// Copyright 2026 Google LLC.

// Use of this source code is governed by a BSD-style

// license that can be found in the LICENSE file.

// Code generated file. DO NOT EDIT.

// Package privateca provides access to the Certificate Authority API.

//

// For product documentation, see: https://cloud.google.com/

//

// # Library status

//

// These client libraries are officially supported by Google. However, this

// library is considered complete and is in maintenance mode. This means

// that we will address critical bugs and security issues but will not add

// any new features.

//

// When possible, we recommend using our newer

// [Cloud Client Libraries for Go](https://pkg.go.dev/cloud.google.com/go)

// that are still actively being worked and iterated on.

//

// # Creating a client

//

// Usage example:

//

// import "google.golang.org/api/privateca/v1"

// ...

// ctx := context.Background()

// privatecaService, err := privateca.NewService(ctx)

//

// In this example, Google Application Default Credentials are used for

// authentication. For information on how to create and obtain Application

// Default Credentials, see https://developers.google.com/identity/protocols/application-default-credentials.

//

// # Other authentication options

//

// To use an API key for authentication (note: some APIs do not support API

// keys), use [google.golang.org/api/option.WithAPIKey]:

//

// privatecaService, err := privateca.NewService(ctx, option.WithAPIKey("AIza..."))

//

// To use an OAuth token (e.g., a user token obtained via a three-legged OAuth

// flow, use [google.golang.org/api/option.WithTokenSource]:

//

// config := &oauth2.Config{...}

// // ...

// token, err := config.Exchange(ctx, ...)

// privatecaService, err := privateca.NewService(ctx, option.WithTokenSource(config.TokenSource(ctx, token)))

//

// See [google.golang.org/api/option.ClientOption] for details on options.

package privateca // import "google.golang.org/api/privateca/v1"

import (

"bytes"

"context"

"encoding/json"

"errors"

"fmt"

"io"

"log/slog"

"net/http"

"net/url"

"strconv"

"strings"

"github.com/googleapis/gax-go/v2/internallog"

googleapi "google.golang.org/api/googleapi"

internal "google.golang.org/api/internal"

gensupport "google.golang.org/api/internal/gensupport"

option "google.golang.org/api/option"

internaloption "google.golang.org/api/option/internaloption"

htransport "google.golang.org/api/transport/http"

)

// Always reference these packages, just in case the auto-generated code

// below doesn't.

var _ = bytes.NewBuffer

var _ = strconv.Itoa

var _ = fmt.Sprintf

var _ = json.NewDecoder

var _ = io.Copy

var _ = url.Parse

var _ = gensupport.MarshalJSON

var _ = googleapi.Version

var _ = errors.New

var _ = strings.Replace

var _ = context.Canceled

var _ = internaloption.WithDefaultEndpoint

var _ = internal.Version

var _ = internallog.New

const apiId = "privateca:v1"

const apiName = "privateca"

const apiVersion = "v1"

const basePath = "https://privateca.googleapis.com/"

const basePathTemplate = "https://privateca.UNIVERSE_DOMAIN/"

const mtlsBasePath = "https://privateca.mtls.googleapis.com/"

// OAuth2 scopes used by this API.

const (

// See, edit, configure, and delete your Google Cloud data and see the email

// address for your Google Account.

CloudPlatformScope = "https://www.googleapis.com/auth/cloud-platform"

)

// NewService creates a new Service.

func NewService(ctx context.Context, opts ...option.ClientOption) (*Service, error) {

scopesOption := internaloption.WithDefaultScopes(

"https://www.googleapis.com/auth/cloud-platform",

)

// NOTE: prepend, so we don't override user-specified scopes.

opts = append([]option.ClientOption{scopesOption}, opts...)

opts = append(opts, internaloption.WithDefaultEndpoint(basePath))

opts = append(opts, internaloption.WithDefaultEndpointTemplate(basePathTemplate))

opts = append(opts, internaloption.WithDefaultMTLSEndpoint(mtlsBasePath))

opts = append(opts, internaloption.EnableNewAuthLibrary())

client, endpoint, err := htransport.NewClient(ctx, opts...)

if err != nil {

return nil, err

}

s := &Service{client: client, BasePath: basePath, logger: internaloption.GetLogger(opts)}

s.Projects = NewProjectsService(s)

if endpoint != "" {

s.BasePath = endpoint

}

return s, nil

}

// New creates a new Service. It uses the provided http.Client for requests.

//

// Deprecated: please use NewService instead.

// To provide a custom HTTP client, use option.WithHTTPClient.

