OAuth2 scopes used by this API.
const (
// See, edit, configure, and delete your Google Cloud data and see the email
// address for your Google Account.
CloudPlatformScope = "https://www.googleapis.com/auth/cloud-platform"
)
type GenerateAccessTokenRequest struct {
// Delegates: The sequence of service accounts in a delegation chain. This
// field is required for delegated requests
// (https://cloud.google.com/iam/help/credentials/delegated-request). For
// direct requests
// (https://cloud.google.com/iam/help/credentials/direct-request), which are
// more common, do not specify this field. Each service account must be granted
// the `roles/iam.serviceAccountTokenCreator` role on its next service account
// in the chain. The last service account in the chain must be granted the
// `roles/iam.serviceAccountTokenCreator` role on the service account that is
// specified in the `name` field of the request. The delegates must have the
// following format: `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`.
// The `-` wildcard character is required; replacing it with a project ID is
// invalid.
Delegates []string `json:"delegates,omitempty"`
// Lifetime: The desired lifetime duration of the access token in seconds. By
// default, the maximum allowed value is 1 hour. To set a lifetime of up to 12
// hours, you can add the service account as an allowed value in an
// Organization Policy that enforces the
// `constraints/iam.allowServiceAccountCredentialLifetimeExtension` constraint.
// See detailed instructions at
// https://cloud.google.com/iam/help/credentials/lifetime If a value is not
// specified, the token's lifetime will be set to a default value of 1 hour.
Lifetime string `json:"lifetime,omitempty"`
// Scope: Required. Code to identify the scopes to be included in the OAuth 2.0
// access token. See
// https://developers.google.com/identity/protocols/googlescopes for more
// information. At least one value required.
Scope []string `json:"scope,omitempty"`
// ForceSendFields is a list of field names (e.g. "Delegates") to
// unconditionally include in API requests. By default, fields with empty or
// default values are omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
// details.
ForceSendFields []string `json:"-"`
// NullFields is a list of field names (e.g. "Delegates") to include in API
// requests with the JSON null value. By default, fields with empty values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
NullFields []string `json:"-"`
}
func (s *GenerateAccessTokenRequest) MarshalJSON() ([]byte, error)
type GenerateAccessTokenResponse struct {
// AccessToken: The OAuth 2.0 access token.
AccessToken string `json:"accessToken,omitempty"`
// ExpireTime: Token expiration time. The expiration time is always set.
ExpireTime string `json:"expireTime,omitempty"`
// ServerResponse contains the HTTP response code and headers from the server.
googleapi.ServerResponse `json:"-"`
// ForceSendFields is a list of field names (e.g. "AccessToken") to
// unconditionally include in API requests. By default, fields with empty or
// default values are omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
// details.
ForceSendFields []string `json:"-"`
// NullFields is a list of field names (e.g. "AccessToken") to include in API
// requests with the JSON null value. By default, fields with empty values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
NullFields []string `json:"-"`
}
func (s *GenerateAccessTokenResponse) MarshalJSON() ([]byte, error)
type GenerateIdTokenRequest struct {
// Audience: Required. The audience for the token, such as the API or account
// that this token grants access to.
Audience string `json:"audience,omitempty"`
// Delegates: The sequence of service accounts in a delegation chain. Each
// service account must be granted the `roles/iam.serviceAccountTokenCreator`
// role on its next service account in the chain. The last service account in
// the chain must be granted the `roles/iam.serviceAccountTokenCreator` role on
// the service account that is specified in the `name` field of the request.
// The delegates must have the following format:
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
// character is required; replacing it with a project ID is invalid.
Delegates []string `json:"delegates,omitempty"`
// IncludeEmail: Include the service account email in the token. If set to
// `true`, the token will contain `email` and `email_verified` claims.
IncludeEmail bool `json:"includeEmail,omitempty"`
// ForceSendFields is a list of field names (e.g. "Audience") to
// unconditionally include in API requests. By default, fields with empty or
// default values are omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
// details.
ForceSendFields []string `json:"-"`
// NullFields is a list of field names (e.g. "Audience") to include in API
// requests with the JSON null value. By default, fields with empty values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
NullFields []string `json:"-"`
}
func (s *GenerateIdTokenRequest) MarshalJSON() ([]byte, error)
type GenerateIdTokenResponse struct {
// Token: The OpenId Connect ID token.
