Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / google-api-python-client / ea3a5e1b5572e5438ba86ec0074f60029bd94855 / . / docs / dyn / iam_v1.projects.serviceAccounts.html
blob: 98cd27dca0566848627a1f0c3d31ad3c8ed19749 [file] [log] [blame]
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]1<html><body>
2<style>
3
4body, h1, h2, h3, div, span, p, pre, a {
5 margin: 0;
6 padding: 0;
7 border: 0;
8 font-weight: inherit;
9 font-style: inherit;
10 font-size: 100%;
11 font-family: inherit;
12 vertical-align: baseline;
13}
14
15body {
16 font-size: 13px;
17 padding: 1em;
18}
19
20h1 {
21 font-size: 26px;
22 margin-bottom: 1em;
23}
24
25h2 {
26 font-size: 24px;
27 margin-bottom: 1em;
28}
29
30h3 {
31 font-size: 20px;
32 margin-bottom: 1em;
33 margin-top: 1em;
34}
35
36pre, code {
37 line-height: 1.5;
38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace;
39}
40
41pre {
42 margin-top: 0.5em;
43}
44
45h1, h2, h3, p {
46 font-family: Arial, sans serif;
47}
48
49h1, h2, h3 {
50 border-bottom: solid #CCC 1px;
51}
52
53.toc_element {
54 margin-top: 0.5em;
55}
56
57.firstline {
58 margin-left: 2 em;
59}
60
61.method {
62 margin-top: 1em;
63 border: solid 1px #CCC;
64 padding: 1em;
65 background: #EEE;
66}
67
68.details {
69 font-weight: bold;
70 font-size: 14px;
71}
72
73</style>
74
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]75<h1><a href="iam_v1.html">Google Identity and Access Management (IAM) API</a> . <a href="iam_v1.projects.html">projects</a> . <a href="iam_v1.projects.serviceAccounts.html">serviceAccounts</a></h1>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]76<h2>Instance Methods</h2>
77<p class="toc_element">
78 <code><a href="iam_v1.projects.serviceAccounts.keys.html">keys()</a></code>
79</p>
80<p class="firstline">Returns the keys Resource.</p>
81
82<p class="toc_element">
83 <code><a href="#create">create(name, body, x__xgafv=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]84<p class="firstline">Creates a ServiceAccount and returns it.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]85<p class="toc_element">
86 <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]87<p class="firstline">Deletes a ServiceAccount.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]88<p class="toc_element">
89 <code><a href="#get">get(name, x__xgafv=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]90<p class="firstline">Gets a ServiceAccount.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]91<p class="toc_element">
92 <code><a href="#getIamPolicy">getIamPolicy(resource, x__xgafv=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]93<p class="firstline">Returns the IAM access control policy for a ServiceAccount.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]94<p class="toc_element">
95 <code><a href="#list">list(name, pageToken=None, x__xgafv=None, pageSize=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]96<p class="firstline">Lists ServiceAccounts for a project.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]97<p class="toc_element">
98 <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>
99<p class="firstline">Retrieves the next page of results.</p>
100<p class="toc_element">
101 <code><a href="#setIamPolicy">setIamPolicy(resource, body, x__xgafv=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]102<p class="firstline">Sets the IAM access control policy for a ServiceAccount.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]103<p class="toc_element">
104 <code><a href="#signBlob">signBlob(name, body, x__xgafv=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]105<p class="firstline">Signs a blob using a service account's system-managed private key.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]106<p class="toc_element">
107 <code><a href="#testIamPermissions">testIamPermissions(resource, body, x__xgafv=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]108<p class="firstline">Tests the specified permissions against the IAM access control policy for a ServiceAccount.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]109<p class="toc_element">
110 <code><a href="#update">update(name, body, x__xgafv=None)</a></code></p>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]111<p class="firstline">Updates a ServiceAccount. Currently, only the following fields are updatable: `display_name` . The `etag` is mandatory.</p>
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]112<h3>Method Details</h3>
113<div class="method">
114 <code class="details" id="create">create(name, body, x__xgafv=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]115 <pre>Creates a ServiceAccount and returns it.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]116
117Args:
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]118 name: string, Required. The resource name of the project associated with the service accounts, such as `projects/my-project-123`. (required)
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]119 body: object, The request body. (required)
120 The object takes the form of:
121
122{ # The service account create request.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]123 "serviceAccount": { # A service account in the Identity and Access Management API. To create a service account, specify the `project_id` and the `account_id` for the account. The `account_id` is unique within the project, and is used to generate the service account email address and a stable `unique_id`. If the account already exists, the account's resource name is returned in util::Status's ResourceInfo.resource_name in the format of projects/{project}/serviceAccounts/{email}. The caller can use the name in other methods to access the account. All other methods can identify the service account using the format `projects/{project}/serviceAccounts/{account}`. Using `-` as a wildcard for the project will infer the project from the account. The `account` value can be the `email` address or the `unique_id` of the service account. # The ServiceAccount resource to create. Currently, only the following values are user assignable: `display_name` .
