{
  "auth": {
    "oauth2": {
      "scopes": {
        "https://www.googleapis.com/auth/cloud-platform": {
          "description": "View and manage your data across Google Cloud Platform services"
        }
      }
    }
  },
  "basePath": "",
  "baseUrl": "https://iamcredentials.googleapis.com/",
  "batchPath": "batch",
  "canonicalName": "IAM Credentials",
  "description": "Creates short-lived, limited-privilege credentials for IAM service accounts.",
  "discoveryVersion": "v1",
  "documentationLink": "https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials",
  "fullyEncodeReservedExpansion": true,
  "icons": {
    "x16": "http://www.google.com/images/icons/product/search-16.gif",
    "x32": "http://www.google.com/images/icons/product/search-32.gif"
  },
  "id": "iamcredentials:v1",
  "kind": "discovery#restDescription",
  "name": "iamcredentials",
  "ownerDomain": "google.com",
  "ownerName": "Google",
  "parameters": {
    "$.xgafv": {
      "description": "V1 error format.",
      "enum": [
        "1",
        "2"
      ],
      "enumDescriptions": [
        "v1 error format",
        "v2 error format"
      ],
      "location": "query",
      "type": "string"
    },
    "access_token": {
      "description": "OAuth access token.",
      "location": "query",
      "type": "string"
    },
    "alt": {
      "default": "json",
      "description": "Data format for response.",
      "enum": [
        "json",
        "media",
        "proto"
      ],
      "enumDescriptions": [
        "Responses with Content-Type of application/json",
        "Media download with context-dependent Content-Type",
        "Responses with Content-Type of application/x-protobuf"
      ],
      "location": "query",
      "type": "string"
    },
    "callback": {
      "description": "JSONP",
      "location": "query",
      "type": "string"
    },
    "fields": {
      "description": "Selector specifying which fields to include in a partial response.",
      "location": "query",
      "type": "string"
    },
    "key": {
      "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.",
      "location": "query",
      "type": "string"
    },
    "oauth_token": {
      "description": "OAuth 2.0 token for the current user.",
      "location": "query",
      "type": "string"
    },
    "prettyPrint": {
      "default": "true",
      "description": "Returns response with indentations and line breaks.",
      "location": "query",
      "type": "boolean"
    },
    "quotaUser": {
      "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.",
      "location": "query",
      "type": "string"
    },
    "uploadType": {
      "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\").",
      "location": "query",
      "type": "string"
    },
    "upload_protocol": {
      "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").",
      "location": "query",
      "type": "string"
    }
  },
  "protocol": "rest",
  "resources": {
    "projects": {
      "resources": {
        "serviceAccounts": {
          "methods": {
            "generateAccessToken": {
              "description": "Generates an OAuth 2.0 access token for a service account.",
              "flatPath": "v1/projects/{projectsId}/serviceAccounts/{serviceAccountsId}:generateAccessToken",
              "httpMethod": "POST",
              "id": "iamcredentials.projects.serviceAccounts.generateAccessToken",
              "parameterOrder": [
                "name"
              ],
              "parameters": {
                "name": {
                  "description": "Required. The resource name of the service account for which the credentials\nare requested, in the following format:\n`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard\ncharacter is required; replacing it with a project ID is invalid.",
                  "location": "path",
                  "pattern": "^projects/[^/]+/serviceAccounts/[^/]+$",
                  "required": true,
                  "type": "string"
                }
              },
              "path": "v1/{+name}:generateAccessToken",
              "request": {
                "$ref": "GenerateAccessTokenRequest"
              },
              "response": {
                "$ref": "GenerateAccessTokenResponse"
              },
              "scopes": [
                "https://www.googleapis.com/auth/cloud-platform"
              ]
            },
            "generateIdToken": {
              "description": "Generates an OpenID Connect ID token for a service account.",
              "flatPath": "v1/projects/{projectsId}/serviceAccounts/{serviceAccountsId}:generateIdToken",
              "httpMethod": "POST",
              "id": "iamcredentials.projects.serviceAccounts.generateIdToken",
              "parameterOrder": [
                "name"
              ],
              "parameters": {
                "name": {
                  "description": "Required. The resource name of the service account for which the credentials\nare requested, in the following format:\n`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard\ncharacter is required; replacing it with a project ID is invalid.",
                  "location": "path",
                  "pattern": "^projects/[^/]+/serviceAccounts/[^/]+$",
                  "required": true,
                  "type": "string"
                }
              },
              "path": "v1/{+name}:generateIdToken",
              "request": {
                "$ref": "GenerateIdTokenRequest"
              },
              "response": {
                "$ref": "GenerateIdTokenResponse"
              },
              "scopes": [
                "https://www.googleapis.com/auth/cloud-platform"
              ]
            },
            "signBlob": {
              "description": "Signs a blob using a service account's system-managed private key.",
              "flatPath": "v1/projects/{projectsId}/serviceAccounts/{serviceAccountsId}:signBlob",
              "httpMethod": "POST",
              "id": "iamcredentials.projects.serviceAccounts.signBlob",
              "parameterOrder": [
                "name"
              ],
              "parameters": {
                "name": {
                  "description": "Required. The resource name of the service account for which the credentials\nare requested, in the following format:\n`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard\ncharacter is required; replacing it with a project ID is invalid.",
                  "location": "path",
                  "pattern": "^projects/[^/]+/serviceAccounts/[^/]+$",
                  "required": true,
                  "type": "string"
                }
              },
              "path": "v1/{+name}:signBlob",
              "request": {
                "$ref": "SignBlobRequest"
              },
              "response": {
                "$ref": "SignBlobResponse"
              },
              "scopes": [
                "https://www.googleapis.com/auth/cloud-platform"
              ]
            },
            "signJwt": {
              "description": "Signs a JWT using a service account's system-managed private key.",
