Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / dd49464a6262c0d1f71efcf11f131e2f591fe5f6 / . / docs / dyn / iam_v1.projects.serviceAccounts.html
blob: 1ae6a327c45bef34b526abd1b1847c1d590ee792 [file] [log] [blame]
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]75<h1><a href="iam_v1.html">Identity and Access Management (IAM) API</a> . <a href="iam_v1.projects.html">projects</a> . <a href="iam_v1.projects.serviceAccounts.html">serviceAccounts</a></h1>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]76<h2>Instance Methods</h2>
77<p class="toc_element">
78 <code><a href="iam_v1.projects.serviceAccounts.keys.html">keys()</a></code>
79</p>
80<p class="firstline">Returns the keys Resource.</p>
81
82<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]83 <code><a href="#create">create(name, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]84<p class="firstline">Creates a ServiceAccount</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]85<p class="toc_element">
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]86 <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]87<p class="firstline">Deletes a ServiceAccount.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]88<p class="toc_element">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]89 <code><a href="#disable">disable(name, body=None, x__xgafv=None)</a></code></p>
90<p class="firstline">DisableServiceAccount is currently in the alpha launch stage.</p>
91<p class="toc_element">
92 <code><a href="#enable">enable(name, body=None, x__xgafv=None)</a></code></p>
93<p class="firstline">EnableServiceAccount is currently in the alpha launch stage.</p>
94<p class="toc_element">
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]95 <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]96<p class="firstline">Gets a ServiceAccount.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]97<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]98 <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]99<p class="firstline">Returns the Cloud IAM access control policy for a</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]100<p class="toc_element">
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]101 <code><a href="#list">list(name, pageToken=None, x__xgafv=None, pageSize=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]102<p class="firstline">Lists ServiceAccounts for a project.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]103<p class="toc_element">
104 <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
105<p class="firstline">Retrieves the next page of results.</p>
106<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]107 <code><a href="#patch">patch(name, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]108<p class="firstline">Patches a ServiceAccount.</p>
109<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]110 <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]111<p class="firstline">Sets the Cloud IAM access control policy for a</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]112<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]113 <code><a href="#signBlob">signBlob(name, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]114<p class="firstline">**Note**: This method is in the process of being deprecated. Call the</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]115<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]116 <code><a href="#signJwt">signJwt(name, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]117<p class="firstline">**Note**: This method is in the process of being deprecated. Call the</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]118<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]119 <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]120<p class="firstline">Tests the specified permissions against the IAM access control policy</p>
121<p class="toc_element">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]122 <code><a href="#undelete">undelete(name, body=None, x__xgafv=None)</a></code></p>
123<p class="firstline">Restores a deleted ServiceAccount.</p>
124<p class="toc_element">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]125 <code><a href="#update">update(name, body=None, x__xgafv=None)</a></code></p>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]126<p class="firstline">Note: This method is in the process of being deprecated. Use</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]127<h3>Method Details</h3>
128<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]129 <code class="details" id="create">create(name, body=None, x__xgafv=None)</code>
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]130 <pre>Creates a ServiceAccount
131and returns it.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]132
133Args:
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]134 name: string, Required. The resource name of the project associated with the service
135accounts, such as `projects/my-project-123`. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]136 body: object, The request body.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]137 The object takes the form of:
138
139{ # The service account create request.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]140 "serviceAccount": { # A service account in the Identity and Access Management API. # The ServiceAccount resource to
141 # create. Currently, only the following values are user assignable:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]142 # `display_name` and `description`.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]143 #
144 # To create a service account, specify the `project_id` and the `account_id`
145 # for the account. The `account_id` is unique within the project, and is used
146 # to generate the service account email address and a stable
147 # `unique_id`.
148 #
149 # If the account already exists, the account's resource name is returned
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]150 # in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller
151 # can use the name in other methods to access the account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]152 #
153 # All other methods can identify the service account using the format
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]154 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
155 # Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
156 # the account. The `ACCOUNT` value can be the `email` address or the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]157 # `unique_id` of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]158 "oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]159 # This is used in conjunction with the OAuth2 clientconfig API to make
160 # three legged OAuth2 (3LO) flows to access the data of Google users.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]161 "displayName": "A String", # Optional. A user-specified name for the service account.
162 # Must be less than or equal to 100 UTF-8 bytes.
163 "description": "A String", # Optional. A user-specified opaque description of the service account.
164 # Must be less than or equal to 256 UTF-8 bytes.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]165 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]166 "disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.
167 # The field is currently in alpha phase.
168 "etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned
169 # for backwards compatibility.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]170 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
171 "email": "A String", # @OutputOnly The email address of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]172 "name": "A String", # The resource name of the service account in the following format:
173 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
174 #
175 # Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
176 # project from the `account` and the `ACCOUNT` value can be the `email`
177 # address or the `unique_id` of the service account.
178 #
179 # In responses the resource name will always be in the format
180 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]181 },
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]182 "accountId": "A String", # Required. The account id that is used to generate the service account
183 # email address and a stable unique id. It is unique within a project,
184 # must be 6-30 characters long, and match the regular expression
185 # `[a-z]([-a-z0-9]*[a-z0-9])` to comply with RFC1035.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]186 }
187
188 x__xgafv: string, V1 error format.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]189 Allowed values
190 1 - v1 error format
191 2 - v2 error format
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]192
193Returns:
194 An object of the form:
195
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]196 { # A service account in the Identity and Access Management API.
197 #
198 # To create a service account, specify the `project_id` and the `account_id`
199 # for the account. The `account_id` is unique within the project, and is used
200 # to generate the service account email address and a stable
201 # `unique_id`.
202 #
203 # If the account already exists, the account's resource name is returned
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]204 # in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller
205 # can use the name in other methods to access the account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]206 #
207 # All other methods can identify the service account using the format
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]208 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
209 # Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
210 # the account. The `ACCOUNT` value can be the `email` address or the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]211 # `unique_id` of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]212 "oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]213 # This is used in conjunction with the OAuth2 clientconfig API to make
214 # three legged OAuth2 (3LO) flows to access the data of Google users.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]215 "displayName": "A String", # Optional. A user-specified name for the service account.
216 # Must be less than or equal to 100 UTF-8 bytes.
217 "description": "A String", # Optional. A user-specified opaque description of the service account.
218 # Must be less than or equal to 256 UTF-8 bytes.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]219 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]220 "disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.
221 # The field is currently in alpha phase.
222 "etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned
223 # for backwards compatibility.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]224 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
225 "email": "A String", # @OutputOnly The email address of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]226 "name": "A String", # The resource name of the service account in the following format:
227 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
228 #
229 # Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
230 # project from the `account` and the `ACCOUNT` value can be the `email`
231 # address or the `unique_id` of the service account.
232 #
233 # In responses the resource name will always be in the format
234 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]235 }</pre>
236</div>
237
238<div class="method">
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]239 <code class="details" id="delete">delete(name, x__xgafv=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]240 <pre>Deletes a ServiceAccount.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]241
242Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]243 name: string, Required. The resource name of the service account in the following format:
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]244`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
245Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
246the account. The `ACCOUNT` value can be the `email` address or the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]247`unique_id` of the service account. (required)
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]248 x__xgafv: string, V1 error format.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]249 Allowed values
250 1 - v1 error format
251 2 - v2 error format
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]252
253Returns:
254 An object of the form:
255
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]256 { # A generic empty message that you can re-use to avoid defining duplicated
257 # empty messages in your APIs. A typical example is to use it as the request
258 # or the response type of an API method. For instance:
259 #
260 # service Foo {
261 # rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
262 # }
263 #
264 # The JSON representation for `Empty` is empty JSON object `{}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]265 }</pre>
266</div>
267
268<div class="method">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]269 <code class="details" id="disable">disable(name, body=None, x__xgafv=None)</code>
270 <pre>DisableServiceAccount is currently in the alpha launch stage.