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]124 "oauth2ClientId": "A String", # @OutputOnly. The OAuth2 client id for the service account. This is used in conjunction with the OAuth2 clientconfig API to make three legged OAuth2 (3LO) flows to access the data of Google users.
125 "displayName": "A String", # Optional. A user-specified description of the service account. Must be fewer than 100 UTF-8 bytes.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]126 "name": "A String", # The resource name of the service account in the following format: `projects/{project}/serviceAccounts/{account}`. Requests using `-` as a wildcard for the project will infer the project from the `account` and the `account` value can be the `email` address or the `unique_id` of the service account. In responses the resource name will always be in the format `projects/{project}/serviceAccounts/{email}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]127 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
128 "etag": "A String", # Used to perform a consistent read-modify-write.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]129 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
130 "email": "A String", # @OutputOnly The email address of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]131 },
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]132 "accountId": "A String", # Required. The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])` to comply with RFC1035.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]133 }
134
135 x__xgafv: string, V1 error format.
136
137Returns:
138 An object of the form:
139
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]140 { # A service account in the Identity and Access Management API. To create a service account, specify the `project_id` and the `account_id` for the account. The `account_id` is unique within the project, and is used to generate the service account email address and a stable `unique_id`. If the account already exists, the account's resource name is returned in util::Status's ResourceInfo.resource_name in the format of projects/{project}/serviceAccounts/{email}. The caller can use the name in other methods to access the account. All other methods can identify the service account using the format `projects/{project}/serviceAccounts/{account}`. Using `-` as a wildcard for the project will infer the project from the account. The `account` value can be the `email` address or the `unique_id` of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]141 "oauth2ClientId": "A String", # @OutputOnly. The OAuth2 client id for the service account. This is used in conjunction with the OAuth2 clientconfig API to make three legged OAuth2 (3LO) flows to access the data of Google users.
142 "displayName": "A String", # Optional. A user-specified description of the service account. Must be fewer than 100 UTF-8 bytes.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]143 "name": "A String", # The resource name of the service account in the following format: `projects/{project}/serviceAccounts/{account}`. Requests using `-` as a wildcard for the project will infer the project from the `account` and the `account` value can be the `email` address or the `unique_id` of the service account. In responses the resource name will always be in the format `projects/{project}/serviceAccounts/{email}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]144 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
145 "etag": "A String", # Used to perform a consistent read-modify-write.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]146 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
147 "email": "A String", # @OutputOnly The email address of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]148 }</pre>
149</div>
150
151<div class="method">
152 <code class="details" id="delete">delete(name, x__xgafv=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]153 <pre>Deletes a ServiceAccount.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]154
155Args:
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]156 name: string, The resource name of the service account in the following format: `projects/{project}/serviceAccounts/{account}`. Using `-` as a wildcard for the project will infer the project from the account. The `account` value can be the `email` address or the `unique_id` of the service account. (required)
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]157 x__xgafv: string, V1 error format.
158
159Returns:
160 An object of the form:
161
162 { # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.
163 }</pre>
164</div>
165
166<div class="method">
167 <code class="details" id="get">get(name, x__xgafv=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]168 <pre>Gets a ServiceAccount.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]169
170Args:
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]171 name: string, The resource name of the service account in the following format: `projects/{project}/serviceAccounts/{account}`. Using `-` as a wildcard for the project will infer the project from the account. The `account` value can be the `email` address or the `unique_id` of the service account. (required)
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]172 x__xgafv: string, V1 error format.
173
174Returns:
175 An object of the form:
176
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]177 { # A service account in the Identity and Access Management API. To create a service account, specify the `project_id` and the `account_id` for the account. The `account_id` is unique within the project, and is used to generate the service account email address and a stable `unique_id`. If the account already exists, the account's resource name is returned in util::Status's ResourceInfo.resource_name in the format of projects/{project}/serviceAccounts/{email}. The caller can use the name in other methods to access the account. All other methods can identify the service account using the format `projects/{project}/serviceAccounts/{account}`. Using `-` as a wildcard for the project will infer the project from the account. The `account` value can be the `email` address or the `unique_id` of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]178 "oauth2ClientId": "A String", # @OutputOnly. The OAuth2 client id for the service account. This is used in conjunction with the OAuth2 clientconfig API to make three legged OAuth2 (3LO) flows to access the data of Google users.
