@google-cloud/discoveryengine 2.2.0 → 2.4.0

package/build/protos/google/cloud/discoveryengine/v1/control.proto

@@ -77,7 +77,7 @@ message Condition {
   // Optional. Query regex to match the whole search query.
   // Cannot be set when
   // [Condition.query_terms][google.cloud.discoveryengine.v1.Condition.query_terms]
-  // is set. This is currently supporting promotion use case.
+  // is set. Only supported for Basic Site Search promotion serving controls.
   string query_regex = 4 [(google.api.field_behavior) = OPTIONAL];
 }
 
@@ -288,8 +288,6 @@ message Control {
     SynonymsAction synonyms_action = 10;
 
     // Promote certain links based on predefined trigger queries.
-    //
-    // This now only supports basic site search.
     PromoteAction promote_action = 15;
   }
 

package/build/protos/google/cloud/discoveryengine/v1/conversational_search_service.proto

@@ -833,6 +833,9 @@ message AnswerQueryRequest {
 
         // Non-answer-seeking query classification type, for no clear intent.
         NON_ANSWER_SEEKING_QUERY_V2 = 4;
+
+        // User defined query classification type.
+        USER_DEFINED_CLASSIFICATION_QUERY = 5;
       }
 
       // Enabled query classification types.
@@ -1122,11 +1125,23 @@ message ListSessionsRequest {
   // Provide this to retrieve the subsequent page.
   string page_token = 3;
 
-  // A filter to apply on the list results. The supported features are:
-  // user_pseudo_id, state.
+  // A comma-separated list of fields to filter by, in EBNF grammar.
+  // The supported fields are:
+  // * `user_pseudo_id`
+  // * `state`
+  // * `display_name`
+  // * `starred`
+  // * `is_pinned`
+  // * `labels`
+  // * `create_time`
+  // * `update_time`
   //
-  // Example:
+  // Examples:
   // "user_pseudo_id = some_id"
+  // "display_name = \"some_name\""
+  // "starred = true"
+  // "is_pinned=true AND (NOT labels:hidden)"
+  // "create_time > \"1970-01-01T12:00:00Z\""
   string filter = 4;
 
   // A comma-separated list of fields to order by, sorted in ascending order.

package/build/protos/google/cloud/discoveryengine/v1/data_store.proto

@@ -18,6 +18,7 @@ package google.cloud.discoveryengine.v1;
 
 import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
+import "google/cloud/discoveryengine/v1/cmek_config_service.proto";
 import "google/cloud/discoveryengine/v1/common.proto";
 import "google/cloud/discoveryengine/v1/document_processing_config.proto";
 import "google/cloud/discoveryengine/v1/schema.proto";
@@ -83,13 +84,16 @@ message DataStore {
     GOOGLE_WORKSPACE = 4;
   }
 
-  // Immutable. The full resource name of the data store.
+  // Immutable. Identifier. The full resource name of the data store.
   // Format:
   // `projects/{project}/locations/{location}/collections/{collection_id}/dataStores/{data_store_id}`.
   //
   // This field must be a UTF-8 encoded string with a length limit of 1024
   // characters.
-  string name = 1 [(google.api.field_behavior) = IMMUTABLE];
+  string name = 1 [
+    (google.api.field_behavior) = IMMUTABLE,
+    (google.api.field_behavior) = IDENTIFIER
+  ];
 
   // Required. The data store display name.
   //
@@ -128,10 +132,42 @@ message DataStore {
   AdvancedSiteSearchConfig advanced_site_search_config = 12
       [(google.api.field_behavior) = OPTIONAL];
 
+  // Input only. The KMS key to be used to protect this DataStore at creation
+  // time.
+  //
+  // Must be set for requests that need to comply with CMEK Org Policy
+  // protections.
+  //
+  // If this field is set and processed successfully, the DataStore will be
+  // protected by the KMS key, as indicated in the cmek_config field.
+  string kms_key_name = 32 [(google.api.field_behavior) = INPUT_ONLY];
+
+  // Output only. CMEK-related information for the DataStore.
+  CmekConfig cmek_config = 18 [(google.api.field_behavior) = OUTPUT_ONLY];
+
   // Output only. Data size estimation for billing.
   BillingEstimation billing_estimation = 23
       [(google.api.field_behavior) = OUTPUT_ONLY];
 
