Package com.google.cloud.iam.admin.v1

Class IAMClient

  • All Implemented Interfaces:
    com.google.api.gax.core.BackgroundResource, AutoCloseable
    @Generated("by gapic-generator-java")
public class IAMClient
extends Object
implements com.google.api.gax.core.BackgroundResource
    Service Description: Creates and manages Identity and Access Management (IAM) resources.

    You can use this service to work with all of the following resources:

    • **Service accounts**, which identify an application or a virtual machine (VM) instance rather than a person
    • **Service account keys**, which service accounts use to authenticate with Google APIs
    • **IAM policies for service accounts**, which specify the roles that a principal has for the service account
    • **IAM custom roles**, which help you limit the number of permissions that you grant to principals

    In addition, you can use this service to complete the following tasks, among others:

    • Test whether a service account can use specific permissions
    • Check which roles you can grant for a specific resource
    • Lint, or validate, condition expressions in an IAM policy

    When you read data from the IAM API, each read is eventually consistent. In other words, if you write data with the IAM API, then immediately read that data, the read operation might return an older version of the data. To deal with this behavior, your application can retry the request with truncated exponential backoff.

    In contrast, writing data to the IAM API is sequentially consistent. In other words, write operations are always processed in the order in which they were received.

    This class provides the ability to make remote calls to the backing service through method calls that map to API methods. Sample code to get started: 

    
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ServiceAccountName name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]");
   ServiceAccount response = iAMClient.getServiceAccount(name);
 }

    Note: close() needs to be called on the IAMClient object to clean up resources such as threads. In the example above, try-with-resources is used, which automatically calls close().

    The surface of this class includes several types of Java methods for each of the API's methods:

    1. A "flattened" method. With this type of method, the fields of the request type have been converted into function parameters. It may be the case that not all fields are available as parameters, and not every API method will have a flattened method entry point.
    2. A "request object" method. This type of method only takes one parameter, a request object, which must be constructed before the call. Not every API method will have a request object method.
    3. A "callable" method. This type of method takes no parameters and returns an immutable API callable object, which can be used to initiate calls to the service.

    See the individual methods for example code.

    Many parameters require resource names to be formatted in a particular way. To assist with these names, this class includes a format method for each type of name, and additionally a parse method to extract the individual identifiers contained within names that are returned.

    This class can be customized by passing in a custom instance of IAMSettings to create(). For example:

    To customize credentials: 

    
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 IAMSettings iAMSettings =
     IAMSettings.newBuilder()
         .setCredentialsProvider(FixedCredentialsProvider.create(myCredentials))
         .build();
 IAMClient iAMClient = IAMClient.create(iAMSettings);

    To customize the endpoint: 

    
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 IAMSettings iAMSettings = IAMSettings.newBuilder().setEndpoint(myEndpoint).build();
 IAMClient iAMClient = IAMClient.create(iAMSettings);

    Please refer to the GitHub repository's samples for more quickstart code snippets.

    • Constructor Detail

      • IAMClient

        protected IAMClient​(IAMSettings settings)
             throws IOException
        Constructs an instance of IAMClient, using the given settings. This is protected so that it is easy to make a subclass, but otherwise, the static factory methods should be preferred.
        Throws:
        IOException

      • IAMClient

        protected IAMClient​(IAMStub stub)

    • Method Detail

      • create

        public static final IAMClient create​(IAMSettings settings)
                              throws IOException
        Constructs an instance of IAMClient, using the given settings. The channels are created based on the settings passed in, or defaults for any settings that are not set.
        Throws:
        IOException

      • create

        public static final IAMClient create​(IAMStub stub)
        Constructs an instance of IAMClient, using the given stub for making calls. This is for advanced usage - prefer using create(IAMSettings).

      • getStub

        public IAMStub getStub()

      • listServiceAccounts

        public final IAMClient.ListServiceAccountsPagedResponse listServiceAccounts​(ProjectName name)
        Lists every [ServiceAccount][google.iam.admin.v1.ServiceAccount] that belongs to a specific project.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ProjectName name = ProjectName.of("[PROJECT]");
   for (ServiceAccount element : iAMClient.listServiceAccounts(name).iterateAll()) {
     // doThingsWith(element);
   }
 }
        Parameters:
        name - Required. The resource name of the project associated with the service accounts, such as `projects/my-project-123`.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • listServiceAccounts

        public final IAMClient.ListServiceAccountsPagedResponse listServiceAccounts​(String name)
        Lists every [ServiceAccount][google.iam.admin.v1.ServiceAccount] that belongs to a specific project.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = ProjectName.of("[PROJECT]").toString();
   for (ServiceAccount element : iAMClient.listServiceAccounts(name).iterateAll()) {
     // doThingsWith(element);
   }
 }
        Parameters:
        name - Required. The resource name of the project associated with the service accounts, such as `projects/my-project-123`.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • listServiceAccounts

        public final IAMClient.ListServiceAccountsPagedResponse listServiceAccounts​(ListServiceAccountsRequest request)
        Lists every [ServiceAccount][google.iam.admin.v1.ServiceAccount] that belongs to a specific project.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ListServiceAccountsRequest request =
       ListServiceAccountsRequest.newBuilder()
           .setName(ProjectName.of("[PROJECT]").toString())
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .build();
   for (ServiceAccount element : iAMClient.listServiceAccounts(request).iterateAll()) {
     // doThingsWith(element);
   }
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • listServiceAccountsPagedCallable

        public final com.google.api.gax.rpc.UnaryCallable<ListServiceAccountsRequest,​IAMClient.ListServiceAccountsPagedResponse> listServiceAccountsPagedCallable()
        Lists every [ServiceAccount][google.iam.admin.v1.ServiceAccount] that belongs to a specific project.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ListServiceAccountsRequest request =
       ListServiceAccountsRequest.newBuilder()
           .setName(ProjectName.of("[PROJECT]").toString())
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .build();
   ApiFuture<ServiceAccount> future =
       iAMClient.listServiceAccountsPagedCallable().futureCall(request);
   // Do something.
   for (ServiceAccount element : future.get().iterateAll()) {
     // doThingsWith(element);
   }
 }

      • listServiceAccountsCallable

        public final com.google.api.gax.rpc.UnaryCallable<ListServiceAccountsRequest,​ListServiceAccountsResponse> listServiceAccountsCallable()
        Lists every [ServiceAccount][google.iam.admin.v1.ServiceAccount] that belongs to a specific project.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ListServiceAccountsRequest request =
       ListServiceAccountsRequest.newBuilder()
           .setName(ProjectName.of("[PROJECT]").toString())
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .build();
   while (true) {
     ListServiceAccountsResponse response =
         iAMClient.listServiceAccountsCallable().call(request);
     for (ServiceAccount element : response.getAccountsList()) {
       // doThingsWith(element);
     }
     String nextPageToken = response.getNextPageToken();
     if (!Strings.isNullOrEmpty(nextPageToken)) {
       request = request.toBuilder().setPageToken(nextPageToken).build();
     } else {
       break;
     }
   }
 }

