The response message for Locations.ListLocations.

The standard List next-page token.

A list of locations that matches the specified filter in the request.

The public key for a given CryptoKeyVersion. Obtained via GetPublicKey.

The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and [Textual Encoding of Subject Public Key Info] (https://tools.ietf.org/html/rfc7468#section-13).

The Algorithm associated with this key.

Response message for KeyManagementService.AsymmetricDecrypt.

The decrypted data originally encrypted with the matching public key.

Response message for KeyManagementService.AsymmetricSign.

The created signature.

Response message for KeyManagementService.Decrypt.

The decrypted data originally supplied in EncryptRequest.plaintext.

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

The current state of the CryptoKeyVersion.

Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.

Output only. The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.

Output only. The time at which this CryptoKeyVersion's key material was imported.

Output only. The name of the ImportJob used to import this CryptoKeyVersion. Only present if the underlying key material was imported.

Output only. The root cause of an import failure. Only present if state is IMPORT_FAILED.

Output only. The time this CryptoKeyVersion's key material was generated.

[ExternalProtectionLevelOptions] stores a group of additional fields for configuring a [CryptoKeyVersion] that are specific to the [EXTERNAL] protection level.

Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.

Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.

Output only. The time at which this CryptoKeyVersion was created.

Output only. Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM.

Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.

Response message for KeyManagementService.Encrypt.

The resource name of the CryptoKeyVersion used in encryption. Check this field to verify that the intended resource was used for encryption.

The encrypted data.

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

The current state of the CryptoKeyVersion.

Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.

Output only. The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.

Output only. The time at which this CryptoKeyVersion's key material was imported.

Output only. The name of the ImportJob used to import this CryptoKeyVersion. Only present if the underlying key material was imported.

Output only. The root cause of an import failure. Only present if state is IMPORT_FAILED.

Output only. The time this CryptoKeyVersion's key material was generated.

[ExternalProtectionLevelOptions] stores a group of additional fields for configuring a [CryptoKeyVersion] that are specific to the [EXTERNAL] protection level.

Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.

Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.

Output only. The time at which this CryptoKeyVersion was created.

Output only. Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM.

Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.

A CryptoKey represents a logical key that can be used for cryptographic operations.

A CryptoKey is made up of one or more versions, which represent the actual key material used in cryptographic operations.

A template describing settings for new CryptoKeyVersion instances. The properties of new CryptoKeyVersion instances created by either CreateCryptoKeyVersion or auto-rotation are controlled by this template.

next_rotation_time will be advanced by this period when the service automatically rotates a key. Must be at least 24 hours and at most 876,000 hours.

If rotation_period is set, next_rotation_time must also be set.

Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted.

Immutable. The immutable purpose of this CryptoKey.

Output only. A copy of the "primary" CryptoKeyVersion that will be used by Encrypt when this CryptoKey is given in EncryptRequest.name.

The CryptoKey's primary version can be updated via UpdateCryptoKeyPrimaryVersion.

Keys with purpose ENCRYPT_DECRYPT may have a primary. For other keys, this field will be omitted.

At next_rotation_time, the Key Management Service will automatically:

1. Create a new version of this CryptoKey.
2. Mark the new version as primary.

Key rotations performed manually via CreateCryptoKeyVersion and UpdateCryptoKeyPrimaryVersion do not affect next_rotation_time.

Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted.

Output only. The resource name for this CryptoKey in the format projects/*/locations/*/keyRings/*/cryptoKeys/*.

Labels with user-defined metadata. For more information, see Labeling Keys.

Output only. The time at which this CryptoKey was created.

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

The current state of the CryptoKeyVersion.

Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.

Output only. The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.

Output only. The time at which this CryptoKeyVersion's key material was imported.

Output only. The name of the ImportJob used to import this CryptoKeyVersion. Only present if the underlying key material was imported.

Output only. The root cause of an import failure. Only present if state is IMPORT_FAILED.

Output only. The time this CryptoKeyVersion's key material was generated.

[ExternalProtectionLevelOptions] stores a group of additional fields for configuring a [CryptoKeyVersion] that are specific to the [EXTERNAL] protection level.

Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.

Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.

Output only. The time at which this CryptoKeyVersion was created.

Output only. Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM.

Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

The current state of the CryptoKeyVersion.

Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.

Output only. The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.

Output only. The time at which this CryptoKeyVersion's key material was imported.

Output only. The name of the ImportJob used to import this CryptoKeyVersion. Only present if the underlying key material was imported.

Output only. The root cause of an import failure. Only present if state is IMPORT_FAILED.

Output only. The time this CryptoKeyVersion's key material was generated.

[ExternalProtectionLevelOptions] stores a group of additional fields for configuring a [CryptoKeyVersion] that are specific to the [EXTERNAL] protection level.

Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.

Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.

