google-api-python-client 2.187.0__py3-none-any.whl → 2.189.0__py3-none-any.whl

googleapiclient/discovery_cache/documents/cloudkms.v1.json

@@ -203,7 +203,7 @@
 "folders": {
 "methods": {
 "getAutokeyConfig": {
-"description": "Returns the AutokeyConfig for a folder.",
+"description": "Returns the AutokeyConfig for a folder or project.",
 "flatPath": "v1/folders/{foldersId}/autokeyConfig",
 "httpMethod": "GET",
 "id": "cloudkms.folders.getAutokeyConfig",
@@ -212,7 +212,7 @@
 ],
 "parameters": {
 "name": {
-"description": "Required. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`.",
+"description": "Required. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig` or `projects/{PROJECT_NUMBER}/autokeyConfig`.",
 "location": "path",
 "pattern": "^folders/[^/]+/autokeyConfig$",
 "required": true,
@@ -255,7 +255,7 @@
 ]
 },
 "updateAutokeyConfig": {
-"description": "Updates the AutokeyConfig for a folder. The caller must have both `cloudkms.autokeyConfigs.update` permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy` permission on the provided key project. A KeyHandle creation in the folder's descendant projects will use this configuration to determine where to create the resulting CryptoKey.",
+"description": "Updates the AutokeyConfig for a folder or a project. The caller must have both `cloudkms.autokeyConfigs.update` permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy` permission on the provided key project. A KeyHandle creation in the folder's descendant projects will use this configuration to determine where to create the resulting CryptoKey.",
 "flatPath": "v1/folders/{foldersId}/autokeyConfig",
 "httpMethod": "PATCH",
 "id": "cloudkms.folders.updateAutokeyConfig",
@@ -264,7 +264,7 @@
 ],
 "parameters": {
 "name": {
-"description": "Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig` `projects/{PROJECT_NUMBER}/autokeyConfig`.",
+"description": "Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`",
 "location": "path",
 "pattern": "^folders/[^/]+/autokeyConfig$",
 "required": true,
@@ -393,6 +393,32 @@
 },
 "projects": {
 "methods": {
+"getAutokeyConfig": {
+"description": "Returns the AutokeyConfig for a folder or project.",
+"flatPath": "v1/projects/{projectsId}/autokeyConfig",
+"httpMethod": "GET",
+"id": "cloudkms.projects.getAutokeyConfig",
+"parameterOrder": [
+"name"
+],
+"parameters": {
+"name": {
+"description": "Required. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig` or `projects/{PROJECT_NUMBER}/autokeyConfig`.",
+"location": "path",
+"pattern": "^projects/[^/]+/autokeyConfig$",
+"required": true,
+"type": "string"
+}
+},
+"path": "v1/{+name}",
+"response": {
+"$ref": "AutokeyConfig"
+},
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
+},
 "getKajPolicyConfig": {
 "description": "Gets the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.",
 "flatPath": "v1/projects/{projectsId}/kajPolicyConfig",
@@ -497,6 +523,41 @@
 "https://www.googleapis.com/auth/cloudkms"
 ]
 },
+"updateAutokeyConfig": {
+"description": "Updates the AutokeyConfig for a folder or a project. The caller must have both `cloudkms.autokeyConfigs.update` permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy` permission on the provided key project. A KeyHandle creation in the folder's descendant projects will use this configuration to determine where to create the resulting CryptoKey.",
+"flatPath": "v1/projects/{projectsId}/autokeyConfig",
+"httpMethod": "PATCH",
+"id": "cloudkms.projects.updateAutokeyConfig",
+"parameterOrder": [
+"name"
+],
+"parameters": {
+"name": {
+"description": "Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`",
+"location": "path",
+"pattern": "^projects/[^/]+/autokeyConfig$",
+"required": true,
+"type": "string"
+},
+"updateMask": {
+"description": "Required. Masks which fields of the AutokeyConfig to update, e.g. `keyProject`.",
+"format": "google-fieldmask",
+"location": "query",
+"type": "string"
+}
+},
+"path": "v1/{+name}",
+"request": {
+"$ref": "AutokeyConfig"
+},
+"response": {
+"$ref": "AutokeyConfig"
+},
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
+},
 "updateKajPolicyConfig": {
 "description": "Updates the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.",
 "flatPath": "v1/projects/{projectsId}/kajPolicyConfig",
@@ -2429,172 +2490,526 @@
 ]
 }
 }
-}
-}
-}
-}
-}
 },
-"revision": "20251023",
-"rootUrl": "https://cloudkms.googleapis.com/",
-"schemas": {
-"AsymmetricDecryptRequest": {
-"description": "Request message for KeyManagementService.AsymmetricDecrypt.",
-"id": "AsymmetricDecryptRequest",
-"properties": {
-"ciphertext": {
-"description": "Required. The data encrypted with the named CryptoKeyVersion's public key using OAEP.",
-"format": "byte",
+"singleTenantHsmInstances": {
+"methods": {
+"create": {
+"description": "Creates a new SingleTenantHsmInstance in a given Project and Location. User must create a RegisterTwoFactorAuthKeys proposal with this single-tenant HSM instance to finish setup of the instance.",
+"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/singleTenantHsmInstances",
+"httpMethod": "POST",
+"id": "cloudkms.projects.locations.singleTenantHsmInstances.create",
+"parameterOrder": [
+"parent"
+],
+"parameters": {
+"parent": {
+"description": "Required. The resource name of the location associated with the SingleTenantHsmInstance, in the format `projects/*/locations/*`.",
+"location": "path",
+"pattern": "^projects/[^/]+/locations/[^/]+$",
+"required": true,
 "type": "string"
 },
-"ciphertextCrc32c": {
-"description": "Optional. An optional CRC32C checksum of the AsymmetricDecryptRequest.ciphertext. If specified, KeyManagementService will verify the integrity of the received AsymmetricDecryptRequest.ciphertext using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(AsymmetricDecryptRequest.ciphertext) is equal to AsymmetricDecryptRequest.ciphertext_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
-"format": "int64",
+"singleTenantHsmInstanceId": {
+"description": "Optional. It must be unique within a location and match the regular expression `[a-zA-Z0-9_-]{1,63}`.",
+"location": "query",
 "type": "string"
 }
 },
-"type": "object"
+"path": "v1/{+parent}/singleTenantHsmInstances",
+"request": {
+"$ref": "SingleTenantHsmInstance"
 },
-"AsymmetricDecryptResponse": {
-"description": "Response message for KeyManagementService.AsymmetricDecrypt.",
-"id": "AsymmetricDecryptResponse",
-"properties": {
-"plaintext": {
-"description": "The decrypted data originally encrypted with the matching public key.",
-"format": "byte",
-"type": "string"
+"response": {
+"$ref": "Operation"
 },
-"plaintextCrc32c": {
-"description": "Integrity verification field. A CRC32C checksum of the returned AsymmetricDecryptResponse.plaintext. An integrity check of AsymmetricDecryptResponse.plaintext can be performed by computing the CRC32C checksum of AsymmetricDecryptResponse.plaintext and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
-"format": "int64",
-"type": "string"
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
 },
-"protectionLevel": {
-"description": "The ProtectionLevel of the CryptoKeyVersion used in decryption.",
-"enum": [
-"PROTECTION_LEVEL_UNSPECIFIED",
-"SOFTWARE",
-"HSM",
-"EXTERNAL",
-"EXTERNAL_VPC"
-],
-"enumDescriptions": [
-"Not specified.",
-"Crypto operations are performed in software.",
-"Crypto operations are performed in a Hardware Security Module.",
-"Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"get": {
+"description": "Returns metadata for a given SingleTenantHsmInstance.",
+"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/singleTenantHsmInstances/{singleTenantHsmInstancesId}",
+"httpMethod": "GET",
+"id": "cloudkms.projects.locations.singleTenantHsmInstances.get",
+"parameterOrder": [
+"name"
 ],
+"parameters": {
+"name": {
+"description": "Required. The name of the SingleTenantHsmInstance to get.",
+"location": "path",
+"pattern": "^projects/[^/]+/locations/[^/]+/singleTenantHsmInstances/[^/]+$",
+"required": true,
 "type": "string"
-},
-"verifiedCiphertextCrc32c": {
-"description": "Integrity verification field. A flag indicating whether AsymmetricDecryptRequest.ciphertext_crc32c was received by KeyManagementService and used for the integrity verification of the ciphertext. A false value of this field indicates either that AsymmetricDecryptRequest.ciphertext_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set AsymmetricDecryptRequest.ciphertext_crc32c but this field is still false, discard the response and perform a limited number of retries.",
-"type": "boolean"
 }
 },
-"type": "object"
-},
-"AsymmetricSignRequest": {
-"description": "Request message for KeyManagementService.AsymmetricSign.",
-"id": "AsymmetricSignRequest",
-"properties": {
-"data": {
-"description": "Optional. The data to sign. It can't be supplied if AsymmetricSignRequest.digest is supplied.",
-"format": "byte",
-"type": "string"
-},
-"dataCrc32c": {
-"description": "Optional. An optional CRC32C checksum of the AsymmetricSignRequest.data. If specified, KeyManagementService will verify the integrity of the received AsymmetricSignRequest.data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(AsymmetricSignRequest.data) is equal to AsymmetricSignRequest.data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
-"format": "int64",
-"type": "string"
+"path": "v1/{+name}",
+"response": {
+"$ref": "SingleTenantHsmInstance"
 },
-"digest": {
-"$ref": "Digest",
-"description": "Optional. The digest of the data to sign. The digest must be produced with the same digest algorithm as specified by the key version's algorithm. This field may not be supplied if AsymmetricSignRequest.data is supplied."
