Console
    Start free

    Types overview

    AccessSecretVersionResponse

    Response message for SecretManagerService.AccessSecretVersion.
    Fields
    name

    string

    The resource name of the SecretVersion in the format projects/*/secrets/*/versions/* .

    payload

    object ( SecretPayload )

    Secret payload

    AddSecretVersionRequest

    Request message for SecretManagerService.AddSecretVersion.
    Fields
    payload

    object ( SecretPayload )

    Required. The secret payload of the SecretVersion.

    AuditConfig

    Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
    Fields
    auditLogConfigs[]

    object ( AuditLogConfig )

    The configuration for logging of each type of permission.

    service

    string

    Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com , cloudsql.googleapis.com . allServices is a special value that covers all services.

    AuditLogConfig

    Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
    Fields
    exemptedMembers[]

    string

    Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.

    logType

    enum

    The log type that this config enables.

    Enum type. Can be one of the following:
    LOG_TYPE_UNSPECIFIED
    Default case. Should never be this.
    ADMIN_READ
    Admin reads. Example: CloudIAM getIamPolicy
    DATA_WRITE
    Data writes. Example: CloudSQL Users create
    DATA_READ
    Data reads. Example: CloudSQL Users list

    Automatic

    A replication policy that replicates the Secret payload without any restrictions.
    Fields
    customerManagedEncryption

    object ( CustomerManagedEncryption )

    Optional. The customer-managed encryption configuration of the Secret. If no configuration is provided, Google-managed default encryption is used. Updates to the Secret encryption configuration only apply to SecretVersions added afterwards. They do not apply retroactively to existing SecretVersions.

    AutomaticStatus

    The replication status of a SecretVersion using automatic replication. Only populated if the parent Secret has an automatic replication policy.
    Fields
    customerManagedEncryption

    object ( CustomerManagedEncryptionStatus )

    Output only. The customer-managed encryption status of the SecretVersion. Only populated if customer-managed encryption is used.

    Binding

    Associates members with a role .
    Fields
    condition

    object ( Expr )

    The condition that is associated with this binding. If the condition evaluates to true , then this binding applies to the current request. If the condition evaluates to false , then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation .

    members[]

    string

    Specifies the identities requesting access for a Cloud Platform resource. members can have the following values: * allUsers : A special identifier that represents anyone who is on the internet; with or without a Google account. * allAuthenticatedUsers : A special identifier that represents anyone who is authenticated with a Google account or a service account. * user:{emailid} : An email address that represents a specific Google account. For example, alice@example.com . * serviceAccount:{emailid} : An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com . * group:{emailid} : An email address that represents a Google group. For example, admins@example.com . * deleted:user:{emailid}?uid={uniqueid} : An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901 . If the user is recovered, this value reverts to user:{emailid} and the recovered user retains the role in the binding. * deleted:serviceAccount:{emailid}?uid={uniqueid} : An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901 . If the service account is undeleted, this value reverts to serviceAccount:{emailid} and the undeleted service account retains the role in the binding. * deleted:group:{emailid}?uid={uniqueid} : An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901 . If the group is recovered, this value reverts to group:{emailid} and the recovered group retains the role in the binding. * domain:{domain} : The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com .

    role

    string

    Role that is assigned to members . For example, roles/viewer , roles/editor , or roles/owner .

    CustomerManagedEncryption

    Configuration for encrypting secret payloads using customer-managed encryption keys (CMEK).
    Fields
    kmsKeyName

    string

    Required. The resource name of the Cloud KMS CryptoKey used to encrypt secret payloads. For secrets using the UserManaged replication policy type, Cloud KMS CryptoKeys must reside in the same location as the replica location. For secrets using the Automatic replication policy type, Cloud KMS CryptoKeys must reside in global . The expected format is projects/*/locations/*/keyRings/*/cryptoKeys/* .

    CustomerManagedEncryptionStatus

    Describes the status of customer-managed encryption.
    Fields
    kmsKeyVersionName

    string

    Required. The resource name of the Cloud KMS CryptoKeyVersion used to encrypt the secret payload, in the following format: projects/*/locations/*/keyRings/*/cryptoKeys/*/versions/* .

    DestroySecretVersionRequest

    Request message for SecretManagerService.DestroySecretVersion.
    Fields
    etag

    string

    Optional. Etag of the SecretVersion. The request succeeds if it matches the etag of the currently stored secret version object. If the etag is omitted, the request succeeds.

    DisableSecretVersionRequest

    Request message for SecretManagerService.DisableSecretVersion.
    Fields
    etag

    string

    Optional. Etag of the SecretVersion. The request succeeds if it matches the etag of the currently stored secret version object. If the etag is omitted, the request succeeds.

