|
1205 | 1205 | "name" |
1206 | 1206 | ], |
1207 | 1207 | "parameters": { |
| 1208 | + "appendScopedAccessSettings": { |
| 1209 | + "description": "Optional. This field will be used to control whether or not scoped access settings are appended to the existing list of scoped access settings. If true, the scoped access settings in the request will be appended to the existing list of scoped access settings. If false, the scoped access settings in the request replace the existing list of scoped access settings.", |
| 1210 | + "location": "query", |
| 1211 | + "type": "boolean" |
| 1212 | + }, |
1208 | 1213 | "name": { |
1209 | 1214 | "description": "Immutable. Assigned by the server during creation. The last segment has an arbitrary length and has only URI unreserved characters (as defined by [RFC 3986 Section 2.3](https://tools.ietf.org/html/rfc3986#section-2.3)). Should not be specified by the client during creation. Example: \"organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N\"", |
1210 | 1215 | "location": "path", |
|
1213 | 1218 | "type": "string" |
1214 | 1219 | }, |
1215 | 1220 | "updateMask": { |
1216 | | - "description": "Required. Only the fields specified in this mask are updated. Because name and group_key cannot be changed, update_mask is required and may only contain the following fields: `access_levels`, `dry_run_access_levels`. update_mask { paths: \"access_levels\" }", |
| 1221 | + "description": "Required. Only the fields specified in this mask are updated. Because name and group_key cannot be changed, update_mask is required and may only contain the following fields: `access_levels`, `dry_run_access_levels`, `reauth_settings`, `scoped_access_settings`. update_mask { paths: \"access_levels\" }", |
1217 | 1222 | "format": "google-fieldmask", |
1218 | 1223 | "location": "query", |
1219 | 1224 | "type": "string" |
|
1290 | 1295 | } |
1291 | 1296 | } |
1292 | 1297 | }, |
1293 | | - "revision": "20240811", |
| 1298 | + "revision": "20240923", |
1294 | 1299 | "rootUrl": "https://accesscontextmanager.googleapis.com/", |
1295 | 1300 | "schemas": { |
1296 | 1301 | "AccessContextManagerOperationMetadata": { |
|
1357 | 1362 | }, |
1358 | 1363 | "type": "object" |
1359 | 1364 | }, |
| 1365 | + "AccessScope": { |
| 1366 | + "description": "Access scope represents the client scope, etc. to which the settings will be applied to.", |
| 1367 | + "id": "AccessScope", |
| 1368 | + "properties": { |
| 1369 | + "clientScope": { |
| 1370 | + "$ref": "ClientScope", |
| 1371 | + "description": "Optional. Client scope for this access scope." |
| 1372 | + } |
| 1373 | + }, |
| 1374 | + "type": "object" |
| 1375 | + }, |
| 1376 | + "AccessSettings": { |
| 1377 | + "description": "Access settings represent the set of conditions that must be met for access to be granted. At least one of the fields must be set.", |
| 1378 | + "id": "AccessSettings", |
| 1379 | + "properties": { |
| 1380 | + "accessLevels": { |
| 1381 | + "description": "Optional. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: \"accessPolicies/9522/accessLevels/device_trusted\"", |
| 1382 | + "items": { |
| 1383 | + "type": "string" |
| 1384 | + }, |
| 1385 | + "type": "array" |
| 1386 | + }, |
| 1387 | + "reauthSettings": { |
| 1388 | + "$ref": "ReauthSettings", |
| 1389 | + "description": "Optional. Reauth settings applied to user access on a given AccessScope." |
| 1390 | + } |
| 1391 | + }, |
| 1392 | + "type": "object" |
| 1393 | + }, |
1360 | 1394 | "ApiOperation": { |
1361 | 1395 | "description": "Identification for an API Operation.", |
1362 | 1396 | "id": "ApiOperation", |
|
1550 | 1584 | "properties": {}, |
1551 | 1585 | "type": "object" |
1552 | 1586 | }, |
| 1587 | + "ClientScope": { |
| 1588 | + "description": "Client scope represents the application, etc. subject to this binding's restrictions.", |
| 1589 | + "id": "ClientScope", |
| 1590 | + "properties": { |
| 1591 | + "restrictedClientApplication": { |
| 1592 | + "$ref": "Application", |
| 1593 | + "description": "Optional. The application that is subject to this binding's scope." |
| 1594 | + } |
| 1595 | + }, |
| 1596 | + "type": "object" |
| 1597 | + }, |
1553 | 1598 | "CommitServicePerimetersRequest": { |
1554 | 1599 | "description": "A request to commit dry-run specs in all Service Perimeters belonging to an Access Policy.", |
1555 | 1600 | "id": "CommitServicePerimetersRequest", |
|
1860 | 1905 | "description": "Immutable. Assigned by the server during creation. The last segment has an arbitrary length and has only URI unreserved characters (as defined by [RFC 3986 Section 2.3](https://tools.ietf.org/html/rfc3986#section-2.3)). Should not be specified by the client during creation. Example: \"organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N\"", |
1861 | 1906 | "type": "string" |
1862 | 1907 | }, |
| 1908 | + "reauthSettings": { |
| 1909 | + "$ref": "ReauthSettings", |
| 1910 | + "description": "Optional. GCSL policy for the group key." |
| 1911 | + }, |
1863 | 1912 | "restrictedClientApplications": { |
1864 | 1913 | "description": "Optional. A list of applications that are subject to this binding's restrictions. If the list is empty, the binding restrictions will universally apply to all applications.", |
