1<html><body> 2<style> 3 4body, h1, h2, h3, div, span, p, pre, a { 5 margin: 0; 6 padding: 0; 7 border: 0; 8 font-weight: inherit; 9 font-style: inherit; 10 font-size: 100%; 11 font-family: inherit; 12 vertical-align: baseline; 13} 14 15body { 16 font-size: 13px; 17 padding: 1em; 18} 19 20h1 { 21 font-size: 26px; 22 margin-bottom: 1em; 23} 24 25h2 { 26 font-size: 24px; 27 margin-bottom: 1em; 28} 29 30h3 { 31 font-size: 20px; 32 margin-bottom: 1em; 33 margin-top: 1em; 34} 35 36pre, code { 37 line-height: 1.5; 38 font-family: Monaco, 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Lucida Console', monospace; 39} 40 41pre { 42 margin-top: 0.5em; 43} 44 45h1, h2, h3, p { 46 font-family: Arial, sans serif; 47} 48 49h1, h2, h3 { 50 border-bottom: solid #CCC 1px; 51} 52 53.toc_element { 54 margin-top: 0.5em; 55} 56 57.firstline { 58 margin-left: 2 em; 59} 60 61.method { 62 margin-top: 1em; 63 border: solid 1px #CCC; 64 padding: 1em; 65 background: #EEE; 66} 67 68.details { 69 font-weight: bold; 70 font-size: 14px; 71} 72 73</style> 74 75<h1><a href="managedidentities_v1.html">Managed Service for Microsoft Active Directory API</a> . <a href="managedidentities_v1.projects.html">projects</a> . <a href="managedidentities_v1.projects.locations.html">locations</a> . <a href="managedidentities_v1.projects.locations.global_.html">global_</a> . <a href="managedidentities_v1.projects.locations.global_.domains.html">domains</a></h1> 76<h2>Instance Methods</h2> 77<p class="toc_element"> 78 <code><a href="managedidentities_v1.projects.locations.global_.domains.sqlIntegrations.html">sqlIntegrations()</a></code> 79</p> 80<p class="firstline">Returns the sqlIntegrations Resource.</p> 81 82<p class="toc_element"> 83 <code><a href="#attachTrust">attachTrust(name, body=None, x__xgafv=None)</a></code></p> 84<p class="firstline">Adds an AD trust to a domain.</p> 85<p class="toc_element"> 86 <code><a href="#close">close()</a></code></p> 87<p class="firstline">Close httplib2 connections.</p> 88<p class="toc_element"> 89 <code><a href="#create">create(parent, body=None, domainName=None, x__xgafv=None)</a></code></p> 90<p class="firstline">Creates a Microsoft AD domain.</p> 91<p class="toc_element"> 92 <code><a href="#delete">delete(name, x__xgafv=None)</a></code></p> 93<p class="firstline">Deletes a domain.</p> 94<p class="toc_element"> 95 <code><a href="#detachTrust">detachTrust(name, body=None, x__xgafv=None)</a></code></p> 96<p class="firstline">Removes an AD trust.</p> 97<p class="toc_element"> 98 <code><a href="#get">get(name, x__xgafv=None)</a></code></p> 99<p class="firstline">Gets information about a domain.</p> 100<p class="toc_element"> 101 <code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p> 102<p class="firstline">Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set.</p> 103<p class="toc_element"> 104 <code><a href="#getLdapssettings">getLdapssettings(name, x__xgafv=None)</a></code></p> 105<p class="firstline">Gets the domain ldaps settings.</p> 106<p class="toc_element"> 107 <code><a href="#list">list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</a></code></p> 108<p class="firstline">Lists domains in a project.</p> 109<p class="toc_element"> 110 <code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p> 111<p class="firstline">Retrieves the next page of results.</p> 112<p class="toc_element"> 113 <code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p> 114<p class="firstline">Updates the metadata and configuration of a domain.</p> 115<p class="toc_element"> 116 <code><a href="#reconfigureTrust">reconfigureTrust(name, body=None, x__xgafv=None)</a></code></p> 117<p class="firstline">Updates the DNS conditional forwarder.</p> 118<p class="toc_element"> 119 <code><a href="#resetAdminPassword">resetAdminPassword(name, body=None, x__xgafv=None)</a></code></p> 120<p class="firstline">Resets a domain's administrator password.</p> 121<p class="toc_element"> 122 <code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p> 123<p class="firstline">Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.</p> 124<p class="toc_element"> 125 <code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p> 126<p class="firstline">Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning.</p> 127<p class="toc_element"> 128 <code><a href="#updateLdapssettings">updateLdapssettings(name, body=None, updateMask=None, x__xgafv=None)</a></code></p> 129<p class="firstline">Patches a single ldaps settings.</p> 130<p class="toc_element"> 131 <code><a href="#validateTrust">validateTrust(name, body=None, x__xgafv=None)</a></code></p> 132<p class="firstline">Validates a trust state, that the target domain is reachable, and that the target domain is able to accept incoming trust requests.</p> 133<h3>Method Details</h3> 134<div class="method"> 135 <code class="details" id="attachTrust">attachTrust(name, body=None, x__xgafv=None)</code> 136 <pre>Adds an AD trust to a domain. 137 138Args: 139 name: string, Required. The resource domain name, project name and location using the form: `projects/{project_id}/locations/global/domains/{domain_name}` (required) 140 body: object, The request body. 141 The object takes the form of: 142 143{ # Request message for AttachTrust 144 "trust": { # Represents a relationship between two domains. This allows a controller in one domain to authenticate a user in another domain. If the trust is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. # Required. The domain trust resource. 145 "createTime": "A String", # Output only. The time the instance was created. 146 "lastTrustHeartbeatTime": "A String", # Output only. The last heartbeat time when the trust was known to be connected. 147 "selectiveAuthentication": True or False, # Optional. The trust authentication type, which decides whether the trusted side has forest/domain wide access or selective access to an approved set of resources. 148 "state": "A String", # Output only. The current state of the trust. 149 "stateDescription": "A String", # Output only. Additional information about the current state of the trust, if available. 150 "targetDnsIpAddresses": [ # Required. The target DNS server IP addresses which can resolve the remote domain involved in the trust. 151 "A String", 152 ], 153 "targetDomainName": "A String", # Required. The fully qualified target domain name which will be in trust with the current domain. 154 "trustDirection": "A String", # Required. The trust direction, which decides if the current domain is trusted, trusting, or both. 155 "trustHandshakeSecret": "A String", # Required. The trust secret used for the handshake with the target domain. This will not be stored. 156 "trustType": "A String", # Required. The type of trust represented by the trust resource. 157 "updateTime": "A String", # Output only. The last update time. 158 }, 159} 160 161 x__xgafv: string, V1 error format. 162 Allowed values 163 1 - v1 error format 164 2 - v2 error format 165 166Returns: 167 An object of the form: 168 169 { # This resource represents a long-running operation that is the result of a network API call. 170 "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. 171 "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation. 