{ "parameters": { "$.xgafv": { "type": "string", "description": "V1 error format.", "enumDescriptions": [ "v1 error format", "v2 error format" ], "location": "query", "enum": [ "1", "2" ] }, "fields": { "location": "query", "type": "string", "description": "Selector specifying which fields to include in a partial response." }, "access_token": { "description": "OAuth access token.", "type": "string", "location": "query" }, "upload_protocol": { "type": "string", "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").", "location": "query" }, "alt": { "default": "json", "type": "string", "location": "query", "enum": [ "json", "media", "proto" ], "description": "Data format for response.", "enumDescriptions": [ "Responses with Content-Type of application/json", "Media download with context-dependent Content-Type", "Responses with Content-Type of application/x-protobuf" ] }, "key": { "type": "string", "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.", "location": "query" }, "quotaUser": { "type": "string", "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.", "location": "query" }, "oauth_token": { "description": "OAuth 2.0 token for the current user.", "type": "string", "location": "query" }, "prettyPrint": { "default": "true", "type": "boolean", "description": "Returns response with indentations and line breaks.", "location": "query" }, "uploadType": { "location": "query", "type": "string", "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\")." }, "callback": { "description": "JSONP", "location": "query", "type": "string" } }, "batchPath": "batch", "title": "Access Approval API", "auth": { "oauth2": { "scopes": { "https://www.googleapis.com/auth/cloud-platform": { "description": "See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account." } } } }, "resources": { "projects": { "resources": { "approvalRequests": { "methods": { "get": { "parameterOrder": [ "name" ], "description": "Gets an approval request. Returns NOT_FOUND if the request does not exist.", "path": "v1/{+name}", "parameters": { "name": { "required": true, "type": "string", "description": "The name of the approval request to retrieve. Format: \"{projects|folders|organizations}/{id}/approvalRequests/{approval_request}\"", "location": "path", "pattern": "^projects/[^/]+/approvalRequests/[^/]+$" } }, "flatPath": "v1/projects/{projectsId}/approvalRequests/{approvalRequestsId}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "accessapproval.projects.approvalRequests.get", "httpMethod": "GET", "response": { "$ref": "ApprovalRequest" } }, "list": { "response": { "$ref": "ListApprovalRequestsResponse" }, "id": "accessapproval.projects.approvalRequests.list", "httpMethod": "GET", "description": "Lists approval requests associated with a project, folder, or organization. Approval requests can be filtered by state (pending, active, dismissed). The order is reverse chronological.", "path": "v1/{+parent}/approvalRequests", "parameters": { "filter": { "type": "string", "description": "A filter on the type of approval requests to retrieve. Must be one of the following values: * [not set]: Requests that are pending or have active approvals. * ALL: All requests. * PENDING: Only pending requests. * ACTIVE: Only active (i.e. currently approved) requests. * DISMISSED: Only requests that have been dismissed, or requests that are not approved and past expiration. * EXPIRED: Only requests that have been approved, and the approval has expired. * HISTORY: Active, dismissed and expired requests.", "location": "query" }, "pageSize": { "location": "query", "description": "Requested page size.", "format": "int32", "type": "integer" }, "pageToken": { "description": "A token identifying the page of results to return.", "location": "query", "type": "string" }, "parent": { "required": true, "pattern": "^projects/[^/]+$", "type": "string", "location": "path", "description": "The parent resource. This may be \"projects/{project}\", \"folders/{folder}\", or \"organizations/{organization}\"." } }, "parameterOrder": [ "parent" ], "flatPath": "v1/projects/{projectsId}/approvalRequests", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "approve": { "path": "v1/{+name}:approve", "request": { "$ref": "ApproveApprovalRequestMessage" }, "response": { "$ref": "ApprovalRequest" }, "parameterOrder": [ "name" ], "parameters": { "name": { "required": true, "location": "path", "description": "Name of the approval request to approve.", "type": "string", "pattern": "^projects/[^/]+/approvalRequests/[^/]+$" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "POST", "description": "Approves a request and returns the updated ApprovalRequest. Returns NOT_FOUND if the request does not exist. Returns FAILED_PRECONDITION if the request exists but is not in a pending state.", "flatPath": "v1/projects/{projectsId}/approvalRequests/{approvalRequestsId}:approve", "id": "accessapproval.projects.approvalRequests.approve" }, "dismiss": { "flatPath": "v1/projects/{projectsId}/approvalRequests/{approvalRequestsId}:dismiss", "httpMethod": "POST", "parameterOrder": [ "name" ], "description": "Dismisses a request. Returns the updated ApprovalRequest. NOTE: When a request is dismissed, it is considered ignored. Dismissing a request does not prevent access granted by other Access Approval requests. Returns NOT_FOUND if the request does not exist. Returns FAILED_PRECONDITION if the request exists but is not in a pending state.", "parameters": { "name": { "location": "path", "type": "string", "pattern": "^projects/[^/]+/approvalRequests/[^/]+$", "required": true, "description": "Name of the ApprovalRequest to dismiss." } }, "request": { "$ref": "DismissApprovalRequestMessage" }, "id": "accessapproval.projects.approvalRequests.dismiss", "path": "v1/{+name}:dismiss", "response": { "$ref": "ApprovalRequest" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "invalidate": { "parameters": { "name": { "location": "path", "pattern": "^projects/[^/]+/approvalRequests/[^/]+$", "type": "string", "description": "Name of the ApprovalRequest to invalidate.", "required": true } }, "description": "Invalidates an existing ApprovalRequest. Returns the updated ApprovalRequest. NOTE: This action revokes Google access based on this approval request. If the resource has other active approvals, access will remain granted. Returns FAILED_PRECONDITION if the request exists but is not in an approved state.", "response": { "$ref": "ApprovalRequest" }, "parameterOrder": [ "name" ], "request": { "$ref": "InvalidateApprovalRequestMessage" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "accessapproval.projects.approvalRequests.invalidate", "httpMethod": "POST", "flatPath": "v1/projects/{projectsId}/approvalRequests/{approvalRequestsId}:invalidate", "path": "v1/{+name}:invalidate" } } } }, "methods": { "updateAccessApprovalSettings": { "httpMethod": "PATCH", "id": "accessapproval.projects.updateAccessApprovalSettings", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "AccessApprovalSettings" }, "description": "Updates