      • getServiceAccount

        public final ServiceAccount getServiceAccount​(ServiceAccountName name)
        Gets a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ServiceAccountName name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]");
   ServiceAccount response = iAMClient.getServiceAccount(name);
 }
        Parameters:
        name - Required. The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • getServiceAccount

        public final ServiceAccount getServiceAccount​(String name)
        Gets a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString();
   ServiceAccount response = iAMClient.getServiceAccount(name);
 }
        Parameters:
        name - Required. The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • getServiceAccount

        public final ServiceAccount getServiceAccount​(GetServiceAccountRequest request)
        Gets a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   GetServiceAccountRequest request =
       GetServiceAccountRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .build();
   ServiceAccount response = iAMClient.getServiceAccount(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • getServiceAccountCallable

        public final com.google.api.gax.rpc.UnaryCallable<GetServiceAccountRequest,​ServiceAccount> getServiceAccountCallable()
        Gets a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   GetServiceAccountRequest request =
       GetServiceAccountRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .build();
   ApiFuture<ServiceAccount> future = iAMClient.getServiceAccountCallable().futureCall(request);
   // Do something.
   ServiceAccount response = future.get();
 }

      • createServiceAccount

        public final ServiceAccount createServiceAccount​(ProjectName name,
                                                 String accountId,
                                                 ServiceAccount serviceAccount)
        Creates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ProjectName name = ProjectName.of("[PROJECT]");
   String accountId = "accountId-1827029976";
   ServiceAccount serviceAccount = ServiceAccount.newBuilder().build();
   ServiceAccount response = iAMClient.createServiceAccount(name, accountId, serviceAccount);
 }
        Parameters:
        name - Required. The resource name of the project associated with the service accounts, such as `projects/my-project-123`.
        accountId - Required. The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])` to comply with RFC1035.
        serviceAccount - The [ServiceAccount][google.iam.admin.v1.ServiceAccount] resource to create. Currently, only the following values are user assignable: `display_name` and `description`.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • createServiceAccount

        public final ServiceAccount createServiceAccount​(String name,
                                                 String accountId,
                                                 ServiceAccount serviceAccount)
        Creates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = ProjectName.of("[PROJECT]").toString();
   String accountId = "accountId-1827029976";
   ServiceAccount serviceAccount = ServiceAccount.newBuilder().build();
   ServiceAccount response = iAMClient.createServiceAccount(name, accountId, serviceAccount);
 }
        Parameters:
        name - Required. The resource name of the project associated with the service accounts, such as `projects/my-project-123`.
        accountId - Required. The account id that is used to generate the service account email address and a stable unique id. It is unique within a project, must be 6-30 characters long, and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])` to comply with RFC1035.
        serviceAccount - The [ServiceAccount][google.iam.admin.v1.ServiceAccount] resource to create. Currently, only the following values are user assignable: `display_name` and `description`.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • createServiceAccount

        public final ServiceAccount createServiceAccount​(CreateServiceAccountRequest request)
        Creates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   CreateServiceAccountRequest request =
       CreateServiceAccountRequest.newBuilder()
           .setName(ProjectName.of("[PROJECT]").toString())
           .setAccountId("accountId-1827029976")
           .setServiceAccount(ServiceAccount.newBuilder().build())
           .build();
   ServiceAccount response = iAMClient.createServiceAccount(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • createServiceAccountCallable

        public final com.google.api.gax.rpc.UnaryCallable<CreateServiceAccountRequest,​ServiceAccount> createServiceAccountCallable()
        Creates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   CreateServiceAccountRequest request =
       CreateServiceAccountRequest.newBuilder()
           .setName(ProjectName.of("[PROJECT]").toString())
           .setAccountId("accountId-1827029976")
           .setServiceAccount(ServiceAccount.newBuilder().build())
           .build();
   ApiFuture<ServiceAccount> future =
       iAMClient.createServiceAccountCallable().futureCall(request);
   // Do something.
   ServiceAccount response = future.get();
 }

      • updateServiceAccount

        public final ServiceAccount updateServiceAccount​(ServiceAccount request)
        **Note:** We are in the process of deprecating this method. Use [PatchServiceAccount][google.iam.admin.v1.IAM.PatchServiceAccount] instead.

        Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        You can update only the `display_name` field.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ServiceAccount request =
       ServiceAccount.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setProjectId("projectId-894832108")
           .setUniqueId("uniqueId-294460212")
           .setEmail("email96619420")
           .setDisplayName("displayName1714148973")
           .setEtag(ByteString.EMPTY)
           .setDescription("description-1724546052")
           .setOauth2ClientId("oauth2ClientId-1210797087")
           .setDisabled(true)
           .build();
   ServiceAccount response = iAMClient.updateServiceAccount(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • updateServiceAccountCallable

        public final com.google.api.gax.rpc.UnaryCallable<ServiceAccount,​ServiceAccount> updateServiceAccountCallable()
        **Note:** We are in the process of deprecating this method. Use [PatchServiceAccount][google.iam.admin.v1.IAM.PatchServiceAccount] instead.

        Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        You can update only the `display_name` field.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ServiceAccount request =
       ServiceAccount.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setProjectId("projectId-894832108")
           .setUniqueId("uniqueId-294460212")
           .setEmail("email96619420")
           .setDisplayName("displayName1714148973")
           .setEtag(ByteString.EMPTY)
           .setDescription("description-1724546052")
           .setOauth2ClientId("oauth2ClientId-1210797087")
           .setDisabled(true)
           .build();
   ApiFuture<ServiceAccount> future =
       iAMClient.updateServiceAccountCallable().futureCall(request);
   // Do something.
   ServiceAccount response = future.get();
 }

      • patchServiceAccount

        public final ServiceAccount patchServiceAccount​(PatchServiceAccountRequest request)
        Patches a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   PatchServiceAccountRequest request =
       PatchServiceAccountRequest.newBuilder()
           .setServiceAccount(ServiceAccount.newBuilder().build())
           .setUpdateMask(FieldMask.newBuilder().build())
           .build();
   ServiceAccount response = iAMClient.patchServiceAccount(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • patchServiceAccountCallable

        public final com.google.api.gax.rpc.UnaryCallable<PatchServiceAccountRequest,​ServiceAccount> patchServiceAccountCallable()
        Patches a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   PatchServiceAccountRequest request =
       PatchServiceAccountRequest.newBuilder()
           .setServiceAccount(ServiceAccount.newBuilder().build())
           .setUpdateMask(FieldMask.newBuilder().build())
           .build();
   ApiFuture<ServiceAccount> future =
       iAMClient.patchServiceAccountCallable().futureCall(request);
   // Do something.
   ServiceAccount response = future.get();
 }

      • deleteServiceAccount

        public final void deleteServiceAccount​(ServiceAccountName name)
        Deletes a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        **Warning:** After you delete a service account, you might not be able to undelete it. If you know that you need to re-enable the service account in the future, use [DisableServiceAccount][google.iam.admin.v1.IAM.DisableServiceAccount] instead.

        If you delete a service account, IAM permanently removes the service account 30 days later. Google Cloud cannot recover the service account after it is permanently removed, even if you file a support request.

        To help avoid unplanned outages, we recommend that you disable the service account before you delete it. Use [DisableServiceAccount][google.iam.admin.v1.IAM.DisableServiceAccount] to disable the service account, then wait at least 24 hours and watch for unintended consequences. If there are no unintended consequences, you can delete the service account.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ServiceAccountName name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]");
   iAMClient.deleteServiceAccount(name);
 }
        Parameters:
        name - Required. The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • deleteServiceAccount

        public final void deleteServiceAccount​(String name)
        Deletes a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        **Warning:** After you delete a service account, you might not be able to undelete it. If you know that you need to re-enable the service account in the future, use [DisableServiceAccount][google.iam.admin.v1.IAM.DisableServiceAccount] instead.

        If you delete a service account, IAM permanently removes the service account 30 days later. Google Cloud cannot recover the service account after it is permanently removed, even if you file a support request.