172 "code": 42, # The status code, which should be an enum value of google.rpc.Code. 173 "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use. 174 { 175 "a_key": "", # Properties of the object. Contains field @type with type URL. 176 }, 177 ], 178 "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. 179 }, 180 "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. 181 "a_key": "", # Properties of the object. Contains field @type with type URL. 182 }, 183 "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. 184 "response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. 185 "a_key": "", # Properties of the object. Contains field @type with type URL. 186 }, 187}</pre> 188</div> 189 190<div class="method"> 191 <code class="details" id="close">close()</code> 192 <pre>Close httplib2 connections.</pre> 193</div> 194 195<div class="method"> 196 <code class="details" id="create">create(parent, body=None, domainName=None, x__xgafv=None)</code> 197 <pre>Creates a Microsoft AD domain. 198 199Args: 200 parent: string, Required. The resource project name and location using the form: `projects/{project_id}/locations/global` (required) 201 body: object, The request body. 202 The object takes the form of: 203 204{ # Represents a managed Microsoft Active Directory domain. If the domain is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. 205 "admin": "A String", # Optional. The name of delegated administrator account used to perform Active Directory operations. If not specified, `setupadmin` will be used. 206 "auditLogsEnabled": True or False, # Optional. Configuration for audit logs. True if audit logs are enabled, else false. Default is audit logs disabled. 207 "authorizedNetworks": [ # Optional. The full names of the Google Compute Engine [networks](/compute/docs/networks-and-firewalls#networks) the domain instance is connected to. Networks can be added using UpdateDomain. The domain is only available on networks listed in `authorized_networks`. If CIDR subnets overlap between networks, domain creation will fail. 208 "A String", 209 ], 210 "createTime": "A String", # Output only. The time the instance was created. 211 "fqdn": "A String", # Output only. The fully-qualified domain name of the exposed domain used by clients to connect to the service. Similar to what would be chosen for an Active Directory set up on an internal network. 212 "labels": { # Optional. Resource labels that can contain user-provided metadata. 213 "a_key": "A String", 214 }, 215 "locations": [ # Required. Locations where domain needs to be provisioned. regions e.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block. 216 "A String", 217 ], 218 "name": "A String", # Required. The unique name of the domain using the form: `projects/{project_id}/locations/global/domains/{domain_name}`. 219 "reservedIpRange": "A String", # Required. The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger. Ranges must be unique and non-overlapping with existing subnets in [Domain].[authorized_networks]. 220 "state": "A String", # Output only. The current state of this domain. 221 "statusMessage": "A String", # Output only. Additional information about the current status of this domain, if available. 222 "trusts": [ # Output only. The current trusts associated with the domain. 223 { # Represents a relationship between two domains. This allows a controller in one domain to authenticate a user in another domain. If the trust is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. 224 "createTime": "A String", # Output only. The time the instance was created. 225 "lastTrustHeartbeatTime": "A String", # Output only. The last heartbeat time when the trust was known to be connected. 226 "selectiveAuthentication": True or False, # Optional. The trust authentication type, which decides whether the trusted side has forest/domain wide access or selective access to an approved set of resources. 227 "state": "A String", # Output only. The current state of the trust. 228 "stateDescription": "A String", # Output only. Additional information about the current state of the trust, if available. 229 "targetDnsIpAddresses": [ # Required. The target DNS server IP addresses which can resolve the remote domain involved in the trust. 230 "A String", 231 ], 232 "targetDomainName": "A String", # Required. The fully qualified target domain name which will be in trust with the current domain. 233 "trustDirection": "A String", # Required. The trust direction, which decides if the current domain is trusted, trusting, or both. 234 "trustHandshakeSecret": "A String", # Required. The trust secret used for the handshake with the target domain. This will not be stored. 235 "trustType": "A String", # Required. The type of trust represented by the trust resource. 236 "updateTime": "A String", # Output only. The last update time. 237 }, 238 ], 239 "updateTime": "A String", # Output only. The last update time. 240} 241 242 domainName: string, Required. The fully qualified domain name. e.g. mydomain.myorganization.com, with the following restrictions: * Must contain only lowercase letters, numbers, periods and hyphens. * Must start with a letter. * Must contain between 2-64 characters. * Must end with a number or a letter. * Must not start with period. * First segment length (mydomain for example above) shouldn't exceed 15 chars. * The last segment cannot be fully numeric. * Must be unique within the customer project. 243 x__xgafv: string, V1 error format. 244 Allowed values 245 1 - v1 error format 246 2 - v2 error format 247 248Returns: 249 An object of the form: 250 251 { # This resource represents a long-running operation that is the result of a network API call. 252 "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. 253 "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation. 254 "code": 42, # The status code, which should be an enum value of google.rpc.Code. 255 "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use. 256 { 257 "a_key": "", # Properties of the object. Contains field @type with type URL. 258 }, 259 ], 260 "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. 261 }, 262 "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. 263 "a_key": "", # Properties of the object. Contains field @type with type URL. 264 }, 265 "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. 266 "response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. 267 "a_key": "", # Properties of the object. Contains field @type with type URL. 268 }, 269}</pre> 270</div> 271 272<div class="method"> 273 <code class="details" id="delete">delete(name, x__xgafv=None)</code> 274 <pre>Deletes a domain. 275 276Args: 277 name: string, Required. The domain resource name using the form: `projects/{project_id}/locations/global/domains/{domain_name}` (required) 278 x__xgafv: string, V1 error format. 279 Allowed values 280 1 - v1 error format 281 2 - v2 error format 282 283Returns: 284 An object of the form: 285 286 { # This resource represents a long-running operation that is the result of a network API call. 287 "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. 288 "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation. 289 "code": 42, # The status code, which should be an enum value of google.rpc.Code. 290 "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use. 291 { 292 "a_key": "", # Properties of the object. Contains field @type with type URL. 293 }, 294 ], 295 "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. 