v1

type APIKey struct {
	// Identifier of this key
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// URL of this key.
	Url string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
	// User represented by this key
	UserId string `protobuf:"bytes,3,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	// If set, this key only grants access to this organization.
	OrganizationId string `protobuf:"bytes,4,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
	// If set, this key only grants access to read-only API's (List..., Get...)
	IsReadonly bool `protobuf:"varint,5,opt,name=is_readonly,json=isReadonly,proto3" json:"is_readonly,omitempty"`
	// The creation timestamp of the key
	CreatedAt *types.Timestamp `protobuf:"bytes,6,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	// The expiration timestamp of the key
	ExpiresAt *types.Timestamp `protobuf:"bytes,7,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
	// Set when this key is expired.
	IsExpired bool `protobuf:"varint,8,opt,name=is_expired,json=isExpired,proto3" json:"is_expired,omitempty"`
	// The revocation timestamp of the key (if any)
	RevokedAt *types.Timestamp `protobuf:"bytes,9,opt,name=revoked_at,json=revokedAt,proto3" json:"revoked_at,omitempty"`
	// Set when this key is explicitly revoked.
	IsRevoked            bool     `protobuf:"varint,10,opt,name=is_revoked,json=isRevoked,proto3" json:"is_revoked,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type APIKeyCallback func(context.Context, *APIKey) error

type APIKeyList struct {
	Items                []*APIKey `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	XXX_NoUnkeyedLiteral struct{}  `json:"-"`
	XXX_unrecognized     []byte    `json:"-"`
	XXX_sizecache        int32     `json:"-"`
}

type APIKeySecret struct {
	// ID of the API key
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Secret of the API key
	Secret               string   `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type AuthenticateAPIKeyRequest struct {
	// API key id
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Secret of the API key
	Secret string `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
	// Life time of the token.
	// If set, then this TTL is used reduce the default TTL
	// of an authentication token. It cannot be used to increase the default
	// lifetime of a token.
	TimeToLive           *types.Duration `protobuf:"bytes,3,opt,name=time_to_live,json=timeToLive,proto3" json:"time_to_live,omitempty"`
	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
	XXX_unrecognized     []byte          `json:"-"`
	XXX_sizecache        int32           `json:"-"`
}

type AuthenticateAPIKeyResponse struct {
	// Bearer token
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// Actual life time of the token.
	TimeToLive           *types.Duration `protobuf:"bytes,2,opt,name=time_to_live,json=timeToLive,proto3" json:"time_to_live,omitempty"`
	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
	XXX_unrecognized     []byte          `json:"-"`
	XXX_sizecache        int32           `json:"-"`
}

type CreateAPIKeyRequest struct {
	// If set, the created key only grants access to this organization.
	OrganizationId string `protobuf:"bytes,1,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
	// If set, the created key only grants access to read-only API's (List..., Get...).
	// If not set, the created key grants access to all API's (that the user has access to).
	Readonly bool `protobuf:"varint,2,opt,name=readonly,proto3" json:"readonly,omitempty"`
	// Duration between now and the expiration date of the created key.
	// A value of 0 means that the API key will not expire.
	// You can still use RevokeAPIKey to revoke such API keys.
	TimeToLive           *types.Duration `protobuf:"bytes,3,opt,name=time_to_live,json=timeToLive,proto3" json:"time_to_live,omitempty"`
	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
	XXX_unrecognized     []byte          `json:"-"`
	XXX_sizecache        int32           `json:"-"`
}