    EnableSecretVersionRequest

    Request message for SecretManagerService.EnableSecretVersion.
    Fields
    etag

    string

    Optional. Etag of the SecretVersion. The request succeeds if it matches the etag of the currently stored secret version object. If the etag is omitted, the request succeeds.

    Expr

    Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
    Fields
    description

    string

    Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

    expression

    string

    Textual representation of an expression in Common Expression Language syntax.

    location

    string

    Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

    title

    string

    Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

    ListLocationsResponse

    The response message for Locations.ListLocations.
    Fields
    locations[]

    object ( Location )

    A list of locations that matches the specified filter in the request.

    nextPageToken

    string

    The standard List next-page token.

    ListSecretVersionsResponse

    Response message for SecretManagerService.ListSecretVersions.
    Fields
    nextPageToken

    string

    A token to retrieve the next page of results. Pass this value in ListSecretVersionsRequest.page_token to retrieve the next page.

    totalSize

    integer ( int32 format)

    The total number of SecretVersions.

    versions[]

    object ( SecretVersion )

    The list of SecretVersions sorted in reverse by create_time (newest first).

    ListSecretsResponse

    Response message for SecretManagerService.ListSecrets.
    Fields
    nextPageToken

    string

    A token to retrieve the next page of results. Pass this value in ListSecretsRequest.page_token to retrieve the next page.

    secrets[]

    object ( Secret )

    The list of Secrets sorted in reverse by create_time (newest first).

    totalSize

    integer ( int32 format)

    The total number of Secrets.

    Location

    A resource that represents Google Cloud Platform location.
    Fields
    displayName

    string

    The friendly name for this location, typically a nearby city name. For example, "Tokyo".

    labels

    map (key: string, value: string)

    Cross-service attributes for the location. For example {"cloud.googleapis.com/region": "us-east1"}

    locationId

    string

    The canonical id for this location. For example: "us-east1" .

    metadata

    map (key: string, value: any)

    Service-specific metadata. For example the available capacity at the given location.

    name

    string

    Resource name for the location, which may vary between implementations. For example: "projects/example-project/locations/us-east1"

    Policy

    An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A Policy is a collection of bindings . A binding binds one or more members to a single role . Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a binding can also specify a condition , which is a logical expression that allows access to a resource only if the expression evaluates to true . A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation . JSON example:{ "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example:bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation .
    Fields
    auditConfigs[]

    object ( AuditConfig )

    Specifies cloud audit logging configuration for this policy.

    bindings[]

    object ( Binding )

    Associates a list of members to a role . Optionally, may specify a condition that determines how and when the bindings are applied. Each of the bindings must contain at least one member.

    etag

    string ( bytes format)

    etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy , and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy. Important:If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy . If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost.

    version

    integer ( int32 format)

    Specifies the format of the policy. Valid values are 0 , 1 , and 3 . Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version 3 . This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions Important:If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy . If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation .

    Replica

    Represents a Replica for this Secret.
    Fields
    customerManagedEncryption

    object ( CustomerManagedEncryption )

    Optional. The customer-managed encryption configuration of the User-Managed Replica. If no configuration is provided, Google-managed default encryption is used. Updates to the Secret encryption configuration only apply to SecretVersions added afterwards. They do not apply retroactively to existing SecretVersions.

    location

    string

    The canonical IDs of the location to replicate data. For example: "us-east1" .

    ReplicaStatus

    Describes the status of a user-managed replica for the SecretVersion.
    Fields
    customerManagedEncryption

    object ( CustomerManagedEncryptionStatus )

    Output only. The customer-managed encryption status of the SecretVersion. Only populated if customer-managed encryption is used.

    location

    string

    Output only. The canonical ID of the replica location. For example: "us-east1" .

    Replication

    A policy that defines the replication and encryption configuration of data.
    Fields
    automatic

    object ( Automatic )

    The Secret will automatically be replicated without any restrictions.

    userManaged

    object ( UserManaged )

    The Secret will only be replicated into the locations specified.

    ReplicationStatus

    The replication status of a SecretVersion.
    Fields
    automatic

    object ( AutomaticStatus )

    Describes the replication status of a SecretVersion with automatic replication. Only populated if the parent Secret has an automatic replication policy.

    userManaged

    object ( UserManagedStatus )

    Describes the replication status of a SecretVersion with user-managed replication. Only populated if the parent Secret has a user-managed replication policy.

