807

"A String",

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

],

}</pre>

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1813

<code class="details" id="undelete">undelete(name, body=None, x__xgafv=None)</code>

1814

<pre>Restores a deleted ServiceAccount.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1815

1816

**Important:** It is not always possible to restore a deleted service

1817

account. Use this method only as a last resort.

1818

1819

After you delete a service account, IAM permanently removes the service

1820

account 30 days later. There is no way to restore a deleted service account

1821

that has been permanently removed.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1822

1823

Args:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1824

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1825

`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_UNIQUE_ID}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1826

Using `-` as a wildcard for the `PROJECT_ID` will infer the project from

1827

the account. (required)

1828

body: object, The request body.

1829

The object takes the form of:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1830

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1831

{ # The service account undelete request.

1832

}

1833

1834

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1841

1842

{

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1843

"restoredAccount": { # An IAM service account. # Metadata for the restored service account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1844

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1845

# A service account is an account for an application or a virtual machine (VM)

1846

# instance, not a person. You can use a service account to call Google APIs. To

1847

# learn more, read the [overview of service

1848

# accounts](https://cloud.google.com/iam/help/service-accounts/overview).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1849

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1850

# When you create a service account, you specify the project ID that owns the

1851

# service account, as well as a name that must be unique within the project.

1852

# IAM uses these values to create an email address that identifies the service

1853

# account.

1854

"disabled": True or False, # Output only. Whether the service account is disabled.

1855

"uniqueId": "A String", # Output only. The unique, stable numeric ID for the service account.

1856

#

1857

# Each service account retains its unique ID even if you delete the service

1858

# account. For example, if you delete a service account, then create a new

1859

# service account with the same name, the new service account has a different

1860

# unique ID than the deleted service account.

1861

"projectId": "A String", # Output only. The ID of the project that owns the service account.

1862

"etag": "A String", # Deprecated. Do not use.

1863

"email": "A String", # Output only. The email address of the service account.

1864

"name": "A String", # The resource name of the service account.

1865

#

1866

# Use one of the following formats:

1867

#

1868

# * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

1869

# * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

1870

#

1871

# As an alternative, you can use the `-` wildcard character instead of the

1872

# project ID:

1873

#

1874

# * `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

1875

# * `projects/-/serviceAccounts/{UNIQUE_ID}`

1876

#

1877

# When possible, avoid using the `-` wildcard character, because it can cause

1878

# response messages to contain misleading error codes. For example, if you

1879

# try to get the service account

1880

# `projects/-/serviceAccounts/fake@example.com`, which does not exist, the

1881

# response contains an HTTP `403 Forbidden` error instead of a `404 Not

1882

# Found` error.

1883

"displayName": "A String", # Optional. A user-specified, human-readable name for the service account. The maximum

1884

# length is 100 UTF-8 bytes.

1885

"oauth2ClientId": "A String", # Output only. The OAuth 2.0 client ID for the service account.

1886

"description": "A String", # Optional. A user-specified, human-readable description of the service account. The

1887

# maximum length is 256 UTF-8 bytes.

1888

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1893

<code class="details" id="update">update(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1894

<pre>**Note:** We are in the process of deprecating this method. Use

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1895

PatchServiceAccount instead.

1896

1897

Updates a ServiceAccount.

1898

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1899

You can update only the `display_name` and `description` fields.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1900

1901

Args:

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1902

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1903

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1904

Use one of the following formats:

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1905

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1906

* `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

1907

* `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

1908

1909

As an alternative, you can use the `-` wildcard character instead of the

1910

project ID:

1911

1912

* `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

1913

* `projects/-/serviceAccounts/{UNIQUE_ID}`

1914

1915

When possible, avoid using the `-` wildcard character, because it can cause

1916

response messages to contain misleading error codes. For example, if you

1917

try to get the service account

1918

`projects/-/serviceAccounts/fake@example.com`, which does not exist, the

1919

response contains an HTTP `403 Forbidden` error instead of a `404 Not

1920

Found` error. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1921

body: object, The request body.

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1922

The object takes the form of:

1923

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1924

{ # An IAM service account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1925

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1926

# A service account is an account for an application or a virtual machine (VM)

1927

# instance, not a person. You can use a service account to call Google APIs. To

1928

# learn more, read the [overview of service

1929

# accounts](https://cloud.google.com/iam/help/service-accounts/overview).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1930

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1931

# When you create a service account, you specify the project ID that owns the

1932

# service account, as well as a name that must be unique within the project.

1933

# IAM uses these values to create an email address that identifies the service

1934

# account.

1935

"disabled": True or False, # Output only. Whether the service account is disabled.

