google-api-python-client 2.188.0__py3-none-any.whl → 2.190.0__py3-none-any.whl

googleapiclient/discovery_cache/documents/iam.v1.json

@@ -474,7 +474,7 @@
 "type": "string"
 },
 "workforcePoolProviderId": {
-"description": "Required. The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix `gcp-` is reserved for use by Google, and may not be specified.",
+"description": "Required. The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters `[a-z0-9-]`. The prefix `gcp-` is reserved for use by Google, and may not be specified.",
 "location": "query",
 "type": "string"
 }
@@ -664,7 +664,7 @@
 "type": "string"
 },
 "workforcePoolProviderKeyId": {
-"description": "Required. The ID to use for the key, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-].",
+"description": "Required. The ID to use for the key, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters `[a-z0-9-]`.",
 "location": "query",
 "type": "string"
 }
@@ -880,7 +880,7 @@
 "type": "string"
 },
 "workforcePoolProviderScimTenantId": {
-"description": "Required. Gemini Enterprise only. The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value should be 4-32 characters, containing the characters [a-z0-9-].",
+"description": "Required. Gemini Enterprise only. The ID to use for the SCIM tenant, which becomes the final component of the resource name. This value should be 4-32 characters, containing the characters `[a-z0-9-]`.",
 "location": "query",
 "type": "string"
 }
@@ -1075,7 +1075,7 @@
 "type": "string"
 },
 "workforcePoolProviderScimTokenId": {
-"description": "Required. Gemini Enterprise only. The ID to use for the SCIM token, which becomes the final component of the resource name. This value should be 4-32 characters and follow the pattern: \"([a-z]([a-z0-9\\\\-]{2,30}[a-z0-9]))\"",
+"description": "Required. Gemini Enterprise only. The ID to use for the SCIM token, which becomes the final component of the resource name. This value should be 4-32 characters and follow the pattern: `([a-z]([a-z0-9\\\\-]{2,30}[a-z0-9]))`",
 "location": "query",
 "type": "string"
 }
@@ -2078,7 +2078,7 @@
 ],
 "parameters": {
 "name": {
-"description": "Output only. The resource name of the pool.",
+"description": "Identifier. The resource name of the pool.",
 "location": "path",
 "pattern": "^projects/[^/]+/locations/[^/]+/workloadIdentityPools/[^/]+$",
 "required": true,
@@ -2324,7 +2324,7 @@
 ],
 "parameters": {
 "name": {
-"description": "Output only. The resource name of the namespace.",
+"description": "Identifier. The resource name of the namespace.",
 "location": "path",
 "pattern": "^projects/[^/]+/locations/[^/]+/workloadIdentityPools/[^/]+/namespaces/[^/]+$",
 "required": true,
@@ -2583,7 +2583,7 @@
 ],
 "parameters": {
 "name": {
-"description": "Output only. The resource name of the managed identity.",
+"description": "Identifier. The resource name of the managed identity.",
 "location": "path",
 "pattern": "^projects/[^/]+/locations/[^/]+/workloadIdentityPools/[^/]+/namespaces/[^/]+/managedIdentities/[^/]+$",
 "required": true,
@@ -2953,7 +2953,7 @@
 ],
 "parameters": {
 "name": {
-"description": "Output only. The resource name of the provider.",
+"description": "Identifier. The resource name of the provider.",
 "location": "path",
 "pattern": "^projects/[^/]+/locations/[^/]+/workloadIdentityPools/[^/]+/providers/[^/]+$",
 "required": true,
@@ -4160,7 +4160,7 @@
 }
 }
 },
-"revision": "20251204",
+"revision": "20260123",
 "rootUrl": "https://iam.googleapis.com/",
 "schemas": {
 "AccessRestrictions": {
@@ -4546,12 +4546,14 @@
 "enum": [
 "ATTRIBUTES_TYPE_UNSPECIFIED",
 "AZURE_AD_GROUPS_MAIL",
-"AZURE_AD_GROUPS_ID"
+"AZURE_AD_GROUPS_ID",
+"AZURE_AD_GROUPS_DISPLAY_NAME"
 ],
 "enumDescriptions": [
 "No AttributesType specified.",
 "Used to get the user's group claims from the Microsoft Entra ID identity provider using the configuration provided in ExtraAttributesOAuth2Client. The `mail` property of the `microsoft.graph.group` object is used for claim mapping. See https://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties for more details on `microsoft.graph.group` properties. The group mail addresses of the user's groups that are returned from Microsoft Entra ID can be mapped by using the following attributes: * OIDC: `assertion.groups` * SAML: `assertion.attributes.groups`",
-"Used to get the user's group claims from the Microsoft Entra ID identity provider using the configuration provided in ExtraAttributesOAuth2Client. The `id` property of the `microsoft.graph.group` object is used for claim mapping. See https://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties for more details on `microsoft.graph.group` properties. The group IDs of the user's groups that are returned from Microsoft Entra ID can be mapped by using the following attributes: * OIDC: `assertion.groups` * SAML: `assertion.attributes.groups`"
+"Used to get the user's group claims from the Microsoft Entra ID identity provider using the configuration provided in ExtraAttributesOAuth2Client. The `id` property of the `microsoft.graph.group` object is used for claim mapping. See https://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties for more details on `microsoft.graph.group` properties. The group IDs of the user's groups that are returned from Microsoft Entra ID can be mapped by using the following attributes: * OIDC: `assertion.groups` * SAML: `assertion.attributes.groups`",