type GetMultipleEffectivePermissionsRequest struct {
	// URLs of the resources to fetch.
	Urls                 []string `protobuf:"bytes,1,rep,name=urls,proto3" json:"urls,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type GetPolicyByFilterRequest struct {
	// URL of the resource to which this policy applies.
	// This field is required.
	ResourceUrl string `protobuf:"bytes,1,opt,name=resource_url,json=resourceUrl,proto3" json:"resource_url,omitempty"`
	// common listing options (context field is ignored)
	// used for pagination
	Options *v1.ListOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// Filter role bindings based on member identifier
	// Member ID is formatted as:
	// - user:<user_id>
	// - group:<group_id>
	// This field is optional.
	MemberId string `protobuf:"bytes,3,opt,name=member_id,json=memberId,proto3" json:"member_id,omitempty"`
	// Filter based on role identifier
	// This field is optional.
	RoleId               string   `protobuf:"bytes,4,opt,name=role_id,json=roleId,proto3" json:"role_id,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type Group struct {
	// System identifier of the group.
	// This is a read-only value.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Identifier of the organization that owns this group.
	OrganizationId string `protobuf:"bytes,2,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
	// Name of the group
	Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
	// Description of the group
	Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
	// The creation timestamp of the group
	CreatedAt *types.Timestamp `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	// The deletion timestamp of the group
	DeletedAt *types.Timestamp `protobuf:"bytes,6,opt,name=deleted_at,json=deletedAt,proto3" json:"deleted_at,omitempty"`
	// Set when this organization is deleted.
	// This is a read-only value.
	IsDeleted bool `protobuf:"varint,7,opt,name=is_deleted,json=isDeleted,proto3" json:"is_deleted,omitempty"`
	// URL of this resource
	// This is a read-only value and cannot be initialized.
	Url string `protobuf:"bytes,8,opt,name=url,proto3" json:"url,omitempty"`
	// Set if this group is virtual and managed by the system.
	// This is a read-only value.
	IsVirtual bool `protobuf:"varint,9,opt,name=is_virtual,json=isVirtual,proto3" json:"is_virtual,omitempty"`
	// If set, new users are automatically added to this group.
	// If there are multiple default groups, new users are added to all of them.
	IsDefault            bool     `protobuf:"varint,10,opt,name=is_default,json=isDefault,proto3" json:"is_default,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type GroupCallback func(context.Context, *Group) error

type GroupList struct {
	Items                []*Group `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type GroupMemberCallback func(context.Context, string) error

