Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / dd49464a6262c0d1f71efcf11f131e2f591fe5f6 / . / docs / dyn / cloudiot_v1.projects.locations.registries.groups.html
blob: 52b930f2285acc1edc424faaf044e505b057bbfa [file] [log] [blame]
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
75<h1><a href="cloudiot_v1.html">Cloud IoT API</a> . <a href="cloudiot_v1.projects.html">projects</a> . <a href="cloudiot_v1.projects.locations.html">locations</a> . <a href="cloudiot_v1.projects.locations.registries.html">registries</a> . <a href="cloudiot_v1.projects.locations.registries.groups.html">groups</a></h1>
76<h2>Instance Methods</h2>
77<p class="toc_element">
78 <code><a href="cloudiot_v1.projects.locations.registries.groups.devices.html">devices()</a></code>
79</p>
80<p class="firstline">Returns the devices Resource.</p>
81
82<p class="toc_element">
83 <code><a href="#getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
84<p class="firstline">Gets the access control policy for a resource.</p>
85<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]86 <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]87<p class="firstline">Sets the access control policy on the specified resource. Replaces any</p>
88<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]89 <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]90<p class="firstline">Returns permissions that a caller has on the specified resource.</p>
91<h3>Method Details</h3>
92<div class="method">
93 <code class="details" id="getIamPolicy">getIamPolicy(resource, body=None, x__xgafv=None)</code>
94 <pre>Gets the access control policy for a resource.
95Returns an empty policy if the resource exists and does not have a policy
96set.
97
98Args:
99 resource: string, REQUIRED: The resource for which the policy is being requested.
100See the operation documentation for the appropriate value for this field. (required)
101 body: object, The request body.
102 The object takes the form of:
103
104{ # Request message for `GetIamPolicy` method.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]105 "options": { # Encapsulates settings provided to GetIamPolicy. # OPTIONAL: A `GetPolicyOptions` object for specifying options to
106 # `GetIamPolicy`.
107 "requestedPolicyVersion": 42, # Optional. The policy format version to be returned.
108 #
109 # Valid values are 0, 1, and 3. Requests specifying an invalid value will be
110 # rejected.
111 #
112 # Requests for policies with any conditional bindings must specify version 3.
113 # Policies without any conditional bindings may specify any valid value or
114 # leave the field unset.
115 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]116 }
117
118 x__xgafv: string, V1 error format.
119 Allowed values
120 1 - v1 error format
121 2 - v2 error format
122
123Returns:
124 An object of the form:
125
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]126 { # An Identity and Access Management (IAM) policy, which specifies access
127 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]128 #
129 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]130 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
131 # `members` to a single `role`. Members can be user accounts, service accounts,
132 # Google groups, and domains (such as G Suite). A `role` is a named list of
133 # permissions; each `role` can be an IAM predefined role or a user-created
134 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]135 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]136 # Optionally, a `binding` can specify a `condition`, which is a logical
137 # expression that allows access to a resource only if the expression evaluates
138 # to `true`. A condition can add constraints based on attributes of the
139 # request, the resource, or both.
140 #
141 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]142 #
143 # {
144 # "bindings": [
145 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]146 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]147 # "members": [
148 # "user:mike@example.com",
149 # "group:admins@example.com",
150 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]151 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]152 # ]
153 # },
154 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]155 # "role": "roles/resourcemanager.organizationViewer",
156 # "members": ["user:eve@example.com"],
157 # "condition": {
158 # "title": "expirable access",
159 # "description": "Does not grant access after Sep 2020",
160 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
161 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]162 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]163 # ],
164 # "etag": "BwWWja0YfJA=",
165 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]166 # }
167 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]168 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]169 #
170 # bindings:
171 # - members:
172 # - user:mike@example.com
173 # - group:admins@example.com
174 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]175 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
176 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]177 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]178 # - user:eve@example.com
179 # role: roles/resourcemanager.organizationViewer
180 # condition:
181 # title: expirable access
182 # description: Does not grant access after Sep 2020
183 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
184 # - etag: BwWWja0YfJA=
185 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]186 #
187 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]188 # [IAM documentation](https://cloud.google.com/iam/docs/).
189 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
190 # `condition` that determines how and when the `bindings` are applied. Each
191 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]192 { # Associates `members` with a `role`.
193 "role": "A String", # Role that is assigned to `members`.
194 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
195 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
196 # `members` can have the following values:
197 #
198 # * `allUsers`: A special identifier that represents anyone who is
199 # on the internet; with or without a Google account.