1936

"uniqueId": "A String", # Output only. The unique, stable numeric ID for the service account.

1937

#

1938

# Each service account retains its unique ID even if you delete the service

1939

# account. For example, if you delete a service account, then create a new

1940

# service account with the same name, the new service account has a different

1941

# unique ID than the deleted service account.

1942

"projectId": "A String", # Output only. The ID of the project that owns the service account.

1943

"etag": "A String", # Deprecated. Do not use.

1944

"email": "A String", # Output only. The email address of the service account.

1945

"name": "A String", # The resource name of the service account.

1946

#

1947

# Use one of the following formats:

1948

#

1949

# * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

1950

# * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

1951

#

1952

# As an alternative, you can use the `-` wildcard character instead of the

1953

# project ID:

1954

#

1955

# * `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

1956

# * `projects/-/serviceAccounts/{UNIQUE_ID}`

1957

#

1958

# When possible, avoid using the `-` wildcard character, because it can cause

1959

# response messages to contain misleading error codes. For example, if you

1960

# try to get the service account

1961

# `projects/-/serviceAccounts/fake@example.com`, which does not exist, the

1962

# response contains an HTTP `403 Forbidden` error instead of a `404 Not

1963

# Found` error.

1964

"displayName": "A String", # Optional. A user-specified, human-readable name for the service account. The maximum

1965

# length is 100 UTF-8 bytes.

1966

"oauth2ClientId": "A String", # Output only. The OAuth 2.0 client ID for the service account.

1967

"description": "A String", # Optional. A user-specified, human-readable description of the service account. The

1968

# maximum length is 256 UTF-8 bytes.

1969

}

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1970

1971

x__xgafv: string, V1 error format.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1972

Allowed values

1973

1 - v1 error format

1974

2 - v2 error format

Jon Wayne Parrott

2016-02-19 16:02:29 -0800

[diff] [blame]

1975

1976

Returns:

1977

An object of the form:

1978

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1979

{ # An IAM service account.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1980

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1981

# A service account is an account for an application or a virtual machine (VM)

1982

# instance, not a person. You can use a service account to call Google APIs. To

1983

# learn more, read the [overview of service

1984

# accounts](https://cloud.google.com/iam/help/service-accounts/overview).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1985

#

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1986

# When you create a service account, you specify the project ID that owns the

1987

# service account, as well as a name that must be unique within the project.

1988

# IAM uses these values to create an email address that identifies the service

1989

# account.

1990

"disabled": True or False, # Output only. Whether the service account is disabled.

1991

"uniqueId": "A String", # Output only. The unique, stable numeric ID for the service account.

1992

#

1993

# Each service account retains its unique ID even if you delete the service

1994

# account. For example, if you delete a service account, then create a new

1995

# service account with the same name, the new service account has a different

1996

# unique ID than the deleted service account.

1997

"projectId": "A String", # Output only. The ID of the project that owns the service account.

1998

"etag": "A String", # Deprecated. Do not use.

1999

"email": "A String", # Output only. The email address of the service account.

2000

"name": "A String", # The resource name of the service account.

2001

#

2002

# Use one of the following formats:

2003

#

2004

# * `projects/{PROJECT_ID}/serviceAccounts/{EMAIL_ADDRESS}`

2005

# * `projects/{PROJECT_ID}/serviceAccounts/{UNIQUE_ID}`

2006

#

2007

# As an alternative, you can use the `-` wildcard character instead of the

2008

# project ID:

2009

#

2010

# * `projects/-/serviceAccounts/{EMAIL_ADDRESS}`

2011

# * `projects/-/serviceAccounts/{UNIQUE_ID}`

2012

#

2013

# When possible, avoid using the `-` wildcard character, because it can cause

2014

# response messages to contain misleading error codes. For example, if you

2015

# try to get the service account

2016

# `projects/-/serviceAccounts/fake@example.com`, which does not exist, the

2017

# response contains an HTTP `403 Forbidden` error instead of a `404 Not

2018

# Found` error.

2019

"displayName": "A String", # Optional. A user-specified, human-readable name for the service account. The maximum

2020

# length is 100 UTF-8 bytes.

2021

"oauth2ClientId": "A String", # Output only. The OAuth 2.0 client ID for the service account.

2022

"description": "A String", # Optional. A user-specified, human-readable description of the service account. The

2023

# maximum length is 256 UTF-8 bytes.

2024

}</pre>

Jon Wayne Parrott