google-api-client 0.31.0 → 0.32.0

data/generated/google/apis/healthcare_v1beta1.rb

@@ -25,7 +25,7 @@ module Google
     # @see https://cloud.google.com/healthcare
     module HealthcareV1beta1
       VERSION = 'V1beta1'
-      REVISION = '20190901'
+      REVISION = '20190924'
 
       # View and manage your data across Google Cloud Platform services
       AUTH_CLOUD_PLATFORM = 'https://www.googleapis.com/auth/cloud-platform'

data/generated/google/apis/healthcare_v1beta1/classes.rb

@@ -266,7 +266,7 @@ module Google
       
         # The default timezone used by this dataset. Must be a either a valid IANA
         # time zone name such as "America/New_York" or empty, which defaults to UTC.
-        # This is used for parsing times in resources (e.g., HL7 messages) where no
+        # This is used for parsing times in resources, such as HL7 messages, where no
         # explicit timezone is specified.
         # Corresponds to the JSON property `timeZone`
         # @return [String]
@@ -318,12 +318,12 @@ module Google
         # @return [Google::Apis::HealthcareV1beta1::DicomConfig]
         attr_accessor :dicom
       
-        # Specifies how de-identification of a FHIR store should be handled.
+        # Specifies how to handle de-identification of a FHIR store.
         # Corresponds to the JSON property `fhir`
         # @return [Google::Apis::HealthcareV1beta1::FhirConfig]
         attr_accessor :fhir
       
-        # Specifies how de-identification of image pixel should be handled.
+        # Specifies how to handle de-identification of image pixels.
         # Corresponds to the JSON property `image`
         # @return [Google::Apis::HealthcareV1beta1::ImageConfig]
         attr_accessor :image
@@ -359,8 +359,7 @@ module Google
         # @return [Google::Apis::HealthcareV1beta1::DeidentifyConfig]
         attr_accessor :config
       
-        # The name of the dataset resource to create and write the redacted data to
-        # (e.g.,
+        # The name of the dataset resource to create and write the redacted data to.
         # * The destination dataset must not exist.
         # * The destination dataset must be in the same project as the source
         # dataset. De-identifying data across multiple projects is not supported.
@@ -383,12 +382,12 @@ module Google
       class DeidentifyErrorDetails
         include Google::Apis::Core::Hashable
       
-        # Number of resources failed to process.
+        # Number of resources that failed to process.
         # Corresponds to the JSON property `failureResourceCount`
         # @return [Fixnum]
         attr_accessor :failure_resource_count
       
-        # Number of stores failed to process.
+        # Number of stores that failed to process.
         # Corresponds to the JSON property `failureStoreCount`
         # @return [Fixnum]
         attr_accessor :failure_store_count
@@ -420,6 +419,14 @@ module Google
       class DeidentifySummary
         include Google::Apis::Core::Hashable
       
+        # Number of resources that failed to process.
+        # The failures might be caused by:
+        # * Invalid user input data
+        # * Transient errors that could be skipped
+        # Corresponds to the JSON property `failureResourceCount`
+        # @return [Fixnum]
+        attr_accessor :failure_resource_count
+      
         # Number of resources successfully processed.
         # Corresponds to the JSON property `successResourceCount`
         # @return [Fixnum]
@@ -436,6 +443,7 @@ module Google
       
         # Update properties of this object
         def update!(**args)
+          @failure_resource_count = args[:failure_resource_count] if args.key?(:failure_resource_count)
           @success_resource_count = args[:success_resource_count] if args.key?(:success_resource_count)
           @success_store_count = args[:success_store_count] if args.key?(:success_store_count)
         end
@@ -511,7 +519,7 @@ module Google
         # @return [String]
         attr_accessor :name
       
-        # Specifies where notifications should be sent upon changes to a data store.
+        # Specifies where to send notifications upon changes to a data store.
         # Corresponds to the JSON property `notificationConfig`
         # @return [Google::Apis::HealthcareV1beta1::NotificationConfig]
         attr_accessor :notification_config
@@ -580,20 +588,20 @@ module Google
       end
       
       # Exports data from the specified DICOM store.
-      # If a given resource (e.g., a DICOM object with the same SOPInstance UID)
+      # If a given resource, such as a DICOM object with the same SOPInstance UID,
       # already exists in the output, it is overwritten with the version
       # in the source dataset.
-      # Exported DICOM data will persist when the DICOM store from which it was
+      # Exported DICOM data persists when the DICOM store from which it was
       # exported is deleted.
       class ExportDicomDataRequest
         include Google::Apis::Core::Hashable
       