296 }, 297 "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. 298 "a_key": "", # Properties of the object. Contains field @type with type URL. 299 }, 300 "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. 301 "response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. 302 "a_key": "", # Properties of the object. Contains field @type with type URL. 303 }, 304}</pre> 305</div> 306 307<div class="method"> 308 <code class="details" id="detachTrust">detachTrust(name, body=None, x__xgafv=None)</code> 309 <pre>Removes an AD trust. 310 311Args: 312 name: string, Required. The resource domain name, project name, and location using the form: `projects/{project_id}/locations/global/domains/{domain_name}` (required) 313 body: object, The request body. 314 The object takes the form of: 315 316{ # Request message for DetachTrust 317 "trust": { # Represents a relationship between two domains. This allows a controller in one domain to authenticate a user in another domain. If the trust is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. # Required. The domain trust resource to removed. 318 "createTime": "A String", # Output only. The time the instance was created. 319 "lastTrustHeartbeatTime": "A String", # Output only. The last heartbeat time when the trust was known to be connected. 320 "selectiveAuthentication": True or False, # Optional. The trust authentication type, which decides whether the trusted side has forest/domain wide access or selective access to an approved set of resources. 321 "state": "A String", # Output only. The current state of the trust. 322 "stateDescription": "A String", # Output only. Additional information about the current state of the trust, if available. 323 "targetDnsIpAddresses": [ # Required. The target DNS server IP addresses which can resolve the remote domain involved in the trust. 324 "A String", 325 ], 326 "targetDomainName": "A String", # Required. The fully qualified target domain name which will be in trust with the current domain. 327 "trustDirection": "A String", # Required. The trust direction, which decides if the current domain is trusted, trusting, or both. 328 "trustHandshakeSecret": "A String", # Required. The trust secret used for the handshake with the target domain. This will not be stored. 329 "trustType": "A String", # Required. The type of trust represented by the trust resource. 330 "updateTime": "A String", # Output only. The last update time. 331 }, 332} 333 334 x__xgafv: string, V1 error format. 335 Allowed values 336 1 - v1 error format 337 2 - v2 error format 338 339Returns: 340 An object of the form: 341 342 { # This resource represents a long-running operation that is the result of a network API call. 343 "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. 344 "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation. 345 "code": 42, # The status code, which should be an enum value of google.rpc.Code. 346 "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use. 347 { 348 "a_key": "", # Properties of the object. Contains field @type with type URL. 349 }, 350 ], 351 "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. 352 }, 353 "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. 354 "a_key": "", # Properties of the object. Contains field @type with type URL. 355 }, 356 "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. 357 "response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. 358 "a_key": "", # Properties of the object. Contains field @type with type URL. 359 }, 360}</pre> 361</div> 362 363<div class="method"> 364 <code class="details" id="get">get(name, x__xgafv=None)</code> 365 <pre>Gets information about a domain. 366 367Args: 368 name: string, Required. The domain resource name using the form: `projects/{project_id}/locations/global/domains/{domain_name}` (required) 369 x__xgafv: string, V1 error format. 370 Allowed values 371 1 - v1 error format 372 2 - v2 error format 373 374Returns: 375 An object of the form: 376 377 { # Represents a managed Microsoft Active Directory domain. If the domain is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. 378 "admin": "A String", # Optional. The name of delegated administrator account used to perform Active Directory operations. If not specified, `setupadmin` will be used. 379 "auditLogsEnabled": True or False, # Optional. Configuration for audit logs. True if audit logs are enabled, else false. Default is audit logs disabled. 380 "authorizedNetworks": [ # Optional. The full names of the Google Compute Engine [networks](/compute/docs/networks-and-firewalls#networks) the domain instance is connected to. Networks can be added using UpdateDomain. The domain is only available on networks listed in `authorized_networks`. If CIDR subnets overlap between networks, domain creation will fail. 381 "A String", 382 ], 383 "createTime": "A String", # Output only. The time the instance was created. 384 "fqdn": "A String", # Output only. The fully-qualified domain name of the exposed domain used by clients to connect to the service. Similar to what would be chosen for an Active Directory set up on an internal network. 385 "labels": { # Optional. Resource labels that can contain user-provided metadata. 386 "a_key": "A String", 387 }, 388 "locations": [ # Required. Locations where domain needs to be provisioned. regions e.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block. 389 "A String", 390 ], 391 "name": "A String", # Required. The unique name of the domain using the form: `projects/{project_id}/locations/global/domains/{domain_name}`. 392 "reservedIpRange": "A String", # Required. The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger. Ranges must be unique and non-overlapping with existing subnets in [Domain].[authorized_networks]. 393 "state": "A String", # Output only. The current state of this domain. 394 "statusMessage": "A String", # Output only. Additional information about the current status of this domain, if available. 395 "trusts": [ # Output only. The current trusts associated with the domain. 396 { # Represents a relationship between two domains. This allows a controller in one domain to authenticate a user in another domain. If the trust is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. 397 "createTime": "A String", # Output only. The time the instance was created. 398 "lastTrustHeartbeatTime": "A String", # Output only. The last heartbeat time when the trust was known to be connected. 399 "selectiveAuthentication": True or False, # Optional. The trust authentication type, which decides whether the trusted side has forest/domain wide access or selective access to an approved set of resources. 400 "state": "A String", # Output only. The current state of the trust. 401 "stateDescription": "A String", # Output only. Additional information about the current state of the trust, if available. 402 "targetDnsIpAddresses": [ # Required. The target DNS server IP addresses which can resolve the remote domain involved in the trust. 403 "A String", 404 ], 405 "targetDomainName": "A String", # Required. The fully qualified target domain name which will be in trust with the current domain. 