Output only. The time at which this CryptoKeyVersion was created.

Output only. Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM.

Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

The current state of the CryptoKeyVersion.

Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.

Output only. The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.

Output only. The time at which this CryptoKeyVersion's key material was imported.

Output only. The name of the ImportJob used to import this CryptoKeyVersion. Only present if the underlying key material was imported.

Output only. The root cause of an import failure. Only present if state is IMPORT_FAILED.

Output only. The time this CryptoKeyVersion's key material was generated.

[ExternalProtectionLevelOptions] stores a group of additional fields for configuring a [CryptoKeyVersion] that are specific to the [EXTERNAL] protection level.

Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.

Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.

Output only. The time at which this CryptoKeyVersion was created.

Output only. Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM.

Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.

Response message for KeyManagementService.ListCryptoKeyVersions.

The total number of CryptoKeyVersions that matched the query.

A token to retrieve next page of results. Pass this value in ListCryptoKeyVersionsRequest.page_token to retrieve the next page of results.

The list of CryptoKeyVersions.

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

The current state of the CryptoKeyVersion.

Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.

Output only. The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.

Output only. The time at which this CryptoKeyVersion's key material was imported.

Output only. The name of the ImportJob used to import this CryptoKeyVersion. Only present if the underlying key material was imported.

Output only. The root cause of an import failure. Only present if state is IMPORT_FAILED.

Output only. The time this CryptoKeyVersion's key material was generated.

[ExternalProtectionLevelOptions] stores a group of additional fields for configuring a [CryptoKeyVersion] that are specific to the [EXTERNAL] protection level.

Output only. The time this CryptoKeyVersion's key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.

Output only. The time this CryptoKeyVersion's key material was destroyed. Only present if state is DESTROYED.

Output only. The time at which this CryptoKeyVersion was created.

Output only. Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM.

Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.

Response message for KeyManagementService.ListCryptoKeys.

The total number of CryptoKeys that matched the query.

A token to retrieve next page of results. Pass this value in ListCryptoKeysRequest.page_token to retrieve the next page of results.

The list of CryptoKeys.

A CryptoKey represents a logical key that can be used for cryptographic operations.

A CryptoKey is made up of one or more versions, which represent the actual key material used in cryptographic operations.

A template describing settings for new CryptoKeyVersion instances. The properties of new CryptoKeyVersion instances created by either CreateCryptoKeyVersion or auto-rotation are controlled by this template.

next_rotation_time will be advanced by this period when the service automatically rotates a key. Must be at least 24 hours and at most 876,000 hours.

If rotation_period is set, next_rotation_time must also be set.

Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted.

Immutable. The immutable purpose of this CryptoKey.

Output only. A copy of the "primary" CryptoKeyVersion that will be used by Encrypt when this CryptoKey is given in EncryptRequest.name.

The CryptoKey's primary version can be updated via UpdateCryptoKeyPrimaryVersion.

Keys with purpose ENCRYPT_DECRYPT may have a primary. For other keys, this field will be omitted.

At next_rotation_time, the Key Management Service will automatically:

1. Create a new version of this CryptoKey.
2. Mark the new version as primary.

Key rotations performed manually via CreateCryptoKeyVersion and UpdateCryptoKeyPrimaryVersion do not affect next_rotation_time.

Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted.

Output only. The resource name for this CryptoKey in the format projects/*/locations/*/keyRings/*/cryptoKeys/*.

Labels with user-defined metadata. For more information, see Labeling Keys.

Output only. The time at which this CryptoKey was created.

Response message for KeyManagementService.ListImportJobs.

The total number of ImportJobs that matched the query.

A token to retrieve next page of results. Pass this value in ListImportJobsRequest.page_token to retrieve the next page of results.

The list of ImportJobs.

An ImportJob can be used to create CryptoKeys and CryptoKeyVersions using pre-existing key material, generated outside of Cloud KMS.

When an ImportJob is created, Cloud KMS will generate a "wrapping key", which is a public/private key pair. You use the wrapping key to encrypt (also known as wrap) the pre-existing key material to protect it during the import process. The nature of the wrapping key depends on the choice of import_method. When the wrapping key generation is complete, the state will be set to ACTIVE and the public_key can be fetched. The fetched public key can then be used to wrap your pre-existing key material.

Once the key material is wrapped, it can be imported into a new CryptoKeyVersion in an existing CryptoKey by calling ImportCryptoKeyVersion. Multiple CryptoKeyVersions can be imported with a single ImportJob. Cloud KMS uses the private key portion of the wrapping key to unwrap the key material. Only Cloud KMS has access to the private key.

An ImportJob expires 3 days after it is created. Once expired, Cloud KMS will no longer be able to import or unwrap any key material that was wrapped with the ImportJob's public key.

For more information, see Importing a key.

Output only. The current state of the ImportJob, indicating if it can be used.

Output only. The public key with which to wrap key material prior to import. Only returned if state is ACTIVE.

Required. Immutable. The protection level of the ImportJob. This must match the protection_level of the version_template on the CryptoKey you attempt to import into.

Output only. The resource name for this ImportJob in the format projects/*/locations/*/keyRings/*/importJobs/*.

Required. Immutable. The wrapping method to be used for incoming key material.

Output only. The time this ImportJob's key material was generated.

Output only. The time at which this ImportJob is scheduled for expiration and can no longer be used to import key material.

Output only. The time this ImportJob expired. Only present if state is EXPIRED.

Output only. The time at which this ImportJob was created.

Output only. Statement that was generated and signed by the key creator (for example, an HSM) at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only present if the chosen ImportMethod is one with a protection level of HSM.

Response message for KeyManagementService.ListKeyRings.

The total number of KeyRings that matched the query.

A token to retrieve next page of results. Pass this value in ListKeyRingsRequest.page_token to retrieve the next page of results.

The list of KeyRings.

A KeyRing is a toplevel logical grouping of CryptoKeys.

Output only. The resource name for the KeyRing in the format projects/*/locations/*/keyRings/*.

Output only. The time at which this KeyRing was created.

An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.

A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.

Optionally, a binding can specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both.

JSON example:

{
  "bindings": [
    {
      "role": "roles/resourcemanager.organizationAdmin",
      "members": [
        "user:mike@example.com",
        "group:admins@example.com",
        "domain:google.com",
        "serviceAccount:my-project-id@appspot.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/resourcemanager.organizationViewer",
      "members": ["user:eve@example.com"],
      "condition": {
        "title": "expirable access",
        "description": "Does not grant access after Sep 2020",
        "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",
      }
    }
  ],
  "etag": "BwWWja0YfJA=",
  "version": 3
}

YAML example:

bindings:
- members:
  - user:mike@example.com
  - group:admins@example.com
  - domain:google.com
  - serviceAccount:my-project-id@appspot.gserviceaccount.com
  role: roles/resourcemanager.organizationAdmin
- members:
  - user:eve@example.com
  role: roles/resourcemanager.organizationViewer
  condition:
    title: expirable access
    description: Does not grant access after Sep 2020
    expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
- etag: BwWWja0YfJA=
- version: 3

For a description of IAM and its features, see the IAM documentation.

Specifies the format of the policy.

Valid values are 0, 1, and 3. Requests that specify an invalid value are rejected.

Any operation that affects conditional role bindings must specify version 3. This requirement applies to the following operations:

• Getting a policy that includes a conditional role binding
• Adding a conditional role binding to a policy
• Changing a conditional role binding in a policy
• Removing any role binding, with or without a condition, from a policy that includes conditions

Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost.

If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset.

etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy.

Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost.

Associates a list of members to a role. Optionally, may specify a condition that determines how and when the bindings are applied. Each of the bindings must contain at least one member.

Specifies cloud audit logging configuration for this policy.

An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources.

A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role.

Optionally, a binding can specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both.

JSON example:

{
  "bindings": [
    {
      "role": "roles/resourcemanager.organizationAdmin",
      "members": [
        "user:mike@example.com",
        "group:admins@example.com",
        "domain:google.com",
        "serviceAccount:my-project-id@appspot.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/resourcemanager.organizationViewer",
      "members": ["user:eve@example.com"],
      "condition": {
        "title": "expirable access",
        "description": "Does not grant access after Sep 2020",
        "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",
      }
    }
  ],
  "etag": "BwWWja0YfJA=",
  "version": 3
}

YAML example:

bindings:
- members:
  - user:mike@example.com
  - group:admins@example.com
  - domain:google.com
  - serviceAccount:my-project-id@appspot.gserviceaccount.com
  role: roles/resourcemanager.organizationAdmin
- members:
  - user:eve@example.com
  role: roles/resourcemanager.organizationViewer
  condition:
    title: expirable access
    description: Does not grant access after Sep 2020
    expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
- etag: BwWWja0YfJA=
- version: 3

For a description of IAM and its features, see the IAM documentation.

Specifies the format of the policy.

Valid values are 0, 1, and 3. Requests that specify an invalid value are rejected.

Any operation that affects conditional role bindings must specify version 3. This requirement applies to the following operations:

• Getting a policy that includes a conditional role binding
• Adding a conditional role binding to a policy
• Changing a conditional role binding in a policy
• Removing any role binding, with or without a condition, from a policy that includes conditions

Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost.

If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset.

etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy.

Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost.

Associates a list of members to a role. Optionally, may specify a condition that determines how and when the bindings are applied. Each of the bindings must contain at least one member.