-        # The BigQuery table where the output should be written.
+        # The BigQuery table where the server writes the output.
         # Corresponds to the JSON property `bigqueryDestination`
         # @return [Google::Apis::HealthcareV1beta1::GoogleCloudHealthcareV1beta1DicomBigQueryDestination]
         attr_accessor :bigquery_destination
       
-        # The Cloud Storage location where the output should be written, and the export
+        # The Cloud Storage location where the server writes the output and the export
         # configuration.
         # Corresponds to the JSON property `gcsDestination`
         # @return [Google::Apis::HealthcareV1beta1::GoogleCloudHealthcareV1beta1DicomGcsDestination]
@@ -682,12 +690,12 @@ module Google
         end
       end
       
-      # Specifies how de-identification of a FHIR store should be handled.
+      # Specifies how to handle de-identification of a FHIR store.
       class FhirConfig
         include Google::Apis::Core::Hashable
       
         # Specifies FHIR paths to match and how to transform them. Any field that
-        # is not matched by a FieldMetadata will be passed through to the output
+        # is not matched by a FieldMetadata is passed through to the output
         # dataset unmodified. All extensions are removed in the output.
         # Corresponds to the JSON property `fieldMetadataList`
         # @return [Array<Google::Apis::HealthcareV1beta1::FieldMetadata>]
@@ -709,12 +717,12 @@ module Google
       
         # Whether to disable referential integrity in this FHIR store. This field is
         # immutable after FHIR store creation.
-        # The default value is false, meaning that the API will enforce referential
-        # integrity and fail the requests that will result in inconsistent state in
+        # The default value is false, meaning that the API enforces referential
+        # integrity and fails the requests that result in inconsistent state in
         # the FHIR store.
-        # When this field is set to true, the API will skip referential integrity
-        # check. Consequently, operations that rely on references, such as
-        # GetPatientEverything, will not return all the results if broken references
+        # When this field is set to true, the API skips referential integrity
+        # checks. Consequently, operations that rely on references, such as
+        # GetPatientEverything, do not return all the results if broken references
         # exist.
         # Corresponds to the JSON property `disableReferentialIntegrity`
         # @return [Boolean]
@@ -723,35 +731,25 @@ module Google
       
         # Whether to disable resource versioning for this FHIR store. This field can
         # not be changed after the creation of FHIR store.
-        # If set to false, which is the default behavior, all write operations will
+        # If set to false, which is the default behavior, all write operations
         # cause historical versions to be recorded automatically. The historical
         # versions can be fetched through the history APIs, but cannot be updated.
-        # If set to true, no historical versions will be kept. The server will send
-        # back errors for attempts to read the historical versions.
+        # If set to true, no historical versions are kept. The server sends
+        # errors for attempts to read the historical versions.
         # Corresponds to the JSON property `disableResourceVersioning`
         # @return [Boolean]
         attr_accessor :disable_resource_versioning
         alias_method :disable_resource_versioning?, :disable_resource_versioning
       
-        # Whether to allow the bulk import API to accept history bundles and directly
-        # insert historical resource versions into the FHIR store. Importing resource
-        # histories creates resource interactions that appear to have occurred in the
-        # past, which clients may not want to allow. If set to false, history bundles
-        # within an import will fail with an error.
-        # Corresponds to the JSON property `enableHistoryImport`
-        # @return [Boolean]
-        attr_accessor :enable_history_import
-        alias_method :enable_history_import?, :enable_history_import
-      
         # Whether this FHIR store has the [updateCreate
         # capability](https://www.hl7.org/fhir/capabilitystatement-definitions.html#
         # CapabilityStatement.rest.resource.updateCreate).
         # This determines if the client can use an Update operation to create a new
         # resource with a client-specified ID. If false, all IDs are server-assigned
-        # through the Create operation and attempts to Update a non-existent resource
-        # will return errors. Please treat the audit logs with appropriate levels of
+        # through the Create operation and attempts to update a non-existent resource
+        # return errors. Please treat the audit logs with appropriate levels of
         # care if client-specified resource IDs contain sensitive data such as
-        # patient identifiers, those IDs will be part of the FHIR resource path
+        # patient identifiers, those IDs are part of the FHIR resource path
         # recorded in Cloud audit logs and Cloud Pub/Sub notifications.
         # Corresponds to the JSON property `enableUpdateCreate`
         # @return [Boolean]
@@ -777,7 +775,7 @@ module Google
         # @return [String]
         attr_accessor :name
       