271
272Disables a ServiceAccount,
273which immediately prevents the service account from authenticating and
274gaining access to APIs.
275
276Disabled service accounts can be safely restored by using
277EnableServiceAccount at any point. Deleted service accounts cannot be
278restored using this method.
279
280Disabling a service account that is bound to VMs, Apps, Functions, or
281other jobs will cause those jobs to lose access to resources if they are
282using the disabled service account.
283
284To improve reliability of your services and avoid unexpected outages, it
285is recommended to first disable a service account rather than delete it.
286After disabling the service account, wait at least 24 hours to verify there
287are no unintended consequences, and then delete the service account.
288
289Args:
290 name: string, The resource name of the service account in the following format:
291`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
292Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
293the account. The `ACCOUNT` value can be the `email` address or the
294`unique_id` of the service account. (required)
295 body: object, The request body.
296 The object takes the form of:
297
298{ # The service account disable request.
299 }
300
301 x__xgafv: string, V1 error format.
302 Allowed values
303 1 - v1 error format
304 2 - v2 error format
305
306Returns:
307 An object of the form:
308
309 { # A generic empty message that you can re-use to avoid defining duplicated
310 # empty messages in your APIs. A typical example is to use it as the request
311 # or the response type of an API method. For instance:
312 #
313 # service Foo {
314 # rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
315 # }
316 #
317 # The JSON representation for `Empty` is empty JSON object `{}`.
318 }</pre>
319</div>
320
321<div class="method">
322 <code class="details" id="enable">enable(name, body=None, x__xgafv=None)</code>
323 <pre>EnableServiceAccount is currently in the alpha launch stage.
324
325 Restores a disabled ServiceAccount
326 that has been manually disabled by using DisableServiceAccount. Service
327 accounts that have been disabled by other means or for other reasons,
328 such as abuse, cannot be restored using this method.
329
330 EnableServiceAccount will have no effect on a service account that is
331 not disabled. Enabling an already enabled service account will have no
332 effect.
333
334Args:
335 name: string, The resource name of the service account in the following format:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]336`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]337Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]338the account. The `ACCOUNT` value can be the `email` address or the
339`unique_id` of the service account. (required)
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]340 body: object, The request body.
341 The object takes the form of:
342
343{ # The service account enable request.
344 }
345
346 x__xgafv: string, V1 error format.
347 Allowed values
348 1 - v1 error format
349 2 - v2 error format
350
351Returns:
352 An object of the form:
353
354 { # A generic empty message that you can re-use to avoid defining duplicated
355 # empty messages in your APIs. A typical example is to use it as the request
356 # or the response type of an API method. For instance:
357 #
358 # service Foo {
359 # rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
360 # }
361 #
362 # The JSON representation for `Empty` is empty JSON object `{}`.
363 }</pre>
364</div>
365
366<div class="method">
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]367 <code class="details" id="get">get(name, x__xgafv=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]368 <pre>Gets a ServiceAccount.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]369
370Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]371 name: string, Required. The resource name of the service account in the following format:
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]372`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
373Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
374the account. The `ACCOUNT` value can be the `email` address or the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]375`unique_id` of the service account. (required)
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]376 x__xgafv: string, V1 error format.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]377 Allowed values
378 1 - v1 error format
379 2 - v2 error format
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]380
381Returns:
382 An object of the form:
383
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]384 { # A service account in the Identity and Access Management API.
385 #
386 # To create a service account, specify the `project_id` and the `account_id`
387 # for the account. The `account_id` is unique within the project, and is used
388 # to generate the service account email address and a stable
389 # `unique_id`.
390 #
391 # If the account already exists, the account's resource name is returned
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]392 # in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller
393 # can use the name in other methods to access the account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]394 #
395 # All other methods can identify the service account using the format
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]396 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
397 # Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
398 # the account. The `ACCOUNT` value can be the `email` address or the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]399 # `unique_id` of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]400 "oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]401 # This is used in conjunction with the OAuth2 clientconfig API to make
402 # three legged OAuth2 (3LO) flows to access the data of Google users.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]403 "displayName": "A String", # Optional. A user-specified name for the service account.
404 # Must be less than or equal to 100 UTF-8 bytes.
405 "description": "A String", # Optional. A user-specified opaque description of the service account.
406 # Must be less than or equal to 256 UTF-8 bytes.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]407 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]408 "disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.
409 # The field is currently in alpha phase.
410 "etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned
411 # for backwards compatibility.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]412 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
413 "email": "A String", # @OutputOnly The email address of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]414 "name": "A String", # The resource name of the service account in the following format:
415 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
416 #
417 # Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
418 # project from the `account` and the `ACCOUNT` value can be the `email`
419 # address or the `unique_id` of the service account.
420 #
421 # In responses the resource name will always be in the format
422 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]423 }</pre>
424</div>
425
426<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]427 <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]428 <pre>Returns the Cloud IAM access control policy for a
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]429ServiceAccount.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]430
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]431Note: Service accounts are both
432[resources and
433identities](/iam/docs/service-accounts#service_account_permissions). This
434method treats the service account as a resource. It returns the Cloud IAM
435policy that reflects what members have access to the service account.
436
437This method does not return what resources the service account has access
438to. To see if a service account has access to a resource, call the
439`getIamPolicy` method on the target resource. For example, to view grants
440for a project, call the
441[projects.getIamPolicy](/resource-manager/reference/rest/v1/projects/getIamPolicy)
442method.
443
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]444Args:
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]445 resource: string, REQUIRED: The resource for which the policy is being requested.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]446See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]447 options_requestedPolicyVersion: integer, Optional. The policy format version to be returned.
448
449Valid values are 0, 1, and 3. Requests specifying an invalid value will be
450rejected.
451
452Requests for policies with any conditional bindings must specify version 3.
453Policies without any conditional bindings may specify any valid value or
454leave the field unset.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]455 x__xgafv: string, V1 error format.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]456 Allowed values
457 1 - v1 error format
458 2 - v2 error format
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]459
460Returns:
461 An object of the form:
462
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]463 { # An Identity and Access Management (IAM) policy, which specifies access
464 # controls for Google Cloud resources.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]465 #
466 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]467 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
468 # `members` to a single `role`. Members can be user accounts, service accounts,
469 # Google groups, and domains (such as G Suite). A `role` is a named list of
470 # permissions; each `role` can be an IAM predefined role or a user-created
471 # custom role.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]472 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]473 # Optionally, a `binding` can specify a `condition`, which is a logical
474 # expression that allows access to a resource only if the expression evaluates
475 # to `true`. A condition can add constraints based on attributes of the
476 # request, the resource, or both.
477 #
478 # **JSON example:**
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]479 #
480 # {
481 # "bindings": [
482 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]483 # "role": "roles/resourcemanager.organizationAdmin",
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]484 # "members": [
485 # "user:mike@example.com",
486 # "group:admins@example.com",
487 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]488 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]489 # ]
490 # },
491 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]492 # "role": "roles/resourcemanager.organizationViewer",
493 # "members": ["user:eve@example.com"],
494 # "condition": {
495 # "title": "expirable access",
496 # "description": "Does not grant access after Sep 2020",
497 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
498 # }
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]499 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]500 # ],
501 # "etag": "BwWWja0YfJA=",
502 # "version": 3
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]503 # }
504 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]505 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]506 #
507 # bindings:
508 # - members:
509 # - user:mike@example.com
510 # - group:admins@example.com
511 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]512 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
513 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]514 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]515 # - user:eve@example.com
516 # role: roles/resourcemanager.organizationViewer
517 # condition:
518 # title: expirable access
519 # description: Does not grant access after Sep 2020
520 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
521 # - etag: BwWWja0YfJA=
522 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]523 #
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]524 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]525 # [IAM documentation](https://cloud.google.com/iam/docs/).