1865 | 1914 | "items": { |
1866 | 1915 | "$ref": "Application" |
1867 | 1916 | }, |
1868 | 1917 | "type": "array" |
| 1918 | + }, |
| 1919 | + "scopedAccessSettings": { |
| 1920 | + "description": "Optional. A list of scoped access settings that set this binding's restrictions on a subset of applications. This field cannot be set if restricted_client_applications is set.", |
| 1921 | + "items": { |
| 1922 | + "$ref": "ScopedAccessSettings" |
| 1923 | + }, |
| 1924 | + "type": "array" |
1869 | 1925 | } |
1870 | 1926 | }, |
1871 | 1927 | "type": "object" |
|
2231 | 2287 | }, |
2232 | 2288 | "type": "object" |
2233 | 2289 | }, |
| 2290 | + "ReauthSettings": { |
| 2291 | + "description": "Stores settings related to Google Cloud Session Length including session duration, the type of challenge (i.e. method) they should face when their session expires, and other related settings.", |
| 2292 | + "id": "ReauthSettings", |
| 2293 | + "properties": { |
| 2294 | + "maxInactivity": { |
| 2295 | + "description": "Optional. How long a user is allowed to take between actions before a new access token must be issued. Presently only set for Cloud Apps.", |
| 2296 | + "format": "google-duration", |
| 2297 | + "type": "string" |
| 2298 | + }, |
| 2299 | + "reauthMethod": { |
| 2300 | + "description": "Optional. Reauth method when users GCP session is up.", |
| 2301 | + "enum": [ |
| 2302 | + "REAUTH_METHOD_UNSPECIFIED", |
| 2303 | + "LOGIN", |
| 2304 | + "SECURITY_KEY", |
| 2305 | + "PASSWORD" |
| 2306 | + ], |
| 2307 | + "enumDescriptions": [ |
| 2308 | + "If method undefined in API, we will use LOGIN by default.", |
| 2309 | + "The user will prompted to perform regular login. Users who are enrolled for two-step verification and haven't chosen to \"Remember this computer\" will be prompted for their second factor.", |
| 2310 | + "The user will be prompted to autheticate using their security key. If no security key has been configured, then we will fallback to LOGIN.", |
| 2311 | + "The user will be prompted for their password." |
| 2312 | + ], |
| 2313 | + "type": "string" |
| 2314 | + }, |
| 2315 | + "sessionLength": { |
| 2316 | + "description": "Optional. The session length. Setting this field to zero is equal to disabling. Reauth. Also can set infinite session by flipping the enabled bit to false below. If use_oidc_max_age is true, for OIDC apps, the session length will be the minimum of this field and OIDC max_age param.", |
| 2317 | + "format": "google-duration", |
| 2318 | + "type": "string" |
| 2319 | + }, |
| 2320 | + "sessionLengthEnabled": { |
| 2321 | + "description": "Optional. Big red button to turn off GCSL. When false, all fields set above will be disregarded and the session length is basically infinite.", |
| 2322 | + "type": "boolean" |
| 2323 | + }, |
| 2324 | + "useOidcMaxAge": { |
| 2325 | + "description": "Optional. Only useful for OIDC apps. When false, the OIDC max_age param, if passed in the authentication request will be ignored. When true, the re-auth period will be the minimum of the session_length field and the max_age OIDC param.", |
| 2326 | + "type": "boolean" |
| 2327 | + } |
| 2328 | + }, |
| 2329 | + "type": "object" |
| 2330 | + }, |
2234 | 2331 | "ReplaceAccessLevelsRequest": { |
2235 | 2332 | "description": "A request to replace all existing Access Levels in an Access Policy with the Access Levels provided. This is done atomically.", |
2236 | 2333 | "id": "ReplaceAccessLevelsRequest", |
|
2295 | 2392 | }, |
2296 | 2393 | "type": "object" |
2297 | 2394 | }, |
| 2395 | + "ScopedAccessSettings": { |
| 2396 | + "description": "A relationship between access settings and its scope.", |
| 2397 | + "id": "ScopedAccessSettings", |
| 2398 | + "properties": { |
| 2399 | + "activeSettings": { |
| 2400 | + "$ref": "AccessSettings", |
| 2401 | + "description": "Optional. Access settings for this scoped access settings. This field may be empty if dry_run_settings is set." |
| 2402 | + }, |
| 2403 | + "dryRunSettings": { |
| 2404 | + "$ref": "AccessSettings", |
| 2405 | + "description": "Optional. Dry-run access settings for this scoped access settings. This field may be empty if active_settings is set." |
| 2406 | + }, |
| 2407 | + "scope": { |
| 2408 | + "$ref": "AccessScope", |
| 2409 | + "description": "Optional. Application, etc. to which the access settings will be applied to. Implicitly, this is the scoped access settings key; as such, it must be unique and non-empty." |
| 2410 | + } |
| 2411 | + }, |
| 2412 | + "type": "object" |
| 2413 | + }, |
2298 | 2414 | "ServicePerimeter": { |
2299 | 2415 | "description": "`ServicePerimeter` describes a set of Google Cloud resources which can freely import and export data amongst themselves, but not export outside of the `ServicePerimeter`. If a request with a source within this `ServicePerimeter` has a target outside of the `ServicePerimeter`, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single Google Cloud project or VPC network can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only Google Cloud projects as members, a single Google Cloud project may belong to multiple Service Perimeter Bridges.", |
2300 | 2416 | "id": "ServicePerimeter", |
|
0 commit comments