200 #
201 # * `allAuthenticatedUsers`: A special identifier that represents anyone
202 # who is authenticated with a Google account or a service account.
203 #
204 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]205 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]206 #
207 #
208 # * `serviceAccount:{emailid}`: An email address that represents a service
209 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
210 #
211 # * `group:{emailid}`: An email address that represents a Google group.
212 # For example, `admins@example.com`.
213 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]214 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
215 # identifier) representing a user that has been recently deleted. For
216 # example, `alice@example.com?uid=123456789012345678901`. If the user is
217 # recovered, this value reverts to `user:{emailid}` and the recovered user
218 # retains the role in the binding.
219 #
220 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
221 # unique identifier) representing a service account that has been recently
222 # deleted. For example,
223 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
224 # If the service account is undeleted, this value reverts to
225 # `serviceAccount:{emailid}` and the undeleted service account retains the
226 # role in the binding.
227 #
228 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
229 # identifier) representing a Google group that has been recently
230 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
231 # the group is recovered, this value reverts to `group:{emailid}` and the
232 # recovered group retains the role in the binding.
233 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]234 #
235 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
236 # users of that domain. For example, `google.com` or `example.com`.
237 #
238 "A String",
239 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]240 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]241 # NOTE: An unsatisfied condition will not allow user access via current
242 # binding. Different bindings, including their conditions, are examined
243 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]244 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
245 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]246 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]247 # Example (Comparison):
248 #
249 # title: "Summary size limit"
250 # description: "Determines if a summary is less than 100 chars"
251 # expression: "document.summary.size() &lt; 100"
252 #
253 # Example (Equality):
254 #
255 # title: "Requestor is owner"
256 # description: "Determines if requestor is the document owner"
257 # expression: "document.owner == request.auth.claims.email"
258 #
259 # Example (Logic):
260 #
261 # title: "Public documents"
262 # description: "Determine whether the document should be publicly visible"
263 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
264 #
265 # Example (Data Manipulation):
266 #
267 # title: "Notification string"
268 # description: "Create a notification string with a timestamp."
269 # expression: "'New message received at ' + string(document.create_time)"
270 #
271 # The exact variables and functions that may be referenced within an expression
272 # are determined by the service that evaluates it. See the service
273 # documentation for additional information.
274 "location": "A String", # Optional. String indicating the location of the expression for error
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]275 # reporting, e.g. a file name and a position in the file.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]276 "expression": "A String", # Textual representation of an expression in Common Expression Language
277 # syntax.
278 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]279 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]280 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]281 # its purpose. This can be used e.g. in UIs which allow to enter the
282 # expression.
283 },
284 },
285 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]286 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
287 # prevent simultaneous updates of a policy from overwriting each other.
288 # It is strongly suggested that systems make use of the `etag` in the
289 # read-modify-write cycle to perform policy updates in order to avoid race
290 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
291 # systems are expected to put that etag in the request to `setIamPolicy` to
292 # ensure that their change will be applied to the same version of the policy.
293 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]294 # **Important:** If you use IAM Conditions, you must include the `etag` field
295 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
296 # you to overwrite a version `3` policy with a version `1` policy, and all of
297 # the conditions in the version `3` policy are lost.
298 "version": 42, # Specifies the format of the policy.
299 #
300 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
301 # are rejected.
302 #
303 # Any operation that affects conditional role bindings must specify version
304 # `3`. This requirement applies to the following operations:
305 #
306 # * Getting a policy that includes a conditional role binding
307 # * Adding a conditional role binding to a policy
308 # * Changing a conditional role binding in a policy
309 # * Removing any role binding, with or without a condition, from a policy
310 # that includes conditions
311 #
312 # **Important:** If you use IAM Conditions, you must include the `etag` field
313 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
314 # you to overwrite a version `3` policy with a version `1` policy, and all of
315 # the conditions in the version `3` policy are lost.
316 #
317 # If a policy does not include any conditions, operations on that policy may
318 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]319 }</pre>
320</div>
321
322<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]323 <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]324 <pre>Sets the access control policy on the specified resource. Replaces any
325existing policy.
326
327Args:
328 resource: string, REQUIRED: The resource for which the policy is being specified.