// If you are using google.golang.org/api/googleapis/transport.APIKey, use option.WithAPIKey with NewService instead.

func New(client *http.Client) (*Service, error) {

if client == nil {

return nil, errors.New("client is nil")

}

return NewService(context.TODO(), option.WithHTTPClient(client))

}

type Service struct {

client *http.Client

logger *slog.Logger

BasePath string // API endpoint base URL

UserAgent string // optional additional User-Agent fragment

Projects *ProjectsService

}

func (s *Service) userAgent() string {

if s.UserAgent == "" {

return googleapi.UserAgent

}

return googleapi.UserAgent + " " + s.UserAgent

}

func NewProjectsService(s *Service) *ProjectsService {

rs := &ProjectsService{s: s}

rs.Locations = NewProjectsLocationsService(s)

return rs

}

type ProjectsService struct {

s *Service

Locations *ProjectsLocationsService

}

func NewProjectsLocationsService(s *Service) *ProjectsLocationsService {

rs := &ProjectsLocationsService{s: s}

rs.CaPools = NewProjectsLocationsCaPoolsService(s)

rs.CertificateTemplates = NewProjectsLocationsCertificateTemplatesService(s)

rs.Operations = NewProjectsLocationsOperationsService(s)

return rs

}

type ProjectsLocationsService struct {

s *Service

CaPools *ProjectsLocationsCaPoolsService

CertificateTemplates *ProjectsLocationsCertificateTemplatesService

Operations *ProjectsLocationsOperationsService

}

func NewProjectsLocationsCaPoolsService(s *Service) *ProjectsLocationsCaPoolsService {

rs := &ProjectsLocationsCaPoolsService{s: s}

rs.CertificateAuthorities = NewProjectsLocationsCaPoolsCertificateAuthoritiesService(s)

rs.Certificates = NewProjectsLocationsCaPoolsCertificatesService(s)

return rs

}

type ProjectsLocationsCaPoolsService struct {

s *Service

CertificateAuthorities *ProjectsLocationsCaPoolsCertificateAuthoritiesService

Certificates *ProjectsLocationsCaPoolsCertificatesService

}

func NewProjectsLocationsCaPoolsCertificateAuthoritiesService(s *Service) *ProjectsLocationsCaPoolsCertificateAuthoritiesService {

rs := &ProjectsLocationsCaPoolsCertificateAuthoritiesService{s: s}

rs.CertificateRevocationLists = NewProjectsLocationsCaPoolsCertificateAuthoritiesCertificateRevocationListsService(s)

return rs

}

type ProjectsLocationsCaPoolsCertificateAuthoritiesService struct {

s *Service

CertificateRevocationLists *ProjectsLocationsCaPoolsCertificateAuthoritiesCertificateRevocationListsService

}

func NewProjectsLocationsCaPoolsCertificateAuthoritiesCertificateRevocationListsService(s *Service) *ProjectsLocationsCaPoolsCertificateAuthoritiesCertificateRevocationListsService {

rs := &ProjectsLocationsCaPoolsCertificateAuthoritiesCertificateRevocationListsService{s: s}

return rs

}

type ProjectsLocationsCaPoolsCertificateAuthoritiesCertificateRevocationListsService struct {

s *Service

}

func NewProjectsLocationsCaPoolsCertificatesService(s *Service) *ProjectsLocationsCaPoolsCertificatesService {

rs := &ProjectsLocationsCaPoolsCertificatesService{s: s}

return rs

}

type ProjectsLocationsCaPoolsCertificatesService struct {

s *Service

}

func NewProjectsLocationsCertificateTemplatesService(s *Service) *ProjectsLocationsCertificateTemplatesService {

rs := &ProjectsLocationsCertificateTemplatesService{s: s}

return rs

}

type ProjectsLocationsCertificateTemplatesService struct {

s *Service

}

func NewProjectsLocationsOperationsService(s *Service) *ProjectsLocationsOperationsService {

rs := &ProjectsLocationsOperationsService{s: s}

return rs

}

type ProjectsLocationsOperationsService struct {

s *Service

}

// AccessUrls: URLs where a CertificateAuthority will publish content.

type AccessUrls struct {

// CaCertificateAccessUrl: The URL where this CertificateAuthority's CA

// certificate is published. This will only be set for CAs that have been

// activated.

CaCertificateAccessUrl string `json:"caCertificateAccessUrl,omitempty"`

// CrlAccessUrls: The URLs where this CertificateAuthority's CRLs are

// published. This will only be set for CAs that have been activated.

CrlAccessUrls []string `json:"crlAccessUrls,omitempty"`

// ForceSendFields is a list of field names (e.g. "CaCertificateAccessUrl") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "CaCertificateAccessUrl") to

// include in API requests with the JSON null value. By default, fields with

// empty values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s AccessUrls) MarshalJSON() ([]byte, error) {

type NoMethod AccessUrls

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// ActivateCertificateAuthorityRequest: Request message for

// CertificateAuthorityService.ActivateCertificateAuthority.

type ActivateCertificateAuthorityRequest struct {

// PemCaCertificate: Required. The signed CA certificate issued from

// FetchCertificateAuthorityCsrResponse.pem_csr.