+  // Immutable. Whether data in the
+  // [DataStore][google.cloud.discoveryengine.v1.DataStore] has ACL information.
+  // If set to `true`, the source data must have ACL. ACL will be ingested when
+  // data is ingested by
+  // [DocumentService.ImportDocuments][google.cloud.discoveryengine.v1.DocumentService.ImportDocuments]
+  // methods.
+  //
+  // When ACL is enabled for the
+  // [DataStore][google.cloud.discoveryengine.v1.DataStore],
+  // [Document][google.cloud.discoveryengine.v1.Document] can't be accessed by
+  // calling
+  // [DocumentService.GetDocument][google.cloud.discoveryengine.v1.DocumentService.GetDocument]
+  // or
+  // [DocumentService.ListDocuments][google.cloud.discoveryengine.v1.DocumentService.ListDocuments].
+  //
+  // Currently ACL is only supported in `GENERIC` industry vertical with
+  // non-`PUBLIC_WEBSITE` content config.
+  bool acl_enabled = 24 [(google.api.field_behavior) = IMMUTABLE];
+
   // Config to store data store type configuration for workspace data. This
   // must be set when
   // [DataStore.content_config][google.cloud.discoveryengine.v1.DataStore.content_config]
@@ -160,6 +196,22 @@ message DataStore {
   // Learn more from [this
   // doc](https://cloud.google.com/generative-ai-app-builder/docs/provide-schema).
   Schema starting_schema = 28;
+
+  // Optional. Configuration for `HEALTHCARE_FHIR` vertical.
+  HealthcareFhirConfig healthcare_fhir_config = 29
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Immutable. The fully qualified resource name of the associated
+  // [IdentityMappingStore][google.cloud.discoveryengine.v1.IdentityMappingStore].
+  // This field can only be set for acl_enabled DataStores with `THIRD_PARTY` or
+  // `GSUITE` IdP. Format:
+  // `projects/{project}/locations/{location}/identityMappingStores/{identity_mapping_store}`.
+  string identity_mapping_store = 31 [
+    (google.api.field_behavior) = IMMUTABLE,
+    (google.api.resource_reference) = {
+      type: "discoveryengine.googleapis.com/IdentityMappingStore"
+    }
+  ];
 }
 
 // Configuration data for advance site search.

package/build/protos/google/cloud/discoveryengine/v1/data_store_service.proto

@@ -123,6 +123,20 @@ service DataStoreService {
 // [DataStoreService.CreateDataStore][google.cloud.discoveryengine.v1.DataStoreService.CreateDataStore]
 // method.
 message CreateDataStoreRequest {
+  // CMEK options for the DataStore. Setting this field will override the
+  // default CmekConfig if one is set for the project.
+  oneof cmek_options {
+    // Resource name of the CmekConfig to use for protecting this DataStore.
+    string cmek_config_name = 5 [(google.api.resource_reference) = {
+      type: "discoveryengine.googleapis.com/CmekConfig"
+    }];
+
+    // DataStore without CMEK protections. If a default CmekConfig is set for
+    // the project, setting this field will override the default CmekConfig as
+    // well.
+    bool disable_cmek = 6;
+  }
+
   // Required. The parent resource name, such as
   // `projects/{project}/locations/{location}/collections/{collection}`.
   string parent = 1 [

package/build/protos/google/cloud/discoveryengine/v1/document.proto

@@ -18,6 +18,7 @@ package google.cloud.discoveryengine.v1;
 
 import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
+import "google/cloud/discoveryengine/v1/common.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/timestamp.proto";
 import "google/rpc/status.proto";
@@ -42,6 +43,7 @@ message Document {
 
   // Unstructured data linked to this document.
   message Content {
+    // The content of the unstructured document.
     oneof content {
       // The content represented as a stream of bytes. The maximum length is
       // 1,000,000 bytes (1 MB / ~0.95 MiB).
@@ -63,14 +65,101 @@ message Document {
     //
     // * `application/pdf` (PDF, only native PDFs are supported for now)
     // * `text/html` (HTML)
+    // * `text/plain` (TXT)
+    // * `application/xml` or `text/xml` (XML)
+    // * `application/json` (JSON)
     // * `application/vnd.openxmlformats-officedocument.wordprocessingml.document` (DOCX)
     // * `application/vnd.openxmlformats-officedocument.presentationml.presentation` (PPTX)
-    // * `text/plain` (TXT)
+    // * `application/vnd.openxmlformats-officedocument.spreadsheetml.sheet`
+    // (XLSX)
+    // * `application/vnd.ms-excel.sheet.macroenabled.12` (XLSM)
+    //
+    // The following types are supported only if layout parser is enabled in the
+    // data store:
+    //
+    // * `image/bmp` (BMP)
+    // * `image/gif` (GIF)
+    // * `image/jpeg` (JPEG)
+    // * `image/png` (PNG)
+    // * `image/tiff` (TIFF)
     //
     // See https://www.iana.org/assignments/media-types/media-types.xhtml.
     string mime_type = 1;
   }
 