+"Used to get the user's group claims from the Microsoft Entra ID identity provider using the configuration provided in ExtraAttributesOAuth2Client. The `displayName` property of the `microsoft.graph.group` object is used for claim mapping. See https://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties for more details on `microsoft.graph.group` properties. The display names of the user's groups that are returned from Microsoft Entra ID can be mapped by using the following attributes: * OIDC: `assertion.groups` * SAML: `assertion.attributes.groups`"
 ],
 "type": "string"
 },
@@ -6307,7 +6309,7 @@ false
 "additionalProperties": {
 "type": "string"
 },
-"description": "Required. Maps attributes from the authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported: * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. This is a required field and the mapped subject cannot exceed 127 bytes. * `google.groups`: Groups the authenticating user belongs to. You can grant groups access to resources using an IAM `principalSet` binding; access applies to all members of the group. * `google.display_name`: The name of the authenticated user. This is an optional field and the mapped display name cannot exceed 100 bytes. If not set, `google.subject` will be displayed instead. This attribute cannot be referenced in IAM bindings. * `google.profile_photo`: The URL that specifies the authenticated user's thumbnail photo. This is an optional field. When set, the image will be visible as the user's profile picture. If not set, a generic user icon will be displayed instead. This attribute cannot be referenced in IAM bindings. * `google.posix_username`: The Linux username used by OS Login. This is an optional field and the mapped POSIX username cannot exceed 32 characters. The key must match the regex \"^a-zA-Z0-9._{0,31}$\". This attribute cannot be referenced in IAM bindings. You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where {custom_attribute} is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters [a-z0-9_]. You can reference these attributes in IAM policies to define fine-grained access for a workforce pool to Google Cloud resources. For example: * `google.subject`: `principal://iam.googleapis.com/locations/global/workforcePools/{pool}/subject/{value}` * `google.groups`: `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool}/group/{value}` * `attribute.{custom_attribute}`: `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool}/attribute.{custom_attribute}/{value}` Each value must be a [Common Expression Language] (https://opensource.google/projects/cel) function that maps an identity provider credential to the normalized attribute specified by the corresponding map key. You can use the `assertion` keyword in the expression to access a JSON representation of the authentication credential issued by the provider. The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 16 KB. For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute. For example, the following maps the `sub` claim of the incoming credential to the `subject` attribute on a Google token: ``` {\"google.subject\": \"assertion.sub\"} ```",
+"description": "Required. Maps attributes from the authentication credentials issued by an external identity provider to Google Cloud attributes, such as `subject` and `segment`. Each key must be a string specifying the Google Cloud IAM attribute to map to. The following keys are supported: * `google.subject`: The principal IAM is authenticating. You can reference this value in IAM bindings. This is also the subject that appears in Cloud Logging logs. This is a required field and the mapped subject cannot exceed 127 bytes. * `google.groups`: Groups the authenticating user belongs to. You can grant groups access to resources using an IAM `principalSet` binding; access applies to all members of the group. * `google.display_name`: The name of the authenticated user. This is an optional field and the mapped display name cannot exceed 100 bytes. If not set, `google.subject` will be displayed instead. This attribute cannot be referenced in IAM bindings. * `google.profile_photo`: The URL that specifies the authenticated user's thumbnail photo. This is an optional field. When set, the image will be visible as the user's profile picture. If not set, a generic user icon will be displayed instead. This attribute cannot be referenced in IAM bindings. * `google.posix_username`: The Linux username used by OS Login. This is an optional field and the mapped POSIX username cannot exceed 32 characters. The key must match the regex `^a-zA-Z0-9._{0,31}$`. This attribute cannot be referenced in IAM bindings. You can also provide custom attributes by specifying `attribute.{custom_attribute}`, where {custom_attribute} is the name of the custom attribute to be mapped. You can define a maximum of 50 custom attributes. The maximum length of a mapped attribute key is 100 characters, and the key may only contain the characters `[a-z0-9_]`. You can reference these attributes in IAM policies to define fine-grained access for a workforce pool to Google Cloud resources. For example: * `google.subject`: `principal://iam.googleapis.com/locations/global/workforcePools/{pool}/subject/{value}` * `google.groups`: `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool}/group/{value}` * `attribute.