admin

type CreateRoleRequest struct {
	// The resource name of the parent resource in one of the following formats:
	// `organizations/{ORGANIZATION_ID}`
	// `projects/{PROJECT_ID}`
	Parent string `protobuf:"bytes,1,opt,name=parent" json:"parent,omitempty"`
	// The role id to use for this role.
	RoleId string `protobuf:"bytes,2,opt,name=role_id,json=roleId" json:"role_id,omitempty"`
	// The Role resource to create.
	Role *Role `protobuf:"bytes,3,opt,name=role" json:"role,omitempty"`
}

type CreateServiceAccountKeyRequest struct {
	// The resource name of the service account in the following format:
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}`.
	// Using `-` as a wildcard for the project will infer the project from
	// the account. The `account` value can be the `email` address or the
	// `unique_id` of the service account.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// The output format of the private key. `GOOGLE_CREDENTIALS_FILE` is the
	// default output format.
	PrivateKeyType ServiceAccountPrivateKeyType `` /* 153-byte string literal not displayed */
	// Which type of key and algorithm to use for the key.
	// The default is currently a 2K RSA key.  However this may change in the
	// future.
	KeyAlgorithm ServiceAccountKeyAlgorithm `` /* 143-byte string literal not displayed */
}

type CreateServiceAccountRequest struct {
	// Required. The resource name of the project associated with the service
	// accounts, such as `projects/my-project-123`.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// Required. The account id that is used to generate the service account
	// email address and a stable unique id. It is unique within a project,
	// must be 6-30 characters long, and match the regular expression
	// `[a-z]([-a-z0-9]*[a-z0-9])` to comply with RFC1035.
	AccountId string `protobuf:"bytes,2,opt,name=account_id,json=accountId" json:"account_id,omitempty"`
	// The [ServiceAccount][google.iam.admin.v1.ServiceAccount] resource to create.
	// Currently, only the following values are user assignable:
	// `display_name` .
	ServiceAccount *ServiceAccount `protobuf:"bytes,3,opt,name=service_account,json=serviceAccount" json:"service_account,omitempty"`
}

type DeleteRoleRequest struct {
	// The resource name of the role in one of the following formats:
	// `organizations/{ORGANIZATION_ID}/roles/{ROLE_NAME}`
	// `projects/{PROJECT_ID}/roles/{ROLE_NAME}`
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// Used to perform a consistent read-modify-write.
	Etag []byte `protobuf:"bytes,2,opt,name=etag,proto3" json:"etag,omitempty"`
}

type DeleteServiceAccountKeyRequest struct {
	// The resource name of the service account key in the following format:
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}/keys/{key}`.
	// Using `-` as a wildcard for the project will infer the project from
	// the account. The `account` value can be the `email` address or the
	// `unique_id` of the service account.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
}

type DeleteServiceAccountRequest struct {
	// The resource name of the service account in the following format:
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}`.
	// Using `-` as a wildcard for the project will infer the project from
	// the account. The `account` value can be the `email` address or the
	// `unique_id` of the service account.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
}

type GetRoleRequest struct {
	// The resource name of the role in one of the following formats:
	// `roles/{ROLE_NAME}`
	// `organizations/{ORGANIZATION_ID}/roles/{ROLE_NAME}`
	// `projects/{PROJECT_ID}/roles/{ROLE_NAME}`
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
}

type GetServiceAccountKeyRequest struct {
	// The resource name of the service account key in the following format:
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}/keys/{key}`.
	//
	// Using `-` as a wildcard for the project will infer the project from
	// the account. The `account` value can be the `email` address or the
	// `unique_id` of the service account.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// The output format of the public key requested.
	// X509_PEM is the default output format.
	PublicKeyType ServiceAccountPublicKeyType `` /* 149-byte string literal not displayed */
}

type GetServiceAccountRequest struct {
	// The resource name of the service account in the following format:
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}`.
	// Using `-` as a wildcard for the project will infer the project from
	// the account. The `account` value can be the `email` address or the
	// `unique_id` of the service account.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
}