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
 },
-"digestCrc32c": {
-"description": "Optional. An optional CRC32C checksum of the AsymmetricSignRequest.digest. If specified, KeyManagementService will verify the integrity of the received AsymmetricSignRequest.digest using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(AsymmetricSignRequest.digest) is equal to AsymmetricSignRequest.digest_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
-"format": "int64",
+"list": {
+"description": "Lists SingleTenantHsmInstances.",
+"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/singleTenantHsmInstances",
+"httpMethod": "GET",
+"id": "cloudkms.projects.locations.singleTenantHsmInstances.list",
+"parameterOrder": [
+"parent"
+],
+"parameters": {
+"filter": {
+"description": "Optional. Only include resources that match the filter in the response. For more information, see [Sorting and filtering list results](https://cloud.google.com/kms/docs/sorting-and-filtering).",
+"location": "query",
 "type": "string"
-}
-},
-"type": "object"
 },
-"AsymmetricSignResponse": {
-"description": "Response message for KeyManagementService.AsymmetricSign.",
-"id": "AsymmetricSignResponse",
-"properties": {
-"name": {
-"description": "The resource name of the CryptoKeyVersion used for signing. Check this field to verify that the intended resource was used for signing.",
+"orderBy": {
+"description": "Optional. Specify how the results should be sorted. If not specified, the results will be sorted in the default order. For more information, see [Sorting and filtering list results](https://cloud.google.com/kms/docs/sorting-and-filtering).",
+"location": "query",
 "type": "string"
 },
-"protectionLevel": {
-"description": "The ProtectionLevel of the CryptoKeyVersion used for signing.",
-"enum": [
-"PROTECTION_LEVEL_UNSPECIFIED",
-"SOFTWARE",
-"HSM",
-"EXTERNAL",
-"EXTERNAL_VPC"
-],
-"enumDescriptions": [
-"Not specified.",
-"Crypto operations are performed in software.",
-"Crypto operations are performed in a Hardware Security Module.",
-"Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
-],
-"type": "string"
+"pageSize": {
+"description": "Optional. Optional limit on the number of SingleTenantHsmInstances to include in the response. Further SingleTenantHsmInstances can subsequently be obtained by including the ListSingleTenantHsmInstancesResponse.next_page_token in a subsequent request. If unspecified, the server will pick an appropriate default.",
+"format": "int32",
+"location": "query",
+"type": "integer"
 },
-"signature": {
-"description": "The created signature.",
-"format": "byte",
+"pageToken": {
+"description": "Optional. Optional pagination token, returned earlier via ListSingleTenantHsmInstancesResponse.next_page_token.",
+"location": "query",
 "type": "string"
 },
-"signatureCrc32c": {
-"description": "Integrity verification field. A CRC32C checksum of the returned AsymmetricSignResponse.signature. An integrity check of AsymmetricSignResponse.signature can be performed by computing the CRC32C checksum of AsymmetricSignResponse.signature and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
-"format": "int64",
+"parent": {
+"description": "Required. The resource name of the location associated with the SingleTenantHsmInstances to list, in the format `projects/*/locations/*`.",
+"location": "path",
+"pattern": "^projects/[^/]+/locations/[^/]+$",
+"required": true,
 "type": "string"
 },
-"verifiedDataCrc32c": {
-"description": "Integrity verification field. A flag indicating whether AsymmetricSignRequest.data_crc32c was received by KeyManagementService and used for the integrity verification of the data. A false value of this field indicates either that AsymmetricSignRequest.data_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set AsymmetricSignRequest.data_crc32c but this field is still false, discard the response and perform a limited number of retries.",
-"type": "boolean"
-},
-"verifiedDigestCrc32c": {
-"description": "Integrity verification field. A flag indicating whether AsymmetricSignRequest.digest_crc32c was received by KeyManagementService and used for the integrity verification of the digest. A false value of this field indicates either that AsymmetricSignRequest.digest_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set AsymmetricSignRequest.digest_crc32c but this field is still false, discard the response and perform a limited number of retries.",
+"showDeleted": {
+"description": "Optional. If set to true, HsmManagement.ListSingleTenantHsmInstances will also return SingleTenantHsmInstances in DELETED state.",
+"location": "query",
 "type": "boolean"
 }
 },
-"type": "object"
-},
-"AuditConfig": {
-"description": "Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { \"audit_configs\": [ { \"service\": \"allServices\", \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\", \"exempted_members\": [ \"user:jose@example.com\" ] }, { \"log_type\": \"DATA_WRITE\" }, { \"log_type\": \"ADMIN_READ\" } ] }, { \"service\": \"sampleservice.googleapis.com\", \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\" }, { \"log_type\": \"DATA_WRITE\", \"exempted_members\": [ \"user:aliya@example.com\" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.",
-"id": "AuditConfig",
-"properties": {
-"auditLogConfigs": {
-"description": "The configuration for logging of each type of permission.",
-"items": {
-"$ref": "AuditLogConfig"
+"path": "v1/{+parent}/singleTenantHsmInstances",
+"response": {
+"$ref": "ListSingleTenantHsmInstancesResponse"
 },
-"type": "array"
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
+}
 },
-"service": {
-"description": "Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.",
+"resources": {
+"proposals": {
+"methods": {
+"approve": {
+"description": "Approves a SingleTenantHsmInstanceProposal for a given SingleTenantHsmInstance. The proposal must be in the PENDING state.",
+"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/singleTenantHsmInstances/{singleTenantHsmInstancesId}/proposals/{proposalsId}:approve",
+"httpMethod": "POST",
+"id": "cloudkms.projects.locations.singleTenantHsmInstances.proposals.approve",
+"parameterOrder": [
+"name"
+],
+"parameters": {
+"name": {
+"description": "Required. The name of the SingleTenantHsmInstanceProposal to approve.",
+"location": "path",
+"pattern": "^projects/[^/]+/locations/[^/]+/singleTenantHsmInstances/[^/]+/proposals/[^/]+$",
+"required": true,
 "type": "string"
 }
 },
-"type": "object"
+"path": "v1/{+name}:approve",
+"request": {
+"$ref": "ApproveSingleTenantHsmInstanceProposalRequest"
 },
-"AuditLogConfig": {
-"description": "Provides the configuration for logging a type of permissions. Example: { \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\", \"exempted_members\": [ \"user:jose@example.com\" ] }, { \"log_type\": \"DATA_WRITE\" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.",
-"id": "AuditLogConfig",
-"properties": {
-"exemptedMembers": {
-"description": "Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.",
-"items": {
-"type": "string"
+"response": {
+"$ref": "ApproveSingleTenantHsmInstanceProposalResponse"