{custom_attribute}`: `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool}/attribute.{custom_attribute}/{value}` Each value must be a [Common Expression Language] (https://opensource.google/projects/cel) function that maps an identity provider credential to the normalized attribute specified by the corresponding map key. You can use the `assertion` keyword in the expression to access a JSON representation of the authentication credential issued by the provider. The maximum length of an attribute mapping expression is 2048 characters. When evaluated, the total size of all mapped attributes must not exceed 16 KB. For OIDC providers, you must supply a custom mapping that includes the `google.subject` attribute. For example, the following maps the `sub` claim of the incoming credential to the `subject` attribute on a Google token: ``` {\"google.subject\": \"assertion.sub\"} ```",
 "type": "object"
 },
 "description": {
@@ -6567,8 +6569,7 @@ false
 "type": "string"
 },
 "name": {
-"description": "Output only. The resource name of the pool.",
-"readOnly": true,
+"description": "Identifier. The resource name of the pool.",
 "type": "string"
 },
 "state": {
@@ -6608,8 +6609,7 @@ false
 "type": "string"
 },
 "name": {
-"description": "Output only. The resource name of the managed identity.",
-"readOnly": true,
+"description": "Identifier. The resource name of the managed identity.",
 "type": "string"
 },
 "state": {
@@ -6649,8 +6649,7 @@ false
 "type": "string"
 },
 "name": {
-"description": "Output only. The resource name of the namespace.",
-"readOnly": true,
+"description": "Identifier. The resource name of the namespace.",
 "type": "string"
 },
 "ownerService": {
@@ -6720,8 +6719,7 @@ false
 "type": "string"
 },
 "name": {
-"description": "Output only. The resource name of the provider.",
-"readOnly": true,
+"description": "Identifier. The resource name of the provider.",
 "type": "string"
 },
 "oidc": {
@@ -6769,8 +6767,7 @@ false
 "description": "Immutable. Public half of the asymmetric key."
 },
 "name": {
-"description": "Output only. The resource name of the key.",
-"readOnly": true,
+"description": "Identifier. The resource name of the key.",
 "type": "string"
 },
 "state": {

googleapiclient/discovery_cache/documents/kmsinventory.v1.json

@@ -110,7 +110,7 @@
 "protectedResources": {
 "methods": {
 "search": {
-"description": "Returns metadata about the resources protected by the given Cloud KMS CryptoKey in the given Cloud organization.",
+"description": "Returns metadata about the resources protected by the given Cloud KMS CryptoKey in the given Cloud organization/project.",
 "flatPath": "v1/organizations/{organizationsId}/protectedResources:search",
 "httpMethod": "GET",
 "id": "kmsinventory.organizations.protectedResources.search",
@@ -141,7 +141,7 @@
 "type": "string"
 },
 "scope": {
-"description": "Required. Resource name of the organization. Example: organizations/123",
+"description": "Required. A scope can be an organization or a project. Resources protected by the crypto key in provided scope will be returned. The allowed values are: * organizations/{ORGANIZATION_NUMBER} (e.g., \"organizations/12345678\") * projects/{PROJECT_ID} (e.g., \"projects/foo-bar\") * projects/{PROJECT_NUMBER} (e.g., \"projects/12345678\")",
 "location": "path",
 "pattern": "^organizations/[^/]+$",
 "required": true,
@@ -209,7 +209,7 @@
 "cryptoKeys": {
 "methods": {
 "getProtectedResourcesSummary": {
-"description": "Returns aggregate information about the resources protected by the given Cloud KMS CryptoKey. Only resources within the same Cloud organization as the key will be returned. The project that holds the key must be part of an organization in order for this call to succeed.",
+"description": "Returns aggregate information about the resources protected by the given Cloud KMS CryptoKey. By default, summary of resources within the same Cloud organization as the key will be returned, which requires the KMS organization service account to be configured(refer https://docs.cloud.google.com/kms/docs/view-key-usage#required-roles). If the KMS organization service account is not configured or key's project is not part of an organization, set fallback_scope to `FALLBACK_SCOPE_PROJECT` to retrieve a summary of protected resources within the key's project.",
 "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/keyRings/{keyRingsId}/cryptoKeys/{cryptoKeysId}/protectedResourcesSummary",
 "httpMethod": "GET",
 "id": "kmsinventory.projects.locations.keyRings.cryptoKeys.getProtectedResourcesSummary",
@@ -217,6 +217,19 @@
 "name"
 ],
 "parameters": {
+"fallbackScope": {
+"description": "Optional. The scope to use if the kms organization service account is not configured.",
+"enum": [
+"FALLBACK_SCOPE_UNSPECIFIED",
+"FALLBACK_SCOPE_PROJECT"
+],
+"enumDescriptions": [
+"Unspecified scope type.",
+"If set to `FALLBACK_SCOPE_PROJECT`, the API will fall back to using key's project as request scope if the kms organization service account is not configured."