Token string `json:"token,omitempty"`
// ServerResponse contains the HTTP response code and headers from the server.
googleapi.ServerResponse `json:"-"`
// ForceSendFields is a list of field names (e.g. "Token") to unconditionally
// include in API requests. By default, fields with empty or default values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
// details.
ForceSendFields []string `json:"-"`
// NullFields is a list of field names (e.g. "Token") to include in API
// requests with the JSON null value. By default, fields with empty values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
NullFields []string `json:"-"`
}
func (s *GenerateIdTokenResponse) MarshalJSON() ([]byte, error)
type ProjectsService struct {
ServiceAccounts *ProjectsServiceAccountsService
// contains filtered or unexported fields
}
func NewProjectsService(s *Service) *ProjectsService
type ProjectsServiceAccountsGenerateAccessTokenCall struct {
// contains filtered or unexported fields
}
func (c *ProjectsServiceAccountsGenerateAccessTokenCall) Context(ctx context.Context) *ProjectsServiceAccountsGenerateAccessTokenCall
Context sets the context to be used in this call's Do method.
func (c *ProjectsServiceAccountsGenerateAccessTokenCall) Do(opts ...googleapi.CallOption) (*GenerateAccessTokenResponse, error)
Do executes the "iamcredentials.projects.serviceAccounts.generateAccessToken" call. Any non-2xx status code is an error. Response headers are in either *GenerateAccessTokenResponse.ServerResponse.Header or (if a response was returned at all) in error.(*googleapi.Error).Header. Use googleapi.IsNotModified to check whether the returned error was because http.StatusNotModified was returned.
func (c *ProjectsServiceAccountsGenerateAccessTokenCall) Fields(s ...googleapi.Field) *ProjectsServiceAccountsGenerateAccessTokenCall
Fields allows partial responses to be retrieved. See https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more details.
func (c *ProjectsServiceAccountsGenerateAccessTokenCall) Header() http.Header
Header returns a http.Header that can be modified by the caller to add headers to the request.
type ProjectsServiceAccountsGenerateIdTokenCall struct {
// contains filtered or unexported fields
}
func (c *ProjectsServiceAccountsGenerateIdTokenCall) Context(ctx context.Context) *ProjectsServiceAccountsGenerateIdTokenCall
Context sets the context to be used in this call's Do method.
func (c *ProjectsServiceAccountsGenerateIdTokenCall) Do(opts ...googleapi.CallOption) (*GenerateIdTokenResponse, error)
Do executes the "iamcredentials.projects.serviceAccounts.generateIdToken" call. Any non-2xx status code is an error. Response headers are in either *GenerateIdTokenResponse.ServerResponse.Header or (if a response was returned at all) in error.(*googleapi.Error).Header. Use googleapi.IsNotModified to check whether the returned error was because http.StatusNotModified was returned.
func (c *ProjectsServiceAccountsGenerateIdTokenCall) Fields(s ...googleapi.Field) *ProjectsServiceAccountsGenerateIdTokenCall
Fields allows partial responses to be retrieved. See https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more details.
func (c *ProjectsServiceAccountsGenerateIdTokenCall) Header() http.Header
Header returns a http.Header that can be modified by the caller to add headers to the request.
type ProjectsServiceAccountsService struct {
// contains filtered or unexported fields
}
func NewProjectsServiceAccountsService(s *Service) *ProjectsServiceAccountsService
func (r *ProjectsServiceAccountsService) GenerateAccessToken(name string, generateaccesstokenrequest *GenerateAccessTokenRequest) *ProjectsServiceAccountsGenerateAccessTokenCall
GenerateAccessToken: Generates an OAuth 2.0 access token for a service account.
func (r *ProjectsServiceAccountsService) GenerateIdToken(name string, generateidtokenrequest *GenerateIdTokenRequest) *ProjectsServiceAccountsGenerateIdTokenCall
GenerateIdToken: Generates an OpenID Connect ID token for a service account.
func (r *ProjectsServiceAccountsService) SignBlob(name string, signblobrequest *SignBlobRequest) *ProjectsServiceAccountsSignBlobCall
SignBlob: Signs a blob using a service account's system-managed private key.