-        # Specifies where notifications should be sent upon changes to a data store.
+        # Specifies where to send notifications upon changes to a data store.
         # Corresponds to the JSON property `notificationConfig`
         # @return [Google::Apis::HealthcareV1beta1::NotificationConfig]
         attr_accessor :notification_config
@@ -790,7 +788,6 @@ module Google
         def update!(**args)
           @disable_referential_integrity = args[:disable_referential_integrity] if args.key?(:disable_referential_integrity)
           @disable_resource_versioning = args[:disable_resource_versioning] if args.key?(:disable_resource_versioning)
-          @enable_history_import = args[:enable_history_import] if args.key?(:enable_history_import)
           @enable_update_create = args[:enable_update_create] if args.key?(:enable_update_create)
           @labels = args[:labels] if args.key?(:labels)
           @name = args[:name] if args.key?(:name)
@@ -812,8 +809,8 @@ module Google
         # period-separated list where each component is either a field name or
         # FHIR type name, for example: Patient, HumanName.
         # For "choice" types (those defined in the FHIR spec with the form:
-        # field[x]) we use two separate components. e.g. "deceasedAge.unit" is
-        # matched by "Deceased.Age.unit".
+        # field[x]) we use two separate components. For example,
+        # "deceasedAge.unit" is matched by "Deceased.Age.unit".
         # Supported types are: AdministrativeGenderCode, Code, Date, DateTime,
         # Decimal, HumanName, Id, LanguageCode, Markdown, MimeTypeCode, Oid,
         # String, Uri, Uuid, Xhtml.
@@ -832,12 +829,12 @@ module Google
         end
       end
       
-      # The BigQuery table where the output should be written.
+      # The BigQuery table where the server writes the output.
       class GoogleCloudHealthcareV1beta1DicomBigQueryDestination
         include Google::Apis::Core::Hashable
       
         # If the destination table already exists and this flag is `TRUE`, the table
-        # will be overwritten by the contents of the DICOM store. If the flag is not
+        # is overwritten by the contents of the DICOM store. If the flag is not
         # set and the destination table already exists, the export call returns an
         # error.
         # Corresponds to the JSON property `force`
@@ -862,31 +859,31 @@ module Google
         end
       end
       
-      # The Cloud Storage location where the output should be written, and the export
+      # The Cloud Storage location where the server writes the output and the export
       # configuration.
       class GoogleCloudHealthcareV1beta1DicomGcsDestination
         include Google::Apis::Core::Hashable
       
         # MIME types supported by DICOM spec.
-        # Each file will be written in the following format:
+        # Each file is written in the following format:
         # `.../`study_id`/`series_id`/`instance_id`[/`frame_number`].`extension``
-        # The frame_number component will exist only for multi-frame instances.
+        # The frame_number component exists only for multi-frame instances.
         # Refer to the DICOM conformance statement for permissible MIME types:
         # https://cloud.google.com/healthcare/docs/dicom#wado-rs
-        # The following extensions will be used for output files:
+        # The following extensions are used for output files:
         # application/dicom -> .dcm
         # image/jpeg -> .jpg
         # image/png -> .png
-        # If unspecified, the instances will be exported in their original
+        # If unspecified, the instances are exported in their original
         # DICOM format.
         # Corresponds to the JSON property `mimeType`
         # @return [String]
         attr_accessor :mime_type
       
         # The Cloud Storage destination to export to.
-        # URI for a Cloud Storage directory where result files should be written (in
-        # the format `gs://`bucket-id`/`path/to/destination/dir``). If there is no
-        # trailing slash, the service will append one when composing the object path.
+        # URI for a Cloud Storage directory where the server writes the result files,
+        # in the format `gs://`bucket-id`/`path/to/destination/dir``). If there is no
+        # trailing slash, the service appends one when composing the object path.
         # The user is responsible for creating the Cloud Storage bucket referenced in
         # `uri_prefix`.
         # Corresponds to the JSON property `uriPrefix`
@@ -1205,7 +1202,7 @@ module Google
         # @return [String]
         attr_accessor :name
       