type IAMClient interface {
	// Lists [ServiceAccounts][google.iam.admin.v1.ServiceAccount] for a project.
	ListServiceAccounts(ctx context.Context, in *ListServiceAccountsRequest, opts ...grpc.CallOption) (*ListServiceAccountsResponse, error)
	// Gets a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	GetServiceAccount(ctx context.Context, in *GetServiceAccountRequest, opts ...grpc.CallOption) (*ServiceAccount, error)
	// Creates a [ServiceAccount][google.iam.admin.v1.ServiceAccount]
	// and returns it.
	CreateServiceAccount(ctx context.Context, in *CreateServiceAccountRequest, opts ...grpc.CallOption) (*ServiceAccount, error)
	// Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	//
	// Currently, only the following fields are updatable:
	// `display_name` .
	// The `etag` is mandatory.
	UpdateServiceAccount(ctx context.Context, in *ServiceAccount, opts ...grpc.CallOption) (*ServiceAccount, error)
	// Deletes a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	DeleteServiceAccount(ctx context.Context, in *DeleteServiceAccountRequest, opts ...grpc.CallOption) (*google_protobuf1.Empty, error)
	// Lists [ServiceAccountKeys][google.iam.admin.v1.ServiceAccountKey].
	ListServiceAccountKeys(ctx context.Context, in *ListServiceAccountKeysRequest, opts ...grpc.CallOption) (*ListServiceAccountKeysResponse, error)
	// Gets the [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]
	// by key id.
	GetServiceAccountKey(ctx context.Context, in *GetServiceAccountKeyRequest, opts ...grpc.CallOption) (*ServiceAccountKey, error)
	// Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]
	// and returns it.
	CreateServiceAccountKey(ctx context.Context, in *CreateServiceAccountKeyRequest, opts ...grpc.CallOption) (*ServiceAccountKey, error)
	// Deletes a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
	DeleteServiceAccountKey(ctx context.Context, in *DeleteServiceAccountKeyRequest, opts ...grpc.CallOption) (*google_protobuf1.Empty, error)
	// Signs a blob using a service account's system-managed private key.
	SignBlob(ctx context.Context, in *SignBlobRequest, opts ...grpc.CallOption) (*SignBlobResponse, error)
	// Signs a JWT using a service account's system-managed private key.
	//
	// If no expiry time (`exp`) is provided in the `SignJwtRequest`, IAM sets an
	// an expiry time of one hour by default. If you request an expiry time of
	// more than one hour, the request will fail.
	SignJwt(ctx context.Context, in *SignJwtRequest, opts ...grpc.CallOption) (*SignJwtResponse, error)
	// Returns the IAM access control policy for a
	// [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	GetIamPolicy(ctx context.Context, in *google_iam_v11.GetIamPolicyRequest, opts ...grpc.CallOption) (*google_iam_v1.Policy, error)
	// Sets the IAM access control policy for a
	// [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	SetIamPolicy(ctx context.Context, in *google_iam_v11.SetIamPolicyRequest, opts ...grpc.CallOption) (*google_iam_v1.Policy, error)
	// Tests the specified permissions against the IAM access control policy
	// for a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	TestIamPermissions(ctx context.Context, in *google_iam_v11.TestIamPermissionsRequest, opts ...grpc.CallOption) (*google_iam_v11.TestIamPermissionsResponse, error)
	// Queries roles that can be granted on a particular resource.
	// A role is grantable if it can be used as the role in a binding for a policy
	// for that resource.
	QueryGrantableRoles(ctx context.Context, in *QueryGrantableRolesRequest, opts ...grpc.CallOption) (*QueryGrantableRolesResponse, error)
	// Lists the Roles defined on a resource.
	ListRoles(ctx context.Context, in *ListRolesRequest, opts ...grpc.CallOption) (*ListRolesResponse, error)
	// Gets a Role definition.
	GetRole(ctx context.Context, in *GetRoleRequest, opts ...grpc.CallOption) (*Role, error)
	// Creates a new Role.
	CreateRole(ctx context.Context, in *CreateRoleRequest, opts ...grpc.CallOption) (*Role, error)
	// Updates a Role definition.
	UpdateRole(ctx context.Context, in *UpdateRoleRequest, opts ...grpc.CallOption) (*Role, error)
	// Soft deletes a role. The role is suspended and cannot be used to create new
	// IAM Policy Bindings.
	// The Role will not be included in `ListRoles()` unless `show_deleted` is set
	// in the `ListRolesRequest`. The Role contains the deleted boolean set.
	// Existing Bindings remains, but are inactive. The Role can be undeleted
	// within 7 days. After 7 days the Role is deleted and all Bindings associated
	// with the role are removed.
	DeleteRole(ctx context.Context, in *DeleteRoleRequest, opts ...grpc.CallOption) (*Role, error)
	// Undelete a Role, bringing it back in its previous state.
	UndeleteRole(ctx context.Context, in *UndeleteRoleRequest, opts ...grpc.CallOption) (*Role, error)
	// Lists the permissions testable on a resource.
	// A permission is testable if it can be tested for an identity on a resource.
	QueryTestablePermissions(ctx context.Context, in *QueryTestablePermissionsRequest, opts ...grpc.CallOption) (*QueryTestablePermissionsResponse, error)
}