type GroupMemberList struct {
	// List of ID's of users that are member of the group.
	Items []string `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	// List of users that are member of the group.
	Users                []*User  `protobuf:"bytes,2,rep,name=users,proto3" json:"users,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type GroupMembersRequest struct {
	// ID of the group to add/remove members to/from.
	GroupId string `protobuf:"bytes,1,opt,name=group_id,json=groupId,proto3" json:"group_id,omitempty"`
	// ID's of users to add/remove to/from the group.
	UserIds              []string `protobuf:"bytes,2,rep,name=user_ids,json=userIds,proto3" json:"user_ids,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type HasPermissionsRequest struct {
	// URL of the resource to query permissions for.
	Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
	// The list of permissions that are required.
	Permissions          []string `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type IAMServiceClient interface {
	// Get the current API version of this service.
	// Required permissions:
	// - None
	GetAPIVersion(ctx context.Context, in *v1.Empty, opts ...grpc.CallOption) (*v1.Version, error)
	// Fetch all available information of the currently authenticated user.
	// Required permissions:
	// - None
	GetThisUser(ctx context.Context, in *v1.Empty, opts ...grpc.CallOption) (*User, error)
	// Fetch all available information of the user identified by the given ID.
	// Required permissions:
	// - resourcemanager.organization.get on one of the organizations that the requested user and authenticated user are both a member of
	GetUser(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*User, error)
	// Update a user
	// Required permissions:
	// - None if the given user is the authenticated user.
	// or
	// - resourcemanager.organization.get on one of the organizations that the requested user and authenticated user are both a member of and
	// - iam.user.update on organization on one of the organizations that the requested user and authenticated user are both a member of
	UpdateUser(ctx context.Context, in *User, opts ...grpc.CallOption) (*User, error)
	// Verify the mobile phone number of a user, by provided the unique
	// code that was send to the number.
	// If the code is valid an empty result is returned, otherwise an InvalidArgument error is returned.
	// The authenticated user is always the subject of this request.
	// Required permissions:
	// - None (since the subject is always the authenticated user).
	VerifyUserMobilePhone(ctx context.Context, in *VerifyUserMobilePhoneRequest, opts ...grpc.CallOption) (*v1.Empty, error)
	// Resend a verification code to the mobile phone number listed for the
	// authenticated user.
	// Required permissions:
	// - None (since the subject is always the authenticated user).
	ResendUserMobilePhoneVerification(ctx context.Context, in *v1.Empty, opts ...grpc.CallOption) (*v1.Empty, error)
	// Fetch all groups of the organization identified by the given context ID.
	// Required permissions:
	// - iam.group.list on organization identified by given context ID.
	ListGroups(ctx context.Context, in *v1.ListOptions, opts ...grpc.CallOption) (*GroupList, error)
	// Fetch a group by its id.
	// Required permissions:
	// - iam.group.get on organization that owns the group
	GetGroup(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*Group, error)
	// Create a group
	// Required permissions:
	// - iam.group.create on organization that owns the group
	CreateGroup(ctx context.Context, in *Group, opts ...grpc.CallOption) (*Group, error)
	// Update a group
	// Required permissions:
	// - iam.group.update on organization that owns the group
	UpdateGroup(ctx context.Context, in *Group, opts ...grpc.CallOption) (*Group, error)
	// Delete a group
	// Required permissions:
	// - iam.group.delete on organization that owns the group
	DeleteGroup(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*v1.Empty, error)
	// List of members of the group identified by the given context ID.
	// Required permissions:
	// - iam.group.get on organization that owns the group
	ListGroupMembers(ctx context.Context, in *v1.ListOptions, opts ...grpc.CallOption) (*GroupMemberList, error)
	// Add one or more members to the group identified by given ID.
	// Required permissions:
	// - iam.group.update on organization that owns the group
	AddGroupMembers(ctx context.Context, in *GroupMembersRequest, opts ...grpc.CallOption) (*v1.Empty, error)
	// Remove one or more members from the group identified by given ID.
	// Required permissions:
	// - iam.group.update on organization that owns the group
	DeleteGroupMembers(ctx context.Context, in *GroupMembersRequest, opts ...grpc.CallOption) (*v1.Empty, error)
	// Is the user identified by the given user ID a member of the group identified by the given group ID.
	// Required permissions:
	// - iam.group.get on organization that owns the group, unless the requested user is identical to the authenticated user.
	// Note that if the identified group does not exist, no is returned.
	IsMemberOfGroup(ctx context.Context, in *IsMemberOfGroupRequest, opts ...grpc.CallOption) (*v1.YesOrNo, error)
	// Fetch all roles in the organization identified by the given context ID.
	// Required permissions:
