openapi: 3.0.0
servers:
  - url: https://servicebroker.googleapis.com/
info:
  contact:
    name: Google
    url: https://google.com
  description: |
    The Google Cloud Platform Service Broker API provides Google hosted
    implementation of the Open Service Broker API
    (https://www.openservicebrokerapi.org/).
  license:
    name: Creative Commons Attribution 3.0
    url: http://creativecommons.org/licenses/by/3.0/
  termsOfService: https://developers.google.com/terms/
  title: Service Broker
  version: v1
  x-apiClientRegistration:
    url: https://console.developers.google.com
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_www.google.com_images_branding_googlelogo_2x_googlelogo_color_272x92dp.png
  x-origin:
    - converter:
        url: https://github.com/lucybot/api-spec-converter
        version: 2.7.31
      format: google
      url: https://servicebroker.googleapis.com/$discovery/rest?version=v1
      version: v1
  x-preferred: false
  x-providerName: googleapis.com
  x-serviceName: servicebroker
externalDocs:
  url: https://cloud.google.com/kubernetes-engine/docs/concepts/add-on/service-broker
tags:
  - name: v1
paths:
  "/v1/{resource}:getIamPolicy":
    get:
      description: |-
        Gets the access control policy for a resource.
        Returns an empty policy if the resource exists and does not have a policy
        set.
      operationId: servicebroker.getIamPolicy
      parameters:
        - description: |-
            REQUIRED: The resource for which the policy is being requested.
            See the operation documentation for the appropriate value for this field.
          in: path
          name: resource
          required: true
          schema:
            type: string
          x-reservedExpansion: true
        - description: |-
            Optional. The policy format version to be returned.

            Valid values are 0, 1, and 3. Requests specifying an invalid value will be
            rejected.

            Requests for policies with any conditional bindings must specify version 3.
            Policies without any conditional bindings may specify any valid value or
            leave the field unset.
          in: query
          name: options.requestedPolicyVersion
          schema:
            type: integer
      responses:
        "200":
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/GoogleIamV1__Policy"
          description: Successful response
      security:
        - Oauth2:
            - https://www.googleapis.com/auth/cloud-platform
          Oauth2c:
            - https://www.googleapis.com/auth/cloud-platform
      tags:
        - v1
    parameters:
      - $ref: "#/components/parameters/_.xgafv"
      - $ref: "#/components/parameters/oauth_token"
      - $ref: "#/components/parameters/callback"
      - $ref: "#/components/parameters/alt"
      - $ref: "#/components/parameters/key"
      - $ref: "#/components/parameters/access_token"
      - $ref: "#/components/parameters/upload_protocol"
      - $ref: "#/components/parameters/prettyPrint"
      - $ref: "#/components/parameters/quotaUser"
      - $ref: "#/components/parameters/fields"
      - $ref: "#/components/parameters/uploadType"
  "/v1/{resource}:setIamPolicy":
    parameters:
      - $ref: "#/components/parameters/_.xgafv"
      - $ref: "#/components/parameters/oauth_token"
      - $ref: "#/components/parameters/callback"
      - $ref: "#/components/parameters/alt"
      - $ref: "#/components/parameters/key"
      - $ref: "#/components/parameters/access_token"
      - $ref: "#/components/parameters/upload_protocol"
      - $ref: "#/components/parameters/prettyPrint"
      - $ref: "#/components/parameters/quotaUser"
      - $ref: "#/components/parameters/fields"
      - $ref: "#/components/parameters/uploadType"
    post:
      description: |-
        Sets the access control policy on the specified resource. Replaces any
        existing policy.