        To help avoid unplanned outages, we recommend that you disable the service account before you delete it. Use [DisableServiceAccount][google.iam.admin.v1.IAM.DisableServiceAccount] to disable the service account, then wait at least 24 hours and watch for unintended consequences. If there are no unintended consequences, you can delete the service account.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString();
   iAMClient.deleteServiceAccount(name);
 }
        Parameters:
        name - Required. The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • deleteServiceAccount

        public final void deleteServiceAccount​(DeleteServiceAccountRequest request)
        Deletes a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        **Warning:** After you delete a service account, you might not be able to undelete it. If you know that you need to re-enable the service account in the future, use [DisableServiceAccount][google.iam.admin.v1.IAM.DisableServiceAccount] instead.

        If you delete a service account, IAM permanently removes the service account 30 days later. Google Cloud cannot recover the service account after it is permanently removed, even if you file a support request.

        To help avoid unplanned outages, we recommend that you disable the service account before you delete it. Use [DisableServiceAccount][google.iam.admin.v1.IAM.DisableServiceAccount] to disable the service account, then wait at least 24 hours and watch for unintended consequences. If there are no unintended consequences, you can delete the service account.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   DeleteServiceAccountRequest request =
       DeleteServiceAccountRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .build();
   iAMClient.deleteServiceAccount(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • deleteServiceAccountCallable

        public final com.google.api.gax.rpc.UnaryCallable<DeleteServiceAccountRequest,​com.google.protobuf.Empty> deleteServiceAccountCallable()
        Deletes a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        **Warning:** After you delete a service account, you might not be able to undelete it. If you know that you need to re-enable the service account in the future, use [DisableServiceAccount][google.iam.admin.v1.IAM.DisableServiceAccount] instead.

        If you delete a service account, IAM permanently removes the service account 30 days later. Google Cloud cannot recover the service account after it is permanently removed, even if you file a support request.

        To help avoid unplanned outages, we recommend that you disable the service account before you delete it. Use [DisableServiceAccount][google.iam.admin.v1.IAM.DisableServiceAccount] to disable the service account, then wait at least 24 hours and watch for unintended consequences. If there are no unintended consequences, you can delete the service account.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   DeleteServiceAccountRequest request =
       DeleteServiceAccountRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .build();
   ApiFuture<Empty> future = iAMClient.deleteServiceAccountCallable().futureCall(request);
   // Do something.
   future.get();
 }

      • undeleteServiceAccount

        public final UndeleteServiceAccountResponse undeleteServiceAccount​(UndeleteServiceAccountRequest request)
        Restores a deleted [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        **Important:** It is not always possible to restore a deleted service account. Use this method only as a last resort.

        After you delete a service account, IAM permanently removes the service account 30 days later. There is no way to restore a deleted service account that has been permanently removed.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   UndeleteServiceAccountRequest request =
       UndeleteServiceAccountRequest.newBuilder().setName("name3373707").build();
   UndeleteServiceAccountResponse response = iAMClient.undeleteServiceAccount(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • undeleteServiceAccountCallable

        public final com.google.api.gax.rpc.UnaryCallable<UndeleteServiceAccountRequest,​UndeleteServiceAccountResponse> undeleteServiceAccountCallable()
        Restores a deleted [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        **Important:** It is not always possible to restore a deleted service account. Use this method only as a last resort.

        After you delete a service account, IAM permanently removes the service account 30 days later. There is no way to restore a deleted service account that has been permanently removed.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   UndeleteServiceAccountRequest request =
       UndeleteServiceAccountRequest.newBuilder().setName("name3373707").build();
   ApiFuture<UndeleteServiceAccountResponse> future =
       iAMClient.undeleteServiceAccountCallable().futureCall(request);
   // Do something.
   UndeleteServiceAccountResponse response = future.get();
 }

      • enableServiceAccount

        public final void enableServiceAccount​(EnableServiceAccountRequest request)
        Enables a [ServiceAccount][google.iam.admin.v1.ServiceAccount] that was disabled by [DisableServiceAccount][google.iam.admin.v1.IAM.DisableServiceAccount].

        If the service account is already enabled, then this method has no effect.

        If the service account was disabled by other means—for example, if Google disabled the service account because it was compromised—you cannot use this method to enable the service account.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   EnableServiceAccountRequest request =
       EnableServiceAccountRequest.newBuilder().setName("name3373707").build();
   iAMClient.enableServiceAccount(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • enableServiceAccountCallable

        public final com.google.api.gax.rpc.UnaryCallable<EnableServiceAccountRequest,​com.google.protobuf.Empty> enableServiceAccountCallable()
        Enables a [ServiceAccount][google.iam.admin.v1.ServiceAccount] that was disabled by [DisableServiceAccount][google.iam.admin.v1.IAM.DisableServiceAccount].

        If the service account is already enabled, then this method has no effect.

        If the service account was disabled by other means—for example, if Google disabled the service account because it was compromised—you cannot use this method to enable the service account.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   EnableServiceAccountRequest request =
       EnableServiceAccountRequest.newBuilder().setName("name3373707").build();
   ApiFuture<Empty> future = iAMClient.enableServiceAccountCallable().futureCall(request);
   // Do something.
   future.get();
 }

      • disableServiceAccount

        public final void disableServiceAccount​(DisableServiceAccountRequest request)
        Disables a [ServiceAccount][google.iam.admin.v1.ServiceAccount] immediately.

        If an application uses the service account to authenticate, that application can no longer call Google APIs or access Google Cloud resources. Existing access tokens for the service account are rejected, and requests for new access tokens will fail.

        To re-enable the service account, use [EnableServiceAccount][google.iam.admin.v1.IAM.EnableServiceAccount]. After you re-enable the service account, its existing access tokens will be accepted, and you can request new access tokens.

        To help avoid unplanned outages, we recommend that you disable the service account before you delete it. Use this method to disable the service account, then wait at least 24 hours and watch for unintended consequences. If there are no unintended consequences, you can delete the service account with [DeleteServiceAccount][google.iam.admin.v1.IAM.DeleteServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   DisableServiceAccountRequest request =
       DisableServiceAccountRequest.newBuilder().setName("name3373707").build();
   iAMClient.disableServiceAccount(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • disableServiceAccountCallable

        public final com.google.api.gax.rpc.UnaryCallable<DisableServiceAccountRequest,​com.google.protobuf.Empty> disableServiceAccountCallable()
        Disables a [ServiceAccount][google.iam.admin.v1.ServiceAccount] immediately.

        If an application uses the service account to authenticate, that application can no longer call Google APIs or access Google Cloud resources. Existing access tokens for the service account are rejected, and requests for new access tokens will fail.

        To re-enable the service account, use [EnableServiceAccount][google.iam.admin.v1.IAM.EnableServiceAccount]. After you re-enable the service account, its existing access tokens will be accepted, and you can request new access tokens.