406 "trustDirection": "A String", # Required. The trust direction, which decides if the current domain is trusted, trusting, or both. 407 "trustHandshakeSecret": "A String", # Required. The trust secret used for the handshake with the target domain. This will not be stored. 408 "trustType": "A String", # Required. The type of trust represented by the trust resource. 409 "updateTime": "A String", # Output only. The last update time. 410 }, 411 ], 412 "updateTime": "A String", # Output only. The last update time. 413}</pre> 414</div> 415 416<div class="method"> 417 <code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code> 418 <pre>Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set. 419 420Args: 421 resource: string, REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field. (required) 422 options_requestedPolicyVersion: integer, Optional. The maximum policy version that will be used to format the policy. Valid values are 0, 1, and 3. Requests specifying an invalid value will be rejected. Requests for policies with any conditional role bindings must specify version 3. Policies with no conditional role bindings may specify any valid value or leave the field unset. The policy in the response might use the policy version that you specified, or it might use a lower policy version. For example, if you specify version 3, but the policy has no conditional role bindings, the response uses version 1. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). 423 x__xgafv: string, V1 error format. 424 Allowed values 425 1 - v1 error format 426 2 - v2 error format 427 428Returns: 429 An object of the form: 430 431 { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:[email protected]", "group:[email protected]", "domain:google.com", "serviceAccount:[email protected]" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:[email protected]" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:[email protected] - group:[email protected] - domain:google.com - serviceAccount:[email protected] role: roles/resourcemanager.organizationAdmin - members: - user:[email protected] role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). 432 "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:[email protected]`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`. 433 { # Associates `members`, or principals, with a `role`. 434 "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). 435 "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. 436 "expression": "A String", # Textual representation of an expression in Common Expression Language syntax. 437 "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file. 438 "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. 439 }, 440 "members": [ # Specifies the principals requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `[email protected]` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `[email protected]`. * `group:{emailid}`: An email address that represents a Google group. For example, `[email protected]`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. 441 "A String", 442 ], 443 "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. 444 }, 445 ], 446 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. 447 "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). 448}</pre> 449</div> 450 451<div class="method"> 452 <code class="details" id="getLdapssettings">getLdapssettings(name, x__xgafv=None)</code> 453 <pre>Gets the domain ldaps settings. 454 455Args: 456 name: string, Required. The domain resource name using the form: `projects/{project_id}/locations/global/domains/{domain_name}` (required) 457 x__xgafv: string, V1 error format. 458 Allowed values 459 1 - v1 error format 460 2 - v2 error format 461 462Returns: 463 An object of the form: 464 465 { # LDAPSSettings represents the ldaps settings for domain resource. LDAP is the Lightweight Directory Access Protocol, defined in https://tools.ietf.org/html/rfc4511. The settings object configures LDAP over SSL/TLS, whether it is over port 636 or the StartTLS operation. If LDAPSSettings is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. 466 "certificate": { # Certificate used to configure LDAPS. # Output only. The certificate used to configure LDAPS. Certificates can be chained with a maximum length of 15. 467 "expireTime": "A String", # The certificate expire time. 468 "issuingCertificate": # Object with schema name: Certificate # The issuer of this certificate. 469 "subject": "A String", # The certificate subject. 470 "subjectAlternativeName": [ # The additional hostnames for the domain. 471 "A String", 472 ], 473 "thumbprint": "A String", # The certificate thumbprint which uniquely identifies the certificate. 474 }, 475 "certificatePassword": "A String", # Input only. The password used to encrypt the uploaded PFX certificate. 476 "certificatePfx": "A String", # Input only. The uploaded PKCS12-formatted certificate to configure LDAPS with. It will enable the domain controllers in this domain to accept LDAPS connections (either LDAP over SSL/TLS or the StartTLS operation). A valid certificate chain must form a valid x.509 certificate chain (or be comprised of a single self-signed certificate. It must be encrypted with either: 1) PBES2 + PBKDF2 + AES256 encryption and SHA256 PRF; or 2) pbeWithSHA1And3-KeyTripleDES-CBC Private key must be included for the leaf / single self-signed certificate. Note: For a fqdn your-example-domain.com, the wildcard fqdn is *.your-example-domain.com. Specifically the leaf certificate must have: - Either a blank subject or a subject with CN matching the wildcard fqdn. - Exactly two SANs - the fqdn and wildcard fqdn. - Encipherment and digital key signature key usages. - Server authentication extended key usage (OID=1.3.6.1.5.5.7.3.1) - Private key must be in one of the following formats: RSA, ECDSA, ED25519. - Private key must have appropriate key length: 2048 for RSA, 256 for ECDSA - Signature algorithm of the leaf certificate cannot be MD2, MD5 or SHA1. 477 "name": "A String", # The resource name of the LDAPS settings. Uses the form: `projects/{project}/locations/{location}/domains/{domain}`. 478 "state": "A String", # Output only. The current state of this LDAPS settings. 479 "updateTime": "A String", # Output only. Last update time. 480}</pre> 481</div> 482 483<div class="method"> 484 <code class="details" id="list">list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, x__xgafv=None)</code> 485 <pre>Lists domains in a project. 486 487Args: 488 parent: string, Required. The resource name of the domain location using the form: `projects/{project_id}/locations/global` (required) 489 filter: string, Optional. A filter specifying constraints of a list operation. For example, `Domain.fqdn="mydomain.myorginization"`. 490 orderBy: string, Optional. Specifies the ordering of results. See [Sorting order](https://cloud.google.com/apis/design/design_patterns#sorting_order) for more information. 491 pageSize: integer, Optional. The maximum number of items to return. If not specified, a default value of 1000 will be used. Regardless of the page_size value, the response may include a partial list. Callers should rely on a response's next_page_token to determine if there are additional results to list. 492 pageToken: string, Optional. The `next_page_token` value returned from a previous ListDomainsRequest request, if any. 493 x__xgafv: string, V1 error format. 