+  // ACL Information of the Document.
+  message AclInfo {
+    // AclRestriction to model complex inheritance restrictions.
+    //
+    // Example: Modeling a "Both Permit" inheritance, where to access a
+    // child document, user needs to have access to parent document.
+    //
+    // Document Hierarchy - Space_S --> Page_P.
+    //
+    // Readers:
+    //   Space_S: group_1, user_1
+    //   Page_P: group_2, group_3, user_2
+    //
+    // Space_S ACL Restriction -
+    // {
+    //   "acl_info": {
+    //     "readers": [
+    //       {
+    //         "principals": [
+    //           {
+    //             "group_id": "group_1"
+    //           },
+    //           {
+    //             "user_id": "user_1"
+    //           }
+    //         ]
+    //       }
+    //     ]
+    //   }
+    // }
+    //
+    // Page_P ACL Restriction.
+    // {
+    //   "acl_info": {
+    //     "readers": [
+    //       {
+    //         "principals": [
+    //           {
+    //             "group_id": "group_2"
+    //           },
+    //           {
+    //             "group_id": "group_3"
+    //           },
+    //           {
+    //             "user_id": "user_2"
+    //           }
+    //         ],
+    //       },
+    //       {
+    //         "principals": [
+    //           {
+    //             "group_id": "group_1"
+    //           },
+    //           {
+    //             "user_id": "user_1"
+    //           }
+    //         ],
+    //       }
+    //     ]
+    //   }
+    // }
+    message AccessRestriction {
+      // List of principals.
+      repeated Principal principals = 1;
+
+      // All users within the Identity Provider.
+      bool idp_wide = 2;
+    }
+
+    // Readers of the document.
+    repeated AccessRestriction readers = 1;
+  }
+
   // Index status of the document.
   message IndexStatus {
     // The time when the document was indexed.
@@ -119,9 +208,8 @@ message Document {
   // The identifier of the schema located in the same data store.
   string schema_id = 3;
 
-  // The unstructured data linked to this document. Content must be set if this
-  // document is under a
-  // `CONTENT_REQUIRED` data store.
+  // The unstructured data linked to this document. Content can only be set
+  // and must be set if this document is under a `CONTENT_REQUIRED` data store.
   Content content = 10;
 
   // The identifier of the parent document. Currently supports at most two level
@@ -136,6 +224,9 @@ message Document {
   google.protobuf.Struct derived_struct_data = 6
       [(google.api.field_behavior) = OUTPUT_ONLY];
 
+  // Access control information for the document.
+  AclInfo acl_info = 11;
+
   // Output only. The last time the document was indexed. If this field is set,
   // the document could be returned in search results.
   //

package/build/protos/google/cloud/discoveryengine/v1/document_processing_config.proto

@@ -82,7 +82,34 @@ message DocumentProcessingConfig {
     }
 
     // The layout parsing configurations for documents.
-    message LayoutParsingConfig {}
+    message LayoutParsingConfig {
+      // Optional. If true, the LLM based annotation is added to the table
+      // during parsing.
+      bool enable_table_annotation = 1 [(google.api.field_behavior) = OPTIONAL];
+
+      // Optional. If true, the LLM based annotation is added to the image
+      // during parsing.
+      bool enable_image_annotation = 2 [(google.api.field_behavior) = OPTIONAL];
+
+      // Optional. Contains the required structure types to extract from the
+      // document. Supported values:
+      //
+      // * `shareholder-structure`
+      repeated string structured_content_types = 9
+          [(google.api.field_behavior) = OPTIONAL];
+
+      // Optional. List of HTML elements to exclude from the parsed content.
+      repeated string exclude_html_elements = 10
+          [(google.api.field_behavior) = OPTIONAL];
+
+      // Optional. List of HTML classes to exclude from the parsed content.
+      repeated string exclude_html_classes = 11
+          [(google.api.field_behavior) = OPTIONAL];
+
+      // Optional. List of HTML ids to exclude from the parsed content.
+      repeated string exclude_html_ids = 12
+          [(google.api.field_behavior) = OPTIONAL];
+    }
 
