# Copyright 2018 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""Accesses the google.cloud.kms.v1 KeyManagementService API."""

import functools
import pkg_resources
import warnings

from google.oauth2 import service_account
import google.api_core.gapic_v1.client_info
import google.api_core.gapic_v1.config
import google.api_core.gapic_v1.method
import google.api_core.gapic_v1.routing_header
import google.api_core.grpc_helpers
import google.api_core.page_iterator
import google.api_core.path_template
import grpc

from google.cloud.kms_v1.gapic import enums
from google.cloud.kms_v1.gapic import key_management_service_client_config
from google.cloud.kms_v1.gapic.transports import key_management_service_grpc_transport
from google.cloud.kms_v1.proto import resources_pb2
from google.cloud.kms_v1.proto import service_pb2
from google.cloud.kms_v1.proto import service_pb2_grpc
from google.iam.v1 import iam_policy_pb2
from google.iam.v1 import iam_policy_pb2
from google.iam.v1 import policy_pb2
from google.protobuf import field_mask_pb2

_GAPIC_LIBRARY_VERSION = pkg_resources.get_distribution(
    'google-cloud-kms', ).version


class KeyManagementServiceClient(object):
    """
    Google Cloud Key Management Service

    Manages cryptographic keys and operations using those keys. Implements a REST
    model with the following objects:

    * ``KeyRing``
    * ``CryptoKey``
    * ``CryptoKeyVersion``
    """

    SERVICE_ADDRESS = 'cloudkms.googleapis.com:443'
    """The default address of the service."""

    # The name of the interface for this client. This is the key used to
    # find the method configuration in the client_config dictionary.
    _INTERFACE_NAME = 'google.cloud.kms.v1.KeyManagementService'

    @classmethod
    def from_service_account_file(cls, filename, *args, **kwargs):
        """Creates an instance of this client using the provided credentials
        file.

        Args:
            filename (str): The path to the service account private key json
                file.
            args: Additional arguments to pass to the constructor.
            kwargs: Additional arguments to pass to the constructor.

        Returns:
            KeyManagementServiceClient: The constructed client.
        """
        credentials = service_account.Credentials.from_service_account_file(
            filename)
        kwargs['credentials'] = credentials
        return cls(*args, **kwargs)

    from_service_account_json = from_service_account_file

    @classmethod
    def key_ring_path(cls, project, location, key_ring):
        """Return a fully-qualified key_ring string."""
        return google.api_core.path_template.expand(
            'projects/{project}/locations/{location}/keyRings/{key_ring}',
            project=project,
            location=location,
            key_ring=key_ring,
        )

    @classmethod
    def crypto_key_path_path(cls, project, location, key_ring,
                             crypto_key_path):
        """Return a fully-qualified crypto_key_path string."""
        return google.api_core.path_template.expand(
            'projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key_path=**}',
            project=project,
            location=location,
            key_ring=key_ring,
            crypto_key_path=crypto_key_path,
        )

    @classmethod
    def location_path(cls, project, location):
        """Return a fully-qualified location string."""
        return google.api_core.path_template.expand(
            'projects/{project}/locations/{location}',
            project=project,
            location=location,
        )

    @classmethod
    def crypto_key_path(cls, project, location, key_ring, crypto_key):
        """Return a fully-qualified crypto_key string."""
        return google.api_core.path_template.expand(
            'projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}',
            project=project,
            location=location,
            key_ring=key_ring,
            crypto_key=crypto_key,
        )

    @classmethod
    def crypto_key_version_path(cls, project, location, key_ring, crypto_key,
                                crypto_key_version):
        """Return a fully-qualified crypto_key_version string."""
        return google.api_core.path_template.expand(
            'projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}',
            project=project,
            location=location,
            key_ring=key_ring,
            crypto_key=crypto_key,
            crypto_key_version=crypto_key_version,
        )

    def __init__(self,
                 transport=None,
                 channel=None,
                 credentials=None,
                 client_config=key_management_service_client_config.config,
                 client_info=None):
        """Constructor.

        Args:
            transport (Union[~.KeyManagementServiceGrpcTransport,
                    Callable[[~.Credentials, type], ~.KeyManagementServiceGrpcTransport]): A transport
                instance, responsible for actually making the API calls.
                The default transport uses the gRPC protocol.
                This argument may also be a callable which returns a
                transport instance. Callables will be sent the credentials
                as the first argument and the default transport class as
                the second argument.
            channel (grpc.Channel): DEPRECATED. A ``Channel`` instance
                through which to make calls. This argument is mutually exclusive
                with ``credentials``; providing both will raise an exception.
            credentials (google.auth.credentials.Credentials): The
                authorization credentials to attach to requests. These
                credentials identify this application to the service. If none
                are specified, the client will attempt to ascertain the
                credentials from the environment.
                This argument is mutually exclusive with providing a
                transport instance to ``transport``; doing so will raise
                an exception.
            client_config (dict): DEPRECATED. A dictionary of call options for
                each method. If not specified, the default configuration is used.
            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
                The client info used to send a user-agent string along with
                API requests. If ``None``, then default info will be used.
                Generally, you only need to set this if you're developing
                your own client library.
        """
        # Raise deprecation warnings for things we want to go away.
        if client_config:
            warnings.warn('The `client_config` argument is deprecated.',
                          PendingDeprecationWarning)
        if channel:
            warnings.warn(
                'The `channel` argument is deprecated; use '
                '`transport` instead.', PendingDeprecationWarning)