	// - iam.role.list on organization identified by given context ID.
	ListRoles(ctx context.Context, in *v1.ListOptions, opts ...grpc.CallOption) (*RoleList, error)
	// Fetch a role by its id.
	// Required permissions:
	// - iam.role.get on organization that owns the role
	GetRole(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*Role, error)
	// Create a custom role
	// Required permissions:
	// - iam.role.create on organization that owns the role
	CreateRole(ctx context.Context, in *Role, opts ...grpc.CallOption) (*Role, error)
	// Update a custom role
	// Required permissions:
	// - iam.role.update on organization that owns the role
	UpdateRole(ctx context.Context, in *Role, opts ...grpc.CallOption) (*Role, error)
	// Delete a custom role
	// Required permissions:
	// - iam.role.delete on organization that owns the role
	DeleteRole(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*v1.Empty, error)
	// Get the policy for a resource identified by given URL.
	// Required permissions:
	// - iam.policy.get on resource identified by the url
	GetPolicy(ctx context.Context, in *v1.URLOptions, opts ...grpc.CallOption) (*Policy, error)
	// Get the policies based on given filters.
	// Required permissions:
	// - iam.policy.get on resource identified by the url
	GetPolicyByFilter(ctx context.Context, in *GetPolicyByFilterRequest, opts ...grpc.CallOption) (*Policy, error)
	// Add one or more RoleBindings to the policy of a resource identified by given URL.
	// Required permissions:
	// - iam.policy.update on resource identified by the url
	AddRoleBindings(ctx context.Context, in *RoleBindingsRequest, opts ...grpc.CallOption) (*Policy, error)
	// Remove one or more RoleBindings from the policy of a resource identified by given URL.
	// Required permissions:
	// - iam.policy.update on resource identified by the url
	DeleteRoleBindings(ctx context.Context, in *RoleBindingsRequest, opts ...grpc.CallOption) (*Policy, error)
	// Return the list of permissions that are available to the currently authenticated
	// used for actions on the resource identified by the given URL.
	// Required permissions:
	// - None
	GetEffectivePermissions(ctx context.Context, in *v1.URLOptions, opts ...grpc.CallOption) (*PermissionList, error)
	// Return the lists of permissions that are available to the currently authenticated
	// used for actions on the resources identified by the given URLs.
	// This method can replace multiple GetEffectivePermissions calls into a single roundtrip.
	// Required permissions:
	// - None
	GetMultipleEffectivePermissions(ctx context.Context, in *GetMultipleEffectivePermissionsRequest, opts ...grpc.CallOption) (*MultiplePermissionLists, error)
	// Does the authenticated user have all of the requested permissions for the resource
	// identified by the given URL?
	// Required permissions:
	// - None
	HasPermissions(ctx context.Context, in *HasPermissionsRequest, opts ...grpc.CallOption) (*v1.YesOrNo, error)
	// List all known permissions.
	// Required permissions:
	// - None
	ListPermissions(ctx context.Context, in *v1.Empty, opts ...grpc.CallOption) (*PermissionList, error)
	// Fetch all API keys owned by the authenticated caller.
	// Required permissions:
	// - None
	ListAPIKeys(ctx context.Context, in *v1.ListOptions, opts ...grpc.CallOption) (*APIKeyList, error)
	// Fetch an API key by its id.
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	GetAPIKey(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*APIKey, error)
	// Create a new API key.
	// The API key will be owned by the authenticated caller.
	// Required permissions:
	// - None
	CreateAPIKey(ctx context.Context, in *CreateAPIKeyRequest, opts ...grpc.CallOption) (*APIKeySecret, error)
	// Ensure that the expiration date of the API key identified by given ID
	// is either in the past or set to now.
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	RevokeAPIKey(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*v1.Empty, error)
	// Delete the API key identified by given ID
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	DeleteAPIKey(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*v1.Empty, error)
	// Authenticate using an API key.
	// If authentication succeeds, this function returns a bearer token.
	// That token must be used to authenticate all other API requests.
	// If the given API key identifier is invalid or expired, or an incorrect secret
	// is given, this function will return an unauthenticated error.
	// Required permissions:
	// - None
	AuthenticateAPIKey(ctx context.Context, in *AuthenticateAPIKeyRequest, opts ...grpc.CallOption) (*AuthenticateAPIKeyResponse, error)
	// Renew a non-expired API key authentication token.
	// This allows to extend the lifetime of a token created by AuthenticateAPIKey.
	// If the given token is invalid or expired, or the underlying API key is expired
	// this function will return an unauthenticated error.
	// Required permissions:
	// - None
	RenewAPIKeyToken(ctx context.Context, in *RenewAPIKeyTokenRequest, opts ...grpc.CallOption) (*RenewAPIKeyTokenResponse, error)
	// Revoke an API key authentication token.
	// This function will return a non-error response, even if the given token
	// is invalid or already expired.
	// Required permissions:
	// - None
	RevokeAPIKeyToken(ctx context.Context, in *RevokeAPIKeyTokenRequest, opts ...grpc.CallOption) (*v1.Empty, error)
}