494 Allowed values 495 1 - v1 error format 496 2 - v2 error format 497 498Returns: 499 An object of the form: 500 501 { # Response message for ListDomains 502 "domains": [ # A list of Managed Identities Service domains in the project. 503 { # Represents a managed Microsoft Active Directory domain. If the domain is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. 504 "admin": "A String", # Optional. The name of delegated administrator account used to perform Active Directory operations. If not specified, `setupadmin` will be used. 505 "auditLogsEnabled": True or False, # Optional. Configuration for audit logs. True if audit logs are enabled, else false. Default is audit logs disabled. 506 "authorizedNetworks": [ # Optional. The full names of the Google Compute Engine [networks](/compute/docs/networks-and-firewalls#networks) the domain instance is connected to. Networks can be added using UpdateDomain. The domain is only available on networks listed in `authorized_networks`. If CIDR subnets overlap between networks, domain creation will fail. 507 "A String", 508 ], 509 "createTime": "A String", # Output only. The time the instance was created. 510 "fqdn": "A String", # Output only. The fully-qualified domain name of the exposed domain used by clients to connect to the service. Similar to what would be chosen for an Active Directory set up on an internal network. 511 "labels": { # Optional. Resource labels that can contain user-provided metadata. 512 "a_key": "A String", 513 }, 514 "locations": [ # Required. Locations where domain needs to be provisioned. regions e.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block. 515 "A String", 516 ], 517 "name": "A String", # Required. The unique name of the domain using the form: `projects/{project_id}/locations/global/domains/{domain_name}`. 518 "reservedIpRange": "A String", # Required. The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger. Ranges must be unique and non-overlapping with existing subnets in [Domain].[authorized_networks]. 519 "state": "A String", # Output only. The current state of this domain. 520 "statusMessage": "A String", # Output only. Additional information about the current status of this domain, if available. 521 "trusts": [ # Output only. The current trusts associated with the domain. 522 { # Represents a relationship between two domains. This allows a controller in one domain to authenticate a user in another domain. If the trust is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. 523 "createTime": "A String", # Output only. The time the instance was created. 524 "lastTrustHeartbeatTime": "A String", # Output only. The last heartbeat time when the trust was known to be connected. 525 "selectiveAuthentication": True or False, # Optional. The trust authentication type, which decides whether the trusted side has forest/domain wide access or selective access to an approved set of resources. 526 "state": "A String", # Output only. The current state of the trust. 527 "stateDescription": "A String", # Output only. Additional information about the current state of the trust, if available. 528 "targetDnsIpAddresses": [ # Required. The target DNS server IP addresses which can resolve the remote domain involved in the trust. 529 "A String", 530 ], 531 "targetDomainName": "A String", # Required. The fully qualified target domain name which will be in trust with the current domain. 532 "trustDirection": "A String", # Required. The trust direction, which decides if the current domain is trusted, trusting, or both. 533 "trustHandshakeSecret": "A String", # Required. The trust secret used for the handshake with the target domain. This will not be stored. 534 "trustType": "A String", # Required. The type of trust represented by the trust resource. 535 "updateTime": "A String", # Output only. The last update time. 536 }, 537 ], 538 "updateTime": "A String", # Output only. The last update time. 539 }, 540 ], 541 "nextPageToken": "A String", # A token to retrieve the next page of results, or empty if there are no more results in the list. 542 "unreachable": [ # A list of locations that could not be reached. 543 "A String", 544 ], 545}</pre> 546</div> 547 548<div class="method"> 549 <code class="details" id="list_next">list_next(previous_request, previous_response)</code> 550 <pre>Retrieves the next page of results. 551 552Args: 553 previous_request: The request for the previous page. (required) 554 previous_response: The response from the request for the previous page. (required) 555 556Returns: 557 A request object that you can call 'execute()' on to request the next 558 page. Returns None if there are no more items in the collection. 559 </pre> 560</div> 561 562<div class="method"> 563 <code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code> 564 <pre>Updates the metadata and configuration of a domain. 565 566Args: 567 name: string, Required. The unique name of the domain using the form: `projects/{project_id}/locations/global/domains/{domain_name}`. (required) 568 body: object, The request body. 569 The object takes the form of: 570 571{ # Represents a managed Microsoft Active Directory domain. If the domain is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. 572 "admin": "A String", # Optional. The name of delegated administrator account used to perform Active Directory operations. If not specified, `setupadmin` will be used. 573 "auditLogsEnabled": True or False, # Optional. Configuration for audit logs. True if audit logs are enabled, else false. Default is audit logs disabled. 574 "authorizedNetworks": [ # Optional. The full names of the Google Compute Engine [networks](/compute/docs/networks-and-firewalls#networks) the domain instance is connected to. Networks can be added using UpdateDomain. The domain is only available on networks listed in `authorized_networks`. If CIDR subnets overlap between networks, domain creation will fail. 575 "A String", 576 ], 577 "createTime": "A String", # Output only. The time the instance was created. 578 "fqdn": "A String", # Output only. The fully-qualified domain name of the exposed domain used by clients to connect to the service. Similar to what would be chosen for an Active Directory set up on an internal network. 579 "labels": { # Optional. Resource labels that can contain user-provided metadata. 580 "a_key": "A String", 581 }, 582 "locations": [ # Required. Locations where domain needs to be provisioned. regions e.g. us-west1 or us-east4 Service supports up to 4 locations at once. Each location will use a /26 block. 583 "A String", 584 ], 585 "name": "A String", # Required. The unique name of the domain using the form: `projects/{project_id}/locations/global/domains/{domain_name}`. 586 "reservedIpRange": "A String", # Required. The CIDR range of internal addresses that are reserved for this domain. Reserved networks must be /24 or larger. Ranges must be unique and non-overlapping with existing subnets in [Domain].[authorized_networks]. 587 "state": "A String", # Output only. The current state of this domain. 588 "statusMessage": "A String", # Output only. Additional information about the current status of this domain, if available. 589 "trusts": [ # Output only. The current trusts associated with the domain. 