func (r *ProjectsServiceAccountsService) SignJwt(name string, signjwtrequest *SignJwtRequest) *ProjectsServiceAccountsSignJwtCall
SignJwt: Signs a JWT using a service account's system-managed private key.
type ProjectsServiceAccountsSignBlobCall struct {
// contains filtered or unexported fields
}
func (c *ProjectsServiceAccountsSignBlobCall) Context(ctx context.Context) *ProjectsServiceAccountsSignBlobCall
Context sets the context to be used in this call's Do method.
func (c *ProjectsServiceAccountsSignBlobCall) Do(opts ...googleapi.CallOption) (*SignBlobResponse, error)
Do executes the "iamcredentials.projects.serviceAccounts.signBlob" call. Any non-2xx status code is an error. Response headers are in either *SignBlobResponse.ServerResponse.Header or (if a response was returned at all) in error.(*googleapi.Error).Header. Use googleapi.IsNotModified to check whether the returned error was because http.StatusNotModified was returned.
func (c *ProjectsServiceAccountsSignBlobCall) Fields(s ...googleapi.Field) *ProjectsServiceAccountsSignBlobCall
Fields allows partial responses to be retrieved. See https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more details.
func (c *ProjectsServiceAccountsSignBlobCall) Header() http.Header
Header returns a http.Header that can be modified by the caller to add headers to the request.
type ProjectsServiceAccountsSignJwtCall struct {
// contains filtered or unexported fields
}
func (c *ProjectsServiceAccountsSignJwtCall) Context(ctx context.Context) *ProjectsServiceAccountsSignJwtCall
Context sets the context to be used in this call's Do method.
func (c *ProjectsServiceAccountsSignJwtCall) Do(opts ...googleapi.CallOption) (*SignJwtResponse, error)
Do executes the "iamcredentials.projects.serviceAccounts.signJwt" call. Any non-2xx status code is an error. Response headers are in either *SignJwtResponse.ServerResponse.Header or (if a response was returned at all) in error.(*googleapi.Error).Header. Use googleapi.IsNotModified to check whether the returned error was because http.StatusNotModified was returned.
func (c *ProjectsServiceAccountsSignJwtCall) Fields(s ...googleapi.Field) *ProjectsServiceAccountsSignJwtCall
Fields allows partial responses to be retrieved. See https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more details.
func (c *ProjectsServiceAccountsSignJwtCall) Header() http.Header
Header returns a http.Header that can be modified by the caller to add headers to the request.
type Service struct {
BasePath string // API endpoint base URL
UserAgent string // optional additional User-Agent fragment
Projects *ProjectsService
// contains filtered or unexported fields
}
func New(client *http.Client) (*Service, error)
New creates a new Service. It uses the provided http.Client for requests.
Deprecated: please use NewService instead. To provide a custom HTTP client, use option.WithHTTPClient. If you are using google.golang.org/api/googleapis/transport.APIKey, use option.WithAPIKey with NewService instead.
func NewService(ctx context.Context, opts ...option.ClientOption) (*Service, error)
NewService creates a new Service.
type SignBlobRequest struct {
// Delegates: The sequence of service accounts in a delegation chain. Each
// service account must be granted the `roles/iam.serviceAccountTokenCreator`
// role on its next service account in the chain. The last service account in
// the chain must be granted the `roles/iam.serviceAccountTokenCreator` role on
// the service account that is specified in the `name` field of the request.
// The delegates must have the following format:
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
// character is required; replacing it with a project ID is invalid.
Delegates []string `json:"delegates,omitempty"`
// Payload: Required. The bytes to sign.
Payload string `json:"payload,omitempty"`
// ForceSendFields is a list of field names (e.g. "Delegates") to
// unconditionally include in API requests. By default, fields with empty or
// default values are omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
// details.
ForceSendFields []string `json:"-"`
// NullFields is a list of field names (e.g. "Delegates") to include in API
// requests with the JSON null value. By default, fields with empty values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
NullFields []string `json:"-"`
}
func (s *SignBlobRequest) MarshalJSON() ([]byte, error)
type SignBlobResponse struct {
// KeyId: The ID of the key used to sign the blob. The key used for signing
// will remain valid for at least 12 hours after the blob is signed. To verify
// the signature, you can retrieve the public key in several formats from the
// following endpoints: - RSA public key wrapped in an X.509 v3 certificate:
// `https://www.googleapis.com/service_accounts/v1/metadata/x509/{ACCOUNT_EMAIL}
// ` - Raw key in JSON format:
// `https://www.googleapis.com/service_accounts/v1/metadata/raw/{ACCOUNT_EMAIL}`
// - JSON Web Key (JWK):
// `https://www.googleapis.com/service_accounts/v1/metadata/jwk/{ACCOUNT_EMAIL}`
KeyId string `json:"keyId,omitempty"`
// SignedBlob: The signature for the blob. Does not include the original blob.