329See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]330 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]331 The object takes the form of:
332
333{ # Request message for `SetIamPolicy` method.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]334 "policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]335 # the policy is limited to a few 10s of KB. An empty policy is a
336 # valid policy but certain Cloud Platform services (such as Projects)
337 # might reject them.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]338 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]339 #
340 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]341 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
342 # `members` to a single `role`. Members can be user accounts, service accounts,
343 # Google groups, and domains (such as G Suite). A `role` is a named list of
344 # permissions; each `role` can be an IAM predefined role or a user-created
345 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]346 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]347 # Optionally, a `binding` can specify a `condition`, which is a logical
348 # expression that allows access to a resource only if the expression evaluates
349 # to `true`. A condition can add constraints based on attributes of the
350 # request, the resource, or both.
351 #
352 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]353 #
354 # {
355 # "bindings": [
356 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]357 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]358 # "members": [
359 # "user:mike@example.com",
360 # "group:admins@example.com",
361 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]362 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]363 # ]
364 # },
365 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]366 # "role": "roles/resourcemanager.organizationViewer",
367 # "members": ["user:eve@example.com"],
368 # "condition": {
369 # "title": "expirable access",
370 # "description": "Does not grant access after Sep 2020",
371 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
372 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]373 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]374 # ],
375 # "etag": "BwWWja0YfJA=",
376 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]377 # }
378 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]379 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]380 #
381 # bindings:
382 # - members:
383 # - user:mike@example.com
384 # - group:admins@example.com
385 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]386 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
387 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]388 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]389 # - user:eve@example.com
390 # role: roles/resourcemanager.organizationViewer
391 # condition:
392 # title: expirable access
393 # description: Does not grant access after Sep 2020
394 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
395 # - etag: BwWWja0YfJA=
396 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]397 #
398 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]399 # [IAM documentation](https://cloud.google.com/iam/docs/).
400 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
401 # `condition` that determines how and when the `bindings` are applied. Each
402 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]403 { # Associates `members` with a `role`.
404 "role": "A String", # Role that is assigned to `members`.
405 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
406 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
407 # `members` can have the following values:
408 #
409 # * `allUsers`: A special identifier that represents anyone who is
410 # on the internet; with or without a Google account.
411 #
412 # * `allAuthenticatedUsers`: A special identifier that represents anyone
413 # who is authenticated with a Google account or a service account.
414 #
415 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]416 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]417 #
418 #
419 # * `serviceAccount:{emailid}`: An email address that represents a service
420 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
421 #
422 # * `group:{emailid}`: An email address that represents a Google group.
423 # For example, `admins@example.com`.
424 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]425 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
426 # identifier) representing a user that has been recently deleted. For
427 # example, `alice@example.com?uid=123456789012345678901`. If the user is
428 # recovered, this value reverts to `user:{emailid}` and the recovered user
429 # retains the role in the binding.
430 #
431 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
432 # unique identifier) representing a service account that has been recently
433 # deleted. For example,
434 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
435 # If the service account is undeleted, this value reverts to
436 # `serviceAccount:{emailid}` and the undeleted service account retains the
437 # role in the binding.
438 #
439 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
440 # identifier) representing a Google group that has been recently
441 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
442 # the group is recovered, this value reverts to `group:{emailid}` and the
443 # recovered group retains the role in the binding.
444 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]445 #
446 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
447 # users of that domain. For example, `google.com` or `example.com`.
448 #
449 "A String",
450 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]451 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]452 # NOTE: An unsatisfied condition will not allow user access via current
453 # binding. Different bindings, including their conditions, are examined
454 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]455 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
456 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]457 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]458 # Example (Comparison):
459 #
460 # title: "Summary size limit"
461 # description: "Determines if a summary is less than 100 chars"
462 # expression: "document.summary.size() &lt; 100"
463 #
464 # Example (Equality):
465 #
466 # title: "Requestor is owner"
467 # description: "Determines if requestor is the document owner"
468 # expression: "document.owner == request.auth.claims.email"
469 #
470 # Example (Logic):
471 #
472 # title: "Public documents"
473 # description: "Determine whether the document should be publicly visible"
474 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
475 #
476 # Example (Data Manipulation):
477 #
478 # title: "Notification string"
479 # description: "Create a notification string with a timestamp."
480 # expression: "'New message received at ' + string(document.create_time)"
481 #
482 # The exact variables and functions that may be referenced within an expression
483 # are determined by the service that evaluates it. See the service
484 # documentation for additional information.
485 "location": "A String", # Optional. String indicating the location of the expression for error
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]486 # reporting, e.g. a file name and a position in the file.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]487 "expression": "A String", # Textual representation of an expression in Common Expression Language
488 # syntax.