type IAMServiceServer interface {
	// Get the current API version of this service.
	// Required permissions:
	// - None
	GetAPIVersion(context.Context, *v1.Empty) (*v1.Version, error)
	// Fetch all available information of the currently authenticated user.
	// Required permissions:
	// - None
	GetThisUser(context.Context, *v1.Empty) (*User, error)
	// Fetch all available information of the user identified by the given ID.
	// Required permissions:
	// - resourcemanager.organization.get on one of the organizations that the requested user and authenticated user are both a member of
	GetUser(context.Context, *v1.IDOptions) (*User, error)
	// Update a user
	// Required permissions:
	// - None if the given user is the authenticated user.
	// or
	// - resourcemanager.organization.get on one of the organizations that the requested user and authenticated user are both a member of and
	// - iam.user.update on organization on one of the organizations that the requested user and authenticated user are both a member of
	UpdateUser(context.Context, *User) (*User, error)
	// Verify the mobile phone number of a user, by provided the unique
	// code that was send to the number.
	// If the code is valid an empty result is returned, otherwise an InvalidArgument error is returned.
	// The authenticated user is always the subject of this request.
	// Required permissions:
	// - None (since the subject is always the authenticated user).
	VerifyUserMobilePhone(context.Context, *VerifyUserMobilePhoneRequest) (*v1.Empty, error)
	// Resend a verification code to the mobile phone number listed for the
	// authenticated user.
	// Required permissions:
	// - None (since the subject is always the authenticated user).
	ResendUserMobilePhoneVerification(context.Context, *v1.Empty) (*v1.Empty, error)
	// Fetch all groups of the organization identified by the given context ID.
	// Required permissions:
	// - iam.group.list on organization identified by given context ID.
	ListGroups(context.Context, *v1.ListOptions) (*GroupList, error)
	// Fetch a group by its id.
	// Required permissions:
	// - iam.group.get on organization that owns the group
	GetGroup(context.Context, *v1.IDOptions) (*Group, error)
	// Create a group
	// Required permissions:
	// - iam.group.create on organization that owns the group
	CreateGroup(context.Context, *Group) (*Group, error)
	// Update a group
	// Required permissions:
	// - iam.group.update on organization that owns the group
	UpdateGroup(context.Context, *Group) (*Group, error)
	// Delete a group
	// Required permissions:
	// - iam.group.delete on organization that owns the group
	DeleteGroup(context.Context, *v1.IDOptions) (*v1.Empty, error)
	// List of members of the group identified by the given context ID.
	// Required permissions:
	// - iam.group.get on organization that owns the group
	ListGroupMembers(context.Context, *v1.ListOptions) (*GroupMemberList, error)
	// Add one or more members to the group identified by given ID.
	// Required permissions:
	// - iam.group.update on organization that owns the group
	AddGroupMembers(context.Context, *GroupMembersRequest) (*v1.Empty, error)
	// Remove one or more members from the group identified by given ID.
	// Required permissions:
	// - iam.group.update on organization that owns the group
	DeleteGroupMembers(context.Context, *GroupMembersRequest) (*v1.Empty, error)
	// Is the user identified by the given user ID a member of the group identified by the given group ID.
	// Required permissions:
	// - iam.group.get on organization that owns the group, unless the requested user is identical to the authenticated user.
	// Note that if the identified group does not exist, no is returned.
	IsMemberOfGroup(context.Context, *IsMemberOfGroupRequest) (*v1.YesOrNo, error)
	// Fetch all roles in the organization identified by the given context ID.
	// Required permissions:
	// - iam.role.list on organization identified by given context ID.
	ListRoles(context.Context, *v1.ListOptions) (*RoleList, error)
	// Fetch a role by its id.
	// Required permissions:
	// - iam.role.get on organization that owns the role
	GetRole(context.Context, *v1.IDOptions) (*Role, error)
	// Create a custom role
	// Required permissions:
	// - iam.role.create on organization that owns the role
	CreateRole(context.Context, *Role) (*Role, error)