526 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
527 # `condition` that determines how and when the `bindings` are applied. Each
528 # of the `bindings` must contain at least one member.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]529 { # Associates `members` with a `role`.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]530 "role": "A String", # Role that is assigned to `members`.
531 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]532 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
533 # `members` can have the following values:
534 #
535 # * `allUsers`: A special identifier that represents anyone who is
536 # on the internet; with or without a Google account.
537 #
538 # * `allAuthenticatedUsers`: A special identifier that represents anyone
539 # who is authenticated with a Google account or a service account.
540 #
541 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]542 # account. For example, `alice@example.com` .
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]543 #
544 #
545 # * `serviceAccount:{emailid}`: An email address that represents a service
546 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
547 #
548 # * `group:{emailid}`: An email address that represents a Google group.
549 # For example, `admins@example.com`.
550 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]551 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
552 # identifier) representing a user that has been recently deleted. For
553 # example, `alice@example.com?uid=123456789012345678901`. If the user is
554 # recovered, this value reverts to `user:{emailid}` and the recovered user
555 # retains the role in the binding.
556 #
557 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
558 # unique identifier) representing a service account that has been recently
559 # deleted. For example,
560 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
561 # If the service account is undeleted, this value reverts to
562 # `serviceAccount:{emailid}` and the undeleted service account retains the
563 # role in the binding.
564 #
565 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
566 # identifier) representing a Google group that has been recently
567 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
568 # the group is recovered, this value reverts to `group:{emailid}` and the
569 # recovered group retains the role in the binding.
570 #
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]571 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]572 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]573 # users of that domain. For example, `google.com` or `example.com`.
574 #
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]575 "A String",
576 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]577 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]578 # NOTE: An unsatisfied condition will not allow user access via current
579 # binding. Different bindings, including their conditions, are examined
580 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]581 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
582 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]583 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]584 # Example (Comparison):
585 #
586 # title: "Summary size limit"
587 # description: "Determines if a summary is less than 100 chars"
588 # expression: "document.summary.size() &lt; 100"
589 #
590 # Example (Equality):
591 #
592 # title: "Requestor is owner"
593 # description: "Determines if requestor is the document owner"
594 # expression: "document.owner == request.auth.claims.email"
595 #
596 # Example (Logic):
597 #
598 # title: "Public documents"
599 # description: "Determine whether the document should be publicly visible"
600 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
601 #
602 # Example (Data Manipulation):
603 #
604 # title: "Notification string"
605 # description: "Create a notification string with a timestamp."
606 # expression: "'New message received at ' + string(document.create_time)"
607 #
608 # The exact variables and functions that may be referenced within an expression
609 # are determined by the service that evaluates it. See the service
610 # documentation for additional information.
611 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]612 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]613 "expression": "A String", # Textual representation of an expression in Common Expression Language
614 # syntax.
615 "location": "A String", # Optional. String indicating the location of the expression for error
616 # reporting, e.g. a file name and a position in the file.
617 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]618 # its purpose. This can be used e.g. in UIs which allow to enter the
619 # expression.
620 },
621 },
622 ],
623 "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
624 { # Specifies the audit configuration for a service.
625 # The configuration determines which permission types are logged, and what
626 # identities, if any, are exempted from logging.
627 # An AuditConfig must have one or more AuditLogConfigs.
628 #
629 # If there are AuditConfigs for both `allServices` and a specific service,
630 # the union of the two AuditConfigs is used for that service: the log_types
631 # specified in each AuditConfig are enabled, and the exempted_members in each
632 # AuditLogConfig are exempted.
633 #
634 # Example Policy with multiple AuditConfigs:
635 #
636 # {
637 # "audit_configs": [
638 # {
639 # "service": "allServices"
640 # "audit_log_configs": [
641 # {
642 # "log_type": "DATA_READ",
643 # "exempted_members": [
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]644 # "user:jose@example.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]645 # ]
646 # },
647 # {
648 # "log_type": "DATA_WRITE",
649 # },
650 # {
651 # "log_type": "ADMIN_READ",
652 # }
653 # ]
654 # },
655 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]656 # "service": "sampleservice.googleapis.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]657 # "audit_log_configs": [
658 # {
659 # "log_type": "DATA_READ",
660 # },
661 # {
662 # "log_type": "DATA_WRITE",
663 # "exempted_members": [
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]664 # "user:aliya@example.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]665 # ]
666 # }
667 # ]
668 # }
669 # ]
670 # }
671 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]672 # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
673 # logging. It also exempts jose@example.com from DATA_READ logging, and
674 # aliya@example.com from DATA_WRITE logging.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]675 "auditLogConfigs": [ # The configuration for logging of each type of permission.
676 { # Provides the configuration for logging a type of permissions.
677 # Example:
678 #
679 # {
680 # "audit_log_configs": [
681 # {
682 # "log_type": "DATA_READ",
683 # "exempted_members": [
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]684 # "user:jose@example.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]685 # ]
686 # },
687 # {
688 # "log_type": "DATA_WRITE",
689 # }
690 # ]
691 # }
692 #
693 # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]694 # jose@example.com from DATA_READ logging.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]695 "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of
696 # permission.
697 # Follows the same format of Binding.members.
698 "A String",
699 ],
700 "logType": "A String", # The log type that this config enables.
701 },
702 ],
703 "service": "A String", # Specifies a service that will be enabled for audit logging.
704 # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
705 # `allServices` is a special value that covers all services.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]706 },
707 ],
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]708 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
709 # prevent simultaneous updates of a policy from overwriting each other.
710 # It is strongly suggested that systems make use of the `etag` in the
711 # read-modify-write cycle to perform policy updates in order to avoid race
712 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
713 # systems are expected to put that etag in the request to `setIamPolicy` to
714 # ensure that their change will be applied to the same version of the policy.
715 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]716 # **Important:** If you use IAM Conditions, you must include the `etag` field
717 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
718 # you to overwrite a version `3` policy with a version `1` policy, and all of
719 # the conditions in the version `3` policy are lost.
720 "version": 42, # Specifies the format of the policy.
721 #
722 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
723 # are rejected.
724 #
725 # Any operation that affects conditional role bindings must specify version
726 # `3`. This requirement applies to the following operations:
727 #
728 # * Getting a policy that includes a conditional role binding
729 # * Adding a conditional role binding to a policy
730 # * Changing a conditional role binding in a policy
731 # * Removing any role binding, with or without a condition, from a policy
732 # that includes conditions
733 #
734 # **Important:** If you use IAM Conditions, you must include the `etag` field
735 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
736 # you to overwrite a version `3` policy with a version `1` policy, and all of
737 # the conditions in the version `3` policy are lost.