PemCaCertificate string `json:"pemCaCertificate,omitempty"`

// RequestId: Optional. An ID to identify requests. Specify a unique request ID

// so that if you must retry your request, the server will know to ignore the

// request if it has already been completed. The server will guarantee that for

// at least 60 minutes since the first request. For example, consider a

// situation where you make an initial request and the request times out. If

// you make the request again with the same request ID, the server can check if

// original operation with the same request ID was received, and if so, will

// ignore the second request. This prevents clients from accidentally creating

// duplicate commitments. The request ID must be a valid UUID with the

// exception that zero UUID is not supported

// (00000000-0000-0000-0000-000000000000).

RequestId string `json:"requestId,omitempty"`

// SubordinateConfig: Required. Must include information about the issuer of

// 'pem_ca_certificate', and any further issuers until the self-signed CA.

SubordinateConfig *SubordinateConfig `json:"subordinateConfig,omitempty"`

// ForceSendFields is a list of field names (e.g. "PemCaCertificate") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "PemCaCertificate") to include in

// API requests with the JSON null value. By default, fields with empty values

// are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s ActivateCertificateAuthorityRequest) MarshalJSON() ([]byte, error) {

type NoMethod ActivateCertificateAuthorityRequest

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// AllowedKeyType: Describes a "type" of key that may be used in a Certificate

// issued from a CaPool. Note that a single AllowedKeyType may refer to either

// a fully-qualified key algorithm, such as RSA 4096, or a family of key

// algorithms, such as any RSA key.

type AllowedKeyType struct {

// EllipticCurve: Represents an allowed Elliptic Curve key type.

EllipticCurve *EcKeyType `json:"ellipticCurve,omitempty"`

// Rsa: Represents an allowed RSA key type.

Rsa *RsaKeyType `json:"rsa,omitempty"`

// ForceSendFields is a list of field names (e.g. "EllipticCurve") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "EllipticCurve") to include in API

// requests with the JSON null value. By default, fields with empty values are

// omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s AllowedKeyType) MarshalJSON() ([]byte, error) {

type NoMethod AllowedKeyType

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// AttributeTypeAndValue: AttributeTypeAndValue specifies an attribute type and

// value. It can use either a OID or enum value to specify the attribute type.

type AttributeTypeAndValue struct {

// ObjectId: Object ID for an attribute type of an attribute and value pair.

ObjectId *ObjectId `json:"objectId,omitempty"`

// Type: The attribute type of the attribute and value pair.

//

// Possible values:

// "ATTRIBUTE_TYPE_UNSPECIFIED" - Attribute type is unspecified.

// "COMMON_NAME" - The "common name" of the subject.

// "COUNTRY_CODE" - The country code of the subject.

// "ORGANIZATION" - The organization of the subject.

// "ORGANIZATIONAL_UNIT" - The organizational unit of the subject.

// "LOCALITY" - The locality or city of the subject.

// "PROVINCE" - The province, territory, or regional state of the subject.

// "STREET_ADDRESS" - The street address of the subject.

// "POSTAL_CODE" - The postal code of the subject.

Type string `json:"type,omitempty"`

// Value: The value for the attribute type.

Value string `json:"value,omitempty"`

// ForceSendFields is a list of field names (e.g. "ObjectId") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "ObjectId") to include in API

// requests with the JSON null value. By default, fields with empty values are

// omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s AttributeTypeAndValue) MarshalJSON() ([]byte, error) {

type NoMethod AttributeTypeAndValue

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// AuditConfig: Specifies the audit configuration for a service. The

// configuration determines which permission types are logged, and what

// identities, if any, are exempted from logging. An AuditConfig must have one

// or more AuditLogConfigs. If there are AuditConfigs for both `allServices`

// and a specific service, the union of the two AuditConfigs is used for that

// service: the log_types specified in each AuditConfig are enabled, and the

// exempted_members in each AuditLogConfig are exempted. Example Policy with

// multiple AuditConfigs: { "audit_configs": [ { "service": "allServices",

// "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [

// "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" }, { "log_type":

// "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com",

// "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type":

// "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] } ] } ] } For

// sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

// logging. It also exempts `jose@example.com` from DATA_READ logging, and

// `aliya@example.com` from DATA_WRITE logging.

type AuditConfig struct {

// AuditLogConfigs: The configuration for logging of each type of permission.

AuditLogConfigs []*AuditLogConfig `json:"auditLogConfigs,omitempty"`

// Service: Specifies a service that will be enabled for audit logging. For

// example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices`

// is a special value that covers all services.

Service string `json:"service,omitempty"`

// ForceSendFields is a list of field names (e.g. "AuditLogConfigs") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "AuditLogConfigs") to include in

// API requests with the JSON null value. By default, fields with empty values

// are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s AuditConfig) MarshalJSON() ([]byte, error) {

type NoMethod AuditConfig

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// AuditLogConfig: Provides the configuration for logging a type of

// permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ",

// "exempted_members": [ "user:jose@example.com" ] }, { "log_type":

// "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while

// exempting jose@example.com from DATA_READ logging.

type AuditLogConfig struct {

// ExemptedMembers: Specifies the identities that do not cause logging for this

// type of permission. Follows the same format of Binding.members.