        # Instantiate the transport.
        # The transport is responsible for handling serialization and
        # deserialization and actually sending data to the service.
        if transport:
            if callable(transport):
                self.transport = transport(
                    credentials=credentials,
                    default_class=key_management_service_grpc_transport.
                    KeyManagementServiceGrpcTransport,
                )
            else:
                if credentials:
                    raise ValueError(
                        'Received both a transport instance and '
                        'credentials; these are mutually exclusive.')
                self.transport = transport
        else:
            self.transport = key_management_service_grpc_transport.KeyManagementServiceGrpcTransport(
                address=self.SERVICE_ADDRESS,
                channel=channel,
                credentials=credentials,
            )

        if client_info is None:
            client_info = (
                google.api_core.gapic_v1.client_info.DEFAULT_CLIENT_INFO)
        client_info.gapic_version = _GAPIC_LIBRARY_VERSION
        self._client_info = client_info

        # Parse out the default settings for retry and timeout for each RPC
        # from the client configuration.
        # (Ordinarily, these are the defaults specified in the `*_config.py`
        # file next to this one.)
        self._method_configs = google.api_core.gapic_v1.config.parse_method_configs(
            client_config['interfaces'][self._INTERFACE_NAME], )

        # Save a dictionary of cached API call functions.
        # These are the actual callables which invoke the proper
        # transport methods, wrapped with `wrap_method` to add retry,
        # timeout, and the like.
        self._inner_api_calls = {}

    # Service calls
    def list_key_rings(self,
                       parent,
                       page_size=None,
                       retry=google.api_core.gapic_v1.method.DEFAULT,
                       timeout=google.api_core.gapic_v1.method.DEFAULT,
                       metadata=None):
        """
        Lists ``KeyRings``.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> parent = client.location_path('[PROJECT]', '[LOCATION]')
            >>>
            >>> # Iterate over all results
            >>> for element in client.list_key_rings(parent):
            ...     # process element
            ...     pass
            >>>
            >>>
            >>> # Alternatively:
            >>>
            >>> # Iterate over results one page at a time
            >>> for page in client.list_key_rings(parent, options=CallOptions(page_token=INITIAL_PAGE)):
            ...     for element in page:
            ...         # process element
            ...         pass

        Args:
            parent (str): Required. The resource name of the location associated with the
                ``KeyRings``, in the format ``projects/*/locations/*``.
            page_size (int): The maximum number of resources contained in the
                underlying API response. If page streaming is performed per-
                resource, this parameter does not affect the return value. If page
                streaming is performed per-page, this determines the maximum number
                of resources in a page.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.gax.PageIterator` instance. By default, this
            is an iterable of :class:`~google.cloud.kms_v1.types.KeyRing` instances.
            This object can also be configured to iterate over the pages
            of the response through the `options` parameter.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'list_key_rings' not in self._inner_api_calls:
            self._inner_api_calls[
                'list_key_rings'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.list_key_rings,
                    default_retry=self._method_configs['ListKeyRings'].retry,
                    default_timeout=self._method_configs['ListKeyRings']
                    .timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.ListKeyRingsRequest(
            parent=parent,
            page_size=page_size,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('parent', parent)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        iterator = google.api_core.page_iterator.GRPCIterator(
            client=None,
            method=functools.partial(
                self._inner_api_calls['list_key_rings'],
                retry=retry,
                timeout=timeout,
                metadata=metadata),
            request=request,
            items_field='key_rings',
            request_token_field='page_token',
            response_token_field='next_page_token',
        )
        return iterator

    def list_crypto_keys(self,
                         parent,
                         page_size=None,
                         retry=google.api_core.gapic_v1.method.DEFAULT,
                         timeout=google.api_core.gapic_v1.method.DEFAULT,
                         metadata=None):
        """
        Lists ``CryptoKeys``.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> parent = client.key_ring_path('[PROJECT]', '[LOCATION]', '[KEY_RING]')
            >>>
            >>> # Iterate over all results
            >>> for element in client.list_crypto_keys(parent):
            ...     # process element
            ...     pass
            >>>
            >>>
            >>> # Alternatively:
            >>>
            >>> # Iterate over results one page at a time
            >>> for page in client.list_crypto_keys(parent, options=CallOptions(page_token=INITIAL_PAGE)):
            ...     for element in page:
            ...         # process element
            ...         pass