738 #
739 # If a policy does not include any conditions, operations on that policy may
740 # specify any valid version or leave the field unset.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]741 }</pre>
742</div>
743
744<div class="method">
Thomas Coffee2f245372017-03-27 10:39:26 -0700[diff] [blame]745 <code class="details" id="list">list(name, pageToken=None, x__xgafv=None, pageSize=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]746 <pre>Lists ServiceAccounts for a project.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]747
748Args:
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]749 name: string, Required. The resource name of the project associated with the service
750accounts, such as `projects/my-project-123`. (required)
751 pageToken: string, Optional pagination token returned in an earlier
752ListServiceAccountsResponse.next_page_token.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]753 x__xgafv: string, V1 error format.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]754 Allowed values
755 1 - v1 error format
756 2 - v2 error format
757 pageSize: integer, Optional limit on the number of service accounts to include in the
758response. Further accounts can subsequently be obtained by including the
759ListServiceAccountsResponse.next_page_token
760in a subsequent request.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]761
762Returns:
763 An object of the form:
764
765 { # The service account list response.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]766 "nextPageToken": "A String", # To retrieve the next page of results, set
767 # ListServiceAccountsRequest.page_token
768 # to this value.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]769 "accounts": [ # The list of matching service accounts.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]770 { # A service account in the Identity and Access Management API.
771 #
772 # To create a service account, specify the `project_id` and the `account_id`
773 # for the account. The `account_id` is unique within the project, and is used
774 # to generate the service account email address and a stable
775 # `unique_id`.
776 #
777 # If the account already exists, the account's resource name is returned
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]778 # in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller
779 # can use the name in other methods to access the account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]780 #
781 # All other methods can identify the service account using the format
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]782 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
783 # Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
784 # the account. The `ACCOUNT` value can be the `email` address or the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]785 # `unique_id` of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]786 "oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]787 # This is used in conjunction with the OAuth2 clientconfig API to make
788 # three legged OAuth2 (3LO) flows to access the data of Google users.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]789 "displayName": "A String", # Optional. A user-specified name for the service account.
790 # Must be less than or equal to 100 UTF-8 bytes.
791 "description": "A String", # Optional. A user-specified opaque description of the service account.
792 # Must be less than or equal to 256 UTF-8 bytes.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]793 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]794 "disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.
795 # The field is currently in alpha phase.
796 "etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned
797 # for backwards compatibility.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]798 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
799 "email": "A String", # @OutputOnly The email address of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]800 "name": "A String", # The resource name of the service account in the following format:
801 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
802 #
803 # Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
804 # project from the `account` and the `ACCOUNT` value can be the `email`
805 # address or the `unique_id` of the service account.
806 #
807 # In responses the resource name will always be in the format
808 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]809 },
810 ],
811 }</pre>
812</div>
813
814<div class="method">
815 <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
816 <pre>Retrieves the next page of results.
817
818Args:
819 previous_request: The request for the previous page. (required)
820 previous_response: The response from the request for the previous page. (required)
821
822Returns:
823 A request object that you can call 'execute()' on to request the next
824 page. Returns None if there are no more items in the collection.
825 </pre>
826</div>
827
828<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]829 <code class="details" id="patch">patch(name, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]830 <pre>Patches a ServiceAccount.
831
832Currently, only the following fields are updatable:
833`display_name` and `description`.
834
835Only fields specified in the request are guaranteed to be returned in
836the response. Other fields in the response may be empty.
837
838Note: The field mask is required.
839
840Args:
841 name: string, The resource name of the service account in the following format:
842`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
843
844Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
845project from the `account` and the `ACCOUNT` value can be the `email`
846address or the `unique_id` of the service account.
847
848In responses the resource name will always be in the format
849`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]850 body: object, The request body.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]851 The object takes the form of:
852
853{ # The patch service account request.
854 "serviceAccount": { # A service account in the Identity and Access Management API.
855 #
856 # To create a service account, specify the `project_id` and the `account_id`
857 # for the account. The `account_id` is unique within the project, and is used
858 # to generate the service account email address and a stable
859 # `unique_id`.
860 #
861 # If the account already exists, the account's resource name is returned
862 # in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller
863 # can use the name in other methods to access the account.
864 #
865 # All other methods can identify the service account using the format
866 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
867 # Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
868 # the account. The `ACCOUNT` value can be the `email` address or the
869 # `unique_id` of the service account.
870 "oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.
871 # This is used in conjunction with the OAuth2 clientconfig API to make
872 # three legged OAuth2 (3LO) flows to access the data of Google users.
873 "displayName": "A String", # Optional. A user-specified name for the service account.
874 # Must be less than or equal to 100 UTF-8 bytes.
875 "description": "A String", # Optional. A user-specified opaque description of the service account.
876 # Must be less than or equal to 256 UTF-8 bytes.
877 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
878 "disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.
879 # The field is currently in alpha phase.
880 "etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned
881 # for backwards compatibility.
882 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
883 "email": "A String", # @OutputOnly The email address of the service account.
884 "name": "A String", # The resource name of the service account in the following format:
885 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
886 #
887 # Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
888 # project from the `account` and the `ACCOUNT` value can be the `email`
889 # address or the `unique_id` of the service account.
890 #
891 # In responses the resource name will always be in the format
892 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
893 },
894 "updateMask": "A String",
895 }
896
897 x__xgafv: string, V1 error format.
898 Allowed values
899 1 - v1 error format
900 2 - v2 error format
901
902Returns:
903 An object of the form:
904
905 { # A service account in the Identity and Access Management API.
906 #
907 # To create a service account, specify the `project_id` and the `account_id`
908 # for the account. The `account_id` is unique within the project, and is used
909 # to generate the service account email address and a stable
910 # `unique_id`.
911 #
912 # If the account already exists, the account's resource name is returned
913 # in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller
914 # can use the name in other methods to access the account.
915 #
916 # All other methods can identify the service account using the format
917 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
918 # Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
919 # the account. The `ACCOUNT` value can be the `email` address or the
920 # `unique_id` of the service account.
921 "oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.
922 # This is used in conjunction with the OAuth2 clientconfig API to make
923 # three legged OAuth2 (3LO) flows to access the data of Google users.
924 "displayName": "A String", # Optional. A user-specified name for the service account.
925 # Must be less than or equal to 100 UTF-8 bytes.
926 "description": "A String", # Optional. A user-specified opaque description of the service account.
927 # Must be less than or equal to 256 UTF-8 bytes.
928 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
929 "disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.
930 # The field is currently in alpha phase.
931 "etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned
932 # for backwards compatibility.
933 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
934 "email": "A String", # @OutputOnly The email address of the service account.
935 "name": "A String", # The resource name of the service account in the following format:
936 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
937 #
938 # Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
939 # project from the `account` and the `ACCOUNT` value can be the `email`
940 # address or the `unique_id` of the service account.
941 #
942 # In responses the resource name will always be in the format
943 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
944 }</pre>
945</div>
946
947<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]948 <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]949 <pre>Sets the Cloud IAM access control policy for a
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]950ServiceAccount.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]951
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]952Note: Service accounts are both
953[resources and
954identities](/iam/docs/service-accounts#service_account_permissions). This
955method treats the service account as a resource. Use it to grant members
956access to the service account, such as when they need to impersonate it.
957
958This method does not grant the service account access to other resources,
959such as projects. To grant a service account access to resources, include
960the service account in the Cloud IAM policy for the desired resource, then
961call the appropriate `setIamPolicy` method on the target resource. For
962example, to grant a service account access to a project, call the
963[projects.setIamPolicy](/resource-manager/reference/rest/v1/projects/setIamPolicy)
964method.
965
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]966Args:
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]967 resource: string, REQUIRED: The resource for which the policy is being specified.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]968See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]969 body: object, The request body.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]970 The object takes the form of:
971
972{ # Request message for `SetIamPolicy` method.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]973 "policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]974 # the policy is limited to a few 10s of KB. An empty policy is a
975 # valid policy but certain Cloud Platform services (such as Projects)
976 # might reject them.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]977 # controls for Google Cloud resources.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]978 #
979 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]980 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
981 # `members` to a single `role`. Members can be user accounts, service accounts,
982 # Google groups, and domains (such as G Suite). A `role` is a named list of
983 # permissions; each `role` can be an IAM predefined role or a user-created
984 # custom role.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]985 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]986 # Optionally, a `binding` can specify a `condition`, which is a logical
987 # expression that allows access to a resource only if the expression evaluates
988 # to `true`. A condition can add constraints based on attributes of the
989 # request, the resource, or both.