+],
+"location": "query",
+"type": "string"
+},
 "name": {
 "description": "Required. The resource name of the CryptoKey.",
 "location": "path",
@@ -238,11 +251,62 @@
 }
 }
 }
+},
+"protectedResources": {
+"methods": {
+"search": {
+"description": "Returns metadata about the resources protected by the given Cloud KMS CryptoKey in the given Cloud organization/project.",
+"flatPath": "v1/projects/{projectsId}/protectedResources:search",
+"httpMethod": "GET",
+"id": "kmsinventory.projects.protectedResources.search",
+"parameterOrder": [
+"scope"
+],
+"parameters": {
+"cryptoKey": {
+"description": "Required. The resource name of the CryptoKey.",
+"location": "query",
+"type": "string"
+},
+"pageSize": {
+"description": "The maximum number of resources to return. The service may return fewer than this value. If unspecified, at most 500 resources will be returned. The maximum value is 500; values above 500 will be coerced to 500.",
+"format": "int32",
+"location": "query",
+"type": "integer"
+},
+"pageToken": {
+"description": "A page token, received from a previous KeyTrackingService.SearchProtectedResources call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to KeyTrackingService.SearchProtectedResources must match the call that provided the page token.",
+"location": "query",
+"type": "string"
+},
+"resourceTypes": {
+"description": "Optional. A list of resource types that this request searches for. If empty, it will search all the [trackable resource types](https://cloud.google.com/kms/docs/view-key-usage#tracked-resource-types). Regular expressions are also supported. For example: * `compute.googleapis.com.*` snapshots resources whose type starts with `compute.googleapis.com`. * `.*Image` snapshots resources whose type ends with `Image`. * `.*Image.*` snapshots resources whose type contains `Image`. See [RE2](https://github.com/google/re2/wiki/Syntax) for all supported regular expression syntax. If the regular expression does not match any supported resource type, an INVALID_ARGUMENT error will be returned.",
+"location": "query",
+"repeated": true,
+"type": "string"
+},
+"scope": {
+"description": "Required. A scope can be an organization or a project. Resources protected by the crypto key in provided scope will be returned. The allowed values are: * organizations/{ORGANIZATION_NUMBER} (e.g., \"organizations/12345678\") * projects/{PROJECT_ID} (e.g., \"projects/foo-bar\") * projects/{PROJECT_NUMBER} (e.g., \"projects/12345678\")",
+"location": "path",
+"pattern": "^projects/[^/]+$",
+"required": true,
+"type": "string"
+}
+},
+"path": "v1/{+scope}/protectedResources:search",
+"response": {
+"$ref": "GoogleCloudKmsInventoryV1SearchProtectedResourcesResponse"
+},
+"scopes": [
+"https://www.googleapis.com/auth/cloud-platform"
+]
+}
+}
 }
 }
 }
 },
-"revision": "20251207",
+"revision": "20260201",
 "rootUrl": "https://kmsinventory.googleapis.com/",
 "schemas": {
 "GoogleCloudKmsInventoryV1ListCryptoKeysResponse": {
@@ -319,7 +383,7 @@
 "type": "object"
 },
 "GoogleCloudKmsInventoryV1ProtectedResourcesSummary": {
-"description": "Aggregate information about the resources protected by a Cloud KMS key in the same Cloud organization as the key.",
+"description": "Aggregate information about the resources protected by a Cloud KMS key in the same Cloud organization/project as the key.",
 "id": "GoogleCloudKmsInventoryV1ProtectedResourcesSummary",
 "properties": {
 "cloudProducts": {
@@ -359,6 +423,13 @@
 },
 "description": "The number of resources protected by the key grouped by resource type.",
 "type": "object"
+},
+"warnings": {
+"description": "Warning messages for the state of response ProtectedResourcesSummary For example, if the organization service account is not configured, INSUFFICIENT_PERMISSIONS_PARTIAL_DATA warning will be returned.",
+"items": {
+"$ref": "GoogleCloudKmsInventoryV1Warning"
+},
+"type": "array"
 }
 },
 "type": "object"
@@ -381,6 +452,33 @@
 },
 "type": "object"
 },
+"GoogleCloudKmsInventoryV1Warning": {
+"description": "Warning message specifying various states of response data that might indicate incomplete or partial results.",
+"id": "GoogleCloudKmsInventoryV1Warning",
+"properties": {
+"displayMessage": {
+"description": "The literal message providing context and details about the warnings.",
+"type": "string"
+},
+"warningCode": {
+"description": "The specific warning code for the displayed message.",
+"enum": [
+"WARNING_CODE_UNSPECIFIED",
+"INSUFFICIENT_PERMISSIONS_PARTIAL_DATA",
+"RESOURCE_LIMIT_EXCEEDED_PARTIAL_DATA",