the settings associated with a project, folder, or organization. Settings to update are determined by the value of field_mask.", "request": { "$ref": "AccessApprovalSettings" }, "path": "v1/{+name}", "flatPath": "v1/projects/{projectsId}/accessApprovalSettings", "parameterOrder": [ "name" ], "parameters": { "updateMask": { "format": "google-fieldmask", "location": "query", "description": "The update mask applies to the settings. Only the top level fields of AccessApprovalSettings (notification_emails & enrolled_services) are supported. For each field, if it is included, the currently stored value will be entirely overwritten with the value of the field passed in this request. For the `FieldMask` definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask If this field is left unset, only the notification_emails field will be updated.", "type": "string" }, "name": { "description": "The resource name of the settings. Format is one of: * \"projects/{project}/accessApprovalSettings\" * \"folders/{folder}/accessApprovalSettings\" * \"organizations/{organization}/accessApprovalSettings\"", "location": "path", "pattern": "^projects/[^/]+/accessApprovalSettings$", "type": "string", "required": true } } }, "getAccessApprovalSettings": { "flatPath": "v1/projects/{projectsId}/accessApprovalSettings", "path": "v1/{+name}", "parameters": { "name": { "description": "The name of the AccessApprovalSettings to retrieve. Format: \"{projects|folders|organizations}/{id}/accessApprovalSettings\"", "required": true, "pattern": "^projects/[^/]+/accessApprovalSettings$", "type": "string", "location": "path" } }, "id": "accessapproval.projects.getAccessApprovalSettings", "parameterOrder": [ "name" ], "response": { "$ref": "AccessApprovalSettings" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "GET", "description": "Gets the Access Approval settings associated with a project, folder, or organization." }, "getServiceAccount": { "parameterOrder": [ "name" ], "id": "accessapproval.projects.getServiceAccount", "parameters": { "name": { "pattern": "^projects/[^/]+/serviceAccount$", "required": true, "type": "string", "description": "Name of the AccessApprovalServiceAccount to retrieve.", "location": "path" } }, "path": "v1/{+name}", "flatPath": "v1/projects/{projectsId}/serviceAccount", "httpMethod": "GET", "response": { "$ref": "AccessApprovalServiceAccount" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Retrieves the service account that is used by Access Approval to access KMS keys for signing approved approval requests." }, "deleteAccessApprovalSettings": { "flatPath": "v1/projects/{projectsId}/accessApprovalSettings", "description": "Deletes the settings associated with a project, folder, or organization. This will have the effect of disabling Access Approval for the resource. Access Approval may remain active based on parent resource settings. To confirm the effective settings, call GetAccessApprovalSettings and verify effective setting is disabled.", "parameters": { "name": { "required": true, "type": "string", "location": "path", "description": "Name of the AccessApprovalSettings to delete.", "pattern": "^projects/[^/]+/accessApprovalSettings$" } }, "path": "v1/{+name}", "httpMethod": "DELETE", "id": "accessapproval.projects.deleteAccessApprovalSettings", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "name" ], "response": { "$ref": "Empty" } } } }, "organizations": { "resources": { "approvalRequests": { "methods": { "get": { "flatPath": "v1/organizations/{organizationsId}/approvalRequests/{approvalRequestsId}", "httpMethod": "GET", "parameterOrder": [ "name" ], "description": "Gets an approval request. Returns NOT_FOUND if the request does not exist.", "path": "v1/{+name}", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "ApprovalRequest" }, "id": "accessapproval.organizations.approvalRequests.get", "parameters": { "name": { "type": "string", "description": "The name of the approval request to retrieve. Format: \"{projects|folders|organizations}/{id}/approvalRequests/{approval_request}\"", "location": "path", "pattern": "^organizations/[^/]+/approvalRequests/[^/]+$", "required": true } } }, "list": { "parameterOrder": [ "parent" ], "path": "v1/{+parent}/approvalRequests", "response": { "$ref": "ListApprovalRequestsResponse" }, "description": "Lists approval requests associated with a project, folder, or organization. Approval requests can be filtered by state (pending, active, dismissed). The order is reverse chronological.", "httpMethod": "GET", "id": "accessapproval.organizations.approvalRequests.list", "flatPath": "v1/organizations/{organizationsId}/approvalRequests", "parameters": { "parent": { "required": true, "type": "string", "pattern": "^organizations/[^/]+$", "description": "The parent resource. This may be \"projects/{project}\", \"folders/{folder}\", or \"organizations/{organization}\".", "location": "path" }, "pageToken": { "type": "string", "description": "A token identifying the page of results to return.", "location": "query" }, "filter": { "description": "A filter on the type of approval requests to retrieve. Must be one of the following values: * [not set]: Requests that are pending or have active approvals. * ALL: All requests. * PENDING: Only pending requests. * ACTIVE: Only active (i.e. currently approved) requests. * DISMISSED: Only requests that have been dismissed, or requests that are not approved and past expiration. * EXPIRED: Only requests that have been approved, and the approval has expired. * HISTORY: Active, dismissed and expired requests.", "location": "query", "type": "string" }, "pageSize": { "description": "Requested page size.", "location": "query", "type": "integer", "format": "int32" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "invalidate": { "request": { "$ref": "InvalidateApprovalRequestMessage" }, "response": { "$ref": "ApprovalRequest" }, "description": "Invalidates an existing ApprovalRequest. Returns the updated ApprovalRequest. NOTE: This action revokes Google access based on this approval request. If the resource has other active approvals, access will remain granted. Returns FAILED_PRECONDITION if the request exists but is not in an approved state.", "path": "v1/{+name}:invalidate", "parameters": { "name": { "location": "path", "type": "string", "required": true, "pattern": "^organizations/[^/]+/approvalRequests/[^/]+$", "description": "Name of the ApprovalRequest to invalidate." } }, "httpMethod": "POST", "parameterOrder": [ "name" ], "flatPath": "v1/organizations/{organizationsId}/approvalRequests/{approvalRequestsId}:invalidate", "id": "accessapproval.organizations.approvalRequests.invalidate", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] }, "approve": { "parameters": { "name": { "pattern": "^organizations/[^/]+/approvalRequests/[^/]+$", "location": "path", "description": "Name of the approval request to approve.", "type": "string", "required": true } }, "id": "accessapproval.organizations.approvalRequests.approve", "flatPath": "v1/organizations/{organizationsId}/approvalRequests/{approvalRequestsId}:approve", "path": "v1/{+name}:approve", "description": "Approves a request and returns the updated ApprovalRequest. Returns NOT_FOUND if the request does not exist. Returns FAILED_PRECONDITION if the request exists but is not in a pending state.", "parameterOrder": [ "name" ], "httpMethod": "POST", "request": { "$ref": "ApproveApprovalRequestMessage" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "ApprovalRequest" } }, "dismiss": { "flatPath": "v1/organizations/{organizationsId}/approvalRequests/{approvalRequestsId}:dismiss", "parameterOrder": [ "name" ], "path": "v1/{+name}:dismiss", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "POST", "request": { "$ref": "DismissApprovalRequestMessage" }, "parameters": { "name": { "location": "path", "description": "Name of the ApprovalRequest to dismiss.", "type": "string", "pattern": "^organizations/[^/]+/approvalRequests/[^/]+$", "required": true } }, "id": "accessapproval.organizations.approvalRequests.dismiss", "description": "Dismisses a request. Returns the updated ApprovalRequest. NOTE: When a request is dismissed, it is considered ignored. Dismissing a request does not prevent access granted by other Access Approval requests. Returns NOT_FOUND if the request does not exist. Returns FAILED_PRECONDITION if the request exists but is not in a pending state.", "response": { "$ref": "ApprovalRequest" } } } } }, "methods": { "getServiceAccount": { "response": { "$ref": "AccessApprovalServiceAccount" }, "httpMethod": "GET", "path": "v1/{+name}", "description": "Retrieves the service account that is used by Access Approval to access KMS keys for signing approved approval requests.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "accessapproval.organizations.getServiceAccount", "parameters": { "name": { "pattern": "^organizations/[^/]+/serviceAccount$", "type": "string", "location": "path", "description": "Name of the AccessApprovalServiceAccount to retrieve.", "required": true } }, "flatPath": "v1/organizations/{organizationsId}/serviceAccount", "parameterOrder": [ "name" ] }, "updateAccessApprovalSettings": { "parameterOrder": [ "name" ], "response": { "$ref": "AccessApprovalSettings" }, "description": "Updates the settings associated with a project, folder, or organization. Settings to update are determined by the value of field_mask.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "path": "v1/{+name}", "httpMethod": "PATCH", "parameters": { "name": { "required": true, "location": "path", "type": "string", "pattern": "^organizations/[^/]+/accessApprovalSettings$", "description": "The resource name of the settings. Format is one of: * \"projects/{project}/accessApprovalSettings\" * \"folders/{folder}/accessApprovalSettings\" * \"organizations/{organization}/accessApprovalSettings\"" }, "updateMask": { "format": "google-fieldmask", "location": "query", "type": "string", "description": "The update mask applies to the settings. Only the top level fields of AccessApprovalSettings (notification_emails & enrolled_services) are supported. For each field, if it is included, the currently stored value will be entirely overwritten with the value of the field passed in this request. For the `FieldMask` definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask If this field is left unset, only the notification_emails field will be updated." } }, "id": "accessapproval.organizations.updateAccessApprovalSettings", "flatPath": "v1/organizations/{organizationsId}/accessApprovalSettings", "request": { "$ref": "AccessApprovalSettings" } }, "getAccessApprovalSettings": { "path": "v1/{+name}", "parameters": { "name": { "pattern": "^organizations/[^/]+/accessApprovalSettings$", "description": "The name of the AccessApprovalSettings to retrieve. Format: \"{projects|folders|organizations}/{id}/accessApprovalSettings\"", "required": true, "location": "path", "type": "string" } }, "id": "accessapproval.organizations.getAccessApprovalSettings", "flatPath": "v1/organizations/{organizationsId}/accessApprovalSettings", "description": "Gets the Access Approval settings associated with a project, folder, or organization.", "response": { "$ref": "AccessApprovalSettings" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "GET", "parameterOrder": [ "name" ] }, "deleteAccessApprovalSettings": { "path": "v1/{+name}", "httpMethod": "DELETE", "description": "Deletes the settings associated with a project, folder, or organization. This will have the effect of disabling Access Approval for the resource. Access Approval may remain active based on parent resource settings. To confirm the effective settings, call GetAccessApprovalSettings and verify effective setting is disabled.", "flatPath": "v1/organizations/{organizationsId}/accessApprovalSettings", "parameters": { "name": { "required": true, "type": "string", "pattern": "^organizations/[^/]+/accessApprovalSettings$", "description": "Name of the AccessApprovalSettings to delete.", "location": "path" } }, "response": { "$ref": "Empty" }, "id": "accessapproval.organizations.deleteAccessApprovalSettings", "parameterOrder": [ "name" ], "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ] } } }, "folders": { "resources": { "approvalRequests": { "methods": { "invalidate": { "parameters": { "name": { "pattern": "^folders/[^/]+/approvalRequests/[^/]+$", "required": true, "description": "Name of the ApprovalRequest to invalidate.", "location": "path", "type": "string" } }, "flatPath": "v1/folders/{foldersId}/approvalRequests/{approvalRequestsId}:invalidate", "description": "Invalidates an existing ApprovalRequest. Returns the updated ApprovalRequest. NOTE: This action revokes Google access based on this approval request. If the resource has other active approvals, access will remain granted. Returns FAILED_PRECONDITION if the request exists but is not in an approved state.", "path": "v1/{+name}:invalidate", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "accessapproval.folders.approvalRequests.invalidate", "parameterOrder": [ "name" ], "httpMethod": "POST", "response": { "$ref": "ApprovalRequest" }, "request": { "$ref": "InvalidateApprovalRequestMessage" } }, "approve": { "parameters": { "name": { "description": "Name of the approval request to