     // Configs for document processing types.
     oneof type_dedicated_config {

package/build/protos/google/cloud/discoveryengine/v1/engine.proto

@@ -54,6 +54,118 @@ message Engine {
     repeated SearchAddOn search_add_ons = 2;
   }
 
+  // Additional config specs for a Media Recommendation engine.
+  message MediaRecommendationEngineConfig {
+    // Custom threshold for `cvr` optimization_objective.
+    message OptimizationObjectiveConfig {
+      // Required. The name of the field to target. Currently supported
+      // values: `watch-percentage`, `watch-time`.
+      string target_field = 1 [(google.api.field_behavior) = REQUIRED];
+
+      // Required. The threshold to be applied to the target (e.g., 0.5).
+      float target_field_value_float = 2
+          [(google.api.field_behavior) = REQUIRED];
+    }
+
+    // More feature configs of the selected engine type.
+    message EngineFeaturesConfig {
+      // Feature related configurations applied to a specific type of meida
+      // recommendation engines.
+      oneof type_dedicated_config {
+        // Recommended for you engine feature config.
+        RecommendedForYouFeatureConfig recommended_for_you_config = 1;
+
+        // Most popular engine feature config.
+        MostPopularFeatureConfig most_popular_config = 2;
+      }
+    }
+
+    // Additional feature configurations for creating a `recommended-for-you`
+    // engine.
+    message RecommendedForYouFeatureConfig {
+      // The type of event with which the engine is queried at prediction time.
+      // If set to `generic`, only `view-item`, `media-play`,and
+      // `media-complete` will be used as `context-event` in engine training. If
+      // set to `view-home-page`, `view-home-page` will also be used as
+      // `context-events` in addition to `view-item`, `media-play`, and
+      // `media-complete`. Currently supported for the `recommended-for-you`
+      // engine. Currently supported values: `view-home-page`, `generic`.
+      string context_event_type = 1;
+    }
+
+    // Feature configurations that are required for creating a Most Popular
+    // engine.
+    message MostPopularFeatureConfig {
+      // The time window of which the engine is queried at training and
+      // prediction time. Positive integers only. The value translates to the
+      // last X days of events. Currently required for the `most-popular-items`
+      // engine.
+      int64 time_window_days = 1;
+    }
+
+    // The training state of the engine.
+    enum TrainingState {
+      // Unspecified training state.
+      TRAINING_STATE_UNSPECIFIED = 0;
+
+      // The engine training is paused.
+      PAUSED = 1;
+
+      // The engine is training.
+      TRAINING = 2;
+    }
+
+    // Required. The type of engine. e.g., `recommended-for-you`.
+    //
+    // This field together with
+    // [optimization_objective][google.cloud.discoveryengine.v1.Engine.MediaRecommendationEngineConfig.optimization_objective]
+    // describe engine metadata to use to control engine training and serving.
+    //
+    // Currently supported values: `recommended-for-you`, `others-you-may-like`,
+    // `more-like-this`, `most-popular-items`.
+    string type = 1 [(google.api.field_behavior) = REQUIRED];
+
+    // The optimization objective. e.g., `cvr`.
+    //
+    // This field together with
+    // [optimization_objective][google.cloud.discoveryengine.v1.Engine.MediaRecommendationEngineConfig.type]
+    // describe engine metadata to use to control engine training and serving.
+    //
+    // Currently supported
+    // values: `ctr`, `cvr`.
+    //
+    //  If not specified, we choose default based on engine type.
+    // Default depends on type of recommendation:
+    //
+    // `recommended-for-you` => `ctr`
+    //
+    // `others-you-may-like` => `ctr`
+    string optimization_objective = 2;
+
+    // Name and value of the custom threshold for cvr optimization_objective.
+    // For target_field `watch-time`, target_field_value must be an integer
+    // value indicating the media progress time in seconds between (0, 86400]
+    // (excludes 0, includes 86400) (e.g., 90).
+    // For target_field `watch-percentage`, the target_field_value must be a
+    // valid float value between (0, 1.0] (excludes 0, includes 1.0) (e.g.,
+    // 0.5).
+    OptimizationObjectiveConfig optimization_objective_config = 3;
+
+    // The training state that the engine is in (e.g.
+    // `TRAINING` or `PAUSED`).
+    //
+    // Since part of the cost of running the service
+    // is frequency of training - this can be used to determine when to train
+    // engine in order to control cost. If not specified: the default value for
+    // `CreateEngine` method is `TRAINING`. The default value for
+    // `UpdateEngine` method is to keep the state the same as before.
+    TrainingState training_state = 4;
+
+    // Optional. Additional engine features config.
+    EngineFeaturesConfig engine_features_config = 5
+        [(google.api.field_behavior) = OPTIONAL];
+  }
+
   // Configurations for a Chat Engine.
   message ChatEngineConfig {
     // Configurations for generating a Dialogflow agent.
@@ -159,6 +271,15 @@ message Engine {
     // [solution_type][google.cloud.discoveryengine.v1.Engine.solution_type] is
     // [SOLUTION_TYPE_SEARCH][google.cloud.discoveryengine.v1.SolutionType.SOLUTION_TYPE_SEARCH].
     SearchEngineConfig search_engine_config = 13;
+
+    // Configurations for the Media Engine. Only applicable on the data
+    // stores with
+    // [solution_type][google.cloud.discoveryengine.v1.Engine.solution_type]
+    // [SOLUTION_TYPE_RECOMMENDATION][google.cloud.discoveryengine.v1.SolutionType.SOLUTION_TYPE_RECOMMENDATION]
+    // and
+    // [IndustryVertical.MEDIA][google.cloud.discoveryengine.v1.IndustryVertical.MEDIA]
+    // vertical.
+    MediaRecommendationEngineConfig media_recommendation_engine_config = 14;
   }
 