        Can return Public Errors: NOT_FOUND, INVALID_ARGUMENT and PERMISSION_DENIED
      operationId: servicebroker.setIamPolicy
      parameters:
        - description: |-
            REQUIRED: The resource for which the policy is being specified.
            See the operation documentation for the appropriate value for this field.
          in: path
          name: resource
          required: true
          schema:
            type: string
          x-reservedExpansion: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GoogleIamV1__SetIamPolicyRequest"
      responses:
        "200":
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/GoogleIamV1__Policy"
          description: Successful response
      security:
        - Oauth2:
            - https://www.googleapis.com/auth/cloud-platform
          Oauth2c:
            - https://www.googleapis.com/auth/cloud-platform
      tags:
        - v1
  "/v1/{resource}:testIamPermissions":
    parameters:
      - $ref: "#/components/parameters/_.xgafv"
      - $ref: "#/components/parameters/oauth_token"
      - $ref: "#/components/parameters/callback"
      - $ref: "#/components/parameters/alt"
      - $ref: "#/components/parameters/key"
      - $ref: "#/components/parameters/access_token"
      - $ref: "#/components/parameters/upload_protocol"
      - $ref: "#/components/parameters/prettyPrint"
      - $ref: "#/components/parameters/quotaUser"
      - $ref: "#/components/parameters/fields"
      - $ref: "#/components/parameters/uploadType"
    post:
      description: |-
        Returns permissions that a caller has on the specified resource.
        If the resource does not exist, this will return an empty set of
        permissions, not a NOT_FOUND error.

        Note: This operation is designed to be used for building permission-aware
        UIs and command-line tools, not for authorization checking. This operation
        may "fail open" without warning.
      operationId: servicebroker.testIamPermissions
      parameters:
        - description: |-
            REQUIRED: The resource for which the policy detail is being requested.
            See the operation documentation for the appropriate value for this field.
          in: path
          name: resource
          required: true
          schema:
            type: string
          x-reservedExpansion: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GoogleIamV1__TestIamPermissionsRequest"
      responses:
        "200":
          content:
            "*/*":
              schema:
                $ref: "#/components/schemas/GoogleIamV1__TestIamPermissionsResponse"
          description: Successful response
      security:
        - Oauth2:
            - https://www.googleapis.com/auth/cloud-platform
          Oauth2c:
            - https://www.googleapis.com/auth/cloud-platform
      tags:
        - v1
components:
  parameters:
    _.xgafv:
      description: V1 error format.
      in: query
      name: $.xgafv
      schema:
        enum:
          - "1"
          - "2"
        type: string
    access_token:
      description: OAuth access token.
      in: query
      name: access_token
      schema:
        type: string
    alt:
      description: Data format for response.
      in: query
      name: alt
      schema:
        default: json
        enum:
          - json
          - media
          - proto
        type: string
    callback:
      description: JSONP
      in: query
      name: callback
      schema:
        type: string
    fields:
      description: Selector specifying which fields to include in a partial response.
      in: query
      name: fields
      schema:
        type: string
    key:
      description: API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.
      in: query
      name: key
      schema:
        type: string
    oauth_token:
      description: OAuth 2.0 token for the current user.
      in: query
      name: oauth_token
      schema:
        type: string
    prettyPrint:
      description: Returns response with indentations and line breaks.
      in: query
      name: prettyPrint
      schema:
        default: true
        type: boolean
    quotaUser:
      description: Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.
      in: query
      name: quotaUser
      schema:
        type: string
    uploadType:
      description: Legacy upload protocol for media (e.g. "media", "multipart").
      in: query
      name: uploadType
      schema:
        type: string
    upload_protocol:
      description: Upload protocol for media (e.g. "raw", "multipart").
      in: query
      name: upload_protocol
      schema:
        type: string
  schemas:
    GoogleIamV1__Binding:
      description: Associates `members` with a `role`.
      properties:
        condition:
          $ref: "#/components/schemas/GoogleType__Expr"
          description: |-
            The condition that is associated with this binding.
            NOTE: An unsatisfied condition will not allow user access via current
            binding. Different bindings, including their conditions, are examined
            independently.
        members:
          description: |+
            Specifies the identities requesting access for a Cloud Platform resource.
            `members` can have the following values:

            * `allUsers`: A special identifier that represents anyone who is
               on the internet; with or without a Google account.