489 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]490 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]491 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]492 # its purpose. This can be used e.g. in UIs which allow to enter the
493 # expression.
494 },
495 },
496 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]497 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
498 # prevent simultaneous updates of a policy from overwriting each other.
499 # It is strongly suggested that systems make use of the `etag` in the
500 # read-modify-write cycle to perform policy updates in order to avoid race
501 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
502 # systems are expected to put that etag in the request to `setIamPolicy` to
503 # ensure that their change will be applied to the same version of the policy.
504 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]505 # **Important:** If you use IAM Conditions, you must include the `etag` field
506 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
507 # you to overwrite a version `3` policy with a version `1` policy, and all of
508 # the conditions in the version `3` policy are lost.
509 "version": 42, # Specifies the format of the policy.
510 #
511 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
512 # are rejected.
513 #
514 # Any operation that affects conditional role bindings must specify version
515 # `3`. This requirement applies to the following operations:
516 #
517 # * Getting a policy that includes a conditional role binding
518 # * Adding a conditional role binding to a policy
519 # * Changing a conditional role binding in a policy
520 # * Removing any role binding, with or without a condition, from a policy
521 # that includes conditions
522 #
523 # **Important:** If you use IAM Conditions, you must include the `etag` field
524 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
525 # you to overwrite a version `3` policy with a version `1` policy, and all of
526 # the conditions in the version `3` policy are lost.
527 #
528 # If a policy does not include any conditions, operations on that policy may
529 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]530 },
531 }
532
533 x__xgafv: string, V1 error format.
534 Allowed values
535 1 - v1 error format
536 2 - v2 error format
537
538Returns:
539 An object of the form:
540
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]541 { # An Identity and Access Management (IAM) policy, which specifies access
542 # controls for Google Cloud resources.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]543 #
544 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]545 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
546 # `members` to a single `role`. Members can be user accounts, service accounts,
547 # Google groups, and domains (such as G Suite). A `role` is a named list of
548 # permissions; each `role` can be an IAM predefined role or a user-created
549 # custom role.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]550 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]551 # Optionally, a `binding` can specify a `condition`, which is a logical
552 # expression that allows access to a resource only if the expression evaluates
553 # to `true`. A condition can add constraints based on attributes of the
554 # request, the resource, or both.
555 #
556 # **JSON example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]557 #
558 # {
559 # "bindings": [
560 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]561 # "role": "roles/resourcemanager.organizationAdmin",
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]562 # "members": [
563 # "user:mike@example.com",
564 # "group:admins@example.com",
565 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]566 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]567 # ]
568 # },
569 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]570 # "role": "roles/resourcemanager.organizationViewer",
571 # "members": ["user:eve@example.com"],
572 # "condition": {
573 # "title": "expirable access",
574 # "description": "Does not grant access after Sep 2020",
575 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
576 # }
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]577 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]578 # ],
579 # "etag": "BwWWja0YfJA=",
580 # "version": 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]581 # }
582 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]583 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]584 #
585 # bindings:
586 # - members:
587 # - user:mike@example.com
588 # - group:admins@example.com
589 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]590 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
591 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]592 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]593 # - user:eve@example.com
594 # role: roles/resourcemanager.organizationViewer
595 # condition:
596 # title: expirable access
597 # description: Does not grant access after Sep 2020
598 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
599 # - etag: BwWWja0YfJA=
600 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]601 #
602 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]603 # [IAM documentation](https://cloud.google.com/iam/docs/).
604 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
605 # `condition` that determines how and when the `bindings` are applied. Each
606 # of the `bindings` must contain at least one member.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]607 { # Associates `members` with a `role`.
608 "role": "A String", # Role that is assigned to `members`.
609 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
610 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
611 # `members` can have the following values:
612 #
613 # * `allUsers`: A special identifier that represents anyone who is
614 # on the internet; with or without a Google account.
615 #
616 # * `allAuthenticatedUsers`: A special identifier that represents anyone
617 # who is authenticated with a Google account or a service account.
618 #
619 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]620 # account. For example, `alice@example.com` .
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]621 #
622 #
623 # * `serviceAccount:{emailid}`: An email address that represents a service
624 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
625 #
626 # * `group:{emailid}`: An email address that represents a Google group.
627 # For example, `admins@example.com`.
628 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]629 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
630 # identifier) representing a user that has been recently deleted. For
631 # example, `alice@example.com?uid=123456789012345678901`. If the user is
632 # recovered, this value reverts to `user:{emailid}` and the recovered user
633 # retains the role in the binding.