ExemptedMembers []string `json:"exemptedMembers,omitempty"`

// LogType: The log type that this config enables.

//

// Possible values:

// "LOG_TYPE_UNSPECIFIED" - Default case. Should never be this.

// "ADMIN_READ" - Admin reads. Example: CloudIAM getIamPolicy

// "DATA_WRITE" - Data writes. Example: CloudSQL Users create

// "DATA_READ" - Data reads. Example: CloudSQL Users list

LogType string `json:"logType,omitempty"`

// ForceSendFields is a list of field names (e.g. "ExemptedMembers") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "ExemptedMembers") to include in

// API requests with the JSON null value. By default, fields with empty values

// are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s AuditLogConfig) MarshalJSON() ([]byte, error) {

type NoMethod AuditLogConfig

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// Binding: Associates `members`, or principals, with a `role`.

type Binding struct {

// Condition: The condition that is associated with this binding. If the

// condition evaluates to `true`, then this binding applies to the current

// request. If the condition evaluates to `false`, then this binding does not

// apply to the current request. However, a different role binding might grant

// the same role to one or more of the principals in this binding. To learn

// which resources support conditions in their IAM policies, see the IAM

// documentation

// (https://cloud.google.com/iam/help/conditions/resource-policies).

Condition *Expr `json:"condition,omitempty"`

// Members: Specifies the principals requesting access for a Google Cloud

// resource. `members` can have the following values: * `allUsers`: A special

// identifier that represents anyone who is on the internet; with or without a

// Google account. * `allAuthenticatedUsers`: A special identifier that

// represents anyone who is authenticated with a Google account or a service

// account. Does not include identities that come from external identity

// providers (IdPs) through identity federation. * `user:{emailid}`: An email

// address that represents a specific Google account. For example,

// `alice@example.com` . * `serviceAccount:{emailid}`: An email address that

// represents a Google service account. For example,

// `my-other-app@appspot.gserviceaccount.com`. *

// `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An

// identifier for a Kubernetes service account

// (https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts).

// For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. *

// `group:{emailid}`: An email address that represents a Google group. For

// example, `admins@example.com`. * `domain:{domain}`: The G Suite domain

// (primary) that represents all the users of that domain. For example,

// `google.com` or `example.com`. *

// `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/sub

// ject/{subject_attribute_value}`: A single identity in a workforce identity

// pool. *

// `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/

// group/{group_id}`: All workforce identities in a group. *

// `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/

// attribute.{attribute_name}/{attribute_value}`: All workforce identities with

// a specific attribute value. *

// `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/

// *`: All identities in a workforce identity pool. *

// `principal://iam.googleapis.com/projects/{project_number}/locations/global/wo

// rkloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single

// identity in a workload identity pool. *

// `principalSet://iam.googleapis.com/projects/{project_number}/locations/global

// /workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool

// group. *

// `principalSet://iam.googleapis.com/projects/{project_number}/locations/global

// /workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}

// `: All identities in a workload identity pool with a certain attribute. *

// `principalSet://iam.googleapis.com/projects/{project_number}/locations/global

// /workloadIdentityPools/{pool_id}/*`: All identities in a workload identity

// pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus

// unique identifier) representing a user that has been recently deleted. For

// example, `alice@example.com?uid=123456789012345678901`. If the user is

// recovered, this value reverts to `user:{emailid}` and the recovered user

// retains the role in the binding. *

// `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

// unique identifier) representing a service account that has been recently

// deleted. For example,

// `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the

// service account is undeleted, this value reverts to

// `serviceAccount:{emailid}` and the undeleted service account retains the

// role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email

// address (plus unique identifier) representing a Google group that has been

// recently deleted. For example,

// `admins@example.com?uid=123456789012345678901`. If the group is recovered,

// this value reverts to `group:{emailid}` and the recovered group retains the

// role in the binding. *

// `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool

// _id}/subject/{subject_attribute_value}`: Deleted single identity in a

// workforce identity pool. For example,

// `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-po

// ol-id/subject/my-subject-attribute-value`.

Members []string `json:"members,omitempty"`

// Role: Role that is assigned to the list of `members`, or principals. For

// example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview

// of the IAM roles and permissions, see the IAM documentation

// (https://cloud.google.com/iam/docs/roles-overview). For a list of the

// available pre-defined roles, see here

// (https://cloud.google.com/iam/docs/understanding-roles).