        To help avoid unplanned outages, we recommend that you disable the service account before you delete it. Use this method to disable the service account, then wait at least 24 hours and watch for unintended consequences. If there are no unintended consequences, you can delete the service account with [DeleteServiceAccount][google.iam.admin.v1.IAM.DeleteServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   DisableServiceAccountRequest request =
       DisableServiceAccountRequest.newBuilder().setName("name3373707").build();
   ApiFuture<Empty> future = iAMClient.disableServiceAccountCallable().futureCall(request);
   // Do something.
   future.get();
 }

      • listServiceAccountKeys

        public final ListServiceAccountKeysResponse listServiceAccountKeys​(ServiceAccountName name,
                                                                   List<ListServiceAccountKeysRequest.KeyType> keyTypes)
        Lists every [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey] for a service account.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ServiceAccountName name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]");
   List<ListServiceAccountKeysRequest.KeyType> keyTypes = new ArrayList<>();
   ListServiceAccountKeysResponse response = iAMClient.listServiceAccountKeys(name, keyTypes);
 }
        Parameters:
        name - Required. The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

        Using `-` as a wildcard for the `PROJECT_ID`, will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        keyTypes - Filters the types of keys the user wants to include in the list response. Duplicate key types are not allowed. If no key type is provided, all keys are returned.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • listServiceAccountKeys

        public final ListServiceAccountKeysResponse listServiceAccountKeys​(String name,
                                                                   List<ListServiceAccountKeysRequest.KeyType> keyTypes)
        Lists every [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey] for a service account.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString();
   List<ListServiceAccountKeysRequest.KeyType> keyTypes = new ArrayList<>();
   ListServiceAccountKeysResponse response = iAMClient.listServiceAccountKeys(name, keyTypes);
 }
        Parameters:
        name - Required. The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`.

        Using `-` as a wildcard for the `PROJECT_ID`, will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        keyTypes - Filters the types of keys the user wants to include in the list response. Duplicate key types are not allowed. If no key type is provided, all keys are returned.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • listServiceAccountKeys

        public final ListServiceAccountKeysResponse listServiceAccountKeys​(ListServiceAccountKeysRequest request)
        Lists every [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey] for a service account.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ListServiceAccountKeysRequest request =
       ListServiceAccountKeysRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .addAllKeyTypes(new ArrayList<ListServiceAccountKeysRequest.KeyType>())
           .build();
   ListServiceAccountKeysResponse response = iAMClient.listServiceAccountKeys(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • listServiceAccountKeysCallable

        public final com.google.api.gax.rpc.UnaryCallable<ListServiceAccountKeysRequest,​ListServiceAccountKeysResponse> listServiceAccountKeysCallable()
        Lists every [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey] for a service account.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ListServiceAccountKeysRequest request =
       ListServiceAccountKeysRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .addAllKeyTypes(new ArrayList<ListServiceAccountKeysRequest.KeyType>())
           .build();
   ApiFuture<ListServiceAccountKeysResponse> future =
       iAMClient.listServiceAccountKeysCallable().futureCall(request);
   // Do something.
   ListServiceAccountKeysResponse response = future.get();
 }

      • getServiceAccountKey

        public final ServiceAccountKey getServiceAccountKey​(KeyName name,
                                                    ServiceAccountPublicKeyType publicKeyType)
        Gets a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   KeyName name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]");
   ServiceAccountPublicKeyType publicKeyType = ServiceAccountPublicKeyType.forNumber(0);
   ServiceAccountKey response = iAMClient.getServiceAccountKey(name, publicKeyType);
 }
        Parameters:
        name - Required. The resource name of the service account key in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.

        Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        publicKeyType - Optional. The output format of the public key. The default is `TYPE_NONE`, which means that the public key is not returned.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • getServiceAccountKey

        public final ServiceAccountKey getServiceAccountKey​(String name,
                                                    ServiceAccountPublicKeyType publicKeyType)
        Gets a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString();
   ServiceAccountPublicKeyType publicKeyType = ServiceAccountPublicKeyType.forNumber(0);
   ServiceAccountKey response = iAMClient.getServiceAccountKey(name, publicKeyType);
 }
        Parameters:
        name - Required. The resource name of the service account key in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.

        Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        publicKeyType - Optional. The output format of the public key. The default is `TYPE_NONE`, which means that the public key is not returned.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • getServiceAccountKey

        public final ServiceAccountKey getServiceAccountKey​(GetServiceAccountKeyRequest request)
        Gets a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   GetServiceAccountKeyRequest request =
       GetServiceAccountKeyRequest.newBuilder()
           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
           .setPublicKeyType(ServiceAccountPublicKeyType.forNumber(0))
           .build();
   ServiceAccountKey response = iAMClient.getServiceAccountKey(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • getServiceAccountKeyCallable

        public final com.google.api.gax.rpc.UnaryCallable<GetServiceAccountKeyRequest,​ServiceAccountKey> getServiceAccountKeyCallable()
        Gets a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   GetServiceAccountKeyRequest request =
       GetServiceAccountKeyRequest.newBuilder()
           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
           .setPublicKeyType(ServiceAccountPublicKeyType.forNumber(0))
           .build();
   ApiFuture<ServiceAccountKey> future =
       iAMClient.getServiceAccountKeyCallable().futureCall(request);
   // Do something.
   ServiceAccountKey response = future.get();
 }

      • createServiceAccountKey

        public final ServiceAccountKey createServiceAccountKey​(ServiceAccountName name,
                                                       ServiceAccountPrivateKeyType privateKeyType,
                                                       ServiceAccountKeyAlgorithm keyAlgorithm)
        Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ServiceAccountName name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]");
   ServiceAccountPrivateKeyType privateKeyType = ServiceAccountPrivateKeyType.forNumber(0);
   ServiceAccountKeyAlgorithm keyAlgorithm = ServiceAccountKeyAlgorithm.forNumber(0);
   ServiceAccountKey response =
       iAMClient.createServiceAccountKey(name, privateKeyType, keyAlgorithm);
 }
        Parameters:
        name - Required. The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
        privateKeyType - The output format of the private key. The default value is `TYPE_GOOGLE_CREDENTIALS_FILE`, which is the Google Credentials File format.
        keyAlgorithm - Which type of key and algorithm to use for the key. The default is currently a 2K RSA key. However this may change in the future.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • createServiceAccountKey

        public final ServiceAccountKey createServiceAccountKey​(String name,
                                                       ServiceAccountPrivateKeyType privateKeyType,
                                                       ServiceAccountKeyAlgorithm keyAlgorithm)
        Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString();
   ServiceAccountPrivateKeyType privateKeyType = ServiceAccountPrivateKeyType.forNumber(0);
   ServiceAccountKeyAlgorithm keyAlgorithm = ServiceAccountKeyAlgorithm.forNumber(0);
   ServiceAccountKey response =
       iAMClient.createServiceAccountKey(name, privateKeyType, keyAlgorithm);
 }
        Parameters:
        name - Required. The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
        privateKeyType - The output format of the private key. The default value is `TYPE_GOOGLE_CREDENTIALS_FILE`, which is the Google Credentials File format.
        keyAlgorithm - Which type of key and algorithm to use for the key. The default is currently a 2K RSA key. However this may change in the future.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • createServiceAccountKey

        public final ServiceAccountKey createServiceAccountKey​(CreateServiceAccountKeyRequest request)
        Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   CreateServiceAccountKeyRequest request =
       CreateServiceAccountKeyRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setPrivateKeyType(ServiceAccountPrivateKeyType.forNumber(0))
           .setKeyAlgorithm(ServiceAccountKeyAlgorithm.forNumber(0))
           .build();
   ServiceAccountKey response = iAMClient.createServiceAccountKey(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • createServiceAccountKeyCallable

        public final com.google.api.gax.rpc.UnaryCallable<CreateServiceAccountKeyRequest,​ServiceAccountKey> createServiceAccountKeyCallable()
        Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   CreateServiceAccountKeyRequest request =
       CreateServiceAccountKeyRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setPrivateKeyType(ServiceAccountPrivateKeyType.forNumber(0))
           .setKeyAlgorithm(ServiceAccountKeyAlgorithm.forNumber(0))
           .build();
   ApiFuture<ServiceAccountKey> future =
       iAMClient.createServiceAccountKeyCallable().futureCall(request);
   // Do something.
   ServiceAccountKey response = future.get();
 }