+"ORG_LESS_PROJECT_PARTIAL_DATA"
+],
+"enumDescriptions": [
+"Default value. This value is unused.",
+"Indicates that the caller or service agent lacks necessary permissions to view some of the requested data. The response may be partial. Examples: - KMS organization service agent {service_agent_name} lacks the `cloudasset.assets.searchAllResources` permission on the scope.",
+"Indicates that a resource limit has been exceeded, resulting in partial data. Examples: - The project has more than 10,000 assets (resources, crypto keys, key handles, IAM policies, etc).",
+"Indicates that the project is org-less. Thus the analysis is only done for the project level data and results might be partial."
+],
+"type": "string"
+}
+},
+"type": "object"
+},
 "GoogleCloudKmsV1CryptoKey": {
 "description": "A CryptoKey represents a logical key that can be used for cryptographic operations. A CryptoKey is made up of zero or more versions, which represent the actual key material used in cryptographic operations.",
 "id": "GoogleCloudKmsV1CryptoKey",
@@ -859,6 +957,20 @@
 "GOOGLE_RESPONSE_TO_PRODUCTION_ALERT",
 "CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING"
 ],
+"enumDeprecated": [
+false,
+false,
+false,
+false,
+false,
+false,
+false,
+false,
+true,
+true,
+false,
+false
+],
 "enumDescriptions": [
 "Unspecified access reason.",
 "Customer-initiated support.",
@@ -868,8 +980,8 @@
 "Customer uses their account to perform any access to their own data which their IAM policy authorizes.",
 "Google systems access customer data to help optimize the structure of the data or quality for future uses by the customer.",
 "No reason is expected for this key request.",
-"Customer uses their account to perform any access to their own data which their IAM policy authorizes, and one of the following is true: * A Google administrator has reset the root-access account associated with the user's organization within the past 7 days. * A Google-initiated emergency access operation has interacted with a resource in the same project or folder as the currently accessed resource within the past 7 days.",
-"Google systems access customer data to help optimize the structure of the data or quality for future uses by the customer, and one of the following is true: * A Google administrator has reset the root-access account associated with the user's organization within the past 7 days. * A Google-initiated emergency access operation has interacted with a resource in the same project or folder as the currently accessed resource within the past 7 days.",
+"Deprecated: This code is no longer generated by Google Cloud. The GOOGLE_RESPONSE_TO_PRODUCTION_ALERT justification codes available in both Key Access Justifications and Access Transparency logs provide customer-visible signals of emergency access in more precise contexts. Customer uses their account to perform any access to their own data which their IAM policy authorizes, and one of the following is true: * A Google administrator has reset the root-access account associated with the user's organization within the past 7 days. * A Google-initiated emergency access operation has interacted with a resource in the same project or folder as the currently accessed resource within the past 7 days.",
+"Deprecated: This code is no longer generated by Google Cloud. The GOOGLE_RESPONSE_TO_PRODUCTION_ALERT justification codes available in both Key Access Justifications and Access Transparency logs provide customer-visible signals of emergency access in more precise contexts. Google systems access customer data to help optimize the structure of the data or quality for future uses by the customer, and one of the following is true: * A Google administrator has reset the root-access account associated with the user's organization within the past 7 days. * A Google-initiated emergency access operation has interacted with a resource in the same project or folder as the currently accessed resource within the past 7 days.",
 "Google-initiated access to maintain system reliability.",
 "One of the following operations is being executed while simultaneously encountering an internal technical issue which prevented a more precise justification code from being generated: * Your account has been used to perform any access to your own data which your IAM policy authorizes. * An automated Google system operates on encrypted customer data which your IAM policy authorizes. * Customer-initiated Google support access. * Google-initiated support access to protect system reliability."
 ],