type IAMServer interface {
	// Lists [ServiceAccounts][google.iam.admin.v1.ServiceAccount] for a project.
	ListServiceAccounts(context.Context, *ListServiceAccountsRequest) (*ListServiceAccountsResponse, error)
	// Gets a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	GetServiceAccount(context.Context, *GetServiceAccountRequest) (*ServiceAccount, error)
	// Creates a [ServiceAccount][google.iam.admin.v1.ServiceAccount]
	// and returns it.
	CreateServiceAccount(context.Context, *CreateServiceAccountRequest) (*ServiceAccount, error)
	// Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	//
	// Currently, only the following fields are updatable:
	// `display_name` .
	// The `etag` is mandatory.
	UpdateServiceAccount(context.Context, *ServiceAccount) (*ServiceAccount, error)
	// Deletes a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	DeleteServiceAccount(context.Context, *DeleteServiceAccountRequest) (*google_protobuf1.Empty, error)
	// Lists [ServiceAccountKeys][google.iam.admin.v1.ServiceAccountKey].
	ListServiceAccountKeys(context.Context, *ListServiceAccountKeysRequest) (*ListServiceAccountKeysResponse, error)
	// Gets the [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]
	// by key id.
	GetServiceAccountKey(context.Context, *GetServiceAccountKeyRequest) (*ServiceAccountKey, error)
	// Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]
	// and returns it.
	CreateServiceAccountKey(context.Context, *CreateServiceAccountKeyRequest) (*ServiceAccountKey, error)
	// Deletes a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
	DeleteServiceAccountKey(context.Context, *DeleteServiceAccountKeyRequest) (*google_protobuf1.Empty, error)
	// Signs a blob using a service account's system-managed private key.
	SignBlob(context.Context, *SignBlobRequest) (*SignBlobResponse, error)
	// Signs a JWT using a service account's system-managed private key.
	//
	// If no expiry time (`exp`) is provided in the `SignJwtRequest`, IAM sets an
	// an expiry time of one hour by default. If you request an expiry time of
	// more than one hour, the request will fail.
	SignJwt(context.Context, *SignJwtRequest) (*SignJwtResponse, error)
	// Returns the IAM access control policy for a
	// [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	GetIamPolicy(context.Context, *google_iam_v11.GetIamPolicyRequest) (*google_iam_v1.Policy, error)
	// Sets the IAM access control policy for a
	// [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	SetIamPolicy(context.Context, *google_iam_v11.SetIamPolicyRequest) (*google_iam_v1.Policy, error)
	// Tests the specified permissions against the IAM access control policy
	// for a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
	TestIamPermissions(context.Context, *google_iam_v11.TestIamPermissionsRequest) (*google_iam_v11.TestIamPermissionsResponse, error)
	// Queries roles that can be granted on a particular resource.
	// A role is grantable if it can be used as the role in a binding for a policy
	// for that resource.
	QueryGrantableRoles(context.Context, *QueryGrantableRolesRequest) (*QueryGrantableRolesResponse, error)
	// Lists the Roles defined on a resource.
	ListRoles(context.Context, *ListRolesRequest) (*ListRolesResponse, error)
	// Gets a Role definition.
	GetRole(context.Context, *GetRoleRequest) (*Role, error)
	// Creates a new Role.
	CreateRole(context.Context, *CreateRoleRequest) (*Role, error)
	// Updates a Role definition.
	UpdateRole(context.Context, *UpdateRoleRequest) (*Role, error)
	// Soft deletes a role. The role is suspended and cannot be used to create new
	// IAM Policy Bindings.
	// The Role will not be included in `ListRoles()` unless `show_deleted` is set
	// in the `ListRolesRequest`. The Role contains the deleted boolean set.
	// Existing Bindings remains, but are inactive. The Role can be undeleted
	// within 7 days. After 7 days the Role is deleted and all Bindings associated
	// with the role are removed.
	DeleteRole(context.Context, *DeleteRoleRequest) (*Role, error)
	// Undelete a Role, bringing it back in its previous state.
	UndeleteRole(context.Context, *UndeleteRoleRequest) (*Role, error)
	// Lists the permissions testable on a resource.
	// A permission is testable if it can be tested for an identity on a resource.
	QueryTestablePermissions(context.Context, *QueryTestablePermissionsRequest) (*QueryTestablePermissionsResponse, error)
}