      • uploadServiceAccountKey

        public final ServiceAccountKey uploadServiceAccountKey​(UploadServiceAccountKeyRequest request)
        Uploads the public key portion of a key pair that you manage, and associates the public key with a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        After you upload the public key, you can use the private key from the key pair as a service account key.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   UploadServiceAccountKeyRequest request =
       UploadServiceAccountKeyRequest.newBuilder()
           .setName("name3373707")
           .setPublicKeyData(ByteString.EMPTY)
           .build();
   ServiceAccountKey response = iAMClient.uploadServiceAccountKey(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • uploadServiceAccountKeyCallable

        public final com.google.api.gax.rpc.UnaryCallable<UploadServiceAccountKeyRequest,​ServiceAccountKey> uploadServiceAccountKeyCallable()
        Uploads the public key portion of a key pair that you manage, and associates the public key with a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        After you upload the public key, you can use the private key from the key pair as a service account key.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   UploadServiceAccountKeyRequest request =
       UploadServiceAccountKeyRequest.newBuilder()
           .setName("name3373707")
           .setPublicKeyData(ByteString.EMPTY)
           .build();
   ApiFuture<ServiceAccountKey> future =
       iAMClient.uploadServiceAccountKeyCallable().futureCall(request);
   // Do something.
   ServiceAccountKey response = future.get();
 }

      • deleteServiceAccountKey

        public final void deleteServiceAccountKey​(KeyName name)
        Deletes a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. Deleting a service account key does not revoke short-lived credentials that have been issued based on the service account key.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   KeyName name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]");
   iAMClient.deleteServiceAccountKey(name);
 }
        Parameters:
        name - Required. The resource name of the service account key in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • deleteServiceAccountKey

        public final void deleteServiceAccountKey​(String name)
        Deletes a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. Deleting a service account key does not revoke short-lived credentials that have been issued based on the service account key.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString();
   iAMClient.deleteServiceAccountKey(name);
 }
        Parameters:
        name - Required. The resource name of the service account key in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • deleteServiceAccountKey

        public final void deleteServiceAccountKey​(DeleteServiceAccountKeyRequest request)
        Deletes a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. Deleting a service account key does not revoke short-lived credentials that have been issued based on the service account key.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   DeleteServiceAccountKeyRequest request =
       DeleteServiceAccountKeyRequest.newBuilder()
           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
           .build();
   iAMClient.deleteServiceAccountKey(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • deleteServiceAccountKeyCallable

        public final com.google.api.gax.rpc.UnaryCallable<DeleteServiceAccountKeyRequest,​com.google.protobuf.Empty> deleteServiceAccountKeyCallable()
        Deletes a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. Deleting a service account key does not revoke short-lived credentials that have been issued based on the service account key.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   DeleteServiceAccountKeyRequest request =
       DeleteServiceAccountKeyRequest.newBuilder()
           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
           .build();
   ApiFuture<Empty> future = iAMClient.deleteServiceAccountKeyCallable().futureCall(request);
   // Do something.
   future.get();
 }

      • disableServiceAccountKey

        public final void disableServiceAccountKey​(KeyName name)
        Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service account key can be re-enabled with [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   KeyName name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]");
   iAMClient.disableServiceAccountKey(name);
 }
        Parameters:
        name - Required. The resource name of the service account key in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.

        Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • disableServiceAccountKey

        public final void disableServiceAccountKey​(String name)
        Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service account key can be re-enabled with [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString();
   iAMClient.disableServiceAccountKey(name);
 }
        Parameters:
        name - Required. The resource name of the service account key in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.

        Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • disableServiceAccountKey

        public final void disableServiceAccountKey​(DisableServiceAccountKeyRequest request)
        Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service account key can be re-enabled with [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   DisableServiceAccountKeyRequest request =
       DisableServiceAccountKeyRequest.newBuilder()
           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
           .build();
   iAMClient.disableServiceAccountKey(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • disableServiceAccountKeyCallable

        public final com.google.api.gax.rpc.UnaryCallable<DisableServiceAccountKeyRequest,​com.google.protobuf.Empty> disableServiceAccountKeyCallable()
        Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service account key can be re-enabled with [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   DisableServiceAccountKeyRequest request =
       DisableServiceAccountKeyRequest.newBuilder()
           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
           .build();
   ApiFuture<Empty> future = iAMClient.disableServiceAccountKeyCallable().futureCall(request);
   // Do something.
   future.get();
 }

      • enableServiceAccountKey

        public final void enableServiceAccountKey​(KeyName name)
        Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   KeyName name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]");
   iAMClient.enableServiceAccountKey(name);
 }
        Parameters:
        name - Required. The resource name of the service account key in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.

        Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • enableServiceAccountKey

        public final void enableServiceAccountKey​(String name)
        Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString();
   iAMClient.enableServiceAccountKey(name);
 }
        Parameters:
        name - Required. The resource name of the service account key in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.

        Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • enableServiceAccountKey

        public final void enableServiceAccountKey​(EnableServiceAccountKeyRequest request)
        Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   EnableServiceAccountKeyRequest request =
       EnableServiceAccountKeyRequest.newBuilder()
           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
           .build();
   iAMClient.enableServiceAccountKey(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • enableServiceAccountKeyCallable

        public final com.google.api.gax.rpc.UnaryCallable<EnableServiceAccountKeyRequest,​com.google.protobuf.Empty> enableServiceAccountKeyCallable()
        Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   EnableServiceAccountKeyRequest request =
       EnableServiceAccountKeyRequest.newBuilder()
           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
           .build();
   ApiFuture<Empty> future = iAMClient.enableServiceAccountKeyCallable().futureCall(request);
   // Do something.
   future.get();
 }

      • signBlob

        @Deprecated
public final SignBlobResponse signBlob​(ServiceAccountName name,
                                       com.google.protobuf.ByteString bytesToSign)
        Deprecated.
        This method is deprecated and will be removed in the next major version update.
        **Note:** This method is deprecated. Use the [`signBlob`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signBlob) method in the IAM Service Account Credentials API instead. If you currently use this method, see the [migration guide](https://cloud.google.com/iam/help/credentials/migrate-api) for instructions.

        Signs a blob using the system-managed private key for a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ServiceAccountName name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]");
   ByteString bytesToSign = ByteString.EMPTY;
   SignBlobResponse response = iAMClient.signBlob(name, bytesToSign);
 }
        Parameters:
        name - Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api).

        The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        bytesToSign - Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api).

        The bytes to sign.

        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • signBlob

        @Deprecated
public final SignBlobResponse signBlob​(String name,
                                       com.google.protobuf.ByteString bytesToSign)
        Deprecated.
        This method is deprecated and will be removed in the next major version update.
        **Note:** This method is deprecated. Use the [`signBlob`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signBlob) method in the IAM Service Account Credentials API instead. If you currently use this method, see the [migration guide](https://cloud.google.com/iam/help/credentials/migrate-api) for instructions.

        Signs a blob using the system-managed private key for a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString();
   ByteString bytesToSign = ByteString.EMPTY;
   SignBlobResponse response = iAMClient.signBlob(name, bytesToSign);
 }
        Parameters:
        name - Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api).

        The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        bytesToSign - Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api).

        The bytes to sign.