              "flatPath": "v1/projects/{projectsId}/serviceAccounts/{serviceAccountsId}:signJwt",
              "httpMethod": "POST",
              "id": "iamcredentials.projects.serviceAccounts.signJwt",
              "parameterOrder": [
                "name"
              ],
              "parameters": {
                "name": {
                  "description": "Required. The resource name of the service account for which the credentials\nare requested, in the following format:\n`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard\ncharacter is required; replacing it with a project ID is invalid.",
                  "location": "path",
                  "pattern": "^projects/[^/]+/serviceAccounts/[^/]+$",
                  "required": true,
                  "type": "string"
                }
              },
              "path": "v1/{+name}:signJwt",
              "request": {
                "$ref": "SignJwtRequest"
              },
              "response": {
                "$ref": "SignJwtResponse"
              },
              "scopes": [
                "https://www.googleapis.com/auth/cloud-platform"
              ]
            }
          }
        }
      }
    }
  },
  "revision": "20191206",
  "rootUrl": "https://iamcredentials.googleapis.com/",
  "schemas": {
    "GenerateAccessTokenRequest": {
      "id": "GenerateAccessTokenRequest",
      "properties": {
        "delegates": {
          "description": "The sequence of service accounts in a delegation chain. Each service\naccount must be granted the `roles/iam.serviceAccountTokenCreator` role\non its next service account in the chain. The last service account in the\nchain must be granted the `roles/iam.serviceAccountTokenCreator` role\non the service account that is specified in the `name` field of the\nrequest.\n\nThe delegates must have the following format:\n`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard\ncharacter is required; replacing it with a project ID is invalid.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "lifetime": {
          "description": "The desired lifetime duration of the access token in seconds.\nMust be set to a value less than or equal to 3600 (1 hour). If a value is\nnot specified, the token's lifetime will be set to a default value of one\nhour.",
          "format": "google-duration",
          "type": "string"
        },
        "scope": {
          "description": "Required. Code to identify the scopes to be included in the OAuth 2.0 access token.\nSee https://developers.google.com/identity/protocols/googlescopes for more\ninformation.\nAt least one value required.",
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "GenerateAccessTokenResponse": {
      "id": "GenerateAccessTokenResponse",
      "properties": {
        "accessToken": {
          "description": "The OAuth 2.0 access token.",
          "type": "string"
        },
        "expireTime": {
          "description": "Token expiration time.\nThe expiration time is always set.",
          "format": "google-datetime",
          "type": "string"
        }
      },
      "type": "object"
    },
    "GenerateIdTokenRequest": {
      "id": "GenerateIdTokenRequest",
      "properties": {
        "audience": {
          "description": "Required. The audience for the token, such as the API or account that this token\ngrants access to.",
          "type": "string"
        },
        "delegates": {
          "description": "The sequence of service accounts in a delegation chain. Each service\naccount must be granted the `roles/iam.serviceAccountTokenCreator` role\non its next service account in the chain. The last service account in the\nchain must be granted the `roles/iam.serviceAccountTokenCreator` role\non the service account that is specified in the `name` field of the\nrequest.\n\nThe delegates must have the following format:\n`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard\ncharacter is required; replacing it with a project ID is invalid.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "includeEmail": {
          "description": "Include the service account email in the token. If set to `true`, the\ntoken will contain `email` and `email_verified` claims.",
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "GenerateIdTokenResponse": {
      "id": "GenerateIdTokenResponse",
      "properties": {
        "token": {
          "description": "The OpenId Connect ID token.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "SignBlobRequest": {
      "id": "SignBlobRequest",
      "properties": {
        "delegates": {
          "description": "The sequence of service accounts in a delegation chain. Each service\naccount must be granted the `roles/iam.serviceAccountTokenCreator` role\non its next service account in the chain. The last service account in the\nchain must be granted the `roles/iam.serviceAccountTokenCreator` role\non the service account that is specified in the `name` field of the\nrequest.\n\nThe delegates must have the following format:\n`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard\ncharacter is required; replacing it with a project ID is invalid.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "payload": {
          "description": "Required. The bytes to sign.",
          "format": "byte",
          "type": "string"
        }
      },
      "type": "object"
    },
    "SignBlobResponse": {
      "id": "SignBlobResponse",
      "properties": {
        "keyId": {
          "description": "The ID of the key used to sign the blob.",
          "type": "string"
        },
        "signedBlob": {
          "description": "The signed blob.",
          "format": "byte",
          "type": "string"
        }
      },
      "type": "object"
    },
    "SignJwtRequest": {
      "id": "SignJwtRequest",
      "properties": {
        "delegates": {
          "description": "The sequence of service accounts in a delegation chain. Each service\naccount must be granted the `roles/iam.serviceAccountTokenCreator` role\non its next service account in the chain. The last service account in the\nchain must be granted the `roles/iam.serviceAccountTokenCreator` role\non the service account that is specified in the `name` field of the\nrequest.\n\nThe delegates must have the following format:\n`projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard\ncharacter is required; replacing it with a project ID is invalid.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "payload": {
          "description": "Required. The JWT payload to sign: a JSON object that contains a JWT Claims Set.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "SignJwtResponse": {
      "id": "SignJwtResponse",
      "properties": {
        "keyId": {
          "description": "The ID of the key used to sign the JWT.",
          "type": "string"
        },
        "signedJwt": {
          "description": "The signed JWT.",
          "type": "string"
        }
      },
      "type": "object"
    }
  },
  "servicePath": "",
  "title": "IAM Service Account Credentials API",
  "version": "v1",
  "version_module": true
}