179 "displayName": "A String", # Optional. A user-specified description of the service account. Must be fewer than 100 UTF-8 bytes.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]180 "name": "A String", # The resource name of the service account in the following format: `projects/{project}/serviceAccounts/{account}`. Requests using `-` as a wildcard for the project will infer the project from the `account` and the `account` value can be the `email` address or the `unique_id` of the service account. In responses the resource name will always be in the format `projects/{project}/serviceAccounts/{email}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]181 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
182 "etag": "A String", # Used to perform a consistent read-modify-write.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]183 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
184 "email": "A String", # @OutputOnly The email address of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]185 }</pre>
186</div>
187
188<div class="method">
189 <code class="details" id="getIamPolicy">getIamPolicy(resource, x__xgafv=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]190 <pre>Returns the IAM access control policy for a ServiceAccount.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]191
192Args:
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]193 resource: string, REQUIRED: The resource for which the policy is being requested. `resource` is usually specified as a path. For example, a Project resource is specified as `projects/{project}`. (required)
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]194 x__xgafv: string, V1 error format.
195
196Returns:
197 An object of the form:
198
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]199 { # Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. A `Policy` consists of a list of `bindings`. A `Binding` binds a list of `members` to a `role`, where the members can be user accounts, Google groups, Google domains, and service accounts. A `role` is a named list of permissions defined by IAM. **Example** { "bindings": [ { "role": "roles/owner", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-other-app@appspot.gserviceaccount.com", ] }, { "role": "roles/viewer", "members": ["user:sean@example.com"] } ] } For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam).
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]200 "bindings": [ # Associates a list of `members` to a `role`. Multiple `bindings` must not be specified for the same `role`. `bindings` with no members will result in an error.
201 { # Associates `members` with a `role`.
202 "role": "A String", # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. Required
203 "members": [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@gmail.com` or `joe@example.com`. * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: A Google Apps domain name that represents all the users of that domain. For example, `google.com` or `example.com`.
204 "A String",
205 ],
206 },
207 ],
208 "version": 42, # Version of the `Policy`. The default version is 0.
209 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten blindly.
210 }</pre>
211</div>
212
213<div class="method">
214 <code class="details" id="list">list(name, pageToken=None, x__xgafv=None, pageSize=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]215 <pre>Lists ServiceAccounts for a project.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]216
217Args:
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]218 name: string, Required. The resource name of the project associated with the service accounts, such as `projects/my-project-123`. (required)
219 pageToken: string, Optional pagination token returned in an earlier ListServiceAccountsResponse.next_page_token.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]220 x__xgafv: string, V1 error format.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]221 pageSize: integer, Optional limit on the number of service accounts to include in the response. Further accounts can subsequently be obtained by including the ListServiceAccountsResponse.next_page_token in a subsequent request.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]222
223Returns:
224 An object of the form:
225
226 { # The service account list response.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]227 "nextPageToken": "A String", # To retrieve the next page of results, set ListServiceAccountsRequest.page_token to this value.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]228 "accounts": [ # The list of matching service accounts.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]229 { # A service account in the Identity and Access Management API. To create a service account, specify the `project_id` and the `account_id` for the account. The `account_id` is unique within the project, and is used to generate the service account email address and a stable `unique_id`. If the account already exists, the account's resource name is returned in util::Status's ResourceInfo.resource_name in the format of projects/{project}/serviceAccounts/{email}. The caller can use the name in other methods to access the account. All other methods can identify the service account using the format `projects/{project}/serviceAccounts/{account}`. Using `-` as a wildcard for the project will infer the project from the account. The `account` value can be the `email` address or the `unique_id` of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]230 "oauth2ClientId": "A String", # @OutputOnly. The OAuth2 client id for the service account. This is used in conjunction with the OAuth2 clientconfig API to make three legged OAuth2 (3LO) flows to access the data of Google users.
231 "displayName": "A String", # Optional. A user-specified description of the service account. Must be fewer than 100 UTF-8 bytes.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]232 "name": "A String", # The resource name of the service account in the following format: `projects/{project}/serviceAccounts/{account}`. Requests using `-` as a wildcard for the project will infer the project from the `account` and the `account` value can be the `email` address or the `unique_id` of the service account. In responses the resource name will always be in the format `projects/{project}/serviceAccounts/{email}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]233 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
234 "etag": "A String", # Used to perform a consistent read-modify-write.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]235 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
236 "email": "A String", # @OutputOnly The email address of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]237 },
238 ],
239 }</pre>
240</div>
241
242<div class="method">
243 <code class="details" id="list_next">list_next(previous_request, previous_response)</code>
244 <pre>Retrieves the next page of results.