            * `allAuthenticatedUsers`: A special identifier that represents anyone
               who is authenticated with a Google account or a service account.

            * `user:{emailid}`: An email address that represents a specific Google
               account. For example, `alice@example.com` .


            * `serviceAccount:{emailid}`: An email address that represents a service
               account. For example, `my-other-app@appspot.gserviceaccount.com`.

            * `group:{emailid}`: An email address that represents a Google group.
               For example, `admins@example.com`.

            * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
               identifier) representing a user that has been recently deleted. For
               example, `alice@example.com?uid=123456789012345678901`. If the user is
               recovered, this value reverts to `user:{emailid}` and the recovered user
               retains the role in the binding.

            * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
               unique identifier) representing a service account that has been recently
               deleted. For example,
               `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
               If the service account is undeleted, this value reverts to
               `serviceAccount:{emailid}` and the undeleted service account retains the
               role in the binding.

            * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
               identifier) representing a Google group that has been recently
               deleted. For example, `admins@example.com?uid=123456789012345678901`. If
               the group is recovered, this value reverts to `group:{emailid}` and the
               recovered group retains the role in the binding.


            * `domain:{domain}`: The G Suite domain (primary) that represents all the    users of that domain. For example, `google.com` or `example.com`.

          items:
            type: string
          type: array
        role:
          description: |-
            Role that is assigned to `members`.
            For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
          type: string
      type: object
    GoogleIamV1__Policy:
      description: |-
        An Identity and Access Management (IAM) policy, which specifies access
        controls for Google Cloud resources.


        A `Policy` is a collection of `bindings`. A `binding` binds one or more
        `members` to a single `role`. Members can be user accounts, service accounts,
        Google groups, and domains (such as G Suite). A `role` is a named list of
        permissions; each `role` can be an IAM predefined role or a user-created
        custom role.

        Optionally, a `binding` can specify a `condition`, which is a logical
        expression that allows access to a resource only if the expression evaluates
        to `true`. A condition can add constraints based on attributes of the
        request, the resource, or both.

        **JSON example:**

            {
              "bindings": [
                {
                  "role": "roles/resourcemanager.organizationAdmin",
                  "members": [
                    "user:mike@example.com",
                    "group:admins@example.com",
                    "domain:google.com",
                    "serviceAccount:my-project-id@appspot.gserviceaccount.com"
                  ]
                },
                {
                  "role": "roles/resourcemanager.organizationViewer",
                  "members": ["user:eve@example.com"],
                  "condition": {
                    "title": "expirable access",
                    "description": "Does not grant access after Sep 2020",
                    "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",
                  }
                }
              ],
              "etag": "BwWWja0YfJA=",
              "version": 3
            }

        **YAML example:**

            bindings:
            - members:
              - user:mike@example.com
              - group:admins@example.com
              - domain:google.com
              - serviceAccount:my-project-id@appspot.gserviceaccount.com
              role: roles/resourcemanager.organizationAdmin
            - members:
              - user:eve@example.com
              role: roles/resourcemanager.organizationViewer
              condition:
                title: expirable access
                description: Does not grant access after Sep 2020
                expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
            - etag: BwWWja0YfJA=
            - version: 3

        For a description of IAM and its features, see the
        [IAM documentation](https://cloud.google.com/iam/docs/).
      properties:
        bindings:
          description: |-
            Associates a list of `members` to a `role`. Optionally, may specify a
            `condition` that determines how and when the `bindings` are applied. Each
            of the `bindings` must contain at least one member.
          items:
            $ref: "#/components/schemas/GoogleIamV1__Binding"
          type: array
        etag:
          description: |-
            `etag` is used for optimistic concurrency control as a way to help
            prevent simultaneous updates of a policy from overwriting each other.
            It is strongly suggested that systems make use of the `etag` in the
            read-modify-write cycle to perform policy updates in order to avoid race
            conditions: An `etag` is returned in the response to `getIamPolicy`, and
            systems are expected to put that etag in the request to `setIamPolicy` to
            ensure that their change will be applied to the same version of the policy.