        Args:
            parent (str): Required. The resource name of the ``KeyRing`` to list, in the format
                ``projects/*/locations/*/keyRings/*``.
            page_size (int): The maximum number of resources contained in the
                underlying API response. If page streaming is performed per-
                resource, this parameter does not affect the return value. If page
                streaming is performed per-page, this determines the maximum number
                of resources in a page.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.gax.PageIterator` instance. By default, this
            is an iterable of :class:`~google.cloud.kms_v1.types.CryptoKey` instances.
            This object can also be configured to iterate over the pages
            of the response through the `options` parameter.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'list_crypto_keys' not in self._inner_api_calls:
            self._inner_api_calls[
                'list_crypto_keys'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.list_crypto_keys,
                    default_retry=self._method_configs['ListCryptoKeys'].retry,
                    default_timeout=self._method_configs['ListCryptoKeys']
                    .timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.ListCryptoKeysRequest(
            parent=parent,
            page_size=page_size,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('parent', parent)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        iterator = google.api_core.page_iterator.GRPCIterator(
            client=None,
            method=functools.partial(
                self._inner_api_calls['list_crypto_keys'],
                retry=retry,
                timeout=timeout,
                metadata=metadata),
            request=request,
            items_field='crypto_keys',
            request_token_field='page_token',
            response_token_field='next_page_token',
        )
        return iterator

    def list_crypto_key_versions(
            self,
            parent,
            page_size=None,
            retry=google.api_core.gapic_v1.method.DEFAULT,
            timeout=google.api_core.gapic_v1.method.DEFAULT,
            metadata=None):
        """
        Lists ``CryptoKeyVersions``.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> parent = client.crypto_key_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[CRYPTO_KEY]')
            >>>
            >>> # Iterate over all results
            >>> for element in client.list_crypto_key_versions(parent):
            ...     # process element
            ...     pass
            >>>
            >>>
            >>> # Alternatively:
            >>>
            >>> # Iterate over results one page at a time
            >>> for page in client.list_crypto_key_versions(parent, options=CallOptions(page_token=INITIAL_PAGE)):
            ...     for element in page:
            ...         # process element
            ...         pass

        Args:
            parent (str): Required. The resource name of the ``CryptoKey`` to list, in the format
                ``projects/*/locations/*/keyRings/*/cryptoKeys/*``.
            page_size (int): The maximum number of resources contained in the
                underlying API response. If page streaming is performed per-
                resource, this parameter does not affect the return value. If page
                streaming is performed per-page, this determines the maximum number
                of resources in a page.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.gax.PageIterator` instance. By default, this
            is an iterable of :class:`~google.cloud.kms_v1.types.CryptoKeyVersion` instances.
            This object can also be configured to iterate over the pages
            of the response through the `options` parameter.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'list_crypto_key_versions' not in self._inner_api_calls:
            self._inner_api_calls[
                'list_crypto_key_versions'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.list_crypto_key_versions,
                    default_retry=self._method_configs['ListCryptoKeyVersions']
                    .retry,
                    default_timeout=self._method_configs[
                        'ListCryptoKeyVersions'].timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.ListCryptoKeyVersionsRequest(
            parent=parent,
            page_size=page_size,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('parent', parent)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        iterator = google.api_core.page_iterator.GRPCIterator(
            client=None,
            method=functools.partial(
                self._inner_api_calls['list_crypto_key_versions'],
                retry=retry,
                timeout=timeout,
                metadata=metadata),
            request=request,
            items_field='crypto_key_versions',
            request_token_field='page_token',
            response_token_field='next_page_token',
        )
        return iterator

    def get_key_ring(self,
                     name,
                     retry=google.api_core.gapic_v1.method.DEFAULT,
                     timeout=google.api_core.gapic_v1.method.DEFAULT,
                     metadata=None):
        """
        Returns metadata for a given ``KeyRing``.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> name = client.key_ring_path('[PROJECT]', '[LOCATION]', '[KEY_RING]')
            >>>
            >>> response = client.get_key_ring(name)

        Args:
            name (str): The ``name`` of the ``KeyRing`` to get.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.KeyRing` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'get_key_ring' not in self._inner_api_calls:
            self._inner_api_calls[
                'get_key_ring'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.get_key_ring,
                    default_retry=self._method_configs['GetKeyRing'].retry,
                    default_timeout=self._method_configs['GetKeyRing'].timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.GetKeyRingRequest(name=name, )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('name', name)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['get_key_ring'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def get_crypto_key(self,
                       name,
                       retry=google.api_core.gapic_v1.method.DEFAULT,
                       timeout=google.api_core.gapic_v1.method.DEFAULT,
                       metadata=None):
        """
        Returns metadata for a given ``CryptoKey``, as well as its
        ``primary`` ``CryptoKeyVersion``.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> name = client.crypto_key_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[CRYPTO_KEY]')
            >>>
            >>> response = client.get_crypto_key(name)