 },
-"type": "array"
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
+},
+"create": {
+"description": "Creates a new SingleTenantHsmInstanceProposal for a given SingleTenantHsmInstance.",
+"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/singleTenantHsmInstances/{singleTenantHsmInstancesId}/proposals",
+"httpMethod": "POST",
+"id": "cloudkms.projects.locations.singleTenantHsmInstances.proposals.create",
+"parameterOrder": [
+"parent"
+],
+"parameters": {
+"parent": {
+"description": "Required. The name of the SingleTenantHsmInstance associated with the SingleTenantHsmInstanceProposals.",
+"location": "path",
+"pattern": "^projects/[^/]+/locations/[^/]+/singleTenantHsmInstances/[^/]+$",
+"required": true,
+"type": "string"
+},
+"singleTenantHsmInstanceProposalId": {
+"description": "Optional. It must be unique within a location and match the regular expression `[a-zA-Z0-9_-]{1,63}`.",
+"location": "query",
+"type": "string"
+}
+},
+"path": "v1/{+parent}/proposals",
+"request": {
+"$ref": "SingleTenantHsmInstanceProposal"
+},
+"response": {
+"$ref": "Operation"
+},
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
+},
+"delete": {
+"description": "Deletes a SingleTenantHsmInstanceProposal.",
+"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/singleTenantHsmInstances/{singleTenantHsmInstancesId}/proposals/{proposalsId}",
+"httpMethod": "DELETE",
+"id": "cloudkms.projects.locations.singleTenantHsmInstances.proposals.delete",
+"parameterOrder": [
+"name"
+],
+"parameters": {
+"name": {
+"description": "Required. The name of the SingleTenantHsmInstanceProposal to delete.",
+"location": "path",
+"pattern": "^projects/[^/]+/locations/[^/]+/singleTenantHsmInstances/[^/]+/proposals/[^/]+$",
+"required": true,
+"type": "string"
+}
+},
+"path": "v1/{+name}",
+"response": {
+"$ref": "Empty"
+},
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
+},
+"execute": {
+"description": "Executes a SingleTenantHsmInstanceProposal for a given SingleTenantHsmInstance. The proposal must be in the APPROVED state.",
+"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/singleTenantHsmInstances/{singleTenantHsmInstancesId}/proposals/{proposalsId}:execute",
+"httpMethod": "POST",
+"id": "cloudkms.projects.locations.singleTenantHsmInstances.proposals.execute",
+"parameterOrder": [
+"name"
+],
+"parameters": {
+"name": {
+"description": "Required. The name of the SingleTenantHsmInstanceProposal to execute.",
+"location": "path",
+"pattern": "^projects/[^/]+/locations/[^/]+/singleTenantHsmInstances/[^/]+/proposals/[^/]+$",
+"required": true,
+"type": "string"
+}
+},
+"path": "v1/{+name}:execute",
+"request": {
+"$ref": "ExecuteSingleTenantHsmInstanceProposalRequest"
+},
+"response": {
+"$ref": "Operation"
+},
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
+},
+"get": {
+"description": "Returns metadata for a given SingleTenantHsmInstanceProposal.",
+"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/singleTenantHsmInstances/{singleTenantHsmInstancesId}/proposals/{proposalsId}",
+"httpMethod": "GET",
+"id": "cloudkms.projects.locations.singleTenantHsmInstances.proposals.get",
+"parameterOrder": [
+"name"
+],
+"parameters": {
+"name": {
+"description": "Required. The name of the SingleTenantHsmInstanceProposal to get.",
+"location": "path",
+"pattern": "^projects/[^/]+/locations/[^/]+/singleTenantHsmInstances/[^/]+/proposals/[^/]+$",
+"required": true,
+"type": "string"
+}
+},
+"path": "v1/{+name}",
+"response": {
+"$ref": "SingleTenantHsmInstanceProposal"
+},
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
+},
+"list": {
+"description": "Lists SingleTenantHsmInstanceProposals.",
+"flatPath": "v1/projects/{projectsId}/locations/{locationsId}/singleTenantHsmInstances/{singleTenantHsmInstancesId}/proposals",
+"httpMethod": "GET",
+"id": "cloudkms.projects.locations.singleTenantHsmInstances.proposals.list",
+"parameterOrder": [
+"parent"
+],
+"parameters": {
+"filter": {
+"description": "Optional. Only include resources that match the filter in the response. For more information, see [Sorting and filtering list results](https://cloud.google.com/kms/docs/sorting-and-filtering).",
+"location": "query",
+"type": "string"
+},
+"orderBy": {
+"description": "Optional. Specify how the results should be sorted. If not specified, the results will be sorted in the default order. For more information, see [Sorting and filtering list results](https://cloud.google.com/kms/docs/sorting-and-filtering).",
+"location": "query",
+"type": "string"
+},
+"pageSize": {
+"description": "Optional. Optional limit on the number of SingleTenantHsmInstanceProposals to include in the response. Further SingleTenantHsmInstanceProposals can subsequently be obtained by including the ListSingleTenantHsmInstanceProposalsResponse.next_page_token in a subsequent request. If unspecified, the server will pick an appropriate default.",
+"format": "int32",
+"location": "query",
+"type": "integer"
+},
+"pageToken": {
+"description": "Optional. Optional pagination token, returned earlier via ListSingleTenantHsmInstanceProposalsResponse.next_page_token.",
+"location": "query",
+"type": "string"
+},
+"parent": {
+"description": "Required. The resource name of the single tenant HSM instance associated with the SingleTenantHsmInstanceProposals to list, in the format `projects/*/locations/*/singleTenantHsmInstances/*`.",
+"location": "path",
+"pattern": "^projects/[^/]+/locations/[^/]+/singleTenantHsmInstances/[^/]+$",
+"required": true,
+"type": "string"
+},
+"showDeleted": {
+"description": "Optional. If set to true, HsmManagement.ListSingleTenantHsmInstanceProposals will also return SingleTenantHsmInstanceProposals in DELETED state.",
+"location": "query",
+"type": "boolean"
+}
+},
+"path": "v1/{+parent}/proposals",
+"response": {
+"$ref": "ListSingleTenantHsmInstanceProposalsResponse"
+},
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform",
+"https://www.googleapis.com/auth/cloudkms"
+]
+}
+}
+}
+}
+}
+}
+}
+}
+}
+},
+"revision": "20260116",
+"rootUrl": "https://cloudkms.googleapis.com/",
+"schemas": {
+"AddQuorumMember": {
+"description": "Add a quorum member to the SingleTenantHsmInstance. This will increase the total_approver_count by 1. The SingleTenantHsmInstance must be in the ACTIVE state to perform this operation.",
+"id": "AddQuorumMember",
+"properties": {
+"twoFactorPublicKeyPem": {
+"description": "Required. The public key associated with the 2FA key for the new quorum member to add. Public keys must be associated with RSA 2048 keys.",
+"type": "string"
+}
+},
+"type": "object"
+},
+"ApproveSingleTenantHsmInstanceProposalRequest": {
+"description": "Request message for HsmManagement.ApproveSingleTenantHsmInstanceProposal.",
+"id": "ApproveSingleTenantHsmInstanceProposalRequest",
+"properties": {
+"quorumReply": {
+"$ref": "QuorumReply",
+"description": "Required. The reply to QuorumParameters for approving the proposal."
+},
+"requiredActionQuorumReply": {
+"$ref": "RequiredActionQuorumReply",
+"description": "Required. The reply to RequiredActionQuorumParameters for approving the proposal."