Role string `json:"role,omitempty"`

// ForceSendFields is a list of field names (e.g. "Condition") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "Condition") to include in API

// requests with the JSON null value. By default, fields with empty values are

// omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s Binding) MarshalJSON() ([]byte, error) {

type NoMethod Binding

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// CaOptions: Describes the X.509 basic constraints extension, per RFC 5280

// section 4.2.1.9 (https://tools.ietf.org/html/rfc5280#section-4.2.1.9)

type CaOptions struct {

// IsCa: Optional. Refers to the "CA" boolean field in the X.509 extension.

// When this value is missing, the basic constraints extension will be omitted

// from the certificate.

IsCa bool `json:"isCa,omitempty"`

// MaxIssuerPathLength: Optional. Refers to the path length constraint field in

// the X.509 extension. For a CA certificate, this value describes the depth of

// subordinate CA certificates that are allowed. If this value is less than 0,

// the request will fail. If this value is missing, the max path length will be

// omitted from the certificate.

MaxIssuerPathLength int64 `json:"maxIssuerPathLength,omitempty"`

// ForceSendFields is a list of field names (e.g. "IsCa") to unconditionally

// include in API requests. By default, fields with empty or default values are

// omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "IsCa") to include in API requests

// with the JSON null value. By default, fields with empty values are omitted

// from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s CaOptions) MarshalJSON() ([]byte, error) {

type NoMethod CaOptions

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// CaPool: A CaPool represents a group of CertificateAuthorities that form a

// trust anchor. A CaPool can be used to manage issuance policies for one or

// more CertificateAuthority resources and to rotate CA certificates in and out

// of the trust anchor.

type CaPool struct {

// EncryptionSpec: Optional. When EncryptionSpec is provided, the Subject,

// SubjectAltNames, and the PEM-encoded certificate fields will be encrypted at

// rest.

EncryptionSpec *EncryptionSpec `json:"encryptionSpec,omitempty"`

// IssuancePolicy: Optional. The IssuancePolicy to control how Certificates

// will be issued from this CaPool.

IssuancePolicy *IssuancePolicy `json:"issuancePolicy,omitempty"`

// Labels: Optional. Labels with user-defined metadata.

Labels map[string]string `json:"labels,omitempty"`

// Name: Identifier. The resource name for this CaPool in the format

// `projects/*/locations/*/caPools/*`.

Name string `json:"name,omitempty"`

// PublishingOptions: Optional. The PublishingOptions to follow when issuing

// Certificates from any CertificateAuthority in this CaPool.

PublishingOptions *PublishingOptions `json:"publishingOptions,omitempty"`

// Tier: Required. Immutable. The Tier of this CaPool.

//

// Possible values:

// "TIER_UNSPECIFIED" - Not specified.

// "ENTERPRISE" - Enterprise tier.

// "DEVOPS" - DevOps tier.

Tier string `json:"tier,omitempty"`

// ServerResponse contains the HTTP response code and headers from the server.

googleapi.ServerResponse `json:"-"`

// ForceSendFields is a list of field names (e.g. "EncryptionSpec") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "EncryptionSpec") to include in

// API requests with the JSON null value. By default, fields with empty values

// are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s CaPool) MarshalJSON() ([]byte, error) {

type NoMethod CaPool

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// CancelOperationRequest: The request message for Operations.CancelOperation.

type CancelOperationRequest struct {

}

type CertChain struct {

// Certificates: The certificates that form the CA chain, from leaf to root

// order.

Certificates []string `json:"certificates,omitempty"`

// ForceSendFields is a list of field names (e.g. "Certificates") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "Certificates") to include in API

// requests with the JSON null value. By default, fields with empty values are

// omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s CertChain) MarshalJSON() ([]byte, error) {

type NoMethod CertChain

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// Certificate: A Certificate corresponds to a signed X.509 certificate issued

// by a CertificateAuthority.

type Certificate struct {

// CertificateDescription: Output only. A structured description of the issued

// X.509 certificate.

CertificateDescription *CertificateDescription `json:"certificateDescription,omitempty"`

// CertificateTemplate: Immutable. The resource name for a CertificateTemplate

// used to issue this certificate, in the format

// `projects/*/locations/*/certificateTemplates/*`. If this is specified, the

// caller must have the necessary permission to use this template. If this is

// omitted, no template will be used. This template must be in the same

// location as the Certificate.

CertificateTemplate string `json:"certificateTemplate,omitempty"`

// Config: Immutable. A description of the certificate and key that does not

// require X.509 or ASN.1.

Config *CertificateConfig `json:"config,omitempty"`

// CreateTime: Output only. The time at which this Certificate was created.

CreateTime string `json:"createTime,omitempty"`

// IssuerCertificateAuthority: Output only. The resource name of the issuing

// CertificateAuthority in the format

// `projects/*/locations/*/caPools/*/certificateAuthorities/*`.

IssuerCertificateAuthority string `json:"issuerCertificateAuthority,omitempty"`

// Labels: Optional. Labels with user-defined metadata.