        Args:
            name (str): The ``name`` of the ``CryptoKey`` to get.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.CryptoKey` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'get_crypto_key' not in self._inner_api_calls:
            self._inner_api_calls[
                'get_crypto_key'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.get_crypto_key,
                    default_retry=self._method_configs['GetCryptoKey'].retry,
                    default_timeout=self._method_configs['GetCryptoKey']
                    .timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.GetCryptoKeyRequest(name=name, )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('name', name)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['get_crypto_key'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def get_crypto_key_version(self,
                               name,
                               retry=google.api_core.gapic_v1.method.DEFAULT,
                               timeout=google.api_core.gapic_v1.method.DEFAULT,
                               metadata=None):
        """
        Returns metadata for a given ``CryptoKeyVersion``.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> name = client.crypto_key_version_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[CRYPTO_KEY]', '[CRYPTO_KEY_VERSION]')
            >>>
            >>> response = client.get_crypto_key_version(name)

        Args:
            name (str): The ``name`` of the ``CryptoKeyVersion`` to get.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.CryptoKeyVersion` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'get_crypto_key_version' not in self._inner_api_calls:
            self._inner_api_calls[
                'get_crypto_key_version'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.get_crypto_key_version,
                    default_retry=self._method_configs[
                        'GetCryptoKeyVersion'].retry,
                    default_timeout=self._method_configs['GetCryptoKeyVersion']
                    .timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.GetCryptoKeyVersionRequest(name=name, )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('name', name)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['get_crypto_key_version'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def create_key_ring(self,
                        parent,
                        key_ring_id,
                        key_ring,
                        retry=google.api_core.gapic_v1.method.DEFAULT,
                        timeout=google.api_core.gapic_v1.method.DEFAULT,
                        metadata=None):
        """
        Create a new ``KeyRing`` in a given Project and Location.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> parent = client.location_path('[PROJECT]', '[LOCATION]')
            >>>
            >>> # TODO: Initialize ``key_ring_id``:
            >>> key_ring_id = ''
            >>>
            >>> # TODO: Initialize ``key_ring``:
            >>> key_ring = {}
            >>>
            >>> response = client.create_key_ring(parent, key_ring_id, key_ring)

        Args:
            parent (str): Required. The resource name of the location associated with the
                ``KeyRings``, in the format ``projects/*/locations/*``.
            key_ring_id (str): Required. It must be unique within a location and match the regular
                expression ``[a-zA-Z0-9_-]{1,63}``
            key_ring (Union[dict, ~google.cloud.kms_v1.types.KeyRing]): A ``KeyRing`` with initial field values.
                If a dict is provided, it must be of the same form as the protobuf
                message :class:`~google.cloud.kms_v1.types.KeyRing`
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.KeyRing` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'create_key_ring' not in self._inner_api_calls:
            self._inner_api_calls[
                'create_key_ring'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.create_key_ring,
                    default_retry=self._method_configs['CreateKeyRing'].retry,
                    default_timeout=self._method_configs['CreateKeyRing']
                    .timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.CreateKeyRingRequest(
            parent=parent,
            key_ring_id=key_ring_id,
            key_ring=key_ring,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('parent', parent)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['create_key_ring'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def create_crypto_key(self,
                          parent,
                          crypto_key_id,
                          crypto_key,
                          retry=google.api_core.gapic_v1.method.DEFAULT,
                          timeout=google.api_core.gapic_v1.method.DEFAULT,
                          metadata=None):
        """
        Create a new ``CryptoKey`` within a ``KeyRing``.

        ``CryptoKey.purpose`` is required.

        Example:
            >>> from google.cloud import kms_v1
            >>> from google.cloud.kms_v1 import enums
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> parent = client.key_ring_path('[PROJECT]', '[LOCATION]', '[KEY_RING]')
            >>> crypto_key_id = 'my-app-key'
            >>> purpose = enums.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT
            >>> seconds = 2147483647
            >>> next_rotation_time = {'seconds': seconds}
            >>> seconds_2 = 604800
            >>> rotation_period = {'seconds': seconds_2}
            >>> crypto_key = {'purpose': purpose, 'next_rotation_time': next_rotation_time, 'rotation_period': rotation_period}
            >>>
            >>> response = client.create_crypto_key(parent, crypto_key_id, crypto_key)