590 { # Represents a relationship between two domains. This allows a controller in one domain to authenticate a user in another domain. If the trust is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. 591 "createTime": "A String", # Output only. The time the instance was created. 592 "lastTrustHeartbeatTime": "A String", # Output only. The last heartbeat time when the trust was known to be connected. 593 "selectiveAuthentication": True or False, # Optional. The trust authentication type, which decides whether the trusted side has forest/domain wide access or selective access to an approved set of resources. 594 "state": "A String", # Output only. The current state of the trust. 595 "stateDescription": "A String", # Output only. Additional information about the current state of the trust, if available. 596 "targetDnsIpAddresses": [ # Required. The target DNS server IP addresses which can resolve the remote domain involved in the trust. 597 "A String", 598 ], 599 "targetDomainName": "A String", # Required. The fully qualified target domain name which will be in trust with the current domain. 600 "trustDirection": "A String", # Required. The trust direction, which decides if the current domain is trusted, trusting, or both. 601 "trustHandshakeSecret": "A String", # Required. The trust secret used for the handshake with the target domain. This will not be stored. 602 "trustType": "A String", # Required. The type of trust represented by the trust resource. 603 "updateTime": "A String", # Output only. The last update time. 604 }, 605 ], 606 "updateTime": "A String", # Output only. The last update time. 607} 608 609 updateMask: string, Required. Mask of fields to update. At least one path must be supplied in this field. The elements of the repeated paths field may only include fields from Domain: * `labels` * `locations` * `authorized_networks` * `audit_logs_enabled` 610 x__xgafv: string, V1 error format. 611 Allowed values 612 1 - v1 error format 613 2 - v2 error format 614 615Returns: 616 An object of the form: 617 618 { # This resource represents a long-running operation that is the result of a network API call. 619 "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. 620 "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation. 621 "code": 42, # The status code, which should be an enum value of google.rpc.Code. 622 "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use. 623 { 624 "a_key": "", # Properties of the object. Contains field @type with type URL. 625 }, 626 ], 627 "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. 628 }, 629 "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. 630 "a_key": "", # Properties of the object. Contains field @type with type URL. 631 }, 632 "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. 633 "response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. 634 "a_key": "", # Properties of the object. Contains field @type with type URL. 635 }, 636}</pre> 637</div> 638 639<div class="method"> 640 <code class="details" id="reconfigureTrust">reconfigureTrust(name, body=None, x__xgafv=None)</code> 641 <pre>Updates the DNS conditional forwarder. 642 643Args: 644 name: string, Required. The resource domain name, project name and location using the form: `projects/{project_id}/locations/global/domains/{domain_name}` (required) 645 body: object, The request body. 646 The object takes the form of: 647 648{ # Request message for ReconfigureTrust 649 "targetDnsIpAddresses": [ # Required. The target DNS server IP addresses to resolve the remote domain involved in the trust. 650 "A String", 651 ], 652 "targetDomainName": "A String", # Required. The fully-qualified target domain name which will be in trust with current domain. 653} 654 655 x__xgafv: string, V1 error format. 656 Allowed values 657 1 - v1 error format 658 2 - v2 error format 659 660Returns: 661 An object of the form: 662 663 { # This resource represents a long-running operation that is the result of a network API call. 664 "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. 665 "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation. 666 "code": 42, # The status code, which should be an enum value of google.rpc.Code. 667 "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use. 668 { 669 "a_key": "", # Properties of the object. Contains field @type with type URL. 670 }, 671 ], 672 "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. 673 }, 674 "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. 675 "a_key": "", # Properties of the object. Contains field @type with type URL. 676 }, 677 "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. 678 "response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. 679 "a_key": "", # Properties of the object. Contains field @type with type URL. 680 }, 681}</pre> 682</div> 683 684<div class="method"> 685 <code class="details" id="resetAdminPassword">resetAdminPassword(name, body=None, x__xgafv=None)</code> 686 <pre>Resets a domain's administrator password. 687 688Args: 689 name: string, Required. The domain resource name using the form: `projects/{project_id}/locations/global/domains/{domain_name}` (required) 690 body: object, The request body. 691 The object takes the form of: 692 693{ # Request message for ResetAdminPassword 694} 695 696 x__xgafv: string, V1 error format. 697 Allowed values 698 1 - v1 error format 699 2 - v2 error format 700 701Returns: 702 An object of the form: 703 704 { # Response message for ResetAdminPassword 705 "password": "A String", # A random password. See admin for more information. 706}</pre> 707</div> 708 709<div class="method"> 710 <code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code> 711 <pre>Sets the access control policy on the specified resource. Replaces any existing policy. Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors. 712 713Args: 714 resource: string, REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field. (required) 715 body: object, The request body. 716 The object takes the form of: 717 718{ # Request message for `SetIamPolicy` method. 719 "policy": { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:[email protected]", "group:[email protected]", "domain:google.com", "serviceAccount:[email protected]" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:[email protected]" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:[email protected] - group:[email protected] - domain:google.com - serviceAccount:[email protected] role: roles/resourcemanager.organizationAdmin - members: - user:[email protected] role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). # REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them. 720 "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:[email protected]`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`. 721 { # Associates `members`, or principals, with a `role`. 722 "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). 723 "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. 724 "expression": "A String", # Textual representation of an expression in Common Expression Language syntax. 725 "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file. 726 "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. 