type ListRolesRequest struct {
	// The resource name of the parent resource in one of the following formats:
	// “ (empty string) -- this refers to curated roles.
	// `organizations/{ORGANIZATION_ID}`
	// `projects/{PROJECT_ID}`
	Parent string `protobuf:"bytes,1,opt,name=parent" json:"parent,omitempty"`
	// Optional limit on the number of roles to include in the response.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize" json:"page_size,omitempty"`
	// Optional pagination token returned in an earlier ListRolesResponse.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken" json:"page_token,omitempty"`
	// Optional view for the returned Role objects.
	View RoleView `protobuf:"varint,4,opt,name=view,enum=google.iam.admin.v1.RoleView" json:"view,omitempty"`
	// Include Roles that have been deleted.
	ShowDeleted bool `protobuf:"varint,6,opt,name=show_deleted,json=showDeleted" json:"show_deleted,omitempty"`
}

type ListRolesResponse struct {
	// The Roles defined on this resource.
	Roles []*Role `protobuf:"bytes,1,rep,name=roles" json:"roles,omitempty"`
	// To retrieve the next page of results, set
	// `ListRolesRequest.page_token` to this value.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken" json:"next_page_token,omitempty"`
}

type ListServiceAccountKeysRequest struct {
	// The resource name of the service account in the following format:
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}`.
	//
	// Using `-` as a wildcard for the project, will infer the project from
	// the account. The `account` value can be the `email` address or the
	// `unique_id` of the service account.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// Filters the types of keys the user wants to include in the list
	// response. Duplicate key types are not allowed. If no key type
	// is provided, all keys are returned.
	KeyTypes []ListServiceAccountKeysRequest_KeyType `` /* 149-byte string literal not displayed */
}

type ListServiceAccountKeysRequest_KeyType int32

type ListServiceAccountKeysResponse struct {
	// The public keys for the service account.
	Keys []*ServiceAccountKey `protobuf:"bytes,1,rep,name=keys" json:"keys,omitempty"`
}

type ListServiceAccountsRequest struct {
	// Required. The resource name of the project associated with the service
	// accounts, such as `projects/my-project-123`.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// Optional limit on the number of service accounts to include in the
	// response. Further accounts can subsequently be obtained by including the
	// [ListServiceAccountsResponse.next_page_token][google.iam.admin.v1.ListServiceAccountsResponse.next_page_token]
	// in a subsequent request.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize" json:"page_size,omitempty"`
	// Optional pagination token returned in an earlier
	// [ListServiceAccountsResponse.next_page_token][google.iam.admin.v1.ListServiceAccountsResponse.next_page_token].
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken" json:"page_token,omitempty"`
}