        Args:
            parent (str): Required. The ``name`` of the KeyRing associated with the
                ``CryptoKeys``.
            crypto_key_id (str): Required. It must be unique within a KeyRing and match the regular
                expression ``[a-zA-Z0-9_-]{1,63}``
            crypto_key (Union[dict, ~google.cloud.kms_v1.types.CryptoKey]): A ``CryptoKey`` with initial field values.
                If a dict is provided, it must be of the same form as the protobuf
                message :class:`~google.cloud.kms_v1.types.CryptoKey`
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.CryptoKey` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'create_crypto_key' not in self._inner_api_calls:
            self._inner_api_calls[
                'create_crypto_key'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.create_crypto_key,
                    default_retry=self._method_configs[
                        'CreateCryptoKey'].retry,
                    default_timeout=self._method_configs['CreateCryptoKey']
                    .timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.CreateCryptoKeyRequest(
            parent=parent,
            crypto_key_id=crypto_key_id,
            crypto_key=crypto_key,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('parent', parent)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['create_crypto_key'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def create_crypto_key_version(
            self,
            parent,
            crypto_key_version,
            retry=google.api_core.gapic_v1.method.DEFAULT,
            timeout=google.api_core.gapic_v1.method.DEFAULT,
            metadata=None):
        """
        Create a new ``CryptoKeyVersion`` in a ``CryptoKey``.

        The server will assign the next sequential id. If unset,
        ``state`` will be set to
        ``ENABLED``.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> parent = client.crypto_key_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[CRYPTO_KEY]')
            >>>
            >>> # TODO: Initialize ``crypto_key_version``:
            >>> crypto_key_version = {}
            >>>
            >>> response = client.create_crypto_key_version(parent, crypto_key_version)

        Args:
            parent (str): Required. The ``name`` of the ``CryptoKey`` associated with
                the ``CryptoKeyVersions``.
            crypto_key_version (Union[dict, ~google.cloud.kms_v1.types.CryptoKeyVersion]): A ``CryptoKeyVersion`` with initial field values.
                If a dict is provided, it must be of the same form as the protobuf
                message :class:`~google.cloud.kms_v1.types.CryptoKeyVersion`
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.CryptoKeyVersion` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'create_crypto_key_version' not in self._inner_api_calls:
            self._inner_api_calls[
                'create_crypto_key_version'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.create_crypto_key_version,
                    default_retry=self._method_configs[
                        'CreateCryptoKeyVersion'].retry,
                    default_timeout=self._method_configs[
                        'CreateCryptoKeyVersion'].timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.CreateCryptoKeyVersionRequest(
            parent=parent,
            crypto_key_version=crypto_key_version,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('parent', parent)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['create_crypto_key_version'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def update_crypto_key(self,
                          crypto_key,
                          update_mask,
                          retry=google.api_core.gapic_v1.method.DEFAULT,
                          timeout=google.api_core.gapic_v1.method.DEFAULT,
                          metadata=None):
        """
        Update a ``CryptoKey``.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> # TODO: Initialize ``crypto_key``:
            >>> crypto_key = {}
            >>>
            >>> # TODO: Initialize ``update_mask``:
            >>> update_mask = {}
            >>>
            >>> response = client.update_crypto_key(crypto_key, update_mask)

        Args:
            crypto_key (Union[dict, ~google.cloud.kms_v1.types.CryptoKey]): ``CryptoKey`` with updated values.
                If a dict is provided, it must be of the same form as the protobuf
                message :class:`~google.cloud.kms_v1.types.CryptoKey`
            update_mask (Union[dict, ~google.cloud.kms_v1.types.FieldMask]): Required list of fields to be updated in this request.
                If a dict is provided, it must be of the same form as the protobuf
                message :class:`~google.cloud.kms_v1.types.FieldMask`
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.CryptoKey` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'update_crypto_key' not in self._inner_api_calls:
            self._inner_api_calls[
                'update_crypto_key'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.update_crypto_key,
                    default_retry=self._method_configs[
                        'UpdateCryptoKey'].retry,
                    default_timeout=self._method_configs['UpdateCryptoKey']
                    .timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.UpdateCryptoKeyRequest(
            crypto_key=crypto_key,
            update_mask=update_mask,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('crypto_key.name', crypto_key.name)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['update_crypto_key'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def update_crypto_key_version(
            self,
            crypto_key_version,
            update_mask,
            retry=google.api_core.gapic_v1.method.DEFAULT,
            timeout=google.api_core.gapic_v1.method.DEFAULT,
            metadata=None):
        """
        Update a ``CryptoKeyVersion``'s metadata.

