1// Copyright 2020 Google LLC
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15syntax = "proto3";
16
17package google.iam.credentials.v1;
18
19import "google/api/annotations.proto";
20import "google/api/client.proto";
21import "google/iam/credentials/v1/common.proto";
22
23option cc_enable_arenas = true;
24option csharp_namespace = "Google.Cloud.Iam.Credentials.V1";
25option go_package = "cloud.google.com/go/iam/credentials/apiv1/credentialspb;credentialspb";
26option java_multiple_files = true;
27option java_outer_classname = "IAMCredentialsProto";
28option java_package = "com.google.cloud.iam.credentials.v1";
29option php_namespace = "Google\\Cloud\\Iam\\Credentials\\V1";
30
31// A service account is a special type of Google account that belongs to your
32// application or a virtual machine (VM), instead of to an individual end user.
33// Your application assumes the identity of the service account to call Google
34// APIs, so that the users aren't directly involved.
35//
36// Service account credentials are used to temporarily assume the identity
37// of the service account. Supported credential types include OAuth 2.0 access
38// tokens, OpenID Connect ID tokens, self-signed JSON Web Tokens (JWTs), and
39// more.
40service IAMCredentials {
41  option (google.api.default_host) = "iamcredentials.googleapis.com";
42  option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
43
44  // Generates an OAuth 2.0 access token for a service account.
45  rpc GenerateAccessToken(GenerateAccessTokenRequest) returns (GenerateAccessTokenResponse) {
46    option (google.api.http) = {
47      post: "/v1/{name=projects/*/serviceAccounts/*}:generateAccessToken"
48      body: "*"
49    };
50    option (google.api.method_signature) = "name,delegates,scope,lifetime";
51  }
52
53  // Generates an OpenID Connect ID token for a service account.
54  rpc GenerateIdToken(GenerateIdTokenRequest) returns (GenerateIdTokenResponse) {
55    option (google.api.http) = {
56      post: "/v1/{name=projects/*/serviceAccounts/*}:generateIdToken"
57      body: "*"
58    };
59    option (google.api.method_signature) = "name,delegates,audience,include_email";
60  }
61
62  // Signs a blob using a service account's system-managed private key.
63  rpc SignBlob(SignBlobRequest) returns (SignBlobResponse) {
64    option (google.api.http) = {
65      post: "/v1/{name=projects/*/serviceAccounts/*}:signBlob"
66      body: "*"
67    };
68    option (google.api.method_signature) = "name,delegates,payload";
69  }
70
71  // Signs a JWT using a service account's system-managed private key.
72  rpc SignJwt(SignJwtRequest) returns (SignJwtResponse) {
73    option (google.api.http) = {
74      post: "/v1/{name=projects/*/serviceAccounts/*}:signJwt"
75      body: "*"
76    };
77    option (google.api.method_signature) = "name,delegates,payload";
78  }
79}
80