+}
+},
+"type": "object"
+},
+"ApproveSingleTenantHsmInstanceProposalResponse": {
+"description": "Response message for HsmManagement.ApproveSingleTenantHsmInstanceProposal.",
+"id": "ApproveSingleTenantHsmInstanceProposalResponse",
+"properties": {},
+"type": "object"
+},
+"AsymmetricDecryptRequest": {
+"description": "Request message for KeyManagementService.AsymmetricDecrypt.",
+"id": "AsymmetricDecryptRequest",
+"properties": {
+"ciphertext": {
+"description": "Required. The data encrypted with the named CryptoKeyVersion's public key using OAEP.",
+"format": "byte",
+"type": "string"
+},
+"ciphertextCrc32c": {
+"description": "Optional. An optional CRC32C checksum of the AsymmetricDecryptRequest.ciphertext. If specified, KeyManagementService will verify the integrity of the received AsymmetricDecryptRequest.ciphertext using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(AsymmetricDecryptRequest.ciphertext) is equal to AsymmetricDecryptRequest.ciphertext_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
+"format": "int64",
+"type": "string"
+}
+},
+"type": "object"
+},
+"AsymmetricDecryptResponse": {
+"description": "Response message for KeyManagementService.AsymmetricDecrypt.",
+"id": "AsymmetricDecryptResponse",
+"properties": {
+"plaintext": {
+"description": "The decrypted data originally encrypted with the matching public key.",
+"format": "byte",
+"type": "string"
+},
+"plaintextCrc32c": {
+"description": "Integrity verification field. A CRC32C checksum of the returned AsymmetricDecryptResponse.plaintext. An integrity check of AsymmetricDecryptResponse.plaintext can be performed by computing the CRC32C checksum of AsymmetricDecryptResponse.plaintext and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
+"format": "int64",
+"type": "string"
+},
+"protectionLevel": {
+"description": "The ProtectionLevel of the CryptoKeyVersion used in decryption.",
+"enum": [
+"PROTECTION_LEVEL_UNSPECIFIED",
+"SOFTWARE",
+"HSM",
+"EXTERNAL",
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
+],
+"enumDescriptions": [
+"Not specified.",
+"Crypto operations are performed in software.",
+"Crypto operations are performed in a Hardware Security Module.",
+"Crypto operations are performed by an external key manager.",
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
+],
+"type": "string"
+},
+"verifiedCiphertextCrc32c": {
+"description": "Integrity verification field. A flag indicating whether AsymmetricDecryptRequest.ciphertext_crc32c was received by KeyManagementService and used for the integrity verification of the ciphertext. A false value of this field indicates either that AsymmetricDecryptRequest.ciphertext_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set AsymmetricDecryptRequest.ciphertext_crc32c but this field is still false, discard the response and perform a limited number of retries.",
+"type": "boolean"
+}
+},
+"type": "object"
+},
+"AsymmetricSignRequest": {
+"description": "Request message for KeyManagementService.AsymmetricSign.",
+"id": "AsymmetricSignRequest",
+"properties": {
+"data": {
+"description": "Optional. The data to sign. It can't be supplied if AsymmetricSignRequest.digest is supplied.",
+"format": "byte",
+"type": "string"
+},
+"dataCrc32c": {
+"description": "Optional. An optional CRC32C checksum of the AsymmetricSignRequest.data. If specified, KeyManagementService will verify the integrity of the received AsymmetricSignRequest.data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(AsymmetricSignRequest.data) is equal to AsymmetricSignRequest.data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
+"format": "int64",
+"type": "string"
+},
+"digest": {
+"$ref": "Digest",
+"description": "Optional. The digest of the data to sign. The digest must be produced with the same digest algorithm as specified by the key version's algorithm. This field may not be supplied if AsymmetricSignRequest.data is supplied."
+},
+"digestCrc32c": {
+"description": "Optional. An optional CRC32C checksum of the AsymmetricSignRequest.digest. If specified, KeyManagementService will verify the integrity of the received AsymmetricSignRequest.digest using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(AsymmetricSignRequest.digest) is equal to AsymmetricSignRequest.digest_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
+"format": "int64",
+"type": "string"
+}
+},
+"type": "object"
+},
+"AsymmetricSignResponse": {
+"description": "Response message for KeyManagementService.AsymmetricSign.",
+"id": "AsymmetricSignResponse",
+"properties": {
+"name": {
+"description": "The resource name of the CryptoKeyVersion used for signing. Check this field to verify that the intended resource was used for signing.",
+"type": "string"
+},
+"protectionLevel": {
+"description": "The ProtectionLevel of the CryptoKeyVersion used for signing.",
+"enum": [
+"PROTECTION_LEVEL_UNSPECIFIED",
+"SOFTWARE",
+"HSM",
+"EXTERNAL",
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
+],
+"enumDescriptions": [
+"Not specified.",
+"Crypto operations are performed in software.",
+"Crypto operations are performed in a Hardware Security Module.",
+"Crypto operations are performed by an external key manager.",
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
+],
+"type": "string"
+},
+"signature": {
+"description": "The created signature.",
+"format": "byte",
+"type": "string"
+},
+"signatureCrc32c": {
+"description": "Integrity verification field. A CRC32C checksum of the returned AsymmetricSignResponse.signature. An integrity check of AsymmetricSignResponse.signature can be performed by computing the CRC32C checksum of AsymmetricSignResponse.signature and comparing your results to this field. Discard the response in case of non-matching checksum values, and perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.",
+"format": "int64",
+"type": "string"
+},
+"verifiedDataCrc32c": {
+"description": "Integrity verification field. A flag indicating whether AsymmetricSignRequest.data_crc32c was received by KeyManagementService and used for the integrity verification of the data. A false value of this field indicates either that AsymmetricSignRequest.data_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set AsymmetricSignRequest.data_crc32c but this field is still false, discard the response and perform a limited number of retries.",
+"type": "boolean"
+},
+"verifiedDigestCrc32c": {
+"description": "Integrity verification field. A flag indicating whether AsymmetricSignRequest.digest_crc32c was received by KeyManagementService and used for the integrity verification of the digest. A false value of this field indicates either that AsymmetricSignRequest.digest_crc32c was left unset or that it was not delivered to KeyManagementService. If you've set AsymmetricSignRequest.digest_crc32c but this field is still false, discard the response and perform a limited number of retries.",
+"type": "boolean"
+}
+},
+"type": "object"
+},
+"AuditConfig": {
+"description": "Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { \"audit_configs\": [ { \"service\": \"allServices\", \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\", \"exempted_members\": [ \"user:jose@example.com\" ] }, { \"log_type\": \"DATA_WRITE\" }, { \"log_type\": \"ADMIN_READ\" } ] }, { \"service\": \"sampleservice.googleapis.com\", \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\" }, { \"log_type\": \"DATA_WRITE\", \"exempted_members\": [ \"user:aliya@example.com\" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.",
+"id": "AuditConfig",
+"properties": {
+"auditLogConfigs": {
+"description": "The configuration for logging of each type of permission.",
+"items": {
+"$ref": "AuditLogConfig"
+},
+"type": "array"
+},
+"service": {
+"description": "Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.",
+"type": "string"
+}
+},
+"type": "object"
+},
+"AuditLogConfig": {
+"description": "Provides the configuration for logging a type of permissions. Example: { \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\", \"exempted_members\": [ \"user:jose@example.com\" ] }, { \"log_type\": \"DATA_WRITE\" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.",
+"id": "AuditLogConfig",
+"properties": {
+"exemptedMembers": {
+"description": "Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.",
+"items": {
+"type": "string"
+},
+"type": "array"
 },
 "logType": {
 "description": "The log type that this config enables.",
@@ -2616,7 +3031,7 @@
 "type": "object"
 },
 "AutokeyConfig": {
-"description": "Cloud KMS Autokey configuration for a folder or project.",
+"description": "Cloud KMS Autokey configuration for a folder.",
 "id": "AutokeyConfig",
 "properties": {
 "etag": {
@@ -2628,7 +3043,7 @@
 "type": "string"
 },
 "name": {
-"description": "Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig` `projects/{PROJECT_NUMBER}/autokeyConfig`.",
+"description": "Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`",
 "type": "string"
 },
 "state": {
@@ -2739,21 +3154,55 @@
 "items": {
 "type": "string"
 },