        ``state`` may be changed between
        ``ENABLED`` and
        ``DISABLED`` using this
        method. See ``DestroyCryptoKeyVersion`` and ``RestoreCryptoKeyVersion`` to
        move between other states.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> # TODO: Initialize ``crypto_key_version``:
            >>> crypto_key_version = {}
            >>>
            >>> # TODO: Initialize ``update_mask``:
            >>> update_mask = {}
            >>>
            >>> response = client.update_crypto_key_version(crypto_key_version, update_mask)

        Args:
            crypto_key_version (Union[dict, ~google.cloud.kms_v1.types.CryptoKeyVersion]): ``CryptoKeyVersion`` with updated values.
                If a dict is provided, it must be of the same form as the protobuf
                message :class:`~google.cloud.kms_v1.types.CryptoKeyVersion`
            update_mask (Union[dict, ~google.cloud.kms_v1.types.FieldMask]): Required list of fields to be updated in this request.
                If a dict is provided, it must be of the same form as the protobuf
                message :class:`~google.cloud.kms_v1.types.FieldMask`
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.CryptoKeyVersion` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'update_crypto_key_version' not in self._inner_api_calls:
            self._inner_api_calls[
                'update_crypto_key_version'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.update_crypto_key_version,
                    default_retry=self._method_configs[
                        'UpdateCryptoKeyVersion'].retry,
                    default_timeout=self._method_configs[
                        'UpdateCryptoKeyVersion'].timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.UpdateCryptoKeyVersionRequest(
            crypto_key_version=crypto_key_version,
            update_mask=update_mask,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('crypto_key_version.name',
                               crypto_key_version.name)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['update_crypto_key_version'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def encrypt(self,
                name,
                plaintext,
                additional_authenticated_data=None,
                retry=google.api_core.gapic_v1.method.DEFAULT,
                timeout=google.api_core.gapic_v1.method.DEFAULT,
                metadata=None):
        """
        Encrypts data, so that it can only be recovered by a call to ``Decrypt``.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> name = client.crypto_key_path_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[CRYPTO_KEY_PATH]')
            >>>
            >>> # TODO: Initialize ``plaintext``:
            >>> plaintext = b''
            >>>
            >>> response = client.encrypt(name, plaintext)

        Args:
            name (str): Required. The resource name of the ``CryptoKey`` or ``CryptoKeyVersion``
                to use for encryption.

                If a ``CryptoKey`` is specified, the server will use its
                ``primary version``.
            plaintext (bytes): Required. The data to encrypt. Must be no larger than 64KiB.
            additional_authenticated_data (bytes): Optional data that, if specified, must also be provided during decryption
                through ``DecryptRequest.additional_authenticated_data``.  Must be no
                larger than 64KiB.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.EncryptResponse` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'encrypt' not in self._inner_api_calls:
            self._inner_api_calls[
                'encrypt'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.encrypt,
                    default_retry=self._method_configs['Encrypt'].retry,
                    default_timeout=self._method_configs['Encrypt'].timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.EncryptRequest(
            name=name,
            plaintext=plaintext,
            additional_authenticated_data=additional_authenticated_data,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('name', name)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['encrypt'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def decrypt(self,
                name,
                ciphertext,
                additional_authenticated_data=None,
                retry=google.api_core.gapic_v1.method.DEFAULT,
                timeout=google.api_core.gapic_v1.method.DEFAULT,
                metadata=None):
        """
        Decrypts data that was protected by ``Encrypt``.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> name = client.crypto_key_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[CRYPTO_KEY]')
            >>>
            >>> # TODO: Initialize ``ciphertext``:
            >>> ciphertext = b''
            >>>
            >>> response = client.decrypt(name, ciphertext)

        Args:
            name (str): Required. The resource name of the ``CryptoKey`` to use for decryption.
                The server will choose the appropriate version.
            ciphertext (bytes): Required. The encrypted data originally returned in
                ``EncryptResponse.ciphertext``.
            additional_authenticated_data (bytes): Optional data that must match the data originally supplied in
                ``EncryptRequest.additional_authenticated_data``.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.DecryptResponse` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'decrypt' not in self._inner_api_calls:
            self._inner_api_calls[
                'decrypt'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.decrypt,
                    default_retry=self._method_configs['Decrypt'].retry,
                    default_timeout=self._method_configs['Decrypt'].timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.DecryptRequest(
            name=name,
            ciphertext=ciphertext,
            additional_authenticated_data=additional_authenticated_data,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('name', name)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['decrypt'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def update_crypto_key_primary_version(
            self,
            name,
            crypto_key_version_id,
            retry=google.api_core.gapic_v1.method.DEFAULT,
            timeout=google.api_core.gapic_v1.method.DEFAULT,
            metadata=None):
        """
        Update the version of a ``CryptoKey`` that will be used in ``Encrypt``