type ListServiceAccountsResponse struct {
	// The list of matching service accounts.
	Accounts []*ServiceAccount `protobuf:"bytes,1,rep,name=accounts" json:"accounts,omitempty"`
	// To retrieve the next page of results, set
	// [ListServiceAccountsRequest.page_token][google.iam.admin.v1.ListServiceAccountsRequest.page_token]
	// to this value.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken" json:"next_page_token,omitempty"`
}

type Permission struct {
	// The name of this Permission.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// The title of this Permission.
	Title string `protobuf:"bytes,2,opt,name=title" json:"title,omitempty"`
	// A brief description of what this Permission is used for.
	Description string `protobuf:"bytes,3,opt,name=description" json:"description,omitempty"`
	// This permission can ONLY be used in predefined roles.
	OnlyInPredefinedRoles bool `protobuf:"varint,4,opt,name=only_in_predefined_roles,json=onlyInPredefinedRoles" json:"only_in_predefined_roles,omitempty"`
	// The current launch stage of the permission.
	Stage Permission_PermissionLaunchStage `protobuf:"varint,5,opt,name=stage,enum=google.iam.admin.v1.Permission_PermissionLaunchStage" json:"stage,omitempty"`
	// The current custom role support level.
	CustomRolesSupportLevel Permission_CustomRolesSupportLevel `` /* 188-byte string literal not displayed */
}

type Permission_CustomRolesSupportLevel int32

type Permission_PermissionLaunchStage int32

type QueryGrantableRolesRequest struct {
	// Required. The full resource name to query from the list of grantable roles.
	//
	// The name follows the Google Cloud Platform resource format.
	// For example, a Cloud Platform project with id `my-project` will be named
	// `//cloudresourcemanager.googleapis.com/projects/my-project`.
	FullResourceName string   `protobuf:"bytes,1,opt,name=full_resource_name,json=fullResourceName" json:"full_resource_name,omitempty"`
	View             RoleView `protobuf:"varint,2,opt,name=view,enum=google.iam.admin.v1.RoleView" json:"view,omitempty"`
	// Optional limit on the number of roles to include in the response.
	PageSize int32 `protobuf:"varint,3,opt,name=page_size,json=pageSize" json:"page_size,omitempty"`
	// Optional pagination token returned in an earlier
	// QueryGrantableRolesResponse.
	PageToken string `protobuf:"bytes,4,opt,name=page_token,json=pageToken" json:"page_token,omitempty"`
}

type QueryGrantableRolesResponse struct {
	// The list of matching roles.
	Roles []*Role `protobuf:"bytes,1,rep,name=roles" json:"roles,omitempty"`
	// To retrieve the next page of results, set
	// `QueryGrantableRolesRequest.page_token` to this value.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken" json:"next_page_token,omitempty"`
}

type QueryTestablePermissionsRequest struct {
	// Required. The full resource name to query from the list of testable
	// permissions.
	//
	// The name follows the Google Cloud Platform resource format.
	// For example, a Cloud Platform project with id `my-project` will be named
	// `//cloudresourcemanager.googleapis.com/projects/my-project`.
	FullResourceName string `protobuf:"bytes,1,opt,name=full_resource_name,json=fullResourceName" json:"full_resource_name,omitempty"`
	// Optional limit on the number of permissions to include in the response.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize" json:"page_size,omitempty"`
	// Optional pagination token returned in an earlier
	// QueryTestablePermissionsRequest.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken" json:"page_token,omitempty"`
}

type QueryTestablePermissionsResponse struct {
	// The Permissions testable on the requested resource.
	Permissions []*Permission `protobuf:"bytes,1,rep,name=permissions" json:"permissions,omitempty"`
	// To retrieve the next page of results, set
	// `QueryTestableRolesRequest.page_token` to this value.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken" json:"next_page_token,omitempty"`
}