	// Update a custom role
	// Required permissions:
	// - iam.role.update on organization that owns the role
	UpdateRole(context.Context, *Role) (*Role, error)
	// Delete a custom role
	// Required permissions:
	// - iam.role.delete on organization that owns the role
	DeleteRole(context.Context, *v1.IDOptions) (*v1.Empty, error)
	// Get the policy for a resource identified by given URL.
	// Required permissions:
	// - iam.policy.get on resource identified by the url
	GetPolicy(context.Context, *v1.URLOptions) (*Policy, error)
	// Get the policies based on given filters.
	// Required permissions:
	// - iam.policy.get on resource identified by the url
	GetPolicyByFilter(context.Context, *GetPolicyByFilterRequest) (*Policy, error)
	// Add one or more RoleBindings to the policy of a resource identified by given URL.
	// Required permissions:
	// - iam.policy.update on resource identified by the url
	AddRoleBindings(context.Context, *RoleBindingsRequest) (*Policy, error)
	// Remove one or more RoleBindings from the policy of a resource identified by given URL.
	// Required permissions:
	// - iam.policy.update on resource identified by the url
	DeleteRoleBindings(context.Context, *RoleBindingsRequest) (*Policy, error)
	// Return the list of permissions that are available to the currently authenticated
	// used for actions on the resource identified by the given URL.
	// Required permissions:
	// - None
	GetEffectivePermissions(context.Context, *v1.URLOptions) (*PermissionList, error)
	// Return the lists of permissions that are available to the currently authenticated
	// used for actions on the resources identified by the given URLs.
	// This method can replace multiple GetEffectivePermissions calls into a single roundtrip.
	// Required permissions:
	// - None
	GetMultipleEffectivePermissions(context.Context, *GetMultipleEffectivePermissionsRequest) (*MultiplePermissionLists, error)
	// Does the authenticated user have all of the requested permissions for the resource
	// identified by the given URL?
	// Required permissions:
	// - None
	HasPermissions(context.Context, *HasPermissionsRequest) (*v1.YesOrNo, error)
	// List all known permissions.
	// Required permissions:
	// - None
	ListPermissions(context.Context, *v1.Empty) (*PermissionList, error)
	// Fetch all API keys owned by the authenticated caller.
	// Required permissions:
	// - None
	ListAPIKeys(context.Context, *v1.ListOptions) (*APIKeyList, error)
	// Fetch an API key by its id.
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	GetAPIKey(context.Context, *v1.IDOptions) (*APIKey, error)
	// Create a new API key.
	// The API key will be owned by the authenticated caller.
	// Required permissions:
	// - None
	CreateAPIKey(context.Context, *CreateAPIKeyRequest) (*APIKeySecret, error)
	// Ensure that the expiration date of the API key identified by given ID
	// is either in the past or set to now.
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	RevokeAPIKey(context.Context, *v1.IDOptions) (*v1.Empty, error)
	// Delete the API key identified by given ID
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	DeleteAPIKey(context.Context, *v1.IDOptions) (*v1.Empty, error)
	// Authenticate using an API key.
	// If authentication succeeds, this function returns a bearer token.
	// That token must be used to authenticate all other API requests.
	// If the given API key identifier is invalid or expired, or an incorrect secret
	// is given, this function will return an unauthenticated error.
	// Required permissions:
	// - None
	AuthenticateAPIKey(context.Context, *AuthenticateAPIKeyRequest) (*AuthenticateAPIKeyResponse, error)
	// Renew a non-expired API key authentication token.
	// This allows to extend the lifetime of a token created by AuthenticateAPIKey.
	// If the given token is invalid or expired, or the underlying API key is expired
	// this function will return an unauthenticated error.
	// Required permissions:
	// - None
	RenewAPIKeyToken(context.Context, *RenewAPIKeyTokenRequest) (*RenewAPIKeyTokenResponse, error)
	// Revoke an API key authentication token.
	// This function will return a non-error response, even if the given token
	// is invalid or already expired.
	// Required permissions:
	// - None
	RevokeAPIKeyToken(context.Context, *RevokeAPIKeyTokenRequest) (*v1.Empty, error)
}