approve.", "required": true, "location": "path", "pattern": "^folders/[^/]+/approvalRequests/[^/]+$", "type": "string" } }, "path": "v1/{+name}:approve", "response": { "$ref": "ApprovalRequest" }, "description": "Approves a request and returns the updated ApprovalRequest. Returns NOT_FOUND if the request does not exist. Returns FAILED_PRECONDITION if the request exists but is not in a pending state.", "id": "accessapproval.folders.approvalRequests.approve", "flatPath": "v1/folders/{foldersId}/approvalRequests/{approvalRequestsId}:approve", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "parameterOrder": [ "name" ], "httpMethod": "POST", "request": { "$ref": "ApproveApprovalRequestMessage" } }, "dismiss": { "httpMethod": "POST", "path": "v1/{+name}:dismiss", "flatPath": "v1/folders/{foldersId}/approvalRequests/{approvalRequestsId}:dismiss", "request": { "$ref": "DismissApprovalRequestMessage" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "response": { "$ref": "ApprovalRequest" }, "parameterOrder": [ "name" ], "id": "accessapproval.folders.approvalRequests.dismiss", "parameters": { "name": { "location": "path", "description": "Name of the ApprovalRequest to dismiss.", "type": "string", "required": true, "pattern": "^folders/[^/]+/approvalRequests/[^/]+$" } }, "description": "Dismisses a request. Returns the updated ApprovalRequest. NOTE: When a request is dismissed, it is considered ignored. Dismissing a request does not prevent access granted by other Access Approval requests. Returns NOT_FOUND if the request does not exist. Returns FAILED_PRECONDITION if the request exists but is not in a pending state." }, "list": { "response": { "$ref": "ListApprovalRequestsResponse" }, "parameterOrder": [ "parent" ], "path": "v1/{+parent}/approvalRequests", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "GET", "parameters": { "filter": { "description": "A filter on the type of approval requests to retrieve. Must be one of the following values: * [not set]: Requests that are pending or have active approvals. * ALL: All requests. * PENDING: Only pending requests. * ACTIVE: Only active (i.e. currently approved) requests. * DISMISSED: Only requests that have been dismissed, or requests that are not approved and past expiration. * EXPIRED: Only requests that have been approved, and the approval has expired. * HISTORY: Active, dismissed and expired requests.", "type": "string", "location": "query" }, "pageToken": { "description": "A token identifying the page of results to return.", "location": "query", "type": "string" }, "parent": { "type": "string", "required": true, "description": "The parent resource. This may be \"projects/{project}\", \"folders/{folder}\", or \"organizations/{organization}\".", "location": "path", "pattern": "^folders/[^/]+$" }, "pageSize": { "description": "Requested page size.", "format": "int32", "type": "integer", "location": "query" } }, "flatPath": "v1/folders/{foldersId}/approvalRequests", "description": "Lists approval requests associated with a project, folder, or organization. Approval requests can be filtered by state (pending, active, dismissed). The order is reverse chronological.", "id": "accessapproval.folders.approvalRequests.list" }, "get": { "id": "accessapproval.folders.approvalRequests.get", "response": { "$ref": "ApprovalRequest" }, "parameters": { "name": { "type": "string", "location": "path", "description": "The name of the approval request to retrieve. Format: \"{projects|folders|organizations}/{id}/approvalRequests/{approval_request}\"", "required": true, "pattern": "^folders/[^/]+/approvalRequests/[^/]+$" } }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "GET", "flatPath": "v1/folders/{foldersId}/approvalRequests/{approvalRequestsId}", "description": "Gets an approval request. Returns NOT_FOUND if the request does not exist.", "parameterOrder": [ "name" ], "path": "v1/{+name}" } } } }, "methods": { "deleteAccessApprovalSettings": { "flatPath": "v1/folders/{foldersId}/accessApprovalSettings", "description": "Deletes the settings associated with a project, folder, or organization. This will have the effect of disabling Access Approval for the resource. Access Approval may remain active based on parent resource settings. To confirm the effective settings, call GetAccessApprovalSettings and verify effective setting is disabled.", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "httpMethod": "DELETE", "id": "accessapproval.folders.deleteAccessApprovalSettings", "parameters": { "name": { "type": "string", "location": "path", "pattern": "^folders/[^/]+/accessApprovalSettings$", "required": true, "description": "Name of the AccessApprovalSettings to delete." } }, "response": { "$ref": "Empty" }, "parameterOrder": [ "name" ], "path": "v1/{+name}" }, "getServiceAccount": { "parameters": { "name": { "type": "string", "pattern": "^folders/[^/]+/serviceAccount$", "required": true, "description": "Name of the AccessApprovalServiceAccount to retrieve.", "location": "path" } }, "path": "v1/{+name}", "response": { "$ref": "AccessApprovalServiceAccount" }, "parameterOrder": [ "name" ], "description": "Retrieves the service account that is used by Access Approval to access KMS keys for signing approved approval requests.", "httpMethod": "GET", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "flatPath": "v1/folders/{foldersId}/serviceAccount", "id": "accessapproval.folders.getServiceAccount" }, "updateAccessApprovalSettings": { "response": { "$ref": "AccessApprovalSettings" }, "request": { "$ref": "AccessApprovalSettings" }, "description": "Updates the settings associated with a project, folder, or organization. Settings to update are determined by the value of field_mask.", "parameters": { "updateMask": { "location": "query", "type": "string", "description": "The update mask applies to the settings. Only the top level fields of AccessApprovalSettings (notification_emails & enrolled_services) are supported. For each field, if it is included, the currently stored value will be entirely overwritten with the value of the field passed in this request. For the `FieldMask` definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask If this field is left unset, only the notification_emails field will be updated.", "format": "google-fieldmask" }, "name": { "location": "path", "description": "The resource name of the settings. Format is one of: * \"projects/{project}/accessApprovalSettings\" * \"folders/{folder}/accessApprovalSettings\" * \"organizations/{organization}/accessApprovalSettings\"", "required": true, "type": "string", "pattern": "^folders/[^/]+/accessApprovalSettings$" } }, "id": "accessapproval.folders.updateAccessApprovalSettings", "httpMethod": "PATCH", "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "path": "v1/{+name}", "flatPath": "v1/folders/{foldersId}/accessApprovalSettings", "parameterOrder": [ "name" ] }, "getAccessApprovalSettings": { "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "id": "accessapproval.folders.getAccessApprovalSettings", "response": { "$ref": "AccessApprovalSettings" }, "path": "v1/{+name}", "httpMethod": "GET", "flatPath": "v1/folders/{foldersId}/accessApprovalSettings", "parameters": { "name": { "pattern": "^folders/[^/]+/accessApprovalSettings$", "required": true, "description": "The name of the AccessApprovalSettings to retrieve. Format: \"{projects|folders|organizations}/{id}/accessApprovalSettings\"", "type": "string", "location": "path" } }, "description": "Gets the Access Approval settings associated with a project, folder, or organization.", "parameterOrder": [ "name" ] } } } }, "fullyEncodeReservedExpansion": true, "icons": { "x32": "http://www.google.com/images/icons/product/search-32.gif", "x16": "http://www.google.com/images/icons/product/search-16.gif" }, "baseUrl": "https://accessapproval.googleapis.com/", "id": "accessapproval:v1", "discoveryVersion": "v1", "kind": "discovery#restDescription", "basePath": "", "version_module": true, "mtlsRootUrl": "https://accessapproval.mtls.googleapis.com/", "revision": "20261006", "name": "accessapproval", "version": "v1", "servicePath": "", "canonicalName": "Access Approval", "ownerName": "Google", "documentationLink": "https://cloud.google.com/assured-workloads/access-approval/docs", "ownerDomain": "google.com", "protocol": "rest", "rootUrl": "https://accessapproval.googleapis.com/", "schemas": { "Empty": { "description": "A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }", "type": "object", "id": "Empty", "properties": {} }, "AccessReason": { "id": "AccessReason", "properties": { "detail": { "type": "string", "description": "More detail about certain reason types. See comments for each type above." }, "type": { "enumDescriptions": [ "This value is not used.", "Customer made a request or raised an issue that required the principal to access customer data. `detail` is of the form (\"#####\" is the issue ID): * \"Feedback Report: #####\" * \"Case Number: #####\" * \"Case ID: #####\" * \"E-PIN Reference: #####\" * \"Google-#####\" * \"T-#####\"", "The principal accessed customer data in order to diagnose or resolve a suspected issue in services. Often this access is used to confirm that customers are not affected by a suspected service issue or to remediate a reversible system issue.", "Google initiated service for security, fraud, abuse, or compliance purposes.", "The principal was compelled to access customer data in order to respond to a legal third party data request or process, including legal processes from customers themselves.", "The principal accessed customer data in order to diagnose or resolve a suspected issue in services or a known outage.", "Similar to 'GOOGLE_INITIATED_SERVICE' or 'GOOGLE_INITIATED_REVIEW', but with universe agnostic naming. The principal accessed customer data in order to diagnose or resolve a suspected issue in services or a known outage, or for security, fraud, abuse, or compliance review purposes." ], "enum": [ "TYPE_UNSPECIFIED", "CUSTOMER_INITIATED_SUPPORT", "GOOGLE_INITIATED_SERVICE", "GOOGLE_INITIATED_REVIEW", "THIRD_PARTY_DATA_REQUEST", "GOOGLE_RESPONSE_TO_PRODUCTION_ALERT", "CLOUD_INITIATED_ACCESS" ], "type": "string", "description": "Type of access reason." } }, "type": "object" }, "DismissDecision": { "id": "DismissDecision", "type": "object", "properties": { "dismissTime": { "format": "google-datetime", "type": "string", "description": "The time at which the approval request was dismissed." }, "implicit": { "description": "This field will be true if the ApprovalRequest was implicitly dismissed due to inaction by the access approval approvers (the request is not acted on by the approvers before the exiration time).", "type": "boolean" } }, "description": "A decision that has been made to dismiss an approval request." }, "AccessLocations": { "properties": { "principalOfficeCountry": { "type": "string", "description": "The \"home office\" location of the Google administrator. A two-letter country code (ISO 3166-1 alpha-2), such as \"US\", \"DE\" or \"GB\" or a region code. In some limited situations Google systems may refer refer to a region code instead of a country code. Possible Region Codes: * ASI: Asia * EUR: Europe * OCE: Oceania * AFR: Africa * NAM: North America * SAM: South America * ANT: Antarctica * ANY: Any location" }, "principalPhysicalLocationCountry": { "type": "string", "description": "Physical location of the Google administrator at the time of the access. A two-letter country code (ISO 3166-1 alpha-2), such as \"US\", \"DE\" or \"GB\" or a region code. In some limited situations Google systems may refer refer to a region code instead of a country code. Possible Region Codes: * ASI: Asia * EUR: Europe * OCE: Oceania * AFR: Africa * NAM: North America * SAM: South America * ANT: Antarctica * ANY: Any location" } }, "type": "object", "id": "AccessLocations", "description": "Physical assigned office and physical location of the Google administrator performing the access." }, "ApproveApprovalRequestMessage": { "description": "Request to approve an ApprovalRequest.", "id": "ApproveApprovalRequestMessage", "properties": { "expireTime": { "type": "string", "description": "The expiration time of this approval.", "format": "google-datetime" } }, "type": "object" }, "ApprovalRequest": { "properties": { "requestedReason": { "description": "The access reason for which approval is being requested.", "$ref": "AccessReason" }, "requestedResourceName": { "description": "The resource for which approval is being requested. The format of the resource name is defined at https://cloud.google.com/apis/design/resource_names. The resource name here may either be a \"full\" resource name (e.g. \"//library.googleapis.com/shelves/shelf1/books/book2\") or a \"relative\" resource name (e.g. \"shelves/shelf1/books/book2\") as described in the resource name specification.", "type": "string" }, "requestTime": { "description": "The time at which approval was requested.", "type": "string", "format": "google-datetime" }, "requestedAugmentedInfo": { "$ref": "AugmentedInfo", "description": "This field contains the augmented information of the request." }, "approve": { "description": "Access was approved.", "$ref": "ApproveDecision" }, "requestedLocations": { "description": "The locations for which approval is being requested.", "$ref": "AccessLocations" }, "requestedResourceProperties": { "description": "Properties related to the resource represented by requested_resource_name.", "$ref": "ResourceProperties" }, "requestedExpiration": { "format": "google-datetime", "description": "The original