            **Important:** If you use IAM Conditions, you must include the `etag` field
            whenever you call `setIamPolicy`. If you omit this field, then IAM allows
            you to overwrite a version `3` policy with a version `1` policy, and all of
            the conditions in the version `3` policy are lost.
          format: byte
          type: string
        version:
          description: |-
            Specifies the format of the policy.

            Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
            are rejected.

            Any operation that affects conditional role bindings must specify version
            `3`. This requirement applies to the following operations:

            * Getting a policy that includes a conditional role binding
            * Adding a conditional role binding to a policy
            * Changing a conditional role binding in a policy
            * Removing any role binding, with or without a condition, from a policy
              that includes conditions

            **Important:** If you use IAM Conditions, you must include the `etag` field
            whenever you call `setIamPolicy`. If you omit this field, then IAM allows
            you to overwrite a version `3` policy with a version `1` policy, and all of
            the conditions in the version `3` policy are lost.

            If a policy does not include any conditions, operations on that policy may
            specify any valid version or leave the field unset.
          format: int32
          type: integer
      type: object
    GoogleIamV1__SetIamPolicyRequest:
      description: Request message for `SetIamPolicy` method.
      properties:
        policy:
          $ref: "#/components/schemas/GoogleIamV1__Policy"
          description: |-
            REQUIRED: The complete policy to be applied to the `resource`. The size of
            the policy is limited to a few 10s of KB. An empty policy is a
            valid policy but certain Cloud Platform services (such as Projects)
            might reject them.
      type: object
    GoogleIamV1__TestIamPermissionsRequest:
      description: Request message for `TestIamPermissions` method.
      properties:
        permissions:
          description: |-
            The set of permissions to check for the `resource`. Permissions with
            wildcards (such as '*' or 'storage.*') are not allowed. For more
            information see
            [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
          items:
            type: string
          type: array
      type: object
    GoogleIamV1__TestIamPermissionsResponse:
      description: Response message for `TestIamPermissions` method.
      properties:
        permissions:
          description: |-
            A subset of `TestPermissionsRequest.permissions` that the caller is
            allowed.
          items:
            type: string
          type: array
      type: object
    GoogleType__Expr:
      description: |-
        Represents an expression text. Example:

            title: "User account presence"
            description: "Determines whether the request has a user account"
            expression: "size(request.user) > 0"
      properties:
        description:
          description: |-
            An optional description of the expression. This is a longer text which
            describes the expression, e.g. when hovered over it in a UI.
          type: string
        expression:
          description: |-
            Textual representation of an expression in
            Common Expression Language syntax.

            The application context of the containing message determines which
            well-known feature set of CEL is supported.
          type: string
        location:
          description: |-
            An optional string indicating the location of the expression for error
            reporting, e.g. a file name and a position in the file.
          type: string
        title:
          description: |-
            An optional title for the expression, i.e. a short string describing
            its purpose. This can be used e.g. in UIs which allow to enter the
            expression.
          type: string
      type: object
  securitySchemes:
    Oauth2:
      description: Oauth 2.0 implicit authentication
      flows:
        implicit:
          authorizationUrl: https://accounts.google.com/o/oauth2/auth
          scopes:
            https://www.googleapis.com/auth/cloud-platform: View and manage your data across Google Cloud Platform services
      type: oauth2
    Oauth2c:
      description: Oauth 2.0 accessCode authentication
      flows:
        authorizationCode:
          authorizationUrl: https://accounts.google.com/o/oauth2/auth
          scopes:
            https://www.googleapis.com/auth/cloud-platform: View and manage your data across Google Cloud Platform services
          tokenUrl: https://accounts.google.com/o/oauth2/token
      type: oauth2