type IsMemberOfGroupRequest struct {
	// Identifier of the user
	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	// Identifier of the group
	GroupId              string   `protobuf:"bytes,2,opt,name=group_id,json=groupId,proto3" json:"group_id,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type MultiplePermissionLists struct {
	Items                []*PermissionList `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
	XXX_unrecognized     []byte            `json:"-"`
	XXX_sizecache        int32             `json:"-"`
}

type PermissionList struct {
	// The permissions
	Items []string `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	// URL of the resource (filled out when GetMultipleEffectivePermissions was called).
	Url                  string   `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type Policy struct {
	// URL of the resource to which this policy applies.
	ResourceUrl string `protobuf:"bytes,1,opt,name=resource_url,json=resourceUrl,proto3" json:"resource_url,omitempty"`
	// Role bindings to apply to the resource.
	Bindings             []*RoleBinding `protobuf:"bytes,2,rep,name=bindings,proto3" json:"bindings,omitempty"`
	XXX_NoUnkeyedLiteral struct{}       `json:"-"`
	XXX_unrecognized     []byte         `json:"-"`
	XXX_sizecache        int32          `json:"-"`
}

type RenewAPIKeyTokenRequest struct {
	// Bearer token
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// Extended life time of the token.
	// By default, a renewed token will have a default lifetime from the moment
	// of the renew call.
	// If this field is set, then this TTL is used reduce the default TTL
	// of the renewed token. It cannot be used to increase the default
	// lifetime of the renewed token.
	TimeToLive           *types.Duration `protobuf:"bytes,2,opt,name=time_to_live,json=timeToLive,proto3" json:"time_to_live,omitempty"`
	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
	XXX_unrecognized     []byte          `json:"-"`
	XXX_sizecache        int32           `json:"-"`
}

type RenewAPIKeyTokenResponse struct {
	// Actual life time of the token.
	TimeToLive           *types.Duration `protobuf:"bytes,1,opt,name=time_to_live,json=timeToLive,proto3" json:"time_to_live,omitempty"`
	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
	XXX_unrecognized     []byte          `json:"-"`
	XXX_sizecache        int32           `json:"-"`
}

type RevokeAPIKeyTokenRequest struct {
	// Bearer token
	Token                string   `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type Role struct {
	// System identifier of the role.
	// This is a read-only value.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Identifier of the organization that owns this role.
	// This value is undefined for predefined roles.
	OrganizationId string `protobuf:"bytes,2,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
	// Name of the role
	Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
	// Description of the role
	Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
	// Permissions to grant when this role is bound.
	Permissions []string `protobuf:"bytes,5,rep,name=permissions,proto3" json:"permissions,omitempty"`
	// Set if this role is predefined.
	// This is a read-only value.
	IsPredefined bool `protobuf:"varint,6,opt,name=is_predefined,json=isPredefined,proto3" json:"is_predefined,omitempty"`
	// The creation timestamp of the role
	CreatedAt *types.Timestamp `protobuf:"bytes,7,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	// The deletion timestamp of the role
	DeletedAt *types.Timestamp `protobuf:"bytes,8,opt,name=deleted_at,json=deletedAt,proto3" json:"deleted_at,omitempty"`
	// Set when this organization is deleted.
	// This is a read-only value.
	IsDeleted bool `protobuf:"varint,9,opt,name=is_deleted,json=isDeleted,proto3" json:"is_deleted,omitempty"`
	// URL of this resource
	// This is a read-only value and cannot be initialized.
	Url                  string   `protobuf:"bytes,10,opt,name=url,proto3" json:"url,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type RoleBinding struct {
	// System identifier of the role-binding.
	// This is a read-only value.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Identifier of the member to bind a role to.
	// Member ID is formatted as:
	// - user:<user_id>
	// - group:<group_id>
	MemberId string `protobuf:"bytes,2,opt,name=member_id,json=memberId,proto3" json:"member_id,omitempty"`
	// Identifier of the Role to grant to member
	RoleId string `protobuf:"bytes,3,opt,name=role_id,json=roleId,proto3" json:"role_id,omitempty"`
	// If set, this this role-binding cannot be deleted
	// This is a read-only value.
	DeleteNotAllowed     bool     `protobuf:"varint,4,opt,name=delete_not_allowed,json=deleteNotAllowed,proto3" json:"delete_not_allowed,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type RoleBindingsRequest struct {
	// URL of the resource to add/remove policy binding to/from.
	ResourceUrl string `protobuf:"bytes,1,opt,name=resource_url,json=resourceUrl,proto3" json:"resource_url,omitempty"`
	// Role bindings to add/remove to the policy.
	Bindings             []*RoleBinding `protobuf:"bytes,2,rep,name=bindings,proto3" json:"bindings,omitempty"`
	XXX_NoUnkeyedLiteral struct{}       `json:"-"`
	XXX_unrecognized     []byte         `json:"-"`
	XXX_sizecache        int32          `json:"-"`
}

type RoleCallback func(context.Context, *Role) error

type RoleList struct {
	Items                []*Role  `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type UnimplementedIAMServiceServer struct {
}