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> name = client.crypto_key_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[CRYPTO_KEY]')
            >>>
            >>> # TODO: Initialize ``crypto_key_version_id``:
            >>> crypto_key_version_id = ''
            >>>
            >>> response = client.update_crypto_key_primary_version(name, crypto_key_version_id)

        Args:
            name (str): The resource name of the ``CryptoKey`` to update.
            crypto_key_version_id (str): The id of the child ``CryptoKeyVersion`` to use as primary.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.CryptoKey` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'update_crypto_key_primary_version' not in self._inner_api_calls:
            self._inner_api_calls[
                'update_crypto_key_primary_version'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.update_crypto_key_primary_version,
                    default_retry=self._method_configs[
                        'UpdateCryptoKeyPrimaryVersion'].retry,
                    default_timeout=self._method_configs[
                        'UpdateCryptoKeyPrimaryVersion'].timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.UpdateCryptoKeyPrimaryVersionRequest(
            name=name,
            crypto_key_version_id=crypto_key_version_id,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('name', name)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['update_crypto_key_primary_version'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def destroy_crypto_key_version(
            self,
            name,
            retry=google.api_core.gapic_v1.method.DEFAULT,
            timeout=google.api_core.gapic_v1.method.DEFAULT,
            metadata=None):
        """
        Schedule a ``CryptoKeyVersion`` for destruction.

        Upon calling this method, ``CryptoKeyVersion.state`` will be set to
        ``DESTROY_SCHEDULED``
        and ``destroy_time`` will be set to a time 24
        hours in the future, at which point the ``state``
        will be changed to
        ``DESTROYED``, and the key
        material will be irrevocably destroyed.

        Before the ``destroy_time`` is reached,
        ``RestoreCryptoKeyVersion`` may be called to reverse the process.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> name = client.crypto_key_version_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[CRYPTO_KEY]', '[CRYPTO_KEY_VERSION]')
            >>>
            >>> response = client.destroy_crypto_key_version(name)

        Args:
            name (str): The resource name of the ``CryptoKeyVersion`` to destroy.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.CryptoKeyVersion` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'destroy_crypto_key_version' not in self._inner_api_calls:
            self._inner_api_calls[
                'destroy_crypto_key_version'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.destroy_crypto_key_version,
                    default_retry=self._method_configs[
                        'DestroyCryptoKeyVersion'].retry,
                    default_timeout=self._method_configs[
                        'DestroyCryptoKeyVersion'].timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.DestroyCryptoKeyVersionRequest(name=name, )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('name', name)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['destroy_crypto_key_version'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def restore_crypto_key_version(
            self,
            name,
            retry=google.api_core.gapic_v1.method.DEFAULT,
            timeout=google.api_core.gapic_v1.method.DEFAULT,
            metadata=None):
        """
        Restore a ``CryptoKeyVersion`` in the
        ``DESTROY_SCHEDULED``,
        state.

        Upon restoration of the CryptoKeyVersion, ``state``
        will be set to ``DISABLED``,
        and ``destroy_time`` will be cleared.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> name = client.crypto_key_version_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[CRYPTO_KEY]', '[CRYPTO_KEY_VERSION]')
            >>>
            >>> response = client.restore_crypto_key_version(name)

        Args:
            name (str): The resource name of the ``CryptoKeyVersion`` to restore.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.CryptoKeyVersion` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'restore_crypto_key_version' not in self._inner_api_calls:
            self._inner_api_calls[
                'restore_crypto_key_version'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.restore_crypto_key_version,
                    default_retry=self._method_configs[
                        'RestoreCryptoKeyVersion'].retry,
                    default_timeout=self._method_configs[
                        'RestoreCryptoKeyVersion'].timeout,
                    client_info=self._client_info,
                )

        request = service_pb2.RestoreCryptoKeyVersionRequest(name=name, )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('name', name)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['restore_crypto_key_version'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def set_iam_policy(self,
                       resource,
                       policy,
                       retry=google.api_core.gapic_v1.method.DEFAULT,
                       timeout=google.api_core.gapic_v1.method.DEFAULT,
                       metadata=None):
        """
        Sets the access control policy on the specified resource. Replaces any
        existing policy.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> resource = client.key_ring_path('[PROJECT]', '[LOCATION]', '[KEY_RING]')
            >>>
            >>> # TODO: Initialize ``policy``:
            >>> policy = {}
            >>>
            >>> response = client.set_iam_policy(resource, policy)