-        # Specifies where notifications should be sent upon changes to a data store.
+        # Specifies where to send notifications upon changes to a data store.
         # Corresponds to the JSON property `notificationConfig`
         # @return [Google::Apis::HealthcareV1beta1::NotificationConfig]
         attr_accessor :notification_config
@@ -1290,7 +1287,7 @@ module Google
         end
       end
       
-      # Specifies how de-identification of image pixel should be handled.
+      # Specifies how to handle de-identification of image pixels.
       class ImageConfig
         include Google::Apis::Core::Hashable
       
@@ -1314,8 +1311,8 @@ module Google
         include Google::Apis::Core::Hashable
       
         # Deprecated. Use only for debugging purposes.
-        # Contains sample errors encountered in imports of individual resources
-        # (for example, a Cloud Storage object).
+        # Contains sample errors encountered in imports of individual resources.
+        # For example, a Cloud Storage object.
         # Corresponds to the JSON property `sampleErrors`
         # @return [Array<Google::Apis::HealthcareV1beta1::ErrorDetail>]
         attr_accessor :sample_errors
@@ -1332,8 +1329,8 @@ module Google
       
       # Imports data into the specified DICOM store.
       # Returns an error if any of the files to import are not DICOM files. This
-      # API will accept duplicate DICOM instances, by simply ignoring the newly
-      # pushed instance (it will not overwrite).
+      # API accepts duplicate DICOM instances by ignoring the newly-pushed instance.
+      # It does not overwrite.
       class ImportDicomDataRequest
         include Google::Apis::Core::Hashable
       
@@ -1408,8 +1405,8 @@ module Google
         # @return [Array<String>]
         attr_accessor :info_types
       
-        # Define how to redact sensitive values. Default behaviour is erase,
-        # e.g. "My name is Jake." becomes "My name is ."
+        # Define how to redact sensitive values. Default behaviour is erase.
+        # For example, "My name is Jake." becomes "My name is ."
         # Corresponds to the JSON property `redactConfig`
         # @return [Google::Apis::HealthcareV1beta1::RedactConfig]
         attr_accessor :redact_config
@@ -1799,13 +1796,13 @@ module Google
         end
       end
       
-      # Specifies where notifications should be sent upon changes to a data store.
+      # Specifies where to send notifications upon changes to a data store.
       class NotificationConfig
         include Google::Apis::Core::Hashable
       
         # The [Cloud Pub/Sub](https://cloud.google.com/pubsub/docs/) topic that
         # notifications of changes are published on. Supplied by the client.
-        # PubsubMessage.Data will contain the resource name.
+        # PubsubMessage.Data contains the resource name.
         # PubsubMessage.MessageId is the ID of this message. It is guaranteed to be
         # unique within the topic.
         # PubsubMessage.PublishTime is the time at which the message was published.
@@ -1814,7 +1811,7 @@ module Google
         # names](https://cloud.google.com/pubsub/docs/overview#names) must be scoped
         # to a project. cloud-healthcare@system.gserviceaccount.com must have
         # publisher permissions on the given Cloud Pub/Sub topic. Not having adequate
-        # permissions will cause the calls that send notifications to fail.
+        # permissions causes the calls that send notifications to fail.
         # Corresponds to the JSON property `pubsubTopic`
         # @return [String]
         attr_accessor :pubsub_topic
@@ -1961,8 +1958,8 @@ module Google
         attr_accessor :allow_null_header
         alias_method :allow_null_header?, :allow_null_header
       
-        # Byte(s) to be used as the segment terminator. If this is unset, '\r' will
-        # be used as segment terminator.
+        # Byte(s) to use as the segment terminator. If this is unset, '\r' is
+        # used as segment terminator.
         # Corresponds to the JSON property `segmentTerminator`
         # NOTE: Values are automatically base64 encoded/decoded in the client library.
         # @return [String]
@@ -1983,7 +1980,7 @@ module Google
       class PatientId
         include Google::Apis::Core::Hashable
       
-        # ID type, e.g. MRN or NHS.
+        # ID type. For example, MRN or NHS.
         # Corresponds to the JSON property `type`
         # @return [String]
         attr_accessor :type
@@ -2006,25 +2003,34 @@ module Google
       