requested expiration for the approval. Calculated by adding the requested_duration to the request_time.", "type": "string" }, "requestedDuration": { "description": "The requested access duration.", "type": "string", "format": "google-duration" }, "dismiss": { "$ref": "DismissDecision", "description": "The request was dismissed." }, "name": { "type": "string", "description": "The resource name of the request. Format is \"{projects|folders|organizations}/{id}/approvalRequests/{approval_request}\"." } }, "type": "object", "description": "A request for the customer to approve access to a resource.", "id": "ApprovalRequest" }, "AugmentedInfo": { "id": "AugmentedInfo", "description": "This field contains the augmented information of the request. Requires augmented administrative access to be enabled.", "properties": { "command": { "type": "string", "description": "For command-line tools, the full command-line exactly as entered by the actor without adding any additional characters (such as quotation marks)." } }, "type": "object" }, "AccessApprovalSettings": { "id": "AccessApprovalSettings", "properties": { "name": { "description": "The resource name of the settings. Format is one of: * \"projects/{project}/accessApprovalSettings\" * \"folders/{folder}/accessApprovalSettings\" * \"organizations/{organization}/accessApprovalSettings\"", "type": "string" }, "notificationEmails": { "type": "array", "description": "A list of email addresses to which notifications relating to approval requests should be sent. Notifications relating to a resource will be sent to all emails in the settings of ancestor resources of that resource. A maximum of 50 email addresses are allowed.", "items": { "type": "string" } }, "effectiveApprovalPolicy": { "readOnly": true, "description": "Output only. Effective policy applied for Access Approval, inclusive of inheritance.", "$ref": "CustomerApprovalApprovalPolicy" }, "ancestorsEnrolledServices": { "type": "array", "items": { "$ref": "EnrolledService" }, "readOnly": true, "description": "Output only. Field to differentiate ancestor enrolled services from locally enrolled services." }, "enrolledServices": { "description": "A list of Google Cloud Services for which the given resource has Access Approval enrolled. Access requests for the resource given by name against any of these services contained here will be required to have explicit approval. If name refers to an organization, enrollment can be done for individual services. If name refers to a folder or project, enrollment can only be done on an all or nothing basis. If a cloud_product is repeated in this list, the first entry will be honored and all following entries will be discarded.", "items": { "$ref": "EnrolledService" }, "type": "array" }, "preferredRequestExpirationDays": { "description": "Set the default access approval request expiration time. This value is able to be set directly by the customer at the time of approval, overriding this suggested value. We recommend setting this value to 30 days.", "format": "int32", "type": "integer" }, "activeKeyVersion": { "type": "string", "description": "The asymmetric crypto key version to use for signing approval requests. Empty active_key_version indicates that a Google-managed key should be used for signing. This property will be ignored if set by an ancestor of this resource, and new non-empty values may not be set." }, "notificationPubsubTopic": { "type": "string", "description": "Optional. A pubsub topic that notifications relating to access approval are published to. Notifications include pre-approved accesses." }, "requestScopeMaxWidthPreference": { "enumDescriptions": [ "Default value, defaults to ORGANIZATION if not set. This value is not able to be configured by the user, do not use.", "This is the widest scope possible. It means the customer has no scope restriction when it comes to Access Approval requests.", "Customer allows the scope of Access Approval requests as broad as the Folder level.", "Customer allows the scope of Access Approval requests as broad as the Project level." ], "description": "Optional. A setting that indicates the maximum scope of an Access Approval request: either organization, folder, or project. Google administrators will be asked to send requests no broader than the configured scope.", "enum": [ "REQUEST_SCOPE_MAX_WIDTH_PREFERENCE_UNSPECIFIED", "ORGANIZATION", "FOLDER", "PROJECT" ], "type": "string" }, "approvalPolicy": { "$ref": "CustomerApprovalApprovalPolicy", "description": "Optional. Policy configuration for Access Approval that sets the operating mode. The available policies are Transparency, Streamlined Support, and Approval Required." }, "preferNoBroadApprovalRequests": { "type": "boolean", "description": "This field is used to set a preference for granularity of an access approval request. If true, Google personnel will be asked to send resource-level requests when possible. If false, Google personnel will be asked to send requests at the project level." }, "invalidKeyVersion": { "description": "Output only. This field is read only (not settable via UpdateAccessApprovalSettings method). If the field is true, that indicates that there is some configuration issue with the active_key_version configured at this level in the resource hierarchy (e.g. it doesn't exist or the Access Approval service account doesn't have the correct permissions on it, etc.) This key version is not necessarily the effective key version at this level, as key versions are inherited top-down.", "readOnly": true, "type": "boolean" }, "enrolledAncestor": { "readOnly": true, "description": "Output only. This field is read only (not settable via UpdateAccessApprovalSettings method). If the field is true, that indicates that at least one service is enrolled for Access Approval in one or more ancestors of the Project or Folder (this field will always be unset for the organization since organizations do not have ancestors).", "type": "boolean" }, "ancestorHasActiveKeyVersion": { "type": "boolean", "description": "Output only. This field is read only (not settable via UpdateAccessApprovalSettings method). If the field is true, that indicates that an ancestor of this Project or Folder has set active_key_version (this field will always be unset for the organization since organizations do not have ancestors).", "readOnly": true }, "requireCustomerVisibleJustification": { "description": "Optional. When enabled, Google will only be able to send approval requests for access reasons with a customer accessible case ID in the reason detail. Also known as \"Require customer initiated support case justification\"", "type": "boolean" } }, "description": "Settings on a Project/Folder/Organization related to Access