   // Engine metadata to monitor the status of the engine.
@@ -171,7 +292,7 @@ message Engine {
         [(google.api.field_behavior) = OUTPUT_ONLY];
   }
 
-  // Immutable. The fully qualified resource name of the engine.
+  // Immutable. Identifier. The fully qualified resource name of the engine.
   //
   // This field must be a UTF-8 encoded string with a length limit of 1024
   // characters.
@@ -180,7 +301,10 @@ message Engine {
   // `projects/{project}/locations/{location}/collections/{collection}/engines/{engine}`
   // engine should be 1-63 characters, and valid characters are
   // /[a-z0-9][a-z0-9-_]*/. Otherwise, an INVALID_ARGUMENT error is returned.
-  string name = 1 [(google.api.field_behavior) = IMMUTABLE];
+  string name = 1 [
+    (google.api.field_behavior) = IMMUTABLE,
+    (google.api.field_behavior) = IDENTIFIER
+  ];
 
   // Required. The display name of the engine. Should be human readable. UTF-8
   // encoded string with limit of 1024 characters.
@@ -194,7 +318,7 @@ message Engine {
   google.protobuf.Timestamp update_time = 4
       [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // The data stores associated with this engine.
+  // Optional. The data stores associated with this engine.
   //
   // For
   // [SOLUTION_TYPE_SEARCH][google.cloud.discoveryengine.v1.SolutionType.SOLUTION_TYPE_SEARCH]
@@ -212,16 +336,17 @@ message Engine {
   // [CreateEngineRequest][google.cloud.discoveryengine.v1.CreateEngineRequest],
   // one DataStore id must be provided as the system will use it for necessary
   // initializations.
-  repeated string data_store_ids = 5;
+  repeated string data_store_ids = 5 [(google.api.field_behavior) = OPTIONAL];
 
   // Required. The solutions of the engine.
   SolutionType solution_type = 6 [(google.api.field_behavior) = REQUIRED];
 
-  // The industry vertical that the engine registers.
+  // Optional. The industry vertical that the engine registers.
   // The restriction of the Engine industry vertical is based on
   // [DataStore][google.cloud.discoveryengine.v1.DataStore]: Vertical on Engine
   // has to match vertical of the DataStore linked to the engine.
-  IndustryVertical industry_vertical = 16;
+  IndustryVertical industry_vertical = 16
+      [(google.api.field_behavior) = OPTIONAL];
 