990 #
991 # **JSON example:**
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]992 #
993 # {
994 # "bindings": [
995 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]996 # "role": "roles/resourcemanager.organizationAdmin",
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]997 # "members": [
998 # "user:mike@example.com",
999 # "group:admins@example.com",
1000 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1001 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1002 # ]
1003 # },
1004 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1005 # "role": "roles/resourcemanager.organizationViewer",
1006 # "members": ["user:eve@example.com"],
1007 # "condition": {
1008 # "title": "expirable access",
1009 # "description": "Does not grant access after Sep 2020",
1010 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
1011 # }
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1012 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1013 # ],
1014 # "etag": "BwWWja0YfJA=",
1015 # "version": 3
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1016 # }
1017 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1018 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1019 #
1020 # bindings:
1021 # - members:
1022 # - user:mike@example.com
1023 # - group:admins@example.com
1024 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1025 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
1026 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1027 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1028 # - user:eve@example.com
1029 # role: roles/resourcemanager.organizationViewer
1030 # condition:
1031 # title: expirable access
1032 # description: Does not grant access after Sep 2020
1033 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
1034 # - etag: BwWWja0YfJA=
1035 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1036 #
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1037 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1038 # [IAM documentation](https://cloud.google.com/iam/docs/).
1039 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
1040 # `condition` that determines how and when the `bindings` are applied. Each
1041 # of the `bindings` must contain at least one member.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1042 { # Associates `members` with a `role`.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1043 "role": "A String", # Role that is assigned to `members`.
1044 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1045 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
1046 # `members` can have the following values:
1047 #
1048 # * `allUsers`: A special identifier that represents anyone who is
1049 # on the internet; with or without a Google account.
1050 #
1051 # * `allAuthenticatedUsers`: A special identifier that represents anyone
1052 # who is authenticated with a Google account or a service account.
1053 #
1054 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1055 # account. For example, `alice@example.com` .
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1056 #
1057 #
1058 # * `serviceAccount:{emailid}`: An email address that represents a service
1059 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
1060 #
1061 # * `group:{emailid}`: An email address that represents a Google group.
1062 # For example, `admins@example.com`.
1063 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1064 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
1065 # identifier) representing a user that has been recently deleted. For
1066 # example, `alice@example.com?uid=123456789012345678901`. If the user is
1067 # recovered, this value reverts to `user:{emailid}` and the recovered user
1068 # retains the role in the binding.
1069 #
1070 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
1071 # unique identifier) representing a service account that has been recently
1072 # deleted. For example,
1073 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
1074 # If the service account is undeleted, this value reverts to
1075 # `serviceAccount:{emailid}` and the undeleted service account retains the
1076 # role in the binding.
1077 #
1078 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
1079 # identifier) representing a Google group that has been recently
1080 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
1081 # the group is recovered, this value reverts to `group:{emailid}` and the
1082 # recovered group retains the role in the binding.
1083 #
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]1084 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1085 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1086 # users of that domain. For example, `google.com` or `example.com`.
1087 #
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1088 "A String",
1089 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1090 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1091 # NOTE: An unsatisfied condition will not allow user access via current
1092 # binding. Different bindings, including their conditions, are examined
1093 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1094 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
1095 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1096 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1097 # Example (Comparison):
1098 #
1099 # title: "Summary size limit"
1100 # description: "Determines if a summary is less than 100 chars"
1101 # expression: "document.summary.size() &lt; 100"
1102 #
1103 # Example (Equality):
1104 #
1105 # title: "Requestor is owner"
1106 # description: "Determines if requestor is the document owner"
1107 # expression: "document.owner == request.auth.claims.email"
1108 #
1109 # Example (Logic):
1110 #
1111 # title: "Public documents"
1112 # description: "Determine whether the document should be publicly visible"
1113 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
1114 #
1115 # Example (Data Manipulation):
1116 #
1117 # title: "Notification string"
1118 # description: "Create a notification string with a timestamp."
1119 # expression: "'New message received at ' + string(document.create_time)"
1120 #
1121 # The exact variables and functions that may be referenced within an expression
1122 # are determined by the service that evaluates it. See the service
1123 # documentation for additional information.
1124 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1125 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1126 "expression": "A String", # Textual representation of an expression in Common Expression Language
1127 # syntax.
1128 "location": "A String", # Optional. String indicating the location of the expression for error
1129 # reporting, e.g. a file name and a position in the file.
1130 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1131 # its purpose. This can be used e.g. in UIs which allow to enter the
1132 # expression.
1133 },
1134 },
1135 ],
1136 "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
1137 { # Specifies the audit configuration for a service.
1138 # The configuration determines which permission types are logged, and what
1139 # identities, if any, are exempted from logging.
1140 # An AuditConfig must have one or more AuditLogConfigs.
1141 #
1142 # If there are AuditConfigs for both `allServices` and a specific service,
1143 # the union of the two AuditConfigs is used for that service: the log_types
1144 # specified in each AuditConfig are enabled, and the exempted_members in each
1145 # AuditLogConfig are exempted.
1146 #
1147 # Example Policy with multiple AuditConfigs:
1148 #
1149 # {
1150 # "audit_configs": [
1151 # {
1152 # "service": "allServices"
1153 # "audit_log_configs": [
1154 # {
1155 # "log_type": "DATA_READ",
1156 # "exempted_members": [
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1157 # "user:jose@example.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1158 # ]
1159 # },
1160 # {
1161 # "log_type": "DATA_WRITE",
1162 # },
1163 # {
1164 # "log_type": "ADMIN_READ",
1165 # }
1166 # ]
1167 # },
1168 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1169 # "service": "sampleservice.googleapis.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1170 # "audit_log_configs": [
1171 # {
1172 # "log_type": "DATA_READ",
1173 # },
1174 # {
1175 # "log_type": "DATA_WRITE",
1176 # "exempted_members": [
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1177 # "user:aliya@example.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1178 # ]
1179 # }
1180 # ]
1181 # }
1182 # ]
1183 # }
1184 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1185 # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
1186 # logging. It also exempts jose@example.com from DATA_READ logging, and
1187 # aliya@example.com from DATA_WRITE logging.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1188 "auditLogConfigs": [ # The configuration for logging of each type of permission.
1189 { # Provides the configuration for logging a type of permissions.
1190 # Example:
1191 #
1192 # {
1193 # "audit_log_configs": [
1194 # {
1195 # "log_type": "DATA_READ",
1196 # "exempted_members": [
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1197 # "user:jose@example.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1198 # ]
1199 # },
1200 # {
1201 # "log_type": "DATA_WRITE",
1202 # }
1203 # ]
1204 # }
1205 #
1206 # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1207 # jose@example.com from DATA_READ logging.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1208 "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of
1209 # permission.
1210 # Follows the same format of Binding.members.
1211 "A String",
1212 ],
1213 "logType": "A String", # The log type that this config enables.
1214 },
1215 ],
1216 "service": "A String", # Specifies a service that will be enabled for audit logging.
1217 # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
1218 # `allServices` is a special value that covers all services.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1219 },
1220 ],
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1221 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
1222 # prevent simultaneous updates of a policy from overwriting each other.
1223 # It is strongly suggested that systems make use of the `etag` in the
1224 # read-modify-write cycle to perform policy updates in order to avoid race
1225 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
1226 # systems are expected to put that etag in the request to `setIamPolicy` to
1227 # ensure that their change will be applied to the same version of the policy.