Approval.", "type": "object" }, "InvalidateApprovalRequestMessage": { "properties": {}, "description": "Request to invalidate an existing approval.", "type": "object", "id": "InvalidateApprovalRequestMessage" }, "ResourceProperties": { "description": "The properties associated with the resource of the request.", "properties": { "excludesDescendants": { "description": "Whether an approval will exclude the descendants of the resource being requested.", "type": "boolean" } }, "id": "ResourceProperties", "type": "object" }, "ListApprovalRequestsResponse": { "id": "ListApprovalRequestsResponse", "type": "object", "properties": { "approvalRequests": { "description": "Approval request details.", "type": "array", "items": { "$ref": "ApprovalRequest" } }, "nextPageToken": { "description": "Token to retrieve the next page of results, or empty if there are no more.", "type": "string" } }, "description": "Response to listing of ApprovalRequest objects." }, "AccessApprovalServiceAccount": { "id": "AccessApprovalServiceAccount", "description": "Access Approval service account related to a project/folder/organization.", "properties": { "name": { "type": "string", "description": "The resource name of the Access Approval service account. Format is one of: * \"projects/{project}/serviceAccount\" * \"folders/{folder}/serviceAccount\" * \"organizations/{organization}/serviceAccount\"" }, "accountEmail": { "type": "string", "description": "Email address of the service account." } }, "type": "object" }, "CustomerApprovalApprovalPolicy": { "properties": { "justificationBasedApprovalPolicy": { "type": "string", "description": "Optional. Policy for approval based on the justification given.", "enumDescriptions": [ "Default value, defaults to JUSTIFICATION_BASED_APPROVAL_NOT_ENABLED if not set. This value is not able to be configured by the user, do not use.", "Audit-only mode. All accesses are pre-approved instantly.", "Customer initiated support access reasons are pre-approved instantly. All other accesses require customer approval.", "All access approval requests require customer approval. This is the default value if the policy is not set.", "Defer configuration to parent settings. This is the default value if the policy is not set and the parent has a value set." ], "enum": [ "JUSTIFICATION_BASED_APPROVAL_POLICY_UNSPECIFIED", "JUSTIFICATION_BASED_APPROVAL_ENABLED_ALL", "JUSTIFICATION_BASED_APPROVAL_ENABLED_EXTERNAL_JUSTIFICATIONS", "JUSTIFICATION_BASED_APPROVAL_NOT_ENABLED", "JUSTIFICATION_BASED_APPROVAL_INHERITED" ] } }, "id": "CustomerApprovalApprovalPolicy", "description": "Represents all the policies that can be set for Customer Approval.", "type": "object" }, "SignatureInfo": { "properties": { "serializedApprovalRequest": { "description": "The ApprovalRequest that is serialized without the SignatureInfo message field. This data is used with the hashing algorithm to generate the digital signature, and it can be used for signature verification.", "type": "string", "format": "byte" }, "customerKmsKeyVersion": { "description": "The resource name of the customer CryptoKeyVersion used for signing.", "type": "string" }, "googleKeyAlgorithm": { "description": "The hashing algorithm used for signature verification. It will only be present in the case of Google managed keys.", "type": "string", "enumDescriptions": [ "Not specified.", "Creates symmetric encryption keys.", "AES-GCM (Galois Counter Mode) using 128-bit keys.", "AES-GCM (Galois Counter Mode) using 256-bit keys.", "AES-CBC (Cipher Block Chaining Mode) using 128-bit keys.", "AES-CBC (Cipher Block Chaining Mode) using 256-bit keys.", "AES-CTR (Counter Mode) using 128-bit keys.", "AES-CTR (Counter Mode) using 256-bit keys.", "RSASSA-PSS 2048 bit key with a SHA256 digest.", "RSASSA-PSS 3072 bit key with a SHA256 digest.", "RSASSA-PSS 4096 bit key with a SHA256 digest.", "RSASSA-PSS 4096 bit key with a SHA512 digest.", "RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.", "RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.", "RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.", "RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.", "RSASSA-PKCS1-v1_5 signing without encoding, with a 2048 bit key.", "RSASSA-PKCS1-v1_5 signing without encoding, with a 3072 bit key.", "RSASSA-PKCS1-v1_5 signing without encoding, with a 4096 bit key.", "RSAES-OAEP 2048 bit key with a SHA256 digest.", "RSAES-OAEP 3072 bit key with a SHA256 digest.", "RSAES-OAEP 4096 bit key with a SHA256 digest.", "RSAES-OAEP 4096 bit key with a SHA512 digest.", "RSAES-OAEP 2048 bit key with a SHA1 digest.", "RSAES-OAEP 3072 bit key with a SHA1 digest.", "RSAES-OAEP 4096 bit key with a SHA1 digest.", "ECDSA on the NIST P-256 curve with a SHA256 digest. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms", "ECDSA on the NIST P-384 curve with a SHA384 digest. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms", "ECDSA on the non-NIST secp256k1 curve. This curve is only supported for HSM protection level. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms", "EdDSA on the Curve25519 in pure mode (taking data as input).", "HMAC-SHA256 signing with a 256 bit key.", "HMAC-SHA1 signing with a 160 bit key.", "HMAC-SHA384 signing with a 384 bit key.", "HMAC-SHA512 signing with a 512 bit key.", "HMAC-SHA224 signing with a 224 bit key.", "Algorithm representing symmetric encryption by an external key manager.", "ML-KEM-768 (FIPS 203)", "ML-KEM-1024 (FIPS 203)", "X-Wing hybrid KEM combining ML-KEM-768 with X25519 following datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/.", "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 1. Randomized version.", "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version.", "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 5. Randomized version.", "The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized version.", "The post-quantum stateless hash-based digital signature algorithm, at security level 1. Randomized pre-hash version supporting SHA256 digests.", "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 1. Randomized version supporting externally-computed message representatives.", "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 3. Randomized version supporting externally-computed message representatives.", "The post-quantum Module-Lattice-Based Digital Signature Algorithm, at security level 5. Randomized version supporting externally-computed message representatives.", "Key encapsulation: Elliptic Curve Diffie-Hellman with NIST P-256 key that returns shared secret.", "Key encapsulation: Elliptic Curve Diffie-Hellman with NIST P-384 key that returns shared secret.", "AES key wrap with zero padding algorithm (RFC 5649). Can only be used by keys with purpose AES_WRAPPING." ], "enum": [ "CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED", "GOOGLE_SYMMETRIC_ENCRYPTION", "AES_128_GCM", "AES_256_GCM", "AES_128_CBC", "AES_256_CBC", "AES_128_CTR", "AES_256_CTR", "RSA_SIGN_PSS_2048_SHA256", "RSA_SIGN_PSS_3072_SHA256", "RSA_SIGN_PSS_4096_SHA256", "RSA_SIGN_PSS_4096_SHA512", "RSA_SIGN_PKCS1_2048_SHA256", "RSA_SIGN_PKCS1_3072_SHA256", "RSA_SIGN_PKCS1_4096_SHA256", "RSA_SIGN_PKCS1_4096_SHA512", "RSA_SIGN_RAW_PKCS1_2048", "RSA_SIGN_RAW_PKCS1_3072", "RSA_SIGN_RAW_PKCS1_4096", "RSA_DECRYPT_OAEP_2048_SHA256", "RSA_DECRYPT_OAEP_3072_SHA256", "RSA_DECRYPT_OAEP_4096_SHA256", "RSA_DECRYPT_OAEP_4096_SHA512", "RSA_DECRYPT_OAEP_2048_SHA1", "RSA_DECRYPT_OAEP_3072_SHA1", "RSA_DECRYPT_OAEP_4096_SHA1", "EC_SIGN_P256_SHA256", "EC_SIGN_P384_SHA384", "EC_SIGN_SECP256K1_SHA256", "EC_SIGN_ED25519", "HMAC_SHA256", "HMAC_SHA1", "HMAC_SHA384", "HMAC_SHA512", "HMAC_SHA224", "EXTERNAL_SYMMETRIC_ENCRYPTION", "ML_KEM_768", "ML_KEM_1024", "KEM_XWING", "PQ_SIGN_ML_DSA_44", "PQ_SIGN_ML_DSA_65", "PQ_SIGN_ML_DSA_87", "PQ_SIGN_SLH_DSA_SHA2_128S", "PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256", "PQ_SIGN_ML_DSA_44_EXTERNAL_MU", "PQ_SIGN_ML_DSA_65_EXTERNAL_MU", "PQ_SIGN_ML_DSA_87_EXTERNAL_MU", "KEM_ECDH_P256", "KEM_ECDH_P384", "AES_256_KWP" ] }, "signature": { "type": "string", "format": "byte", "description": "The digital signature." }, "googlePublicKeyPem": { "description": "The public key for the Google default signing, encoded in PEM format. The signature was created using a private key which may be verified using this public key.", "type": "string" } }, "description": "Information about the digital signature of the resource.", "id": "SignatureInfo", "type": "object" }, "ApproveDecision": { "description": "A decision that has been made to approve access to a resource.", "id": "ApproveDecision", "type": "object", "properties": { "invalidateTime": { "type": "string", "format": "google-datetime", "description": "If set, denotes the timestamp at which the approval is invalidated." }, "signatureInfo": { "description": "The signature for the ApprovalRequest and details on how it was signed.", "$ref": "SignatureInfo" }, "approveTime": { "type": "string", "format": "google-datetime", "description": "The time at which approval was granted." }, "autoApproved": { "description": "True when the request has been auto-approved.", "type": "boolean" }, "policyApproved": { "description": "True when the request has been approved by the customer's defined policy.", "type": "boolean" }, "expireTime": { "description": "The time at which the approval expires.", "format": "google-datetime", "type": "string" } } }, "EnrolledService": { "properties": { "cloudProduct": { "description": "The product for which Access Approval will be enrolled. Allowed values are listed below (case-sensitive): * all * GA * Access Context Manager * Anthos Identity Service * AlloyDB for PostgreSQL * Apigee * Application Integration * App Hub * Artifact Registry * Anthos Service Mesh * Access Transparency * BigQuery * Certificate Authority Service * Cloud Bigtable * CCAI Assist and Knowledge * Cloud Dataflow * Cloud Dataproc * CEP Security Gateway * Compliance Evaluation Service * Cloud Firestore * Cloud Healthcare API * Chronicle * Cloud AI Companion Gateway - Titan * Google Cloud Armor * Cloud Asset Inventory * Cloud Asset Search * Cloud Deploy * Cloud DNS * Cloud Latency * Cloud Memorystore for Redis * CloudNet Control * Cloud Riptide * Cloud Tasks * Cloud Trace * Cloud Data Transfer * Cloud Composer * Integration Connectors * Contact Center AI Insights * Cloud Pub/Sub * Cloud Run * Resource Manager * Cloud Spanner * Database Center * Cloud Dataform * Cloud Data Fusion * Dataplex * Dialogflow Customer Experience Edition * Cloud DLP * Document AI * Edge Container * Edge Network * Cloud EKM * Eventarc * Firebase Data Connect * Firebase Rules * App Engine * Cloud Build * Compute Engine * Cloud Functions (2nd Gen) * Cloud Filestore * Cloud Interconnect * Cloud NetApp Volumes * Cloud Storage * Generative AI App Builder * Google Kubernetes Engine * Backup for GKE API * GKE Connect * GKE Hub * Hoverboard * Cloud HSM * Cloud Identity and Access Management * Cloud Identity-Aware Proxy * Infrastructure Manager * Identity Storage Service * Key Access Justifications * Cloud Key Management Service * Cloud Logging * Looker (Google Cloud core) * Looker Studio * Management Hub * Model Armor * Cloud Monitoring * Cloud NAT * Connectivity Hub * External passthrough Network Load Balancer * OIDC One * Organization Policy Service * Org Lifecycle * Persistent Disk * Parameter Manager * Private Services Access * Regional Internal Application Load Balancer * Storage Batch Operations * Cloud Security Command Center * Secure Source Manager * Seeker * Service Provisioning * Speaker ID * Secret Manager * Cloud SQL * Cloud Speech-to-Text * Traffic Director * Cloud Text-to-Speech * USPS Andromeda * Vertex AI * Virtual Private Cloud (VPC) * VPC Access * VPC Service Controls Troubleshooter * VPC virtnet * Cloud Workstations * Web Risk Note: These values are supported as input for legacy purposes, but will not be returned from the API. * all * ga-only * appengine.googleapis.com * artifactregistry.googleapis.com * bigquery.googleapis.com * bigtable.googleapis.com * container.googleapis.com * cloudkms.googleapis.com * cloudresourcemanager.googleapis.com * cloudsql.googleapis.com * compute.googleapis.com * dataflow.googleapis.com * dataproc.googleapis.com * dlp.googleapis.com * iam.googleapis.com * logging.googleapis.com * orgpolicy.googleapis.com * pubsub.googleapis.com * spanner.googleapis.com * secretmanager.googleapis.com * speakerid.googleapis.com * storage.googleapis.com Calls to UpdateAccessApprovalSettings using 'all' or any of the XXX.googleapis.com will be translated to the associated product name ('all', 'App Engine', etc.). Note: 'all' will enroll the resource in all products supported at both 'GA' and 'Preview' levels. More information about levels of support is available at https://cloud.google.com/access-approval/docs/supported-services", "type": "string" }, "enrollmentLevel": { "type": "string", "enum": [ "ENROLLMENT_LEVEL_UNSPECIFIED", "BLOCK_ALL" ], "enumDescriptions": [ "Default value if not set, defaults to \"BLOCK_ALL\". This value is not available to be set by the user, do not use.", "Service is enrolled in Access Approval for all requests" ], "description": "The enrollment level of the service." } }, "type": "object", "description": "Represents the enrollment of a cloud resource into a specific service.", "id": "EnrolledService" }, "DismissApprovalRequestMessage": { "properties": {}, "description": "Request to dismiss an approval request.", "type": "object", "id": "DismissApprovalRequestMessage" } }, "description": "An API for controlling access to data by Google personnel." }