634 #
635 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
636 # unique identifier) representing a service account that has been recently
637 # deleted. For example,
638 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
639 # If the service account is undeleted, this value reverts to
640 # `serviceAccount:{emailid}` and the undeleted service account retains the
641 # role in the binding.
642 #
643 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
644 # identifier) representing a Google group that has been recently
645 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
646 # the group is recovered, this value reverts to `group:{emailid}` and the
647 # recovered group retains the role in the binding.
648 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]649 #
650 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
651 # users of that domain. For example, `google.com` or `example.com`.
652 #
653 "A String",
654 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]655 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]656 # NOTE: An unsatisfied condition will not allow user access via current
657 # binding. Different bindings, including their conditions, are examined
658 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]659 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
660 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]661 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]662 # Example (Comparison):
663 #
664 # title: "Summary size limit"
665 # description: "Determines if a summary is less than 100 chars"
666 # expression: "document.summary.size() &lt; 100"
667 #
668 # Example (Equality):
669 #
670 # title: "Requestor is owner"
671 # description: "Determines if requestor is the document owner"
672 # expression: "document.owner == request.auth.claims.email"
673 #
674 # Example (Logic):
675 #
676 # title: "Public documents"
677 # description: "Determine whether the document should be publicly visible"
678 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
679 #
680 # Example (Data Manipulation):
681 #
682 # title: "Notification string"
683 # description: "Create a notification string with a timestamp."
684 # expression: "'New message received at ' + string(document.create_time)"
685 #
686 # The exact variables and functions that may be referenced within an expression
687 # are determined by the service that evaluates it. See the service
688 # documentation for additional information.
689 "location": "A String", # Optional. String indicating the location of the expression for error
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]690 # reporting, e.g. a file name and a position in the file.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]691 "expression": "A String", # Textual representation of an expression in Common Expression Language
692 # syntax.
693 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]694 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]695 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]696 # its purpose. This can be used e.g. in UIs which allow to enter the
697 # expression.
698 },
699 },
700 ],
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]701 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
702 # prevent simultaneous updates of a policy from overwriting each other.
703 # It is strongly suggested that systems make use of the `etag` in the
704 # read-modify-write cycle to perform policy updates in order to avoid race
705 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
706 # systems are expected to put that etag in the request to `setIamPolicy` to
707 # ensure that their change will be applied to the same version of the policy.
708 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]709 # **Important:** If you use IAM Conditions, you must include the `etag` field
710 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
711 # you to overwrite a version `3` policy with a version `1` policy, and all of
712 # the conditions in the version `3` policy are lost.
713 "version": 42, # Specifies the format of the policy.
714 #
715 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
716 # are rejected.
717 #
718 # Any operation that affects conditional role bindings must specify version
719 # `3`. This requirement applies to the following operations:
720 #
721 # * Getting a policy that includes a conditional role binding
722 # * Adding a conditional role binding to a policy
723 # * Changing a conditional role binding in a policy
724 # * Removing any role binding, with or without a condition, from a policy
725 # that includes conditions
726 #
727 # **Important:** If you use IAM Conditions, you must include the `etag` field
728 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
729 # you to overwrite a version `3` policy with a version `1` policy, and all of
730 # the conditions in the version `3` policy are lost.
731 #
732 # If a policy does not include any conditions, operations on that policy may
733 # specify any valid version or leave the field unset.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]734 }</pre>
735</div>
736
737<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]738 <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]739 <pre>Returns permissions that a caller has on the specified resource.
740If the resource does not exist, this will return an empty set of
741permissions, not a NOT_FOUND error.
742
743Args:
744 resource: string, REQUIRED: The resource for which the policy detail is being requested.
745See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]746 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]747 The object takes the form of:
748
749{ # Request message for `TestIamPermissions` method.
750 "permissions": [ # The set of permissions to check for the `resource`. Permissions with
751 # wildcards (such as '*' or 'storage.*') are not allowed. For more
752 # information see
753 # [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
754 "A String",
755 ],
756 }
757
758 x__xgafv: string, V1 error format.
759 Allowed values
760 1 - v1 error format
761 2 - v2 error format
762
763Returns:
764 An object of the form:
765
766 { # Response message for `TestIamPermissions` method.
767 "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is
768 # allowed.
769 "A String",
770 ],
771 }</pre>
772</div>
773
774</body></html>