245
246Args:
247 previous_request: The request for the previous page. (required)
248 previous_response: The response from the request for the previous page. (required)
249
250Returns:
251 A request object that you can call 'execute()' on to request the next
252 page. Returns None if there are no more items in the collection.
253 </pre>
254</div>
255
256<div class="method">
257 <code class="details" id="setIamPolicy">setIamPolicy(resource, body, x__xgafv=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]258 <pre>Sets the IAM access control policy for a ServiceAccount.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]259
260Args:
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]261 resource: string, REQUIRED: The resource for which the policy is being specified. `resource` is usually specified as a path. For example, a Project resource is specified as `projects/{project}`. (required)
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]262 body: object, The request body. (required)
263 The object takes the form of:
264
265{ # Request message for `SetIamPolicy` method.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]266 "policy": { # Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. A `Policy` consists of a list of `bindings`. A `Binding` binds a list of `members` to a `role`, where the members can be user accounts, Google groups, Google domains, and service accounts. A `role` is a named list of permissions defined by IAM. **Example** { "bindings": [ { "role": "roles/owner", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-other-app@appspot.gserviceaccount.com", ] }, { "role": "roles/viewer", "members": ["user:sean@example.com"] } ] } For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]267 "bindings": [ # Associates a list of `members` to a `role`. Multiple `bindings` must not be specified for the same `role`. `bindings` with no members will result in an error.
268 { # Associates `members` with a `role`.
269 "role": "A String", # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. Required
270 "members": [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@gmail.com` or `joe@example.com`. * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: A Google Apps domain name that represents all the users of that domain. For example, `google.com` or `example.com`.
271 "A String",
272 ],
273 },
274 ],
275 "version": 42, # Version of the `Policy`. The default version is 0.
276 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten blindly.
277 },
278 }
279
280 x__xgafv: string, V1 error format.
281
282Returns:
283 An object of the form:
284
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]285 { # Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. A `Policy` consists of a list of `bindings`. A `Binding` binds a list of `members` to a `role`, where the members can be user accounts, Google groups, Google domains, and service accounts. A `role` is a named list of permissions defined by IAM. **Example** { "bindings": [ { "role": "roles/owner", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-other-app@appspot.gserviceaccount.com", ] }, { "role": "roles/viewer", "members": ["user:sean@example.com"] } ] } For a description of IAM and its features, see the [IAM developer's guide](https://cloud.google.com/iam).
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]286 "bindings": [ # Associates a list of `members` to a `role`. Multiple `bindings` must not be specified for the same `role`. `bindings` with no members will result in an error.
287 { # Associates `members` with a `role`.
288 "role": "A String", # Role that is assigned to `members`. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. Required
289 "members": [ # Specifies the identities requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `alice@gmail.com` or `joe@example.com`. * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain}`: A Google Apps domain name that represents all the users of that domain. For example, `google.com` or `example.com`.
290 "A String",
291 ],
292 },
293 ],
294 "version": 42, # Version of the `Policy`. The default version is 0.
295 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. If no `etag` is provided in the call to `setIamPolicy`, then the existing policy is overwritten blindly.
296 }</pre>
297</div>
298
299<div class="method">
300 <code class="details" id="signBlob">signBlob(name, body, x__xgafv=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]301 <pre>Signs a blob using a service account's system-managed private key.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]302
303Args:
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]304 name: string, The resource name of the service account in the following format: `projects/{project}/serviceAccounts/{account}`. Using `-` as a wildcard for the project will infer the project from the account. The `account` value can be the `email` address or the `unique_id` of the service account. (required)
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]305 body: object, The request body. (required)
306 The object takes the form of:
307
308{ # The service account sign blob request.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]309 "bytesToSign": "A String", # The bytes to sign.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]310 }
311
312 x__xgafv: string, V1 error format.
313
314Returns:
315 An object of the form:
316
317 { # The service account sign blob response.
318 "keyId": "A String", # The id of the key used to sign the blob.
319 "signature": "A String", # The signed blob.