Labels map[string]string `json:"labels,omitempty"`

// Lifetime: Required. Immutable. The desired lifetime of a certificate. Used

// to create the "not_before_time" and "not_after_time" fields inside an X.509

// certificate. Note that the lifetime may be truncated if it would extend past

// the life of any certificate authority in the issuing chain.

Lifetime string `json:"lifetime,omitempty"`

// Name: Identifier. The resource name for this Certificate in the format

// `projects/*/locations/*/caPools/*/certificates/*`.

Name string `json:"name,omitempty"`

// PemCertificate: Output only. The pem-encoded, signed X.509 certificate.

PemCertificate string `json:"pemCertificate,omitempty"`

// PemCertificateChain: Output only. The chain that may be used to verify the

// X.509 certificate. Expected to be in issuer-to-root order according to RFC

// 5246.

PemCertificateChain []string `json:"pemCertificateChain,omitempty"`

// PemCsr: Immutable. A pem-encoded X.509 certificate signing request (CSR).

PemCsr string `json:"pemCsr,omitempty"`

// RevocationDetails: Output only. Details regarding the revocation of this

// Certificate. This Certificate is considered revoked if and only if this

// field is present.

RevocationDetails *RevocationDetails `json:"revocationDetails,omitempty"`

// SubjectMode: Immutable. Specifies how the Certificate's identity fields are

// to be decided. If this is omitted, the `DEFAULT` subject mode will be used.

//

// Possible values:

// "SUBJECT_REQUEST_MODE_UNSPECIFIED" - Not specified.

// "DEFAULT" - The default mode used in most cases. Indicates that the

// certificate's Subject and/or SubjectAltNames are specified in the

// certificate request. This mode requires the caller to have the

// `privateca.certificates.create` permission.

// "RDN_SEQUENCE" - A mode used to get an accurate representation of the

// Subject field's distinguished name. Indicates that the certificate's Subject

// and/or SubjectAltNames are specified in the certificate request. When

// parsing a PEM CSR this mode will maintain the sequence of RDNs found in the

// CSR's subject field in the issued Certificate. This mode requires the caller

// to have the `privateca.certificates.create` permission.

// "REFLECTED_SPIFFE" - A mode reserved for special cases. Indicates that the

// certificate should have one SPIFFE SubjectAltNames set by the service based

// on the caller's identity. This mode will ignore any explicitly specified

// Subject and/or SubjectAltNames in the certificate request. This mode

// requires the caller to have the `privateca.certificates.createForSelf`

// permission.

SubjectMode string `json:"subjectMode,omitempty"`

// UpdateTime: Output only. The time at which this Certificate was updated.

UpdateTime string `json:"updateTime,omitempty"`

// ServerResponse contains the HTTP response code and headers from the server.

googleapi.ServerResponse `json:"-"`

// ForceSendFields is a list of field names (e.g. "CertificateDescription") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "CertificateDescription") to

// include in API requests with the JSON null value. By default, fields with

// empty values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s Certificate) MarshalJSON() ([]byte, error) {

type NoMethod Certificate

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// CertificateAuthority: A CertificateAuthority represents an individual

// Certificate Authority. A CertificateAuthority can be used to create

// Certificates.

type CertificateAuthority struct {

// AccessUrls: Output only. URLs for accessing content published by this CA,

// such as the CA certificate and CRLs.

AccessUrls *AccessUrls `json:"accessUrls,omitempty"`

// CaCertificateDescriptions: Output only. A structured description of this

// CertificateAuthority's CA certificate and its issuers. Ordered as

// self-to-root.

CaCertificateDescriptions []*CertificateDescription `json:"caCertificateDescriptions,omitempty"`

// Config: Required. Immutable. The config used to create a self-signed X.509

// certificate or CSR.

Config *CertificateConfig `json:"config,omitempty"`

// CreateTime: Output only. The time at which this CertificateAuthority was

// created.

CreateTime string `json:"createTime,omitempty"`

// DeleteTime: Output only. The time at which this CertificateAuthority was

// soft deleted, if it is in the DELETED state.

DeleteTime string `json:"deleteTime,omitempty"`

// ExpireTime: Output only. The time at which this CertificateAuthority will be

// permanently purged, if it is in the DELETED state.

ExpireTime string `json:"expireTime,omitempty"`

// GcsBucket: Immutable. The name of a Cloud Storage bucket where this

// CertificateAuthority will publish content, such as the CA certificate and

// CRLs. This must be a bucket name, without any prefixes (such as `gs://`) or

// suffixes (such as `.googleapis.com`). For example, to use a bucket named

// `my-bucket`, you would simply specify `my-bucket`. If not specified, a

// managed bucket will be created.

GcsBucket string `json:"gcsBucket,omitempty"`

// KeySpec: Required. Immutable. Used when issuing certificates for this

// CertificateAuthority. If this CertificateAuthority is a self-signed

// CertificateAuthority, this key is also used to sign the self-signed CA

// certificate. Otherwise, it is used to sign a CSR.