1228 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1229 # **Important:** If you use IAM Conditions, you must include the `etag` field
1230 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
1231 # you to overwrite a version `3` policy with a version `1` policy, and all of
1232 # the conditions in the version `3` policy are lost.
1233 "version": 42, # Specifies the format of the policy.
1234 #
1235 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
1236 # are rejected.
1237 #
1238 # Any operation that affects conditional role bindings must specify version
1239 # `3`. This requirement applies to the following operations:
1240 #
1241 # * Getting a policy that includes a conditional role binding
1242 # * Adding a conditional role binding to a policy
1243 # * Changing a conditional role binding in a policy
1244 # * Removing any role binding, with or without a condition, from a policy
1245 # that includes conditions
1246 #
1247 # **Important:** If you use IAM Conditions, you must include the `etag` field
1248 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
1249 # you to overwrite a version `3` policy with a version `1` policy, and all of
1250 # the conditions in the version `3` policy are lost.
1251 #
1252 # If a policy does not include any conditions, operations on that policy may
1253 # specify any valid version or leave the field unset.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1254 },
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1255 "updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
1256 # the fields in the mask will be modified. If no mask is provided, the
1257 # following default mask is used:
1258 # paths: "bindings, etag"
1259 # This field is only used by Cloud IAM.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1260 }
1261
1262 x__xgafv: string, V1 error format.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1263 Allowed values
1264 1 - v1 error format
1265 2 - v2 error format
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1266
1267Returns:
1268 An object of the form:
1269
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1270 { # An Identity and Access Management (IAM) policy, which specifies access
1271 # controls for Google Cloud resources.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1272 #
1273 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1274 # A `Policy` is a collection of `bindings`. A `binding` binds one or more
1275 # `members` to a single `role`. Members can be user accounts, service accounts,
1276 # Google groups, and domains (such as G Suite). A `role` is a named list of
1277 # permissions; each `role` can be an IAM predefined role or a user-created
1278 # custom role.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1279 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1280 # Optionally, a `binding` can specify a `condition`, which is a logical
1281 # expression that allows access to a resource only if the expression evaluates
1282 # to `true`. A condition can add constraints based on attributes of the
1283 # request, the resource, or both.
1284 #
1285 # **JSON example:**
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1286 #
1287 # {
1288 # "bindings": [
1289 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1290 # "role": "roles/resourcemanager.organizationAdmin",
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1291 # "members": [
1292 # "user:mike@example.com",
1293 # "group:admins@example.com",
1294 # "domain:google.com",
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1295 # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1296 # ]
1297 # },
1298 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1299 # "role": "roles/resourcemanager.organizationViewer",
1300 # "members": ["user:eve@example.com"],
1301 # "condition": {
1302 # "title": "expirable access",
1303 # "description": "Does not grant access after Sep 2020",
1304 # "expression": "request.time &lt; timestamp('2020-10-01T00:00:00.000Z')",
1305 # }
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1306 # }
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1307 # ],
1308 # "etag": "BwWWja0YfJA=",
1309 # "version": 3
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1310 # }
1311 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1312 # **YAML example:**
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1313 #
1314 # bindings:
1315 # - members:
1316 # - user:mike@example.com
1317 # - group:admins@example.com
1318 # - domain:google.com
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1319 # - serviceAccount:my-project-id@appspot.gserviceaccount.com
1320 # role: roles/resourcemanager.organizationAdmin
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1321 # - members:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1322 # - user:eve@example.com
1323 # role: roles/resourcemanager.organizationViewer
1324 # condition:
1325 # title: expirable access
1326 # description: Does not grant access after Sep 2020
1327 # expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
1328 # - etag: BwWWja0YfJA=
1329 # - version: 3
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1330 #
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1331 # For a description of IAM and its features, see the
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1332 # [IAM documentation](https://cloud.google.com/iam/docs/).
1333 "bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a
1334 # `condition` that determines how and when the `bindings` are applied. Each
1335 # of the `bindings` must contain at least one member.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1336 { # Associates `members` with a `role`.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1337 "role": "A String", # Role that is assigned to `members`.
1338 # For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1339 "members": [ # Specifies the identities requesting access for a Cloud Platform resource.
1340 # `members` can have the following values:
1341 #
1342 # * `allUsers`: A special identifier that represents anyone who is
1343 # on the internet; with or without a Google account.
1344 #
1345 # * `allAuthenticatedUsers`: A special identifier that represents anyone
1346 # who is authenticated with a Google account or a service account.
1347 #
1348 # * `user:{emailid}`: An email address that represents a specific Google
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1349 # account. For example, `alice@example.com` .
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1350 #
1351 #
1352 # * `serviceAccount:{emailid}`: An email address that represents a service
1353 # account. For example, `my-other-app@appspot.gserviceaccount.com`.
1354 #
1355 # * `group:{emailid}`: An email address that represents a Google group.
1356 # For example, `admins@example.com`.
1357 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1358 # * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
1359 # identifier) representing a user that has been recently deleted. For
1360 # example, `alice@example.com?uid=123456789012345678901`. If the user is
1361 # recovered, this value reverts to `user:{emailid}` and the recovered user
1362 # retains the role in the binding.
1363 #
1364 # * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
1365 # unique identifier) representing a service account that has been recently
1366 # deleted. For example,
1367 # `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
1368 # If the service account is undeleted, this value reverts to
1369 # `serviceAccount:{emailid}` and the undeleted service account retains the
1370 # role in the binding.
1371 #
1372 # * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
1373 # identifier) representing a Google group that has been recently
1374 # deleted. For example, `admins@example.com?uid=123456789012345678901`. If
1375 # the group is recovered, this value reverts to `group:{emailid}` and the
1376 # recovered group retains the role in the binding.
1377 #
Sai Cheemalapati4ba8c232017-06-06 18:46:08 -0400[diff] [blame]1378 #
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1379 # * `domain:{domain}`: The G Suite domain (primary) that represents all the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1380 # users of that domain. For example, `google.com` or `example.com`.
1381 #
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1382 "A String",
1383 ],
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1384 "condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1385 # NOTE: An unsatisfied condition will not allow user access via current
1386 # binding. Different bindings, including their conditions, are examined
1387 # independently.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1388 # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
1389 # are documented at https://github.com/google/cel-spec.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1390 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1391 # Example (Comparison):
1392 #
1393 # title: "Summary size limit"
1394 # description: "Determines if a summary is less than 100 chars"
1395 # expression: "document.summary.size() &lt; 100"
1396 #
1397 # Example (Equality):
1398 #
1399 # title: "Requestor is owner"
1400 # description: "Determines if requestor is the document owner"
1401 # expression: "document.owner == request.auth.claims.email"
1402 #
1403 # Example (Logic):
1404 #
1405 # title: "Public documents"
1406 # description: "Determine whether the document should be publicly visible"
1407 # expression: "document.type != 'private' &amp;&amp; document.type != 'internal'"
1408 #
1409 # Example (Data Manipulation):
1410 #
1411 # title: "Notification string"
1412 # description: "Create a notification string with a timestamp."
1413 # expression: "'New message received at ' + string(document.create_time)"
1414 #
1415 # The exact variables and functions that may be referenced within an expression
1416 # are determined by the service that evaluates it. See the service
1417 # documentation for additional information.
1418 "description": "A String", # Optional. Description of the expression. This is a longer text which
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1419 # describes the expression, e.g. when hovered over it in a UI.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1420 "expression": "A String", # Textual representation of an expression in Common Expression Language
1421 # syntax.