320 }</pre>
321</div>
322
323<div class="method">
324 <code class="details" id="testIamPermissions">testIamPermissions(resource, body, x__xgafv=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]325 <pre>Tests the specified permissions against the IAM access control policy for a ServiceAccount.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]326
327Args:
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]328 resource: string, REQUIRED: The resource for which the policy detail is being requested. `resource` is usually specified as a path. For example, a Project resource is specified as `projects/{project}`. (required)
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]329 body: object, The request body. (required)
330 The object takes the form of:
331
332{ # Request message for `TestIamPermissions` method.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]333 "permissions": [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as '*' or 'storage.*') are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]334 "A String",
335 ],
336 }
337
338 x__xgafv: string, V1 error format.
339
340Returns:
341 An object of the form:
342
343 { # Response message for `TestIamPermissions` method.
344 "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed.
345 "A String",
346 ],
347 }</pre>
348</div>
349
350<div class="method">
351 <code class="details" id="update">update(name, body, x__xgafv=None)</code>
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]352 <pre>Updates a ServiceAccount. Currently, only the following fields are updatable: `display_name` . The `etag` is mandatory.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]353
354Args:
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]355 name: string, The resource name of the service account in the following format: `projects/{project}/serviceAccounts/{account}`. Requests using `-` as a wildcard for the project will infer the project from the `account` and the `account` value can be the `email` address or the `unique_id` of the service account. In responses the resource name will always be in the format `projects/{project}/serviceAccounts/{email}`. (required)
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]356 body: object, The request body. (required)
357 The object takes the form of:
358
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]359{ # A service account in the Identity and Access Management API. To create a service account, specify the `project_id` and the `account_id` for the account. The `account_id` is unique within the project, and is used to generate the service account email address and a stable `unique_id`. If the account already exists, the account's resource name is returned in util::Status's ResourceInfo.resource_name in the format of projects/{project}/serviceAccounts/{email}. The caller can use the name in other methods to access the account. All other methods can identify the service account using the format `projects/{project}/serviceAccounts/{account}`. Using `-` as a wildcard for the project will infer the project from the account. The `account` value can be the `email` address or the `unique_id` of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]360 "oauth2ClientId": "A String", # @OutputOnly. The OAuth2 client id for the service account. This is used in conjunction with the OAuth2 clientconfig API to make three legged OAuth2 (3LO) flows to access the data of Google users.
361 "displayName": "A String", # Optional. A user-specified description of the service account. Must be fewer than 100 UTF-8 bytes.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]362 "name": "A String", # The resource name of the service account in the following format: `projects/{project}/serviceAccounts/{account}`. Requests using `-` as a wildcard for the project will infer the project from the `account` and the `account` value can be the `email` address or the `unique_id` of the service account. In responses the resource name will always be in the format `projects/{project}/serviceAccounts/{email}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]363 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
364 "etag": "A String", # Used to perform a consistent read-modify-write.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]365 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
366 "email": "A String", # @OutputOnly The email address of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]367}
368
369 x__xgafv: string, V1 error format.
370
371Returns:
372 An object of the form:
373
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]374 { # A service account in the Identity and Access Management API. To create a service account, specify the `project_id` and the `account_id` for the account. The `account_id` is unique within the project, and is used to generate the service account email address and a stable `unique_id`. If the account already exists, the account's resource name is returned in util::Status's ResourceInfo.resource_name in the format of projects/{project}/serviceAccounts/{email}. The caller can use the name in other methods to access the account. All other methods can identify the service account using the format `projects/{project}/serviceAccounts/{account}`. Using `-` as a wildcard for the project will infer the project from the account. The `account` value can be the `email` address or the `unique_id` of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]375 "oauth2ClientId": "A String", # @OutputOnly. The OAuth2 client id for the service account. This is used in conjunction with the OAuth2 clientconfig API to make three legged OAuth2 (3LO) flows to access the data of Google users.
376 "displayName": "A String", # Optional. A user-specified description of the service account. Must be fewer than 100 UTF-8 bytes.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]377 "name": "A String", # The resource name of the service account in the following format: `projects/{project}/serviceAccounts/{account}`. Requests using `-` as a wildcard for the project will infer the project from the `account` and the `account` value can be the `email` address or the `unique_id` of the service account. In responses the resource name will always be in the format `projects/{project}/serviceAccounts/{email}`.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]378 "projectId": "A String", # @OutputOnly The id of the project that owns the service account.
379 "etag": "A String", # Used to perform a consistent read-modify-write.
Sai Cheemalapatiea3a5e12016-10-12 14:05:53 -0700[diff] [blame^]380 "uniqueId": "A String", # @OutputOnly The unique and stable id of the service account.
381 "email": "A String", # @OutputOnly The email address of the service account.
Jon Wayne Parrott36e41bc2016-02-19 16:02:29 -0800[diff] [blame]382 }</pre>
383</div>
384
385</body></html>