KeySpec *KeyVersionSpec `json:"keySpec,omitempty"`

// Labels: Optional. Labels with user-defined metadata.

Labels map[string]string `json:"labels,omitempty"`

// Lifetime: Required. Immutable. The desired lifetime of the CA certificate.

// Used to create the "not_before_time" and "not_after_time" fields inside an

// X.509 certificate.

Lifetime string `json:"lifetime,omitempty"`

// Name: Identifier. The resource name for this CertificateAuthority in the

// format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.

Name string `json:"name,omitempty"`

// PemCaCertificates: Output only. This CertificateAuthority's certificate

// chain, including the current CertificateAuthority's certificate. Ordered

// such that the root issuer is the final element (consistent with RFC 5246).

// For a self-signed CA, this will only list the current CertificateAuthority's

// certificate.

PemCaCertificates []string `json:"pemCaCertificates,omitempty"`

// SatisfiesPzi: Output only. Reserved for future use.

SatisfiesPzi bool `json:"satisfiesPzi,omitempty"`

// SatisfiesPzs: Output only. Reserved for future use.

SatisfiesPzs bool `json:"satisfiesPzs,omitempty"`

// State: Output only. The State for this CertificateAuthority.

//

// Possible values:

// "STATE_UNSPECIFIED" - Not specified.

// "ENABLED" - Certificates can be issued from this CA. CRLs will be

// generated for this CA. The CA will be part of the CaPool's trust anchor, and

// will be used to issue certificates from the CaPool.

// "DISABLED" - Certificates cannot be issued from this CA. CRLs will still

// be generated. The CA will be part of the CaPool's trust anchor, but will not

// be used to issue certificates from the CaPool.

// "STAGED" - Certificates can be issued from this CA. CRLs will be generated

// for this CA. The CA will be part of the CaPool's trust anchor, but will not

// be used to issue certificates from the CaPool.

// "AWAITING_USER_ACTIVATION" - Certificates cannot be issued from this CA.

// CRLs will not be generated. The CA will not be part of the CaPool's trust

// anchor, and will not be used to issue certificates from the CaPool.

// "DELETED" - Certificates cannot be issued from this CA. CRLs will not be

// generated. The CA may still be recovered by calling

// CertificateAuthorityService.UndeleteCertificateAuthority before expire_time.

// The CA will not be part of the CaPool's trust anchor, and will not be used

// to issue certificates from the CaPool.

State string `json:"state,omitempty"`

// SubordinateConfig: Optional. If this is a subordinate CertificateAuthority,

// this field will be set with the subordinate configuration, which describes

// its issuers. This may be updated, but this CertificateAuthority must

// continue to validate.

SubordinateConfig *SubordinateConfig `json:"subordinateConfig,omitempty"`

// Tier: Output only. The CaPool.Tier of the CaPool that includes this

// CertificateAuthority.

//

// Possible values:

// "TIER_UNSPECIFIED" - Not specified.

// "ENTERPRISE" - Enterprise tier.

// "DEVOPS" - DevOps tier.

Tier string `json:"tier,omitempty"`

// Type: Required. Immutable. The Type of this CertificateAuthority.

//

// Possible values:

// "TYPE_UNSPECIFIED" - Not specified.

// "SELF_SIGNED" - Self-signed CA.

// "SUBORDINATE" - Subordinate CA. Could be issued by a Private CA

// CertificateAuthority or an unmanaged CA.

Type string `json:"type,omitempty"`

// UpdateTime: Output only. The time at which this CertificateAuthority was

// last updated.

UpdateTime string `json:"updateTime,omitempty"`

// UserDefinedAccessUrls: Optional. User-defined URLs for CA certificate and

// CRLs. The service does not publish content to these URLs. It is up to the

// user to mirror content to these URLs.

UserDefinedAccessUrls *UserDefinedAccessUrls `json:"userDefinedAccessUrls,omitempty"`

// ServerResponse contains the HTTP response code and headers from the server.

googleapi.ServerResponse `json:"-"`

// ForceSendFields is a list of field names (e.g. "AccessUrls") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "AccessUrls") to include in API

// requests with the JSON null value. By default, fields with empty values are

// omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s CertificateAuthority) MarshalJSON() ([]byte, error) {

type NoMethod CertificateAuthority

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// CertificateConfig: A CertificateConfig describes an X.509 certificate or CSR

// that is to be created, as an alternative to using ASN.1.

type CertificateConfig struct {

// PublicKey: Optional. The public key that corresponds to this config. This

// is, for example, used when issuing Certificates, but not when creating a

// self-signed CertificateAuthority or CertificateAuthority CSR.

PublicKey *PublicKey `json:"publicKey,omitempty"`

// SubjectConfig: Required. Specifies some of the values in a certificate that

// are related to the subject.