-"type": "array"
-},
-"googleCardCerts": {
-"description": "Google card certificate chain corresponding to the attestation.",
-"items": {
+"type": "array"
+},
+"googleCardCerts": {
+"description": "Google card certificate chain corresponding to the attestation.",
+"items": {
+"type": "string"
+},
+"type": "array"
+},
+"googlePartitionCerts": {
+"description": "Google partition certificate chain corresponding to the attestation.",
+"items": {
+"type": "string"
+},
+"type": "array"
+}
+},
+"type": "object"
+},
+"Challenge": {
+"description": "A challenge to be signed by a 2FA key.",
+"id": "Challenge",
+"properties": {
+"challenge": {
+"description": "Output only. The challenge to be signed by the 2FA key indicated by the public key.",
+"format": "byte",
+"readOnly": true,
+"type": "string"
+},
+"publicKeyPem": {
+"description": "Output only. The public key associated with the 2FA key that should sign the challenge.",
+"readOnly": true,
 "type": "string"
+}
 },
-"type": "array"
+"type": "object"
 },
-"googlePartitionCerts": {
-"description": "Google partition certificate chain corresponding to the attestation.",
-"items": {
+"ChallengeReply": {
+"description": "A reply to a challenge signed by a 2FA key.",
+"id": "ChallengeReply",
+"properties": {
+"publicKeyPem": {
+"description": "Required. The public key associated with the 2FA key.",
 "type": "string"
 },
-"type": "array"
+"signedChallenge": {
+"description": "Required. The signed challenge associated with the 2FA key. The signature must be RSASSA-PKCS1 v1.5 with a SHA256 digest.",
+"format": "byte",
+"type": "string"
 }
 },
 "type": "object"
@@ -2786,7 +3235,7 @@
 "type": "string"
 },
 "cryptoKeyBackend": {
-"description": "Immutable. The resource name of the backend environment where the key material for all CryptoKeyVersions associated with this CryptoKey reside and where all related cryptographic operations are performed. Only applicable if CryptoKeyVersions have a ProtectionLevel of EXTERNAL_VPC, with the resource name in the format `projects/*/locations/*/ekmConnections/*`. Note, this list is non-exhaustive and may apply to additional ProtectionLevels in the future.",
+"description": "Immutable. The resource name of the backend environment where the key material for all CryptoKeyVersions associated with this CryptoKey reside and where all related cryptographic operations are performed. Only applicable if CryptoKeyVersions have a ProtectionLevel of EXTERNAL_VPC, with the resource name in the format `projects/*/locations/*/ekmConnections/*`. Only applicable if CryptoKeyVersions have a ProtectionLevel of HSM_SINGLE_TENANT, with the resource name in the format `projects/*/locations/*/singleTenantHsmInstances/*`. Note, this list is non-exhaustive and may apply to additional ProtectionLevels in the future.",
 "type": "string"
 },
 "destroyScheduledDuration": {
@@ -2908,7 +3357,10 @@
 "PQ_SIGN_ML_DSA_65",
 "PQ_SIGN_ML_DSA_87",
 "PQ_SIGN_SLH_DSA_SHA2_128S",
-"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256"
+"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256",
+"PQ_SIGN_ML_DSA_44_EXTERNAL_MU",
+"PQ_SIGN_ML_DSA_65_EXTERNAL_MU",
+"PQ_SIGN_ML_DSA_87_EXTERNAL_MU"
 ],
 "enumDescriptions": [
 "Not specified.",
@@ -2954,7 +3406,10 @@
 "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version.",
 "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 5. Randomized version.",
 "The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized version.",
-"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests."
+"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 1. Randomized version supporting externally-computed message representatives.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version supporting externally-computed message representatives.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 5. Randomized version supporting externally-computed message representatives."
 ],
 "readOnly": true,
 "type": "string"
@@ -3030,14 +3485,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "readOnly": true,
 "type": "string"
@@ -3130,7 +3587,10 @@
 "PQ_SIGN_ML_DSA_65",
 "PQ_SIGN_ML_DSA_87",
 "PQ_SIGN_SLH_DSA_SHA2_128S",
-"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256"
+"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256",
+"PQ_SIGN_ML_DSA_44_EXTERNAL_MU",
+"PQ_SIGN_ML_DSA_65_EXTERNAL_MU",
+"PQ_SIGN_ML_DSA_87_EXTERNAL_MU"
 ],
 "enumDescriptions": [
 "Not specified.",
@@ -3176,7 +3636,10 @@
 "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version.",
 "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 5. Randomized version.",
 "The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized version.",
-"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests."
+"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 1. Randomized version supporting externally-computed message representatives.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version supporting externally-computed message representatives.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 5. Randomized version supporting externally-computed message representatives."
 ],
 "type": "string"
 },
@@ -3187,14 +3650,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 }
@@ -3233,14 +3698,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 },
@@ -3309,14 +3776,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 },
@@ -3327,6 +3796,12 @@
 },
 "type": "object"
 },
+"DeleteSingleTenantHsmInstance": {
+"description": "Delete the SingleTenantHsmInstance. Deleting a SingleTenantHsmInstance will make all CryptoKeys attached to the SingleTenantHsmInstance unusable. The SingleTenantHsmInstance must not be in the DELETING or DELETED state to perform this operation.",
+"id": "DeleteSingleTenantHsmInstance",
+"properties": {},
+"type": "object"
+},
 "DestroyCryptoKeyVersionRequest": {
 "description": "Request message for KeyManagementService.DestroyCryptoKeyVersion.",
 "id": "DestroyCryptoKeyVersionRequest",
@@ -3355,6 +3830,12 @@
 },
 "type": "object"
 },
+"DisableSingleTenantHsmInstance": {
+"description": "Disable the SingleTenantHsmInstance. The SingleTenantHsmInstance must be in the ACTIVE state to perform this operation.",
+"id": "DisableSingleTenantHsmInstance",
+"properties": {},
+"type": "object"
+},
 "EkmConfig": {
 "description": "An EkmConfig is a singleton resource that represents configuration parameters that apply to all CryptoKeys and CryptoKeyVersions with a ProtectionLevel of EXTERNAL_VPC in a given project and location.",
 "id": "EkmConfig",
@@ -3418,6 +3899,18 @@
 },
 "type": "object"
 },
+"Empty": {
+"description": "A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }",
+"id": "Empty",
+"properties": {},
+"type": "object"
+},
+"EnableSingleTenantHsmInstance": {
+"description": "Enable the SingleTenantHsmInstance. The SingleTenantHsmInstance must be in the DISABLED state to perform this operation.",
+"id": "EnableSingleTenantHsmInstance",
+"properties": {},
+"type": "object"
+},
 "EncryptRequest": {
 "description": "Request message for KeyManagementService.Encrypt.",
 "id": "EncryptRequest",
@@ -3470,14 +3963,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 },
@@ -3492,6 +3987,12 @@
 },
 "type": "object"
 },
+"ExecuteSingleTenantHsmInstanceProposalRequest": {
+"description": "Request message for HsmManagement.ExecuteSingleTenantHsmInstanceProposal.",
+"id": "ExecuteSingleTenantHsmInstanceProposalRequest",
+"properties": {},
+"type": "object"
+},
 "Expr": {
 "description": "Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: \"Summary size limit\" description: \"Determines if a summary is less than 100 chars\" expression: \"document.summary.size() < 100\" Example (Equality): title: \"Requestor is owner\" description: \"Determines if requestor is the document owner\" expression: \"document.owner == request.auth.claims.email\" Example (Logic): title: \"Public documents\" description: \"Determine whether the document should be publicly visible\" expression: \"document.type != 'private' && document.type != 'internal'\" Example (Data Manipulation): title: \"Notification string\" description: \"Create a notification string with a timestamp.\" expression: \"'New message received at ' + string(document.create_time)\" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.",
 "id": "Expr",
@@ -3546,14 +4047,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 }
@@ -3627,7 +4130,10 @@
 "PQ_SIGN_ML_DSA_65",
 "PQ_SIGN_ML_DSA_87",
 "PQ_SIGN_SLH_DSA_SHA2_128S",
-"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256"
+"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256",
+"PQ_SIGN_ML_DSA_44_EXTERNAL_MU",
+"PQ_SIGN_ML_DSA_65_EXTERNAL_MU",
+"PQ_SIGN_ML_DSA_87_EXTERNAL_MU"
 ],
 "enumDescriptions": [
 "Not specified.",
@@ -3673,7 +4179,10 @@
 "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version.",
 "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 5. Randomized version.",
 "The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized version.",
-"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests."