        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • signBlob

        @Deprecated
public final SignBlobResponse signBlob​(SignBlobRequest request)
        Deprecated.
        This method is deprecated and will be removed in the next major version update.
        **Note:** This method is deprecated. Use the [`signBlob`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signBlob) method in the IAM Service Account Credentials API instead. If you currently use this method, see the [migration guide](https://cloud.google.com/iam/help/credentials/migrate-api) for instructions.

        Signs a blob using the system-managed private key for a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   SignBlobRequest request =
       SignBlobRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setBytesToSign(ByteString.EMPTY)
           .build();
   SignBlobResponse response = iAMClient.signBlob(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • signBlobCallable

        @Deprecated
public final com.google.api.gax.rpc.UnaryCallable<SignBlobRequest,​SignBlobResponse> signBlobCallable()
        Deprecated.
        This method is deprecated and will be removed in the next major version update.
        **Note:** This method is deprecated. Use the [`signBlob`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signBlob) method in the IAM Service Account Credentials API instead. If you currently use this method, see the [migration guide](https://cloud.google.com/iam/help/credentials/migrate-api) for instructions.

        Signs a blob using the system-managed private key for a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   SignBlobRequest request =
       SignBlobRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setBytesToSign(ByteString.EMPTY)
           .build();
   ApiFuture<SignBlobResponse> future = iAMClient.signBlobCallable().futureCall(request);
   // Do something.
   SignBlobResponse response = future.get();
 }

      • signJwt

        @Deprecated
public final SignJwtResponse signJwt​(ServiceAccountName name,
                                     String payload)
        Deprecated.
        This method is deprecated and will be removed in the next major version update.
        **Note:** This method is deprecated. Use the [`signJwt`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signJwt) method in the IAM Service Account Credentials API instead. If you currently use this method, see the [migration guide](https://cloud.google.com/iam/help/credentials/migrate-api) for instructions.

        Signs a JSON Web Token (JWT) using the system-managed private key for a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ServiceAccountName name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]");
   String payload = "payload-786701938";
   SignJwtResponse response = iAMClient.signJwt(name, payload);
 }
        Parameters:
        name - Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api).

        The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        payload - Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api).

        The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims Set. For example: `{"sub": "user@example.com", "iat": 313435}`

        If the JWT Claims Set contains an expiration time (`exp`) claim, it must be an integer timestamp that is not in the past and no more than 12 hours in the future.

        If the JWT Claims Set does not contain an expiration time (`exp`) claim, this claim is added automatically, with a timestamp that is 1 hour in the future.

        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • signJwt

        @Deprecated
public final SignJwtResponse signJwt​(String name,
                                     String payload)
        Deprecated.
        This method is deprecated and will be removed in the next major version update.
        **Note:** This method is deprecated. Use the [`signJwt`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signJwt) method in the IAM Service Account Credentials API instead. If you currently use this method, see the [migration guide](https://cloud.google.com/iam/help/credentials/migrate-api) for instructions.

        Signs a JSON Web Token (JWT) using the system-managed private key for a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String name = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString();
   String payload = "payload-786701938";
   SignJwtResponse response = iAMClient.signJwt(name, payload);
 }
        Parameters:
        name - Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api).

        The resource name of the service account in the following format: `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}`. Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account. The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.

        payload - Required. Deprecated. [Migrate to Service Account Credentials API](https://cloud.google.com/iam/help/credentials/migrate-api).

        The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims Set. For example: `{"sub": "user@example.com", "iat": 313435}`

        If the JWT Claims Set contains an expiration time (`exp`) claim, it must be an integer timestamp that is not in the past and no more than 12 hours in the future.

        If the JWT Claims Set does not contain an expiration time (`exp`) claim, this claim is added automatically, with a timestamp that is 1 hour in the future.

        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • signJwt

        @Deprecated
public final SignJwtResponse signJwt​(SignJwtRequest request)
        Deprecated.
        This method is deprecated and will be removed in the next major version update.
        **Note:** This method is deprecated. Use the [`signJwt`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signJwt) method in the IAM Service Account Credentials API instead. If you currently use this method, see the [migration guide](https://cloud.google.com/iam/help/credentials/migrate-api) for instructions.

        Signs a JSON Web Token (JWT) using the system-managed private key for a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   SignJwtRequest request =
       SignJwtRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setPayload("payload-786701938")
           .build();
   SignJwtResponse response = iAMClient.signJwt(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • signJwtCallable

        @Deprecated
public final com.google.api.gax.rpc.UnaryCallable<SignJwtRequest,​SignJwtResponse> signJwtCallable()
        Deprecated.
        This method is deprecated and will be removed in the next major version update.
        **Note:** This method is deprecated. Use the [`signJwt`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signJwt) method in the IAM Service Account Credentials API instead. If you currently use this method, see the [migration guide](https://cloud.google.com/iam/help/credentials/migrate-api) for instructions.

        Signs a JSON Web Token (JWT) using the system-managed private key for a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   SignJwtRequest request =
       SignJwtRequest.newBuilder()
           .setName(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setPayload("payload-786701938")
           .build();
   ApiFuture<SignJwtResponse> future = iAMClient.signJwtCallable().futureCall(request);
   // Do something.
   SignJwtResponse response = future.get();
 }

      • getIamPolicy

        public final com.google.iam.v1.Policy getIamPolicy​(com.google.api.resourcenames.ResourceName resource)
        Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount]. This IAM policy specifies which principals have access to the service account.

        This method does not tell you whether the service account has been granted any roles on other resources. To check whether a service account has role grants on a resource, use the `getIamPolicy` method for that resource. For example, to view the role grants for a project, call the Resource Manager API's [`projects.getIamPolicy`](https://cloud.google.com/resource-manager/reference/rest/v1/projects/getIamPolicy) method.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ResourceName resource = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]");
   Policy response = iAMClient.getIamPolicy(resource);
 }
        Parameters:
        resource - REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • getIamPolicy

        public final com.google.iam.v1.Policy getIamPolicy​(String resource)
        Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount]. This IAM policy specifies which principals have access to the service account.

        This method does not tell you whether the service account has been granted any roles on other resources. To check whether a service account has role grants on a resource, use the `getIamPolicy` method for that resource. For example, to view the role grants for a project, call the Resource Manager API's [`projects.getIamPolicy`](https://cloud.google.com/resource-manager/reference/rest/v1/projects/getIamPolicy) method.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String resource = ProjectName.of("[PROJECT]").toString();
   Policy response = iAMClient.getIamPolicy(resource);
 }
        Parameters:
        resource - REQUIRED: The resource for which the policy is being requested. See the operation documentation for the appropriate value for this field.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • getIamPolicy

        public final com.google.iam.v1.Policy getIamPolicy​(com.google.iam.v1.GetIamPolicyRequest request)
        Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount]. This IAM policy specifies which principals have access to the service account.

        This method does not tell you whether the service account has been granted any roles on other resources. To check whether a service account has role grants on a resource, use the `getIamPolicy` method for that resource. For example, to view the role grants for a project, call the Resource Manager API's [`projects.getIamPolicy`](https://cloud.google.com/resource-manager/reference/rest/v1/projects/getIamPolicy) method.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   GetIamPolicyRequest request =
       GetIamPolicyRequest.newBuilder()
           .setResource(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setOptions(GetPolicyOptions.newBuilder().build())
           .build();
   Policy response = iAMClient.getIamPolicy(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • getIamPolicyCallable

        public final com.google.api.gax.rpc.UnaryCallable<com.google.iam.v1.GetIamPolicyRequest,​com.google.iam.v1.Policy> getIamPolicyCallable()
        Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount]. This IAM policy specifies which principals have access to the service account.

        This method does not tell you whether the service account has been granted any roles on other resources. To check whether a service account has role grants on a resource, use the `getIamPolicy` method for that resource. For example, to view the role grants for a project, call the Resource Manager API's [`projects.getIamPolicy`](https://cloud.google.com/resource-manager/reference/rest/v1/projects/getIamPolicy) method.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   GetIamPolicyRequest request =
       GetIamPolicyRequest.newBuilder()
           .setResource(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setOptions(GetPolicyOptions.newBuilder().build())
           .build();
   ApiFuture<Policy> future = iAMClient.getIamPolicyCallable().futureCall(request);
   // Do something.
   Policy response = future.get();
 }

      • setIamPolicy

        public final com.google.iam.v1.Policy setIamPolicy​(com.google.api.resourcenames.ResourceName resource,
                                                   com.google.iam.v1.Policy policy)
        Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Use this method to grant or revoke access to the service account. For example, you could grant a principal the ability to impersonate the service account.

        This method does not enable the service account to access other resources. To grant roles to a service account on a resource, follow these steps:

        1. Call the resource's `getIamPolicy` method to get its current IAM policy. 2. Edit the policy so that it binds the service account to an IAM role for the resource. 3. Call the resource's `setIamPolicy` method to update its IAM policy.

        For detailed instructions, see [Manage access to project, folders, and organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts) or [Manage access to other resources](https://cloud.google.com/iam/help/access/manage-other-resources).

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ResourceName resource = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]");
   Policy policy = Policy.newBuilder().build();
   Policy response = iAMClient.setIamPolicy(resource, policy);
 }
        Parameters:
        resource - REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field.
        policy - REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • setIamPolicy

        public final com.google.iam.v1.Policy setIamPolicy​(String resource,
                                                   com.google.iam.v1.Policy policy)
        Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Use this method to grant or revoke access to the service account. For example, you could grant a principal the ability to impersonate the service account.

        This method does not enable the service account to access other resources. To grant roles to a service account on a resource, follow these steps:

        1. Call the resource's `getIamPolicy` method to get its current IAM policy. 2. Edit the policy so that it binds the service account to an IAM role for the resource. 3. Call the resource's `setIamPolicy` method to update its IAM policy.

        For detailed instructions, see [Manage access to project, folders, and organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts) or [Manage access to other resources](https://cloud.google.com/iam/help/access/manage-other-resources).

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String resource = ProjectName.of("[PROJECT]").toString();
   Policy policy = Policy.newBuilder().build();
   Policy response = iAMClient.setIamPolicy(resource, policy);
 }
        Parameters:
        resource - REQUIRED: The resource for which the policy is being specified. See the operation documentation for the appropriate value for this field.
        policy - REQUIRED: The complete policy to be applied to the `resource`. The size of the policy is limited to a few 10s of KB. An empty policy is a valid policy but certain Cloud Platform services (such as Projects) might reject them.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • setIamPolicy

        public final com.google.iam.v1.Policy setIamPolicy​(com.google.iam.v1.SetIamPolicyRequest request)
        Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Use this method to grant or revoke access to the service account. For example, you could grant a principal the ability to impersonate the service account.

        This method does not enable the service account to access other resources. To grant roles to a service account on a resource, follow these steps:

        1. Call the resource's `getIamPolicy` method to get its current IAM policy. 2. Edit the policy so that it binds the service account to an IAM role for the resource. 3. Call the resource's `setIamPolicy` method to update its IAM policy.

        For detailed instructions, see [Manage access to project, folders, and organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts) or [Manage access to other resources](https://cloud.google.com/iam/help/access/manage-other-resources).

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   SetIamPolicyRequest request =
       SetIamPolicyRequest.newBuilder()
           .setResource(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setPolicy(Policy.newBuilder().build())
           .setUpdateMask(FieldMask.newBuilder().build())
           .build();
   Policy response = iAMClient.setIamPolicy(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • setIamPolicyCallable

        public final com.google.api.gax.rpc.UnaryCallable<com.google.iam.v1.SetIamPolicyRequest,​com.google.iam.v1.Policy> setIamPolicyCallable()
        Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Use this method to grant or revoke access to the service account. For example, you could grant a principal the ability to impersonate the service account.

        This method does not enable the service account to access other resources. To grant roles to a service account on a resource, follow these steps:

        1. Call the resource's `getIamPolicy` method to get its current IAM policy. 2. Edit the policy so that it binds the service account to an IAM role for the resource. 3. Call the resource's `setIamPolicy` method to update its IAM policy.

        For detailed instructions, see [Manage access to project, folders, and organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts) or [Manage access to other resources](https://cloud.google.com/iam/help/access/manage-other-resources).

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   SetIamPolicyRequest request =
       SetIamPolicyRequest.newBuilder()
           .setResource(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .setPolicy(Policy.newBuilder().build())
           .setUpdateMask(FieldMask.newBuilder().build())
           .build();
   ApiFuture<Policy> future = iAMClient.setIamPolicyCallable().futureCall(request);
   // Do something.
   Policy response = future.get();
 }

      • testIamPermissions

        public final com.google.iam.v1.TestIamPermissionsResponse testIamPermissions​(com.google.api.resourcenames.ResourceName resource,
                                                                             List<String> permissions)
        Tests whether the caller has the specified permissions on a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ResourceName resource = ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]");
   List<String> permissions = new ArrayList<>();
   TestIamPermissionsResponse response = iAMClient.testIamPermissions(resource, permissions);
 }
        Parameters:
        resource - REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field.
        permissions - The set of permissions to check for the `resource`. Permissions with wildcards (such as '*' or 'storage.*') are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • testIamPermissions

        public final com.google.iam.v1.TestIamPermissionsResponse testIamPermissions​(String resource,
                                                                             List<String> permissions)
        Tests whether the caller has the specified permissions on a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String resource = ProjectName.of("[PROJECT]").toString();
   List<String> permissions = new ArrayList<>();
   TestIamPermissionsResponse response = iAMClient.testIamPermissions(resource, permissions);
 }
        Parameters:
        resource - REQUIRED: The resource for which the policy detail is being requested. See the operation documentation for the appropriate value for this field.
        permissions - The set of permissions to check for the `resource`. Permissions with wildcards (such as '*' or 'storage.*') are not allowed. For more information see [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • testIamPermissions

        public final com.google.iam.v1.TestIamPermissionsResponse testIamPermissions​(com.google.iam.v1.TestIamPermissionsRequest request)
        Tests whether the caller has the specified permissions on a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   TestIamPermissionsRequest request =
       TestIamPermissionsRequest.newBuilder()
           .setResource(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .addAllPermissions(new ArrayList<String>())
           .build();
   TestIamPermissionsResponse response = iAMClient.testIamPermissions(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • testIamPermissionsCallable

        public final com.google.api.gax.rpc.UnaryCallable<com.google.iam.v1.TestIamPermissionsRequest,​com.google.iam.v1.TestIamPermissionsResponse> testIamPermissionsCallable()
        Tests whether the caller has the specified permissions on a [ServiceAccount][google.iam.admin.v1.ServiceAccount].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   TestIamPermissionsRequest request =
       TestIamPermissionsRequest.newBuilder()
           .setResource(ServiceAccountName.of("[PROJECT]", "[SERVICE_ACCOUNT]").toString())
           .addAllPermissions(new ArrayList<String>())
           .build();
   ApiFuture<TestIamPermissionsResponse> future =
       iAMClient.testIamPermissionsCallable().futureCall(request);
   // Do something.
   TestIamPermissionsResponse response = future.get();
 }

      • queryGrantableRoles

        public final IAMClient.QueryGrantableRolesPagedResponse queryGrantableRoles​(String fullResourceName)
        Lists roles that can be granted on a Google Cloud resource. A role is grantable if the IAM policy for the resource can contain bindings to the role.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   String fullResourceName = "fullResourceName-853732376";
   for (Role element : iAMClient.queryGrantableRoles(fullResourceName).iterateAll()) {
     // doThingsWith(element);
   }
 }
        Parameters:
        fullResourceName - Required. The full resource name to query from the list of grantable roles.