    Rotation

    The rotation time and period for a Secret. At next_rotation_time, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. Secret.topics must be set to configure rotation.
    Fields
    nextRotationTime

    string ( Timestamp format)

    Optional. Timestamp in UTC at which the Secret is scheduled to rotate. Cannot be set to less than 300s (5 min) in the future and at most 3153600000s (100 years). next_rotation_time MUST be set if rotation_period is set.

    rotationPeriod

    string ( Duration format)

    Input only. The Duration between rotation notifications. Must be in seconds and at least 3600s (1h) and at most 3153600000s (100 years). If rotation_period is set, next_rotation_time must be set. next_rotation_time will be advanced by this period when the service automatically sends rotation notifications.

    Secret

    A Secret is a logical secret whose value and versions can be accessed. A Secret is made up of zero or more SecretVersions that represent the secret data.
    Fields
    createTime

    string ( Timestamp format)

    Output only. The time at which the Secret was created.

    etag

    string

    Optional. Etag of the currently stored Secret.

    expireTime

    string ( Timestamp format)

    Optional. Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.

    labels

    map (key: string, value: string)

    The labels assigned to this Secret. Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must conform to the following PCRE regular expression: \p{Ll}\p{Lo}{0,62} Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63} No more than 64 labels can be assigned to a given resource.

    name

    string

    Output only. The resource name of the Secret in the format projects/*/secrets/* .

    replication

    object ( Replication )

    Required. Immutable. The replication policy of the secret data attached to the Secret. The replication policy cannot be changed after the Secret has been created.

    rotation

    object ( Rotation )

    Optional. Rotation policy attached to the Secret. May be excluded if there is no rotation policy.

    topics[]

    object ( Topic )

    Optional. A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions.

    ttl

    string ( Duration format)

    Input only. The TTL for the Secret.

    SecretPayload

    A secret payload resource in the Secret Manager API. This contains the sensitive secret payload that is associated with a SecretVersion.
    Fields
    data

    string ( bytes format)

    The secret data. Must be no larger than 64KiB.

    SecretVersion

    A secret version resource in the Secret Manager API.
    Fields
    createTime

    string ( Timestamp format)

    Output only. The time at which the SecretVersion was created.

    destroyTime

    string ( Timestamp format)

    Output only. The time this SecretVersion was destroyed. Only present if state is DESTROYED.

    etag

    string

    Output only. Etag of the currently stored SecretVersion.

    name

    string

    Output only. The resource name of the SecretVersion in the format projects/*/secrets/*/versions/* . SecretVersion IDs in a Secret start at 1 and are incremented for each subsequent version of the secret.

    replicationStatus

    object ( ReplicationStatus )

    The replication status of the SecretVersion.

    state

    enum

    Output only. The current state of the SecretVersion.

    Enum type. Can be one of the following:
    STATE_UNSPECIFIED
    Not specified. This value is unused and invalid.
    ENABLED
    The SecretVersion may be accessed.
    DISABLED
    The SecretVersion may not be accessed, but the secret data is still available and can be placed back into the ENABLED state.
    DESTROYED
    The SecretVersion is destroyed and the secret data is no longer stored. A version may not leave this state once entered.

    SetIamPolicyRequest

    Request message for SetIamPolicy method.
    Fields
    policy

    object ( Policy )

    REQUIRED: The complete policy to be applied to the resource . The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.

    updateMask

    string ( FieldMask format)

    OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: paths: "bindings, etag"

    TestIamPermissionsRequest

    Request message for TestIamPermissions method.
    Fields
    permissions[]

    string

    The set of permissions to check for the resource . Permissions with wildcards (such as ' ' or 'storage. ') are not allowed. For more information see IAM Overview .

    TestIamPermissionsResponse

    Response message for TestIamPermissions method.
    Fields
    permissions[]

    string

    A subset of TestPermissionsRequest.permissions that the caller is allowed.

    Topic

    A Pub/Sub topic which Secret Manager will publish to when control plane events occur on this secret.
    Fields
    name

    string

    Required. The resource name of the Pub/Sub topic that will be published to, in the following format: projects/*/topics/* . For publication to succeed, the Secret Manager P4SA must have pubsub.publisher permissions on the topic.

    UserManaged

    A replication policy that replicates the Secret payload into the locations specified in Secret.replication.user_managed.replicas
    Fields
    replicas[]

    object ( Replica )

    Required. The list of Replicas for this Secret. Cannot be empty.

    UserManagedStatus

    The replication status of a SecretVersion using user-managed replication. Only populated if the parent Secret has a user-managed replication policy.
    Fields
    replicas[]

    object ( ReplicaStatus )

    Output only. The list of replica statuses for the SecretVersion.
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: