Types overview

AccessSecretVersionResponse

Response message for SecretManagerService.AccessSecretVersion.
Fields
name

string

The resource name of the SecretVersion in the format projects/*/secrets/*/versions/*.
payload

object (SecretPayload)

Secret payload

AddSecretVersionRequest

Request message for SecretManagerService.AddSecretVersion.
Fields
payload

object (SecretPayload)

Required. The secret payload of the SecretVersion.

AuditConfig

Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.
Fields
auditLogConfigs[]

object (AuditLogConfig)

The configuration for logging of each type of permission.
service

string

Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services.

AuditLogConfig

Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
Fields
exemptedMembers[]

string

Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
logType

enum

The log type that this config enables.
Enum type. Can be one of the following:
LOG_TYPE_UNSPECIFIED Default case. Should never be this.
ADMIN_READ Admin reads. Example: CloudIAM getIamPolicy
DATA_WRITE Data writes. Example: CloudSQL Users create
DATA_READ Data reads. Example: CloudSQL Users list

Automatic

A replication policy that replicates the Secret payload without any restrictions.
Fields
customerManagedEncryption

object (CustomerManagedEncryption)

Optional. The customer-managed encryption configuration of the Secret. If no configuration is provided, Google-managed default encryption is used. Updates to the Secret encryption configuration only apply to SecretVersions added afterwards. They do not apply retroactively to existing SecretVersions.

AutomaticStatus

The replication status of a SecretVersion using automatic replication. Only populated if the parent Secret has an automatic replication policy.
Fields
customerManagedEncryption

object (CustomerManagedEncryptionStatus)

Output only. The customer-managed encryption status of the SecretVersion. Only populated if customer-managed encryption is used.

Binding

Associates members with a role.
Fields
condition

object (Expr)

The condition that is associated with this binding. If the condition evaluates to true, then this binding applies to the current request. If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the members in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation.
members[]

string

Specifies the identities requesting access for a Cloud Platform resource. members can have the following values: * allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account. * allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. * user:{emailid}: An email address that represents a specific Google account. For example, alice@example.com . * serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com. * group:{emailid}: An email address that represents a Google group. For example, admins@example.com. * deleted:user:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:{emailid} and the recovered user retains the role in the binding. * deleted:serviceAccount:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:{emailid} and the undeleted service account retains the role in the binding. * deleted:group:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:{emailid} and the recovered group retains the role in the binding. * domain:{domain}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com.

role

string

Role that is assigned to members. For example, roles/viewer, roles/editor, or roles/owner.

CustomerManagedEncryption

Configuration for encrypting secret payloads using customer-managed encryption keys (CMEK).
Fields
kmsKeyName

string

Required. The resource name of the Cloud KMS CryptoKey used to encrypt secret payloads. For secrets using the UserManaged replication policy type, Cloud KMS CryptoKeys must reside in the same location as the replica location. For secrets using the Automatic replication policy type, Cloud KMS CryptoKeys must reside in global. The expected format is projects/*/locations/*/keyRings/*/cryptoKeys/*.

CustomerManagedEncryptionStatus

Describes the status of customer-managed encryption.
Fields
kmsKeyVersionName

string

Required. The resource name of the Cloud KMS CryptoKeyVersion used to encrypt the secret payload, in the following format: projects/*/locations/*/keyRings/*/cryptoKeys/*/versions/*.

DestroySecretVersionRequest

Request message for SecretManagerService.DestroySecretVersion.
Fields
etag

string

Optional. Etag of the SecretVersion. The request succeeds if it matches the etag of the currently stored secret version object. If the etag is omitted, the request succeeds.

DisableSecretVersionRequest

Request message for SecretManagerService.DisableSecretVersion.
Fields
etag

string

Optional. Etag of the SecretVersion. The request succeeds if it matches the etag of the currently stored secret version object. If the etag is omitted, the request succeeds.

EnableSecretVersionRequest

Request message for SecretManagerService.EnableSecretVersion.
Fields
etag

string

Optional. Etag of the SecretVersion. The request succeeds if it matches the etag of the currently stored secret version object. If the etag is omitted, the request succeeds.

Expr

Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
Fields
description

string

Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression

string

Textual representation of an expression in Common Expression Language syntax.
location

string

Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
title

string

Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

ListLocationsResponse

The response message for Locations.ListLocations.
Fields
locations[]

object (Location)

A list of locations that matches the specified filter in the request.
nextPageToken

string

The standard List next-page token.

ListSecretVersionsResponse

Response message for SecretManagerService.ListSecretVersions.
Fields
nextPageToken

string

A token to retrieve the next page of results. Pass this value in ListSecretVersionsRequest.page_token to retrieve the next page.
totalSize

integer (int32 format)

The total number of SecretVersions.
versions[]

object (SecretVersion)

The list of SecretVersions sorted in reverse by create_time (newest first).

ListSecretsResponse

Response message for SecretManagerService.ListSecrets.
Fields
nextPageToken

string

A token to retrieve the next page of results. Pass this value in ListSecretsRequest.page_token to retrieve the next page.
secrets[]

object (Secret)

The list of Secrets sorted in reverse by create_time (newest first).
totalSize

integer (int32 format)

The total number of Secrets.

Location

A resource that represents Google Cloud Platform location.
Fields
displayName

string

The friendly name for this location, typically a nearby city name. For example, "Tokyo".
labels

map (key: string, value: string)

Cross-service attributes for the location. For example {"cloud.googleapis.com/region": "us-east1"}
locationId

string

The canonical id for this location. For example: "us-east1".
metadata

map (key: string, value: any)

Service-specific metadata. For example the available capacity at the given location.
name

string

Resource name for the location, which may vary between implementations. For example: "projects/example-project/locations/us-east1"

Policy

An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions; each role can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a binding can also specify a condition, which is a logical expression that allows access to a resource only if the expression evaluates to true. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the IAM documentation. JSON example: { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:mike@example.com", "group:admins@example.com", "domain:google.com", "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:eve@example.com" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } YAML example: bindings: - members: - user:mike@example.com - group:admins@example.com - domain:google.com - serviceAccount:my-project-id@appspot.gserviceaccount.com role: roles/resourcemanager.organizationAdmin - members: - user:eve@example.com role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the IAM documentation.
Fields
auditConfigs[]

object (AuditConfig)

Specifies cloud audit logging configuration for this policy.
bindings[]

object (Binding)

Associates a list of members to a role. Optionally, may specify a condition that determines how and when the bindings are applied. Each of the bindings must contain at least one member.
etag

string (bytes format)

etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost.
version

integer (int32 format)

Specifies the format of the policy. Valid values are 0, 1, and 3. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version 3. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation.

Replica

Represents a Replica for this Secret.
Fields
customerManagedEncryption

object (CustomerManagedEncryption)

Optional. The customer-managed encryption configuration of the User-Managed Replica. If no configuration is provided, Google-managed default encryption is used. Updates to the Secret encryption configuration only apply to SecretVersions added afterwards. They do not apply retroactively to existing SecretVersions.
location

string

The canonical IDs of the location to replicate data. For example: "us-east1".

ReplicaStatus

Describes the status of a user-managed replica for the SecretVersion.
Fields
customerManagedEncryption

object (CustomerManagedEncryptionStatus)

Output only. The customer-managed encryption status of the SecretVersion. Only populated if customer-managed encryption is used.
location

string

Output only. The canonical ID of the replica location. For example: "us-east1".

Replication

A policy that defines the replication and encryption configuration of data.
Fields
automatic

object (Automatic)

The Secret will automatically be replicated without any restrictions.
userManaged

object (UserManaged)

The Secret will only be replicated into the locations specified.

ReplicationStatus

The replication status of a SecretVersion.
Fields
automatic

object (AutomaticStatus)

Describes the replication status of a SecretVersion with automatic replication. Only populated if the parent Secret has an automatic replication policy.
userManaged

object (UserManagedStatus)

Describes the replication status of a SecretVersion with user-managed replication. Only populated if the parent Secret has a user-managed replication policy.

Rotation

The rotation time and period for a Secret. At next_rotation_time, Secret Manager will send a Pub/Sub notification to the topics configured on the Secret. Secret.topics must be set to configure rotation.
Fields
nextRotationTime

string (Timestamp format)

Optional. Timestamp in UTC at which the Secret is scheduled to rotate. Cannot be set to less than 300s (5 min) in the future and at most 3153600000s (100 years). next_rotation_time MUST be set if rotation_period is set.
rotationPeriod

string (Duration format)

Input only. The Duration between rotation notifications. Must be in seconds and at least 3600s (1h) and at most 3153600000s (100 years). If rotation_period is set, next_rotation_time must be set. next_rotation_time will be advanced by this period when the service automatically sends rotation notifications.

Secret

A Secret is a logical secret whose value and versions can be accessed. A Secret is made up of zero or more SecretVersions that represent the secret data.
Fields
createTime

string (Timestamp format)

Output only. The time at which the Secret was created.
etag

string

Optional. Etag of the currently stored Secret.
expireTime

string (Timestamp format)

Optional. Timestamp in UTC when the Secret is scheduled to expire. This is always provided on output, regardless of what was sent on input.
labels

map (key: string, value: string)

The labels assigned to this Secret. Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must conform to the following PCRE regular expression: \p{Ll}\p{Lo}{0,62} Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63} No more than 64 labels can be assigned to a given resource.
name

string

Output only. The resource name of the Secret in the format projects/*/secrets/*.
replication

object (Replication)

Required. Immutable. The replication policy of the secret data attached to the Secret. The replication policy cannot be changed after the Secret has been created.
rotation

object (Rotation)

Optional. Rotation policy attached to the Secret. May be excluded if there is no rotation policy.
topics[]

object (Topic)

Optional. A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions.
ttl

string (Duration format)

Input only. The TTL for the Secret.

SecretPayload

A secret payload resource in the Secret Manager API. This contains the sensitive secret payload that is associated with a SecretVersion.
Fields
data

string (bytes format)

The secret data. Must be no larger than 64KiB.

SecretVersion

A secret version resource in the Secret Manager API.
Fields
createTime

string (Timestamp format)

Output only. The time at which the SecretVersion was created.
destroyTime

string (Timestamp format)

Output only. The time this SecretVersion was destroyed. Only present if state is DESTROYED.
etag

string

Output only. Etag of the currently stored SecretVersion.
name

string

Output only. The resource name of the SecretVersion in the format projects/*/secrets/*/versions/*. SecretVersion IDs in a Secret start at 1 and are incremented for each subsequent version of the secret.
replicationStatus

object (ReplicationStatus)

The replication status of the SecretVersion.
state

enum

Output only. The current state of the SecretVersion.
Enum type. Can be one of the following:
STATE_UNSPECIFIED Not specified. This value is unused and invalid.
ENABLED The SecretVersion may be accessed.
DISABLED The SecretVersion may not be accessed, but the secret data is still available and can be placed back into the ENABLED state.
DESTROYED The SecretVersion is destroyed and the secret data is no longer stored. A version may not leave this state once entered.

SetIamPolicyRequest

Request message for SetIamPolicy method.
Fields
policy

object (Policy)

REQUIRED: The complete policy to be applied to the resource. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
updateMask

string (FieldMask format)

OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only the fields in the mask will be modified. If no mask is provided, the following default mask is used: paths: "bindings, etag"

TestIamPermissionsRequest

Request message for TestIamPermissions method.
Fields
permissions[]

string

The set of permissions to check for the resource. Permissions with wildcards (such as '' or 'storage.') are not allowed. For more information see IAM Overview.

TestIamPermissionsResponse

Response message for TestIamPermissions method.
Fields
permissions[]

string

A subset of TestPermissionsRequest.permissions that the caller is allowed.

Topic

A Pub/Sub topic which Secret Manager will publish to when control plane events occur on this secret.
Fields
name

string

Required. The resource name of the Pub/Sub topic that will be published to, in the following format: projects/*/topics/*. For publication to succeed, the Secret Manager P4SA must have pubsub.publisher permissions on the topic.

UserManaged

A replication policy that replicates the Secret payload into the locations specified in Secret.replication.user_managed.replicas
Fields
replicas[]

object (Replica)

Required. The list of Replicas for this Secret. Cannot be empty.

UserManagedStatus

The replication status of a SecretVersion using user-managed replication. Only populated if the parent Secret has a user-managed replication policy.
Fields
replicas[]

object (ReplicaStatus)

Output only. The list of replica statuses for the SecretVersion.