   // Common config spec that specifies the metadata of the engine.
   CommonConfig common_config = 15;

package/build/protos/google/cloud/discoveryengine/v1/grounded_generation_service.proto

@@ -438,6 +438,9 @@ message CheckGroundingSpec {
   // threshold may lead to more but somewhat weaker citations. If unset, the
   // threshold will default to 0.6.
   optional double citation_threshold = 1;
+
+  // The control flag that enables claim-level grounding score in the response.
+  optional bool enable_claim_level_score = 4;
 }
 
 // Request message for
@@ -531,6 +534,11 @@ message CheckGroundingResponse {
     // [citation_indices][google.cloud.discoveryengine.v1.CheckGroundingResponse.Claim.citation_indices]
     // should not be returned.
     optional bool grounding_check_required = 6;
+
+    // Confidence score for the claim in the answer candidate, in the range of
+    // [0, 1]. This is set only when
+    // `CheckGroundingRequest.grounding_spec.enable_claim_level_score` is true.
+    optional double score = 7;
   }
 
   // The support score for the input answer candidate.

package/build/protos/google/cloud/discoveryengine/v1/grounding.proto

@@ -55,4 +55,13 @@ message FactChunk {
 
   // More fine-grained information for the source reference.
   map<string, string> source_metadata = 3;
+
+  // The URI of the source.
+  string uri = 5;
+
+  // The title of the source.
+  string title = 6;
+
+  // The domain of the source.
+  string domain = 7;
 }

package/build/protos/google/cloud/discoveryengine/v1/identity_mapping_store.proto

@@ -0,0 +1,84 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.discoveryengine.v1;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/cloud/discoveryengine/v1/cmek_config_service.proto";
+
+option csharp_namespace = "Google.Cloud.DiscoveryEngine.V1";
+option go_package = "cloud.google.com/go/discoveryengine/apiv1/discoveryenginepb;discoveryenginepb";
+option java_multiple_files = true;
+option java_outer_classname = "IdentityMappingStoreProto";
+option java_package = "com.google.cloud.discoveryengine.v1";
+option objc_class_prefix = "DISCOVERYENGINE";
+option php_namespace = "Google\\Cloud\\DiscoveryEngine\\V1";
+option ruby_package = "Google::Cloud::DiscoveryEngine::V1";
+
+// Identity Mapping Store which contains Identity Mapping Entries.
+message IdentityMappingStore {
+  option (google.api.resource) = {
+    type: "discoveryengine.googleapis.com/IdentityMappingStore"
+    pattern: "projects/{project}/locations/{location}/identityMappingStores/{identity_mapping_store}"
+  };
+
+  // Immutable. The full resource name of the identity mapping store.
+  // Format:
+  // `projects/{project}/locations/{location}/identityMappingStores/{identity_mapping_store}`.
+  // This field must be a UTF-8 encoded string with a length limit of 1024
+  // characters.
+  string name = 1 [(google.api.field_behavior) = IMMUTABLE];
+
+  // Input only. The KMS key to be used to protect this Identity Mapping Store
+  // at creation time.
+  //
+  // Must be set for requests that need to comply with CMEK Org Policy
+  // protections.
+  //
+  // If this field is set and processed successfully, the Identity Mapping Store
+  // will be protected by the KMS key, as indicated in the cmek_config field.
+  string kms_key_name = 3 [(google.api.field_behavior) = INPUT_ONLY];
+
+  // Output only. CMEK-related information for the Identity Mapping Store.
+  CmekConfig cmek_config = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
+
+// Identity Mapping Entry that maps an external identity to an internal
+// identity.
+message IdentityMappingEntry {
+  // Union field identity_provider_id. Identity Provider id can be a user or a
+  // group.
+  oneof identity_provider_id {
+    // User identifier.
+    // For Google Workspace user account, user_id should be the google workspace
+    // user email.
+    // For non-google identity provider, user_id is the mapped user identifier
+    // configured during the workforcepool config.
+    string user_id = 2;
+
+    // Group identifier.
+    // For Google Workspace user account, group_id should be the google
+    // workspace group email.
+    // For non-google identity provider, group_id is the mapped group identifier
+    // configured during the workforcepool config.
+    string group_id = 3;
+  }
+
+  // Required. Identity outside the customer identity provider.
+  // The length limit of external identity will be of 100 characters.
+  string external_identity = 1 [(google.api.field_behavior) = REQUIRED];
+}