+"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 1. Randomized version supporting externally-computed message representatives.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version supporting externally-computed message representatives.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 5. Randomized version supporting externally-computed message representatives."
 ],
 "type": "string"
 },
@@ -3713,6 +4222,10 @@
 "readOnly": true,
 "type": "string"
 },
+"cryptoKeyBackend": {
+"description": "Immutable. The resource name of the backend environment where the key material for the wrapping key resides and where all related cryptographic operations are performed. Currently, this field is only populated for keys stored in HSM_SINGLE_TENANT. Note, this list is non-exhaustive and may apply to additional ProtectionLevels in the future.",
+"type": "string"
+},
 "expireEventTime": {
 "description": "Output only. The time this ImportJob expired. Only present if state is EXPIRED.",
 "format": "google-datetime",
@@ -3765,14 +4278,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 },
@@ -3837,6 +4352,20 @@
 "GOOGLE_RESPONSE_TO_PRODUCTION_ALERT",
 "CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING"
 ],
+"enumDeprecated": [
+false,
+false,
+false,
+false,
+false,
+false,
+false,
+false,
+true,
+true,
+false,
+false
+],
 "enumDescriptions": [
 "Unspecified access reason.",
 "Customer-initiated support.",
@@ -3846,8 +4375,8 @@
 "Customer uses their account to perform any access to their own data which their IAM policy authorizes.",
 "Google systems access customer data to help optimize the structure of the data or quality for future uses by the customer.",
 "No reason is expected for this key request.",
-"Customer uses their account to perform any access to their own data which their IAM policy authorizes, and one of the following is true: * A Google administrator has reset the root-access account associated with the user's organization within the past 7 days. * A Google-initiated emergency access operation has interacted with a resource in the same project or folder as the currently accessed resource within the past 7 days.",
-"Google systems access customer data to help optimize the structure of the data or quality for future uses by the customer, and one of the following is true: * A Google administrator has reset the root-access account associated with the user's organization within the past 7 days. * A Google-initiated emergency access operation has interacted with a resource in the same project or folder as the currently accessed resource within the past 7 days.",
+"Deprecated: This code is no longer generated by Google Cloud. The GOOGLE_RESPONSE_TO_PRODUCTION_ALERT justification codes available in both Key Access Justifications and Access Transparency logs provide customer-visible signals of emergency access in more precise contexts. Customer uses their account to perform any access to their own data which their IAM policy authorizes, and one of the following is true: * A Google administrator has reset the root-access account associated with the user's organization within the past 7 days. * A Google-initiated emergency access operation has interacted with a resource in the same project or folder as the currently accessed resource within the past 7 days.",
+"Deprecated: This code is no longer generated by Google Cloud. The GOOGLE_RESPONSE_TO_PRODUCTION_ALERT justification codes available in both Key Access Justifications and Access Transparency logs provide customer-visible signals of emergency access in more precise contexts. Google systems access customer data to help optimize the structure of the data or quality for future uses by the customer, and one of the following is true: * A Google administrator has reset the root-access account associated with the user's organization within the past 7 days. * A Google-initiated emergency access operation has interacted with a resource in the same project or folder as the currently accessed resource within the past 7 days.",
 "Google-initiated access to maintain system reliability.",
 "One of the following operations is being executed while simultaneously encountering an internal technical issue which prevented a more precise justification code from being generated: * Your account has been used to perform any access to your own data which your IAM policy authorizes. * An automated Google system operates on encrypted customer data which your IAM policy authorizes. * Customer-initiated Google support access. * Google-initiated support access to protect system reliability."
 ],
@@ -4095,6 +4624,52 @@
 },
 "type": "object"
 },
+"ListSingleTenantHsmInstanceProposalsResponse": {
+"description": "Response message for HsmManagement.ListSingleTenantHsmInstanceProposals.",
+"id": "ListSingleTenantHsmInstanceProposalsResponse",
+"properties": {
+"nextPageToken": {
+"description": "A token to retrieve next page of results. Pass this value in ListSingleTenantHsmInstanceProposalsRequest.page_token to retrieve the next page of results.",
+"type": "string"
+},
+"singleTenantHsmInstanceProposals": {
+"description": "The list of SingleTenantHsmInstanceProposals.",
+"items": {
+"$ref": "SingleTenantHsmInstanceProposal"
+},
+"type": "array"
+},
+"totalSize": {
+"description": "The total number of SingleTenantHsmInstanceProposals that matched the query. This field is not populated if ListSingleTenantHsmInstanceProposalsRequest.filter is applied.",
+"format": "int32",
+"type": "integer"
+}
+},
+"type": "object"
+},
+"ListSingleTenantHsmInstancesResponse": {
+"description": "Response message for HsmManagement.ListSingleTenantHsmInstances.",
+"id": "ListSingleTenantHsmInstancesResponse",
+"properties": {
+"nextPageToken": {
+"description": "A token to retrieve next page of results. Pass this value in ListSingleTenantHsmInstancesRequest.page_token to retrieve the next page of results.",
+"type": "string"
+},
+"singleTenantHsmInstances": {
+"description": "The list of SingleTenantHsmInstances.",
+"items": {
+"$ref": "SingleTenantHsmInstance"
+},
+"type": "array"
+},
+"totalSize": {
+"description": "The total number of SingleTenantHsmInstances that matched the query. This field is not populated if ListSingleTenantHsmInstancesRequest.filter is applied.",
+"format": "int32",
+"type": "integer"
+}
+},
+"type": "object"
+},
 "Location": {
 "description": "A resource that represents a Google Cloud location.",
 "id": "Location",
@@ -4140,6 +4715,10 @@
 "hsmAvailable": {
 "description": "Indicates whether CryptoKeys with protection_level HSM can be created in this location.",
 "type": "boolean"
+},
+"hsmSingleTenantAvailable": {
+"description": "Indicates whether CryptoKeys with protection_level HSM_SINGLE_TENANT can be created in this location.",
+"type": "boolean"
 }
 },
 "type": "object"
@@ -4186,14 +4765,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 },
@@ -4246,14 +4827,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 },
@@ -4392,7 +4975,10 @@
 "PQ_SIGN_ML_DSA_65",
 "PQ_SIGN_ML_DSA_87",
 "PQ_SIGN_SLH_DSA_SHA2_128S",
-"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256"
+"PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256",
+"PQ_SIGN_ML_DSA_44_EXTERNAL_MU",
+"PQ_SIGN_ML_DSA_65_EXTERNAL_MU",
+"PQ_SIGN_ML_DSA_87_EXTERNAL_MU"
 ],
 "enumDescriptions": [
 "Not specified.",
@@ -4438,7 +5024,10 @@
 "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version.",
 "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 5. Randomized version.",
 "The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized version.",
-"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests."
+"The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 1. Randomized version supporting externally-computed message representatives.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version supporting externally-computed message representatives.",
+"The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 5. Randomized version supporting externally-computed message representatives."