// After the key pair referenced by the `key_id` response field expires, Google
// no longer exposes the public key that can be used to verify the blob. As a
// result, the receiver can no longer verify the signature.
SignedBlob string `json:"signedBlob,omitempty"`
// ServerResponse contains the HTTP response code and headers from the server.
googleapi.ServerResponse `json:"-"`
// ForceSendFields is a list of field names (e.g. "KeyId") to unconditionally
// include in API requests. By default, fields with empty or default values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
// details.
ForceSendFields []string `json:"-"`
// NullFields is a list of field names (e.g. "KeyId") to include in API
// requests with the JSON null value. By default, fields with empty values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
NullFields []string `json:"-"`
}
func (s *SignBlobResponse) MarshalJSON() ([]byte, error)
type SignJwtRequest struct {
// Delegates: The sequence of service accounts in a delegation chain. Each
// service account must be granted the `roles/iam.serviceAccountTokenCreator`
// role on its next service account in the chain. The last service account in
// the chain must be granted the `roles/iam.serviceAccountTokenCreator` role on
// the service account that is specified in the `name` field of the request.
// The delegates must have the following format:
// `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
// character is required; replacing it with a project ID is invalid.
Delegates []string `json:"delegates,omitempty"`
// Payload: Required. The JWT payload to sign. Must be a serialized JSON object
// that contains a JWT Claims Set. For example: `{"sub": "user@example.com",
// "iat": 313435}` If the JWT Claims Set contains an expiration time (`exp`)
// claim, it must be an integer timestamp that is not in the past and no more
// than 12 hours in the future.
Payload string `json:"payload,omitempty"`
// ForceSendFields is a list of field names (e.g. "Delegates") to
// unconditionally include in API requests. By default, fields with empty or
// default values are omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
// details.
ForceSendFields []string `json:"-"`
// NullFields is a list of field names (e.g. "Delegates") to include in API
// requests with the JSON null value. By default, fields with empty values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
NullFields []string `json:"-"`
}
func (s *SignJwtRequest) MarshalJSON() ([]byte, error)
type SignJwtResponse struct {
// KeyId: The ID of the key used to sign the JWT. The key used for signing will
// remain valid for at least 12 hours after the JWT is signed. To verify the
// signature, you can retrieve the public key in several formats from the
// following endpoints: - RSA public key wrapped in an X.509 v3 certificate:
// `https://www.googleapis.com/service_accounts/v1/metadata/x509/{ACCOUNT_EMAIL}
// ` - Raw key in JSON format:
// `https://www.googleapis.com/service_accounts/v1/metadata/raw/{ACCOUNT_EMAIL}`
// - JSON Web Key (JWK):
// `https://www.googleapis.com/service_accounts/v1/metadata/jwk/{ACCOUNT_EMAIL}`
KeyId string `json:"keyId,omitempty"`
// SignedJwt: The signed JWT. Contains the automatically generated header; the
// client-supplied payload; and the signature, which is generated using the key
// referenced by the `kid` field in the header. After the key pair referenced
// by the `key_id` response field expires, Google no longer exposes the public
// key that can be used to verify the JWT. As a result, the receiver can no
// longer verify the signature.
SignedJwt string `json:"signedJwt,omitempty"`
// ServerResponse contains the HTTP response code and headers from the server.
googleapi.ServerResponse `json:"-"`
// ForceSendFields is a list of field names (e.g. "KeyId") to unconditionally
// include in API requests. By default, fields with empty or default values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
// details.
ForceSendFields []string `json:"-"`
// NullFields is a list of field names (e.g. "KeyId") to include in API
// requests with the JSON null value. By default, fields with empty values are
// omitted from API requests. See
// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
NullFields []string `json:"-"`
}
func (s *SignJwtResponse) MarshalJSON() ([]byte, error)