727 }, 728 "members": [ # Specifies the principals requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `[email protected]` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `[email protected]`. * `group:{emailid}`: An email address that represents a Google group. For example, `[email protected]`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. 729 "A String", 730 ], 731 "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. 732 }, 733 ], 734 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. 735 "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). 736 }, 737} 738 739 x__xgafv: string, V1 error format. 740 Allowed values 741 1 - v1 error format 742 2 - v2 error format 743 744Returns: 745 An object of the form: 746 747 { # An Identity and Access Management (IAM) policy, which specifies access controls for Google Cloud resources. A `Policy` is a collection of `bindings`. A `binding` binds one or more `members`, or principals, to a single `role`. Principals can be user accounts, service accounts, Google groups, and domains (such as G Suite). A `role` is a named list of permissions; each `role` can be an IAM predefined role or a user-created custom role. For some types of Google Cloud resources, a `binding` can also specify a `condition`, which is a logical expression that allows access to a resource only if the expression evaluates to `true`. A condition can add constraints based on attributes of the request, the resource, or both. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). **JSON example:** { "bindings": [ { "role": "roles/resourcemanager.organizationAdmin", "members": [ "user:[email protected]", "group:[email protected]", "domain:google.com", "serviceAccount:[email protected]" ] }, { "role": "roles/resourcemanager.organizationViewer", "members": [ "user:[email protected]" ], "condition": { "title": "expirable access", "description": "Does not grant access after Sep 2020", "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag": "BwWWja0YfJA=", "version": 3 } **YAML example:** bindings: - members: - user:[email protected] - group:[email protected] - domain:google.com - serviceAccount:[email protected] role: roles/resourcemanager.organizationAdmin - members: - user:[email protected] role: roles/resourcemanager.organizationViewer condition: title: expirable access description: Does not grant access after Sep 2020 expression: request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA= version: 3 For a description of IAM and its features, see the [IAM documentation](https://cloud.google.com/iam/docs/). 748 "bindings": [ # Associates a list of `members`, or principals, with a `role`. Optionally, may specify a `condition` that determines how and when the `bindings` are applied. Each of the `bindings` must contain at least one principal. The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of these principals can be Google groups. Each occurrence of a principal counts towards these limits. For example, if the `bindings` grant 50 different roles to `user:[email protected]`, and not to any other principal, then you can add another 1,450 principals to the `bindings` in the `Policy`. 749 { # Associates `members`, or principals, with a `role`. 750 "condition": { # Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information. # The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). 751 "description": "A String", # Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. 752 "expression": "A String", # Textual representation of an expression in Common Expression Language syntax. 753 "location": "A String", # Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file. 754 "title": "A String", # Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. 755 }, 756 "members": [ # Specifies the principals requesting access for a Cloud Platform resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid}`: An email address that represents a specific Google account. For example, `[email protected]` . * `serviceAccount:{emailid}`: An email address that represents a service account. For example, `[email protected]`. * `group:{emailid}`: An email address that represents a Google group. For example, `[email protected]`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. 757 "A String", 758 ], 759 "role": "A String", # Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. 760 }, 761 ], 762 "etag": "A String", # `etag` is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the `etag` in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An `etag` is returned in the response to `getIamPolicy`, and systems are expected to put that etag in the request to `setIamPolicy` to ensure that their change will be applied to the same version of the policy. **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. 763 "version": 42, # Specifies the format of the policy. Valid values are `0`, `1`, and `3`. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version `3`. This requirement applies to the following operations: * Getting a policy that includes a conditional role binding * Adding a conditional role binding to a policy * Changing a conditional role binding in a policy * Removing any role binding, with or without a condition, from a policy that includes conditions **Important:** If you use IAM Conditions, you must include the `etag` field whenever you call `setIamPolicy`. If you omit this field, then IAM allows you to overwrite a version `3` policy with a version `1` policy, and all of the conditions in the version `3` policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies). 764}</pre> 765</div> 766 767<div class="method"> 768 <code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code> 769 <pre>Returns permissions that a caller has on the specified resource. If the resource does not exist, this will return an empty set of permissions, not a `NOT_FOUND` error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization checking. This operation may "fail open" without warning. 770 771Args: 772 resource: string, REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field. (required) 773 body: object, The request body. 774 The object takes the form of: 775 776{ # Request message for `TestIamPermissions` method. 777 "permissions": [ # The set of permissions to check for the `resource`. Permissions with wildcards (such as '*' or 'storage.*') are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions). 778 "A String", 779 ], 780} 781 782 x__xgafv: string, V1 error format. 783 Allowed values 784 1 - v1 error format 785 2 - v2 error format 786 787Returns: 788 An object of the form: 789 790 { # Response message for `TestIamPermissions` method. 791 "permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is allowed. 792 "A String", 793 ], 794}</pre> 795</div> 796 797<div class="method"> 798 <code class="details" id="updateLdapssettings">updateLdapssettings(name, body=None, updateMask=None, x__xgafv=None)</code> 799 <pre>Patches a single ldaps settings. 800 801Args: 802 name: string, The resource name of the LDAPS settings. Uses the form: `projects/{project}/locations/{location}/domains/{domain}`. (required) 803 body: object, The request body. 804 The object takes the form of: 805 806{ # LDAPSSettings represents the ldaps settings for domain resource. LDAP is the Lightweight Directory Access Protocol, defined in https://tools.ietf.org/html/rfc4511. The settings object configures LDAP over SSL/TLS, whether it is over port 636 or the StartTLS operation. If LDAPSSettings is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. 