        Args:
            resource (str): REQUIRED: The resource for which the policy is being specified.
                ``resource`` is usually specified as a path. For example, a Project
                resource is specified as ``projects/{project}``.
            policy (Union[dict, ~google.cloud.kms_v1.types.Policy]): REQUIRED: The complete policy to be applied to the ``resource``. The size of
                the policy is limited to a few 10s of KB. An empty policy is a
                valid policy but certain Cloud Platform services (such as Projects)
                might reject them.
                If a dict is provided, it must be of the same form as the protobuf
                message :class:`~google.cloud.kms_v1.types.Policy`
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.Policy` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'set_iam_policy' not in self._inner_api_calls:
            self._inner_api_calls[
                'set_iam_policy'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.set_iam_policy,
                    default_retry=self._method_configs['SetIamPolicy'].retry,
                    default_timeout=self._method_configs['SetIamPolicy']
                    .timeout,
                    client_info=self._client_info,
                )

        request = iam_policy_pb2.SetIamPolicyRequest(
            resource=resource,
            policy=policy,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('resource', resource)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['set_iam_policy'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def get_iam_policy(self,
                       resource,
                       retry=google.api_core.gapic_v1.method.DEFAULT,
                       timeout=google.api_core.gapic_v1.method.DEFAULT,
                       metadata=None):
        """
        Gets the access control policy for a resource.
        Returns an empty policy if the resource exists and does not have a policy
        set.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> resource = client.key_ring_path('[PROJECT]', '[LOCATION]', '[KEY_RING]')
            >>>
            >>> response = client.get_iam_policy(resource)

        Args:
            resource (str): REQUIRED: The resource for which the policy is being requested.
                ``resource`` is usually specified as a path. For example, a Project
                resource is specified as ``projects/{project}``.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.Policy` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'get_iam_policy' not in self._inner_api_calls:
            self._inner_api_calls[
                'get_iam_policy'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.get_iam_policy,
                    default_retry=self._method_configs['GetIamPolicy'].retry,
                    default_timeout=self._method_configs['GetIamPolicy']
                    .timeout,
                    client_info=self._client_info,
                )

        request = iam_policy_pb2.GetIamPolicyRequest(resource=resource, )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('resource', resource)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['get_iam_policy'](
            request, retry=retry, timeout=timeout, metadata=metadata)

    def test_iam_permissions(self,
                             resource,
                             permissions,
                             retry=google.api_core.gapic_v1.method.DEFAULT,
                             timeout=google.api_core.gapic_v1.method.DEFAULT,
                             metadata=None):
        """
        Returns permissions that a caller has on the specified resource.
        If the resource does not exist, this will return an empty set of
        permissions, not a NOT_FOUND error.

        Example:
            >>> from google.cloud import kms_v1
            >>>
            >>> client = kms_v1.KeyManagementServiceClient()
            >>>
            >>> resource = client.key_ring_path('[PROJECT]', '[LOCATION]', '[KEY_RING]')
            >>>
            >>> # TODO: Initialize ``permissions``:
            >>> permissions = []
            >>>
            >>> response = client.test_iam_permissions(resource, permissions)

        Args:
            resource (str): REQUIRED: The resource for which the policy detail is being requested.
                ``resource`` is usually specified as a path. For example, a Project
                resource is specified as ``projects/{project}``.
            permissions (list[str]): The set of permissions to check for the ``resource``. Permissions with
                wildcards (such as '*' or 'storage.*') are not allowed. For more
                information see
                `IAM Overview <https://cloud.google.com/iam/docs/overview#permissions>`_.
            retry (Optional[google.api_core.retry.Retry]):  A retry object used
                to retry requests. If ``None`` is specified, requests will not
                be retried.
            timeout (Optional[float]): The amount of time, in seconds, to wait
                for the request to complete. Note that if ``retry`` is
                specified, the timeout applies to each individual attempt.
            metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata
                that is provided to the method.

        Returns:
            A :class:`~google.cloud.kms_v1.types.TestIamPermissionsResponse` instance.

        Raises:
            google.api_core.exceptions.GoogleAPICallError: If the request
                    failed for any reason.
            google.api_core.exceptions.RetryError: If the request failed due
                    to a retryable error and retry attempts failed.
            ValueError: If the parameters are invalid.
        """
        # Wrap the transport method to add retry and timeout logic.
        if 'test_iam_permissions' not in self._inner_api_calls:
            self._inner_api_calls[
                'test_iam_permissions'] = google.api_core.gapic_v1.method.wrap_method(
                    self.transport.test_iam_permissions,
                    default_retry=self._method_configs[
                        'TestIamPermissions'].retry,
                    default_timeout=self._method_configs['TestIamPermissions']
                    .timeout,
                    client_info=self._client_info,
                )

        request = iam_policy_pb2.TestIamPermissionsRequest(
            resource=resource,
            permissions=permissions,
        )
        if metadata is None:
            metadata = []
        metadata = list(metadata)
        try:
            routing_header = [('resource', resource)]
        except AttributeError:
            pass
        else:
            routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata(
                routing_header)
            metadata.append(routing_metadata)

        return self._inner_api_calls['test_iam_permissions'](
            request, retry=retry, timeout=timeout, metadata=metadata)