1422 "location": "A String", # Optional. String indicating the location of the expression for error
1423 # reporting, e.g. a file name and a position in the file.
1424 "title": "A String", # Optional. Title for the expression, i.e. a short string describing
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1425 # its purpose. This can be used e.g. in UIs which allow to enter the
1426 # expression.
1427 },
1428 },
1429 ],
1430 "auditConfigs": [ # Specifies cloud audit logging configuration for this policy.
1431 { # Specifies the audit configuration for a service.
1432 # The configuration determines which permission types are logged, and what
1433 # identities, if any, are exempted from logging.
1434 # An AuditConfig must have one or more AuditLogConfigs.
1435 #
1436 # If there are AuditConfigs for both `allServices` and a specific service,
1437 # the union of the two AuditConfigs is used for that service: the log_types
1438 # specified in each AuditConfig are enabled, and the exempted_members in each
1439 # AuditLogConfig are exempted.
1440 #
1441 # Example Policy with multiple AuditConfigs:
1442 #
1443 # {
1444 # "audit_configs": [
1445 # {
1446 # "service": "allServices"
1447 # "audit_log_configs": [
1448 # {
1449 # "log_type": "DATA_READ",
1450 # "exempted_members": [
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1451 # "user:jose@example.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1452 # ]
1453 # },
1454 # {
1455 # "log_type": "DATA_WRITE",
1456 # },
1457 # {
1458 # "log_type": "ADMIN_READ",
1459 # }
1460 # ]
1461 # },
1462 # {
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1463 # "service": "sampleservice.googleapis.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1464 # "audit_log_configs": [
1465 # {
1466 # "log_type": "DATA_READ",
1467 # },
1468 # {
1469 # "log_type": "DATA_WRITE",
1470 # "exempted_members": [
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1471 # "user:aliya@example.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1472 # ]
1473 # }
1474 # ]
1475 # }
1476 # ]
1477 # }
1478 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1479 # For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
1480 # logging. It also exempts jose@example.com from DATA_READ logging, and
1481 # aliya@example.com from DATA_WRITE logging.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1482 "auditLogConfigs": [ # The configuration for logging of each type of permission.
1483 { # Provides the configuration for logging a type of permissions.
1484 # Example:
1485 #
1486 # {
1487 # "audit_log_configs": [
1488 # {
1489 # "log_type": "DATA_READ",
1490 # "exempted_members": [
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1491 # "user:jose@example.com"
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1492 # ]
1493 # },
1494 # {
1495 # "log_type": "DATA_WRITE",
1496 # }
1497 # ]
1498 # }
1499 #
1500 # This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1501 # jose@example.com from DATA_READ logging.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1502 "exemptedMembers": [ # Specifies the identities that do not cause logging for this type of
1503 # permission.
1504 # Follows the same format of Binding.members.
1505 "A String",
1506 ],
1507 "logType": "A String", # The log type that this config enables.
1508 },
1509 ],
1510 "service": "A String", # Specifies a service that will be enabled for audit logging.
1511 # For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
1512 # `allServices` is a special value that covers all services.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1513 },
1514 ],
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1515 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help
1516 # prevent simultaneous updates of a policy from overwriting each other.
1517 # It is strongly suggested that systems make use of the `etag` in the
1518 # read-modify-write cycle to perform policy updates in order to avoid race
1519 # conditions: An `etag` is returned in the response to `getIamPolicy`, and
1520 # systems are expected to put that etag in the request to `setIamPolicy` to
1521 # ensure that their change will be applied to the same version of the policy.
1522 #
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1523 # **Important:** If you use IAM Conditions, you must include the `etag` field
1524 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
1525 # you to overwrite a version `3` policy with a version `1` policy, and all of
1526 # the conditions in the version `3` policy are lost.
1527 "version": 42, # Specifies the format of the policy.
1528 #
1529 # Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
1530 # are rejected.
1531 #
1532 # Any operation that affects conditional role bindings must specify version
1533 # `3`. This requirement applies to the following operations:
1534 #
1535 # * Getting a policy that includes a conditional role binding
1536 # * Adding a conditional role binding to a policy
1537 # * Changing a conditional role binding in a policy
1538 # * Removing any role binding, with or without a condition, from a policy
1539 # that includes conditions
1540 #
1541 # **Important:** If you use IAM Conditions, you must include the `etag` field
1542 # whenever you call `setIamPolicy`. If you omit this field, then IAM allows
1543 # you to overwrite a version `3` policy with a version `1` policy, and all of
1544 # the conditions in the version `3` policy are lost.
1545 #
1546 # If a policy does not include any conditions, operations on that policy may
1547 # specify any valid version or leave the field unset.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1548 }</pre>
1549</div>
1550
1551<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1552 <code class="details" id="signBlob">signBlob(name, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1553 <pre>**Note**: This method is in the process of being deprecated. Call the
1554[`signBlob()`](/iam/credentials/reference/rest/v1/projects.serviceAccounts/signBlob)
1555method of the Cloud IAM Service Account Credentials API instead.
1556
1557Signs a blob using a service account's system-managed private key.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1558
1559Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1560 name: string, Required. The resource name of the service account in the following format:
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1561`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
1562Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
1563the account. The `ACCOUNT` value can be the `email` address or the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1564`unique_id` of the service account. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1565 body: object, The request body.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1566 The object takes the form of:
1567
1568{ # The service account sign blob request.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1569 "bytesToSign": "A String", # Required. The bytes to sign.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1570 }
1571
1572 x__xgafv: string, V1 error format.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1573 Allowed values
1574 1 - v1 error format
1575 2 - v2 error format
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1576
1577Returns:
1578 An object of the form:
1579
1580 { # The service account sign blob response.
1581 "keyId": "A String", # The id of the key used to sign the blob.
1582 "signature": "A String", # The signed blob.
1583 }</pre>
1584</div>
1585
1586<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1587 <code class="details" id="signJwt">signJwt(name, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1588 <pre>**Note**: This method is in the process of being deprecated. Call the
1589[`signJwt()`](/iam/credentials/reference/rest/v1/projects.serviceAccounts/signJwt)
1590method of the Cloud IAM Service Account Credentials API instead.
1591
1592Signs a JWT using a service account's system-managed private key.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1593
1594If no expiry time (`exp`) is provided in the `SignJwtRequest`, IAM sets an
1595an expiry time of one hour by default. If you request an expiry time of
1596more than one hour, the request will fail.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1597
1598Args:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1599 name: string, Required. The resource name of the service account in the following format:
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1600`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
1601Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
1602the account. The `ACCOUNT` value can be the `email` address or the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1603`unique_id` of the service account. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1604 body: object, The request body.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1605 The object takes the form of:
1606
1607{ # The service account sign JWT request.
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1608 "payload": "A String", # Required. The JWT payload to sign, a JSON JWT Claim set.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1609 }
1610
1611 x__xgafv: string, V1 error format.
1612 Allowed values
1613 1 - v1 error format
1614 2 - v2 error format
1615
1616Returns:
1617 An object of the form:
1618
1619 { # The service account sign JWT response.
1620 "keyId": "A String", # The id of the key used to sign the JWT.
1621 "signedJwt": "A String", # The signed JWT.
1622 }</pre>
1623</div>
1624
1625<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1626 <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1627 <pre>Tests the specified permissions against the IAM access control policy
1628for a ServiceAccount.
1629
1630Args:
1631 resource: string, REQUIRED: The resource for which the policy detail is being requested.