807 "certificate": { # Certificate used to configure LDAPS. # Output only. The certificate used to configure LDAPS. Certificates can be chained with a maximum length of 15. 808 "expireTime": "A String", # The certificate expire time. 809 "issuingCertificate": # Object with schema name: Certificate # The issuer of this certificate. 810 "subject": "A String", # The certificate subject. 811 "subjectAlternativeName": [ # The additional hostnames for the domain. 812 "A String", 813 ], 814 "thumbprint": "A String", # The certificate thumbprint which uniquely identifies the certificate. 815 }, 816 "certificatePassword": "A String", # Input only. The password used to encrypt the uploaded PFX certificate. 817 "certificatePfx": "A String", # Input only. The uploaded PKCS12-formatted certificate to configure LDAPS with. It will enable the domain controllers in this domain to accept LDAPS connections (either LDAP over SSL/TLS or the StartTLS operation). A valid certificate chain must form a valid x.509 certificate chain (or be comprised of a single self-signed certificate. It must be encrypted with either: 1) PBES2 + PBKDF2 + AES256 encryption and SHA256 PRF; or 2) pbeWithSHA1And3-KeyTripleDES-CBC Private key must be included for the leaf / single self-signed certificate. Note: For a fqdn your-example-domain.com, the wildcard fqdn is *.your-example-domain.com. Specifically the leaf certificate must have: - Either a blank subject or a subject with CN matching the wildcard fqdn. - Exactly two SANs - the fqdn and wildcard fqdn. - Encipherment and digital key signature key usages. - Server authentication extended key usage (OID=1.3.6.1.5.5.7.3.1) - Private key must be in one of the following formats: RSA, ECDSA, ED25519. - Private key must have appropriate key length: 2048 for RSA, 256 for ECDSA - Signature algorithm of the leaf certificate cannot be MD2, MD5 or SHA1. 818 "name": "A String", # The resource name of the LDAPS settings. Uses the form: `projects/{project}/locations/{location}/domains/{domain}`. 819 "state": "A String", # Output only. The current state of this LDAPS settings. 820 "updateTime": "A String", # Output only. Last update time. 821} 822 823 updateMask: string, Required. Mask of fields to update. At least one path must be supplied in this field. For the `FieldMask` definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask 824 x__xgafv: string, V1 error format. 825 Allowed values 826 1 - v1 error format 827 2 - v2 error format 828 829Returns: 830 An object of the form: 831 832 { # This resource represents a long-running operation that is the result of a network API call. 833 "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. 834 "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation. 835 "code": 42, # The status code, which should be an enum value of google.rpc.Code. 836 "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use. 837 { 838 "a_key": "", # Properties of the object. Contains field @type with type URL. 839 }, 840 ], 841 "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. 842 }, 843 "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. 844 "a_key": "", # Properties of the object. Contains field @type with type URL. 845 }, 846 "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. 847 "response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. 848 "a_key": "", # Properties of the object. Contains field @type with type URL. 849 }, 850}</pre> 851</div> 852 853<div class="method"> 854 <code class="details" id="validateTrust">validateTrust(name, body=None, x__xgafv=None)</code> 855 <pre>Validates a trust state, that the target domain is reachable, and that the target domain is able to accept incoming trust requests. 856 857Args: 858 name: string, Required. The resource domain name, project name, and location using the form: `projects/{project_id}/locations/global/domains/{domain_name}` (required) 859 body: object, The request body. 860 The object takes the form of: 861 862{ # Request message for ValidateTrust 863 "trust": { # Represents a relationship between two domains. This allows a controller in one domain to authenticate a user in another domain. If the trust is being changed, it will be placed into the UPDATING state, which indicates that the resource is being reconciled. At this point, Get will reflect an intermediate state. # Required. The domain trust to validate trust state for. 864 "createTime": "A String", # Output only. The time the instance was created. 865 "lastTrustHeartbeatTime": "A String", # Output only. The last heartbeat time when the trust was known to be connected. 866 "selectiveAuthentication": True or False, # Optional. The trust authentication type, which decides whether the trusted side has forest/domain wide access or selective access to an approved set of resources. 867 "state": "A String", # Output only. The current state of the trust. 868 "stateDescription": "A String", # Output only. Additional information about the current state of the trust, if available. 869 "targetDnsIpAddresses": [ # Required. The target DNS server IP addresses which can resolve the remote domain involved in the trust. 870 "A String", 871 ], 872 "targetDomainName": "A String", # Required. The fully qualified target domain name which will be in trust with the current domain. 873 "trustDirection": "A String", # Required. The trust direction, which decides if the current domain is trusted, trusting, or both. 874 "trustHandshakeSecret": "A String", # Required. The trust secret used for the handshake with the target domain. This will not be stored. 875 "trustType": "A String", # Required. The type of trust represented by the trust resource. 876 "updateTime": "A String", # Output only. The last update time. 877 }, 878} 879 880 x__xgafv: string, V1 error format. 881 Allowed values 882 1 - v1 error format 883 2 - v2 error format 884 885Returns: 886 An object of the form: 887 888 { # This resource represents a long-running operation that is the result of a network API call. 889 "done": True or False, # If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available. 890 "error": { # The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). # The error result of the operation in case of failure or cancellation. 891 "code": 42, # The status code, which should be an enum value of google.rpc.Code. 892 "details": [ # A list of messages that carry the error details. There is a common set of message types for APIs to use. 893 { 894 "a_key": "", # Properties of the object. Contains field @type with type URL. 895 }, 896 ], 897 "message": "A String", # A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. 898 }, 899 "metadata": { # Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. 900 "a_key": "", # Properties of the object. Contains field @type with type URL. 901 }, 902 "name": "A String", # The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`. 903 "response": { # The normal response of the operation in case of success. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. 904 "a_key": "", # Properties of the object. Contains field @type with type URL. 905 }, 906}</pre> 907</div> 908 909</body></html>