SubjectConfig *SubjectConfig `json:"subjectConfig,omitempty"`

// SubjectKeyId: Optional. When specified this provides a custom SKI to be used

// in the certificate. This should only be used to maintain a SKI of an

// existing CA originally created outside CA service, which was not generated

// using method (1) described in RFC 5280 section 4.2.1.2.

SubjectKeyId *CertificateConfigKeyId `json:"subjectKeyId,omitempty"`

// X509Config: Required. Describes how some of the technical X.509 fields in a

// certificate should be populated.

X509Config *X509Parameters `json:"x509Config,omitempty"`

// ForceSendFields is a list of field names (e.g. "PublicKey") to

// unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "PublicKey") to include in API

// requests with the JSON null value. By default, fields with empty values are

// omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s CertificateConfig) MarshalJSON() ([]byte, error) {

type NoMethod CertificateConfig

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// CertificateConfigKeyId: A KeyId identifies a specific public key, usually by

// hashing the public key.

type CertificateConfigKeyId struct {

// KeyId: Required. The value of this KeyId encoded in lowercase hexadecimal.

// This is most likely the 160 bit SHA-1 hash of the public key.

KeyId string `json:"keyId,omitempty"`

// ForceSendFields is a list of field names (e.g. "KeyId") to unconditionally

// include in API requests. By default, fields with empty or default values are

// omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "KeyId") to include in API

// requests with the JSON null value. By default, fields with empty values are

// omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s CertificateConfigKeyId) MarshalJSON() ([]byte, error) {

type NoMethod CertificateConfigKeyId

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// CertificateDescription: A CertificateDescription describes an X.509

// certificate or CSR that has been issued, as an alternative to using ASN.1 /

// X.509.

type CertificateDescription struct {

// AiaIssuingCertificateUrls: Describes lists of issuer CA certificate URLs

// that appear in the "Authority Information Access" extension in the

// certificate.

AiaIssuingCertificateUrls []string `json:"aiaIssuingCertificateUrls,omitempty"`

// AuthorityKeyId: Identifies the subject_key_id of the parent certificate, per

// https://tools.ietf.org/html/rfc5280#section-4.2.1.1

AuthorityKeyId *KeyId `json:"authorityKeyId,omitempty"`

// CertFingerprint: The hash of the x.509 certificate.

CertFingerprint *CertificateFingerprint `json:"certFingerprint,omitempty"`

// CrlDistributionPoints: Describes a list of locations to obtain CRL

// information, i.e. the DistributionPoint.fullName described by

// https://tools.ietf.org/html/rfc5280#section-4.2.1.13

CrlDistributionPoints []string `json:"crlDistributionPoints,omitempty"`

// PublicKey: The public key that corresponds to an issued certificate.

PublicKey *PublicKey `json:"publicKey,omitempty"`

// SubjectDescription: Describes some of the values in a certificate that are

// related to the subject and lifetime.

SubjectDescription *SubjectDescription `json:"subjectDescription,omitempty"`

// SubjectKeyId: Provides a means of identifiying certificates that contain a

// particular public key, per

// https://tools.ietf.org/html/rfc5280#section-4.2.1.2.

SubjectKeyId *KeyId `json:"subjectKeyId,omitempty"`

// TbsCertificateDigest: The hash of the pre-signed certificate, which will be

// signed by the CA. Corresponds to the TBS Certificate in

// https://tools.ietf.org/html/rfc5280#section-4.1.2. The field will always be

// populated.

TbsCertificateDigest string `json:"tbsCertificateDigest,omitempty"`

// X509Description: Describes some of the technical X.509 fields in a

// certificate.

X509Description *X509Parameters `json:"x509Description,omitempty"`

// ForceSendFields is a list of field names (e.g. "AiaIssuingCertificateUrls")

// to unconditionally include in API requests. By default, fields with empty or

// default values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more

// details.

ForceSendFields []string `json:"-"`

// NullFields is a list of field names (e.g. "AiaIssuingCertificateUrls") to

// include in API requests with the JSON null value. By default, fields with

// empty values are omitted from API requests. See

// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.

NullFields []string `json:"-"`

}

func (s CertificateDescription) MarshalJSON() ([]byte, error) {

type NoMethod CertificateDescription

return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)

}

// CertificateExtensionConstraints: Describes a set of X.509 extensions that

// may be part of some certificate issuance controls.

type CertificateExtensionConstraints struct {

// AdditionalExtensions: Optional. A set of ObjectIds identifying custom X.509

// extensions. Will be combined with known_extensions to determine the full set

// of X.509 extensions.

AdditionalExtensions []*ObjectId `json:"additionalExtensions,omitempty"`

// KnownExtensions: Optional. A set of named X.509 extensions. Will be combined

// with additional_extensions to determine the full set of X.509 extensions.

//

// Possible values:

// "KNOWN_CERTIFICATE_EXTENSION_UNSPECIFIED" - Not specified.

// "BASE_KEY_USAGE" - Refers to a certificate's Key Usage extension, as

// described in [RFC 5280 section