type Role struct {
	// The name of the role.
	//
	// When Role is used in CreateRole, the role name must not be set.
	//
	// When Role is used in output and other input such as UpdateRole, the role
	// name is the complete path, e.g., roles/logging.viewer for curated roles
	// and organizations/{ORGANIZATION_ID}/roles/logging.viewer for custom roles.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// Optional.  A human-readable title for the role.  Typically this
	// is limited to 100 UTF-8 bytes.
	Title string `protobuf:"bytes,2,opt,name=title" json:"title,omitempty"`
	// Optional.  A human-readable description for the role.
	Description string `protobuf:"bytes,3,opt,name=description" json:"description,omitempty"`
	// The names of the permissions this role grants when bound in an IAM policy.
	IncludedPermissions []string `protobuf:"bytes,7,rep,name=included_permissions,json=includedPermissions" json:"included_permissions,omitempty"`
	// The current launch stage of the role.
	Stage Role_RoleLaunchStage `protobuf:"varint,8,opt,name=stage,enum=google.iam.admin.v1.Role_RoleLaunchStage" json:"stage,omitempty"`
	// Used to perform a consistent read-modify-write.
	Etag []byte `protobuf:"bytes,9,opt,name=etag,proto3" json:"etag,omitempty"`
	// The current deleted state of the role. This field is read only.
	// It will be ignored in calls to CreateRole and UpdateRole.
	Deleted bool `protobuf:"varint,11,opt,name=deleted" json:"deleted,omitempty"`
}

type RoleView int32

type Role_RoleLaunchStage int32

type ServiceAccount struct {
	// The resource name of the service account in the following format:
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}`.
	//
	// Requests using `-` as a wildcard for the project will infer the project
	// from the `account` and the `account` value can be the `email` address or
	// the `unique_id` of the service account.
	//
	// In responses the resource name will always be in the format
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}`.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// @OutputOnly The id of the project that owns the service account.
	ProjectId string `protobuf:"bytes,2,opt,name=project_id,json=projectId" json:"project_id,omitempty"`
	// @OutputOnly The unique and stable id of the service account.
	UniqueId string `protobuf:"bytes,4,opt,name=unique_id,json=uniqueId" json:"unique_id,omitempty"`
	// @OutputOnly The email address of the service account.
	Email string `protobuf:"bytes,5,opt,name=email" json:"email,omitempty"`
	// Optional. A user-specified description of the service account.  Must be
	// fewer than 100 UTF-8 bytes.
	DisplayName string `protobuf:"bytes,6,opt,name=display_name,json=displayName" json:"display_name,omitempty"`
	// Used to perform a consistent read-modify-write.
	Etag []byte `protobuf:"bytes,7,opt,name=etag,proto3" json:"etag,omitempty"`
	// @OutputOnly. The OAuth2 client id for the service account.
	// This is used in conjunction with the OAuth2 clientconfig API to make
	// three legged OAuth2 (3LO) flows to access the data of Google users.
	Oauth2ClientId string `protobuf:"bytes,9,opt,name=oauth2_client_id,json=oauth2ClientId" json:"oauth2_client_id,omitempty"`
}