 ],
 "type": "string"
 },
@@ -4462,14 +5051,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 },
@@ -4498,6 +5089,75 @@
 },
 "type": "object"
 },
+"QuorumAuth": {
+"description": "Configuration for M of N quorum auth.",
+"id": "QuorumAuth",
+"properties": {
+"requiredApproverCount": {
+"description": "Output only. The required numbers of approvers. The M value used for M of N quorum auth. Must be greater than or equal to 2 and less than or equal to total_approver_count - 1.",
+"format": "int32",
+"readOnly": true,
+"type": "integer"
+},
+"totalApproverCount": {
+"description": "Required. The total number of approvers. This is the N value used for M of N quorum auth. Must be greater than or equal to 3 and less than or equal to 16.",
+"format": "int32",
+"type": "integer"
+},
+"twoFactorPublicKeyPems": {
+"description": "Output only. The public keys associated with the 2FA keys for M of N quorum auth.",
+"items": {
+"type": "string"
+},
+"readOnly": true,
+"type": "array"
+}
+},
+"type": "object"
+},
+"QuorumParameters": {
+"description": "Parameters of quorum approval for the SingleTenantHsmInstanceProposal.",
+"id": "QuorumParameters",
+"properties": {
+"approvedTwoFactorPublicKeyPems": {
+"description": "Output only. The public keys associated with the 2FA keys that have already approved the SingleTenantHsmInstanceProposal by signing the challenge.",
+"items": {
+"type": "string"
+},
+"readOnly": true,
+"type": "array"
+},
+"challenges": {
+"description": "Output only. The challenges to be signed by 2FA keys for quorum auth. M of N of these challenges are required to be signed to approve the operation.",
+"items": {
+"$ref": "Challenge"
+},
+"readOnly": true,
+"type": "array"
+},
+"requiredApproverCount": {
+"description": "Output only. The required numbers of approvers. This is the M value used for M of N quorum auth. It is less than the number of public keys.",
+"format": "int32",
+"readOnly": true,
+"type": "integer"
+}
+},
+"type": "object"
+},
+"QuorumReply": {
+"description": "The reply to QuorumParameters for approving the proposal.",
+"id": "QuorumReply",
+"properties": {
+"challengeReplies": {
+"description": "Required. The challenge replies to approve the proposal. Challenge replies can be sent across multiple requests. The proposal will be approved when required_approver_count challenge replies are provided.",
+"items": {
+"$ref": "ChallengeReply"
+},
+"type": "array"
+}
+},
+"type": "object"
+},
 "RawDecryptRequest": {
 "description": "Request message for KeyManagementService.RawDecrypt.",
 "id": "RawDecryptRequest",
@@ -4561,14 +5221,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 },
@@ -4659,14 +5321,16 @@
 "SOFTWARE",
 "HSM",
 "EXTERNAL",
-"EXTERNAL_VPC"
+"EXTERNAL_VPC",
+"HSM_SINGLE_TENANT"
 ],
 "enumDescriptions": [
 "Not specified.",
 "Crypto operations are performed in software.",
 "Crypto operations are performed in a Hardware Security Module.",
 "Crypto operations are performed by an external key manager.",
-"Crypto operations are performed in an EKM-over-VPC backend."
+"Crypto operations are performed in an EKM-over-VPC backend.",
+"Crypto operations are performed in a single-tenant HSM."
 ],
 "type": "string"
 },
@@ -4690,6 +5354,100 @@
 },
 "type": "object"
 },
+"RefreshSingleTenantHsmInstance": {
+"description": "Refreshes the SingleTenantHsmInstance. This operation must be performed periodically to keep the SingleTenantHsmInstance active. This operation must be performed before unrefreshed_duration_until_disable has passed. The SingleTenantHsmInstance must be in the ACTIVE state to perform this operation.",
+"id": "RefreshSingleTenantHsmInstance",
+"properties": {},
+"type": "object"
+},
+"RegisterTwoFactorAuthKeys": {
+"description": "Register 2FA keys for the SingleTenantHsmInstance. This operation requires all Challenges to be signed by 2FA keys. The SingleTenantHsmInstance must be in the PENDING_TWO_FACTOR_AUTH_REGISTRATION state to perform this operation.",
+"id": "RegisterTwoFactorAuthKeys",
+"properties": {
+"requiredApproverCount": {
+"description": "Required. The required numbers of approvers to set for the SingleTenantHsmInstance. This is the M value used for M of N quorum auth. Must be greater than or equal to 2 and less than or equal to total_approver_count - 1.",
+"format": "int32",
+"type": "integer"
+},
+"twoFactorPublicKeyPems": {
+"description": "Required. The public keys associated with the 2FA keys for M of N quorum auth. Public keys must be associated with RSA 2048 keys.",
+"items": {
+"type": "string"
+},
+"type": "array"
+}
+},
+"type": "object"
+},
+"RemoveQuorumMember": {
+"description": "Remove a quorum member from the SingleTenantHsmInstance. This will reduce total_approver_count by 1. The SingleTenantHsmInstance must be in the ACTIVE state to perform this operation.",
+"id": "RemoveQuorumMember",
+"properties": {
+"twoFactorPublicKeyPem": {
+"description": "Required. The public key associated with the 2FA key for the quorum member to remove. Public keys must be associated with RSA 2048 keys.",
+"type": "string"
+}
+},
+"type": "object"
+},
+"RequiredActionQuorumParameters": {
+"description": "Parameters for an approval that has both required challenges and a quorum.",
+"id": "RequiredActionQuorumParameters",
+"properties": {
+"approvedTwoFactorPublicKeyPems": {
+"description": "Output only. The public keys associated with the 2FA keys that have already approved the SingleTenantHsmInstanceProposal by signing the challenge.",
+"items": {
+"type": "string"
+},
+"readOnly": true,
+"type": "array"
+},
+"quorumChallenges": {
+"description": "Output only. The challenges to be signed by 2FA keys for quorum auth. M of N of these challenges are required to be signed to approve the operation.",
+"items": {
+"$ref": "Challenge"
+},
+"readOnly": true,
+"type": "array"
+},
+"requiredApproverCount": {
+"description": "Output only. The required number of quorum approvers. This is the M value used for M of N quorum auth. It is less than the number of public keys.",
+"format": "int32",
+"readOnly": true,
+"type": "integer"
+},
+"requiredChallenges": {
+"description": "Output only. A list of specific challenges that must be signed. For some operations, this will contain a single challenge.",
+"items": {
+"$ref": "Challenge"
+},
+"readOnly": true,
+"type": "array"
+}
+},
+"type": "object"
+},
+"RequiredActionQuorumReply": {
+"description": "The reply to RequiredActionQuorumParameters for approving the proposal.",
+"id": "RequiredActionQuorumReply",
+"properties": {
+"quorumChallengeReplies": {
+"description": "Required. Quorum members' signed challenge replies. These can be provided across multiple requests. The proposal will be approved when required_approver_count quorum_challenge_replies are provided and when all required_challenge_replies are provided.",
+"items": {
+"$ref": "ChallengeReply"
+},
+"type": "array"
+},
+"requiredChallengeReplies": {
+"description": "Required. All required challenges must be signed for the proposal to be approved. These can be sent across multiple requests.",
+"items": {
+"$ref": "ChallengeReply"
+},
+"type": "array"
+}
+},
+"type": "object"
+},
 "RestoreCryptoKeyVersionRequest": {
 "description": "Request message for KeyManagementService.RestoreCryptoKeyVersion.",
 "id": "RestoreCryptoKeyVersionRequest",
@@ -4779,6 +5537,179 @@
 },
 "type": "object"
 },
+"SingleTenantHsmInstance": {
+"description": "A SingleTenantHsmInstance represents a single-tenant HSM instance. It can be used for creating CryptoKeys with a ProtectionLevel of HSM_SINGLE_TENANT, as well as performing cryptographic operations using keys created within the SingleTenantHsmInstance.",
+"id": "SingleTenantHsmInstance",
+"properties": {
+"createTime": {
+"description": "Output only. The time at which the SingleTenantHsmInstance was created.",
+"format": "google-datetime",
+"readOnly": true,
+"type": "string"
+},
+"deleteTime": {
+"description": "Output only. The time at which the SingleTenantHsmInstance was deleted.",
+"format": "google-datetime",
+"readOnly": true,
+"type": "string"
+},
+"disableTime": {
+"description": "Output only. The time at which the instance will be automatically disabled if not refreshed. This field is updated upon creation and after each successful refresh operation and enable. A RefreshSingleTenantHsmInstance operation must be made via a SingleTenantHsmInstanceProposal before this time otherwise the SingleTenantHsmInstance will become disabled.",
+"format": "google-datetime",
+"readOnly": true,
+"type": "string"
+},
+"name": {
+"description": "Identifier. The resource name for this SingleTenantHsmInstance in the format `projects/*/locations/*/singleTenantHsmInstances/*`.",
+"type": "string"
+},
+"quorumAuth": {
+"$ref": "QuorumAuth",
+"description": "Required. The quorum auth configuration for the SingleTenantHsmInstance."