       # Defines an Identity and Access Management (IAM) policy. It is used to
       # specify access control policies for Cloud Platform resources.
-      # A `Policy` consists of a list of `bindings`. A `binding` binds a list of
-      # `members` to a `role`, where the members can be user accounts, Google groups,
-      # Google domains, and service accounts. A `role` is a named list of permissions
-      # defined by IAM.
+      # A `Policy` is a collection of `bindings`. A `binding` binds one or more
+      # `members` to a single `role`. Members can be user accounts, service accounts,
+      # Google groups, and domains (such as G Suite). A `role` is a named list of
+      # permissions (defined by IAM or configured by users). A `binding` can
+      # optionally specify a `condition`, which is a logic expression that further
+      # constrains the role binding based on attributes about the request and/or
+      # target resource.
       # **JSON Example**
       # `
       # "bindings": [
       # `
-      # "role": "roles/owner",
+      # "role": "role/resourcemanager.organizationAdmin",
       # "members": [
       # "user:mike@example.com",
       # "group:admins@example.com",
       # "domain:google.com",
-      # "serviceAccount:my-other-app@appspot.gserviceaccount.com"
+      # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
       # ]
       # `,
       # `
-      # "role": "roles/viewer",
-      # "members": ["user:sean@example.com"]
+      # "role": "roles/resourcemanager.organizationViewer",
+      # "members": ["user:eve@example.com"],
+      # "condition": `
+      # "title": "expirable access",
+      # "description": "Does not grant access after Sep 2020",
+      # "expression": "request.time <
+      # timestamp('2020-10-01T00:00:00.000Z')",
+      # `
       # `
       # ]
       # `
@@ -2034,11 +2040,15 @@ module Google
       # - user:mike@example.com
       # - group:admins@example.com
       # - domain:google.com
-      # - serviceAccount:my-other-app@appspot.gserviceaccount.com
-      # role: roles/owner
+      # - serviceAccount:my-project-id@appspot.gserviceaccount.com
+      # role: roles/resourcemanager.organizationAdmin
       # - members:
-      # - user:sean@example.com
-      # role: roles/viewer
+      # - user:eve@example.com
+      # role: roles/resourcemanager.organizationViewer
+      # condition:
+      # title: expirable access
+      # description: Does not grant access after Sep 2020
+      # expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
       # For a description of IAM and its features, see the
       # [IAM developer's guide](https://cloud.google.com/iam/docs).
       class Policy
@@ -2049,7 +2059,8 @@ module Google
         # @return [Array<Google::Apis::HealthcareV1beta1::AuditConfig>]
         attr_accessor :audit_configs
       
-        # Associates a list of `members` to a `role`.
+        # Associates a list of `members` to a `role`. Optionally may specify a
+        # `condition` that determines when binding is in effect.
         # `bindings` with no members will result in an error.
         # Corresponds to the JSON property `bindings`
         # @return [Array<Google::Apis::HealthcareV1beta1::Binding>]
@@ -2063,13 +2074,24 @@ module Google
         # systems are expected to put that etag in the request to `setIamPolicy` to
         # ensure that their change will be applied to the same version of the policy.
         # If no `etag` is provided in the call to `setIamPolicy`, then the existing
-        # policy is overwritten.
+        # policy is overwritten. Due to blind-set semantics of an etag-less policy,
+        # 'setIamPolicy' will not fail even if either of incoming or stored policy
+        # does not meet the version requirements.
         # Corresponds to the JSON property `etag`
         # NOTE: Values are automatically base64 encoded/decoded in the client library.
         # @return [String]
         attr_accessor :etag
       
-        # Deprecated.
+        # Specifies the format of the policy.
+        # Valid values are 0, 1, and 3. Requests specifying an invalid value will be
+        # rejected.
+        # Operations affecting conditional bindings must specify version 3. This can
+        # be either setting a conditional policy, modifying a conditional binding,
+        # or removing a conditional binding from the stored conditional policy.
+        # Operations on non-conditional policies may specify any valid value or
+        # leave the field unset.
+        # If no etag is provided in the call to `setIamPolicy`, any version
+        # compliance checks on the incoming and/or stored policy is skipped.
         # Corresponds to the JSON property `version`
         # @return [Fixnum]
         attr_accessor :version
@@ -2118,8 +2140,8 @@ module Google
         end
       end
       