type ServiceAccountKey struct {
	// The resource name of the service account key in the following format
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}/keys/{key}`.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// The output format for the private key.
	// Only provided in `CreateServiceAccountKey` responses, not
	// in `GetServiceAccountKey` or `ListServiceAccountKey` responses.
	//
	// Google never exposes system-managed private keys, and never retains
	// user-managed private keys.
	PrivateKeyType ServiceAccountPrivateKeyType `` /* 153-byte string literal not displayed */
	// Specifies the algorithm (and possibly key size) for the key.
	KeyAlgorithm ServiceAccountKeyAlgorithm `` /* 143-byte string literal not displayed */
	// The private key data. Only provided in `CreateServiceAccountKey`
	// responses. Make sure to keep the private key data secure because it
	// allows for the assertion of the service account identity.
	// When decoded, the private key data can be used to authenticate with
	// Google API client libraries and with
	// <a href="/sdk/gcloud/reference/auth/activate-service-account">gcloud
	// auth activate-service-account</a>.
	PrivateKeyData []byte `protobuf:"bytes,3,opt,name=private_key_data,json=privateKeyData,proto3" json:"private_key_data,omitempty"`
	// The public key data. Only provided in `GetServiceAccountKey` responses.
	PublicKeyData []byte `protobuf:"bytes,7,opt,name=public_key_data,json=publicKeyData,proto3" json:"public_key_data,omitempty"`
	// The key can be used after this timestamp.
	ValidAfterTime *google_protobuf3.Timestamp `protobuf:"bytes,4,opt,name=valid_after_time,json=validAfterTime" json:"valid_after_time,omitempty"`
	// The key can be used before this timestamp.
	ValidBeforeTime *google_protobuf3.Timestamp `protobuf:"bytes,5,opt,name=valid_before_time,json=validBeforeTime" json:"valid_before_time,omitempty"`
}

type ServiceAccountKeyAlgorithm int32

type ServiceAccountPrivateKeyType int32

type ServiceAccountPublicKeyType int32

type SignBlobRequest struct {
	// The resource name of the service account in the following format:
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}`.
	// Using `-` as a wildcard for the project will infer the project from
	// the account. The `account` value can be the `email` address or the
	// `unique_id` of the service account.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// The bytes to sign.
	BytesToSign []byte `protobuf:"bytes,2,opt,name=bytes_to_sign,json=bytesToSign,proto3" json:"bytes_to_sign,omitempty"`
}

type SignBlobResponse struct {
	// The id of the key used to sign the blob.
	KeyId string `protobuf:"bytes,1,opt,name=key_id,json=keyId" json:"key_id,omitempty"`
	// The signed blob.
	Signature []byte `protobuf:"bytes,2,opt,name=signature,proto3" json:"signature,omitempty"`
}

type SignJwtRequest struct {
	// The resource name of the service account in the following format:
	// `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}`.
	// Using `-` as a wildcard for the project will infer the project from
	// the account. The `account` value can be the `email` address or the
	// `unique_id` of the service account.
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// The JWT payload to sign, a JSON JWT Claim set.
	Payload string `protobuf:"bytes,2,opt,name=payload" json:"payload,omitempty"`
}

type SignJwtResponse struct {
	// The id of the key used to sign the JWT.
	KeyId string `protobuf:"bytes,1,opt,name=key_id,json=keyId" json:"key_id,omitempty"`
	// The signed JWT.
	SignedJwt string `protobuf:"bytes,2,opt,name=signed_jwt,json=signedJwt" json:"signed_jwt,omitempty"`
}

type UndeleteRoleRequest struct {
	// The resource name of the role in one of the following formats:
	// `organizations/{ORGANIZATION_ID}/roles/{ROLE_NAME}`
	// `projects/{PROJECT_ID}/roles/{ROLE_NAME}`
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// Used to perform a consistent read-modify-write.
	Etag []byte `protobuf:"bytes,2,opt,name=etag,proto3" json:"etag,omitempty"`
}

type UpdateRoleRequest struct {
	// The resource name of the role in one of the following formats:
	// `roles/{ROLE_NAME}`
	// `organizations/{ORGANIZATION_ID}/roles/{ROLE_NAME}`
	// `projects/{PROJECT_ID}/roles/{ROLE_NAME}`
	Name string `protobuf:"bytes,1,opt,name=name" json:"name,omitempty"`
	// The updated role.
	Role *Role `protobuf:"bytes,2,opt,name=role" json:"role,omitempty"`
	// A mask describing which fields in the Role have changed.
	UpdateMask *google_protobuf2.FieldMask `protobuf:"bytes,3,opt,name=update_mask,json=updateMask" json:"update_mask,omitempty"`
}