+},
+"state": {
+"description": "Output only. The state of the SingleTenantHsmInstance.",
+"enum": [
+"STATE_UNSPECIFIED",
+"CREATING",
+"PENDING_TWO_FACTOR_AUTH_REGISTRATION",
+"ACTIVE",
+"DISABLING",
+"DISABLED",
+"DELETING",
+"DELETED",
+"FAILED"
+],
+"enumDescriptions": [
+"Not specified.",
+"The SingleTenantHsmInstance is being created.",
+"The SingleTenantHsmInstance is waiting for 2FA keys to be registered. This can be done by calling CreateSingleTenantHsmInstanceProposal with the RegisterTwoFactorAuthKeys operation.",
+"The SingleTenantHsmInstance is ready to use. A SingleTenantHsmInstance must be in the ACTIVE state for all CryptoKeys created within the SingleTenantHsmInstance to be usable.",
+"The SingleTenantHsmInstance is being disabled.",
+"The SingleTenantHsmInstance is disabled.",
+"The SingleTenantHsmInstance is being deleted. Requests to the instance will be rejected in this state.",
+"The SingleTenantHsmInstance has been deleted.",
+"The SingleTenantHsmInstance has failed and can not be recovered or used."
+],
+"readOnly": true,
+"type": "string"
+},
+"unrefreshedDurationUntilDisable": {
+"description": "Output only. The system-defined duration that an instance can remain unrefreshed until it is automatically disabled. This will have a value of 120 days.",
+"format": "google-duration",
+"readOnly": true,
+"type": "string"
+}
+},
+"type": "object"
+},
+"SingleTenantHsmInstanceProposal": {
+"description": "A SingleTenantHsmInstanceProposal represents a proposal to perform an operation on a SingleTenantHsmInstance.",
+"id": "SingleTenantHsmInstanceProposal",
+"properties": {
+"addQuorumMember": {
+"$ref": "AddQuorumMember",
+"description": "Add a quorum member to the SingleTenantHsmInstance. This will increase the total_approver_count by 1. The SingleTenantHsmInstance must be in the ACTIVE state to perform this operation."
+},
+"createTime": {
+"description": "Output only. The time at which the SingleTenantHsmInstanceProposal was created.",
+"format": "google-datetime",
+"readOnly": true,
+"type": "string"
+},
+"deleteSingleTenantHsmInstance": {
+"$ref": "DeleteSingleTenantHsmInstance",
+"description": "Delete the SingleTenantHsmInstance. Deleting a SingleTenantHsmInstance will make all CryptoKeys attached to the SingleTenantHsmInstance unusable. The SingleTenantHsmInstance must be in the DISABLED or PENDING_TWO_FACTOR_AUTH_REGISTRATION state to perform this operation."
+},
+"deleteTime": {
+"description": "Output only. The time at which the SingleTenantHsmInstanceProposal was deleted.",
+"format": "google-datetime",
+"readOnly": true,
+"type": "string"
+},
+"disableSingleTenantHsmInstance": {
+"$ref": "DisableSingleTenantHsmInstance",
+"description": "Disable the SingleTenantHsmInstance. The SingleTenantHsmInstance must be in the ACTIVE state to perform this operation."
+},
+"enableSingleTenantHsmInstance": {
+"$ref": "EnableSingleTenantHsmInstance",
+"description": "Enable the SingleTenantHsmInstance. The SingleTenantHsmInstance must be in the DISABLED state to perform this operation."
+},
+"expireTime": {
+"description": "The time at which the SingleTenantHsmInstanceProposal will expire if not approved and executed.",
+"format": "google-datetime",
+"type": "string"
+},
+"failureReason": {
+"description": "Output only. The root cause of the most recent failure. Only present if state is FAILED.",
+"readOnly": true,
+"type": "string"
+},
+"name": {
+"description": "Identifier. The resource name for this SingleTenantHsmInstance in the format `projects/*/locations/*/singleTenantHsmInstances/*/proposals/*`.",
+"type": "string"
+},
+"purgeTime": {
+"description": "Output only. The time at which the soft-deleted SingleTenantHsmInstanceProposal will be permanently purged. This field is only populated when the state is DELETED and will be set a time after expiration of the proposal, i.e. >= expire_time or (create_time + ttl).",
+"format": "google-datetime",
+"readOnly": true,
+"type": "string"
+},
+"quorumParameters": {
+"$ref": "QuorumParameters",
+"description": "Output only. The quorum approval parameters for the SingleTenantHsmInstanceProposal.",
+"readOnly": true
+},
+"refreshSingleTenantHsmInstance": {
+"$ref": "RefreshSingleTenantHsmInstance",
+"description": "Refreshes the SingleTenantHsmInstance. This operation must be performed periodically to keep the SingleTenantHsmInstance active. This operation must be performed before unrefreshed_duration_until_disable has passed. The SingleTenantHsmInstance must be in the ACTIVE state to perform this operation."
+},
+"registerTwoFactorAuthKeys": {
+"$ref": "RegisterTwoFactorAuthKeys",
+"description": "Register 2FA keys for the SingleTenantHsmInstance. This operation requires all N Challenges to be signed by 2FA keys. The SingleTenantHsmInstance must be in the PENDING_TWO_FACTOR_AUTH_REGISTRATION state to perform this operation."
+},
+"removeQuorumMember": {
+"$ref": "RemoveQuorumMember",
+"description": "Remove a quorum member from the SingleTenantHsmInstance. This will reduce total_approver_count by 1. The SingleTenantHsmInstance must be in the ACTIVE state to perform this operation."
+},
+"requiredActionQuorumParameters": {
+"$ref": "RequiredActionQuorumParameters",
+"description": "Output only. Parameters for an approval of a SingleTenantHsmInstanceProposal that has both required challenges and a quorum.",
+"readOnly": true
+},
+"state": {
+"description": "Output only. The state of the SingleTenantHsmInstanceProposal.",
+"enum": [
+"STATE_UNSPECIFIED",
+"CREATING",
+"PENDING",
+"APPROVED",
+"RUNNING",
+"SUCCEEDED",
+"FAILED",
+"DELETED"
+],
+"enumDescriptions": [
+"Not specified.",
+"The SingleTenantHsmInstanceProposal is being created.",
+"The SingleTenantHsmInstanceProposal is pending approval.",
+"The SingleTenantHsmInstanceProposal has been approved.",
+"The SingleTenantHsmInstanceProposal is being executed.",
+"The SingleTenantHsmInstanceProposal has been executed successfully.",
+"The SingleTenantHsmInstanceProposal has failed.",
+"The SingleTenantHsmInstanceProposal has been deleted and will be purged after the purge_time."
+],
+"readOnly": true,
+"type": "string"
+},
+"ttl": {
+"description": "Input only. The TTL for the SingleTenantHsmInstanceProposal. Proposals will expire after this duration.",
+"format": "google-duration",
+"type": "string"
+}
+},
+"type": "object"
+},
 "Status": {
 "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).",
 "id": "Status",