-      # Define how to redact sensitive values. Default behaviour is erase,
-      # e.g. "My name is Jake." becomes "My name is ."
+      # Define how to redact sensitive values. Default behaviour is erase.
+      # For example, "My name is Jake." becomes "My name is ."
       class RedactConfig
         include Google::Apis::Core::Hashable
       
@@ -2209,22 +2231,23 @@ module Google
         # identify different instances of a repeated field.
         # Regex for key: (\d+)(\[\d+\])?(.\d+)?(.\d+)?
         # Examples of (key, value) pairs:
-        # - (0.1, "foo"): Component 1 of Field 0 has the value "foo".
-        # - (1.1.2, "bar"): Sub-component 2 of Component 1 of field 1 has the value
-        # "bar".
-        # - (1[2].1, "baz"): Component 1 of Instance 2 of Field 1, which is repeated,
-        # has the value "baz".
+        # * (0.1, "hemoglobin") denotes that the first component of Field 0 has the
+        # value "hemoglobin".
+        # * (1.1.2, "CBC") denotes that the second sub-component of the first
+        # component of Field 1 has the value "CBC".
+        # * (1[0].1, "HbA1c") denotes that the first component of the
+        # first Instance of Field 1, which is repeated, has the value "HbA1c".
         # Corresponds to the JSON property `fields`
         # @return [Hash<String,String>]
         attr_accessor :fields
       
-        # A string that indicates the type of segment, e.g., EVN, PID.
+        # A string that indicates the type of segment. For example, EVN or PID.
         # Corresponds to the JSON property `segmentId`
         # @return [String]
         attr_accessor :segment_id
       
-        # Set ID for segments that can be in a set. This can be empty if it is
-        # missing or it is not applicable.
+        # Set ID for segments that can be in a set. This can be empty if it's
+        # missing or isn't applicable.
         # Corresponds to the JSON property `setId`
         # @return [String]
         attr_accessor :set_id
@@ -2247,25 +2270,34 @@ module Google
       
         # Defines an Identity and Access Management (IAM) policy. It is used to
         # specify access control policies for Cloud Platform resources.
-        # A `Policy` consists of a list of `bindings`. A `binding` binds a list of
-        # `members` to a `role`, where the members can be user accounts, Google groups,
-        # Google domains, and service accounts. A `role` is a named list of permissions
-        # defined by IAM.
+        # A `Policy` is a collection of `bindings`. A `binding` binds one or more
+        # `members` to a single `role`. Members can be user accounts, service accounts,
+        # Google groups, and domains (such as G Suite). A `role` is a named list of
+        # permissions (defined by IAM or configured by users). A `binding` can
+        # optionally specify a `condition`, which is a logic expression that further
+        # constrains the role binding based on attributes about the request and/or
+        # target resource.
         # **JSON Example**
         # `
         # "bindings": [
         # `
-        # "role": "roles/owner",
+        # "role": "role/resourcemanager.organizationAdmin",
         # "members": [
         # "user:mike@example.com",
         # "group:admins@example.com",
         # "domain:google.com",
-        # "serviceAccount:my-other-app@appspot.gserviceaccount.com"
+        # "serviceAccount:my-project-id@appspot.gserviceaccount.com"
         # ]
         # `,
         # `
-        # "role": "roles/viewer",
-        # "members": ["user:sean@example.com"]
+        # "role": "roles/resourcemanager.organizationViewer",
+        # "members": ["user:eve@example.com"],
+        # "condition": `
+        # "title": "expirable access",
+        # "description": "Does not grant access after Sep 2020",
+        # "expression": "request.time <
+        # timestamp('2020-10-01T00:00:00.000Z')",
+        # `
         # `
         # ]
         # `
@@ -2275,11 +2307,15 @@ module Google
         # - user:mike@example.com
         # - group:admins@example.com
         # - domain:google.com
-        # - serviceAccount:my-other-app@appspot.gserviceaccount.com
-        # role: roles/owner
+        # - serviceAccount:my-project-id@appspot.gserviceaccount.com
+        # role: roles/resourcemanager.organizationAdmin
         # - members:
-        # - user:sean@example.com
-        # role: roles/viewer
+        # - user:eve@example.com
+        # role: roles/resourcemanager.organizationViewer
+        # condition:
+        # title: expirable access
+        # description: Does not grant access after Sep 2020
+        # expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
         # For a description of IAM and its features, see the
         # [IAM developer's guide](https://cloud.google.com/iam/docs).
         # Corresponds to the JSON property `policy`