Sai Cheemalapatie833b792017-03-24 15:06:46 -0700[diff] [blame]1632See the operation documentation for the appropriate value for this field. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1633 body: object, The request body.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1634 The object takes the form of:
1635
1636{ # Request message for `TestIamPermissions` method.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1637 "permissions": [ # The set of permissions to check for the `resource`. Permissions with
1638 # wildcards (such as '*' or 'storage.*') are not allowed. For more
1639 # information see
1640 # [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1641 "A String",
1642 ],
1643 }
1644
1645 x__xgafv: string, V1 error format.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1646 Allowed values
1647 1 - v1 error format
1648 2 - v2 error format
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1649
1650Returns:
1651 An object of the form:
1652
1653 { # Response message for `TestIamPermissions` method.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1654 "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is
1655 # allowed.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1656 "A String",
1657 ],
1658 }</pre>
1659</div>
1660
1661<div class="method">
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1662 <code class="details" id="undelete">undelete(name, body=None, x__xgafv=None)</code>
1663 <pre>Restores a deleted ServiceAccount.
1664This is to be used as an action of last resort. A service account may
1665not always be restorable.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1666
1667Args:
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1668 name: string, The resource name of the service account in the following format:
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1669`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT_UNIQUE_ID}`.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1670Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
1671the account. (required)
1672 body: object, The request body.
1673 The object takes the form of:
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1674
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1675{ # The service account undelete request.
1676 }
1677
1678 x__xgafv: string, V1 error format.
1679 Allowed values
1680 1 - v1 error format
1681 2 - v2 error format
1682
1683Returns:
1684 An object of the form:
1685
1686 {
1687 "restoredAccount": { # A service account in the Identity and Access Management API. # Metadata for the restored service account.
1688 #
1689 # To create a service account, specify the `project_id` and the `account_id`
1690 # for the account. The `account_id` is unique within the project, and is used
1691 # to generate the service account email address and a stable
1692 # `unique_id`.
1693 #
1694 # If the account already exists, the account's resource name is returned
1695 # in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller
1696 # can use the name in other methods to access the account.
1697 #
1698 # All other methods can identify the service account using the format
1699 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
1700 # Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
1701 # the account. The `ACCOUNT` value can be the `email` address or the
1702 # `unique_id` of the service account.
1703 "oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.
1704 # This is used in conjunction with the OAuth2 clientconfig API to make
1705 # three legged OAuth2 (3LO) flows to access the data of Google users.
1706 "displayName": "A String", # Optional. A user-specified name for the service account.
1707 # Must be less than or equal to 100 UTF-8 bytes.
1708 "description": "A String", # Optional. A user-specified opaque description of the service account.
1709 # Must be less than or equal to 256 UTF-8 bytes.
1710 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
1711 "disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.
1712 # The field is currently in alpha phase.
1713 "etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned
1714 # for backwards compatibility.
1715 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
1716 "email": "A String", # @OutputOnly The email address of the service account.
1717 "name": "A String", # The resource name of the service account in the following format:
1718 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
1719 #
1720 # Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
1721 # project from the `account` and the `ACCOUNT` value can be the `email`
1722 # address or the `unique_id` of the service account.
1723 #
1724 # In responses the resource name will always be in the format
1725 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
1726 },
1727 }</pre>
1728</div>
1729
1730<div class="method">
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1731 <code class="details" id="update">update(name, body=None, x__xgafv=None)</code>
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1732 <pre>Note: This method is in the process of being deprecated. Use
1733PatchServiceAccount instead.
1734
1735Updates a ServiceAccount.
1736
1737Currently, only the following fields are updatable:
1738`display_name` and `description`.
1739
1740Args:
1741 name: string, The resource name of the service account in the following format:
1742`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
1743
1744Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
1745project from the `account` and the `ACCOUNT` value can be the `email`
1746address or the `unique_id` of the service account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1747
1748In responses the resource name will always be in the format
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1749`projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. (required)
Dan O'Mearadd494642020-05-01 07:42:23 -0700[diff] [blame^]1750 body: object, The request body.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1751 The object takes the form of:
1752
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1753{ # A service account in the Identity and Access Management API.
1754 #
1755 # To create a service account, specify the `project_id` and the `account_id`
1756 # for the account. The `account_id` is unique within the project, and is used
1757 # to generate the service account email address and a stable
1758 # `unique_id`.
1759 #
1760 # If the account already exists, the account's resource name is returned
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1761 # in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller
1762 # can use the name in other methods to access the account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1763 #
1764 # All other methods can identify the service account using the format
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1765 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
1766 # Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
1767 # the account. The `ACCOUNT` value can be the `email` address or the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1768 # `unique_id` of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1769 "oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1770 # This is used in conjunction with the OAuth2 clientconfig API to make
1771 # three legged OAuth2 (3LO) flows to access the data of Google users.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1772 "displayName": "A String", # Optional. A user-specified name for the service account.
1773 # Must be less than or equal to 100 UTF-8 bytes.
1774 "description": "A String", # Optional. A user-specified opaque description of the service account.
1775 # Must be less than or equal to 256 UTF-8 bytes.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1776 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1777 "disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.
1778 # The field is currently in alpha phase.
1779 "etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned
1780 # for backwards compatibility.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]1781 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
1782 "email": "A String", # @OutputOnly The email address of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1783 "name": "A String", # The resource name of the service account in the following format:
1784 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
1785 #
1786 # Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
1787 # project from the `account` and the `ACCOUNT` value can be the `email`
1788 # address or the `unique_id` of the service account.
1789 #
1790 # In responses the resource name will always be in the format
1791 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1792}
1793
1794 x__xgafv: string, V1 error format.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1795 Allowed values
1796 1 - v1 error format
1797 2 - v2 error format
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1798
1799Returns:
1800 An object of the form:
1801
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1802 { # A service account in the Identity and Access Management API.
1803 #
1804 # To create a service account, specify the `project_id` and the `account_id`
1805 # for the account. The `account_id` is unique within the project, and is used
1806 # to generate the service account email address and a stable
1807 # `unique_id`.
1808 #
1809 # If the account already exists, the account's resource name is returned
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1810 # in the format of projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}. The caller
1811 # can use the name in other methods to access the account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1812 #
1813 # All other methods can identify the service account using the format
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1814 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
1815 # Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
1816 # the account. The `ACCOUNT` value can be the `email` address or the
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1817 # `unique_id` of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1818 "oauth2ClientId": "A String", # @OutputOnly The OAuth2 client id for the service account.
Sai Cheemalapatic30d2b52017-03-13 12:12:03 -0400[diff] [blame]1819 # This is used in conjunction with the OAuth2 clientconfig API to make
1820 # three legged OAuth2 (3LO) flows to access the data of Google users.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1821 "displayName": "A String", # Optional. A user-specified name for the service account.
1822 # Must be less than or equal to 100 UTF-8 bytes.
1823 "description": "A String", # Optional. A user-specified opaque description of the service account.
1824 # Must be less than or equal to 256 UTF-8 bytes.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1825 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1826 "disabled": True or False, # @OutputOnly A bool indicate if the service account is disabled.
1827 # The field is currently in alpha phase.
1828 "etag": "A String", # Optional. Note: `etag` is an inoperable legacy field that is only returned
1829 # for backwards compatibility.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame]1830 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
1831 "email": "A String", # @OutputOnly The email address of the service account.
Bu Sun Kim715bd7f2019-06-14 16:50:42 -0700[diff] [blame]1832 "name": "A String", # The resource name of the service account in the following format:
1833 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
1834 #
1835 # Requests using `-` as a wildcard for the `PROJECT_ID` will infer the
1836 # project from the `account` and the `ACCOUNT` value can be the `email`
1837 # address or the `unique_id` of the service account.
1838 #
1839 # In responses the resource name will always be in the format
1840 # `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1841 }</pre>
1842</div>
1843
1844</body></html>