        The name follows the Google Cloud Platform resource format. For example, a Cloud Platform project with id `my-project` will be named `//cloudresourcemanager.googleapis.com/projects/my-project`.

        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • queryGrantableRoles

        public final IAMClient.QueryGrantableRolesPagedResponse queryGrantableRoles​(QueryGrantableRolesRequest request)
        Lists roles that can be granted on a Google Cloud resource. A role is grantable if the IAM policy for the resource can contain bindings to the role.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   QueryGrantableRolesRequest request =
       QueryGrantableRolesRequest.newBuilder()
           .setFullResourceName("fullResourceName-853732376")
           .setView(RoleView.forNumber(0))
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .build();
   for (Role element : iAMClient.queryGrantableRoles(request).iterateAll()) {
     // doThingsWith(element);
   }
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • queryGrantableRolesPagedCallable

        public final com.google.api.gax.rpc.UnaryCallable<QueryGrantableRolesRequest,​IAMClient.QueryGrantableRolesPagedResponse> queryGrantableRolesPagedCallable()
        Lists roles that can be granted on a Google Cloud resource. A role is grantable if the IAM policy for the resource can contain bindings to the role.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   QueryGrantableRolesRequest request =
       QueryGrantableRolesRequest.newBuilder()
           .setFullResourceName("fullResourceName-853732376")
           .setView(RoleView.forNumber(0))
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .build();
   ApiFuture<Role> future = iAMClient.queryGrantableRolesPagedCallable().futureCall(request);
   // Do something.
   for (Role element : future.get().iterateAll()) {
     // doThingsWith(element);
   }
 }

      • queryGrantableRolesCallable

        public final com.google.api.gax.rpc.UnaryCallable<QueryGrantableRolesRequest,​QueryGrantableRolesResponse> queryGrantableRolesCallable()
        Lists roles that can be granted on a Google Cloud resource. A role is grantable if the IAM policy for the resource can contain bindings to the role.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   QueryGrantableRolesRequest request =
       QueryGrantableRolesRequest.newBuilder()
           .setFullResourceName("fullResourceName-853732376")
           .setView(RoleView.forNumber(0))
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .build();
   while (true) {
     QueryGrantableRolesResponse response =
         iAMClient.queryGrantableRolesCallable().call(request);
     for (Role element : response.getRolesList()) {
       // doThingsWith(element);
     }
     String nextPageToken = response.getNextPageToken();
     if (!Strings.isNullOrEmpty(nextPageToken)) {
       request = request.toBuilder().setPageToken(nextPageToken).build();
     } else {
       break;
     }
   }
 }

      • listRoles

        public final IAMClient.ListRolesPagedResponse listRoles​(ListRolesRequest request)
        Lists every predefined [Role][google.iam.admin.v1.Role] that IAM supports, or every custom role that is defined for an organization or project.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ListRolesRequest request =
       ListRolesRequest.newBuilder()
           .setParent(ProjectName.of("[PROJECT]").toString())
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .setView(RoleView.forNumber(0))
           .setShowDeleted(true)
           .build();
   for (Role element : iAMClient.listRoles(request).iterateAll()) {
     // doThingsWith(element);
   }
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • listRolesPagedCallable

        public final com.google.api.gax.rpc.UnaryCallable<ListRolesRequest,​IAMClient.ListRolesPagedResponse> listRolesPagedCallable()
        Lists every predefined [Role][google.iam.admin.v1.Role] that IAM supports, or every custom role that is defined for an organization or project.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ListRolesRequest request =
       ListRolesRequest.newBuilder()
           .setParent(ProjectName.of("[PROJECT]").toString())
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .setView(RoleView.forNumber(0))
           .setShowDeleted(true)
           .build();
   ApiFuture<Role> future = iAMClient.listRolesPagedCallable().futureCall(request);
   // Do something.
   for (Role element : future.get().iterateAll()) {
     // doThingsWith(element);
   }
 }

      • listRolesCallable

        public final com.google.api.gax.rpc.UnaryCallable<ListRolesRequest,​ListRolesResponse> listRolesCallable()
        Lists every predefined [Role][google.iam.admin.v1.Role] that IAM supports, or every custom role that is defined for an organization or project.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   ListRolesRequest request =
       ListRolesRequest.newBuilder()
           .setParent(ProjectName.of("[PROJECT]").toString())
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .setView(RoleView.forNumber(0))
           .setShowDeleted(true)
           .build();
   while (true) {
     ListRolesResponse response = iAMClient.listRolesCallable().call(request);
     for (Role element : response.getRolesList()) {
       // doThingsWith(element);
     }
     String nextPageToken = response.getNextPageToken();
     if (!Strings.isNullOrEmpty(nextPageToken)) {
       request = request.toBuilder().setPageToken(nextPageToken).build();
     } else {
       break;
     }
   }
 }

      • getRole

        public final Role getRole​(GetRoleRequest request)
        Gets the definition of a [Role][google.iam.admin.v1.Role].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   GetRoleRequest request =
       GetRoleRequest.newBuilder().setName("GetRoleRequest84528163".toString()).build();
   Role response = iAMClient.getRole(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • getRoleCallable

        public final com.google.api.gax.rpc.UnaryCallable<GetRoleRequest,​Role> getRoleCallable()
        Gets the definition of a [Role][google.iam.admin.v1.Role].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   GetRoleRequest request =
       GetRoleRequest.newBuilder().setName("GetRoleRequest84528163".toString()).build();
   ApiFuture<Role> future = iAMClient.getRoleCallable().futureCall(request);
   // Do something.
   Role response = future.get();
 }

      • createRole

        public final Role createRole​(CreateRoleRequest request)
        Creates a new custom [Role][google.iam.admin.v1.Role].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   CreateRoleRequest request =
       CreateRoleRequest.newBuilder()
           .setParent(ProjectName.of("[PROJECT]").toString())
           .setRoleId("roleId-925416399")
           .setRole(Role.newBuilder().build())
           .build();
   Role response = iAMClient.createRole(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • createRoleCallable

        public final com.google.api.gax.rpc.UnaryCallable<CreateRoleRequest,​Role> createRoleCallable()
        Creates a new custom [Role][google.iam.admin.v1.Role].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   CreateRoleRequest request =
       CreateRoleRequest.newBuilder()
           .setParent(ProjectName.of("[PROJECT]").toString())
           .setRoleId("roleId-925416399")
           .setRole(Role.newBuilder().build())
           .build();
   ApiFuture<Role> future = iAMClient.createRoleCallable().futureCall(request);
   // Do something.
   Role response = future.get();
 }

      • updateRole

        public final Role updateRole​(UpdateRoleRequest request)
        Updates the definition of a custom [Role][google.iam.admin.v1.Role].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   UpdateRoleRequest request =
       UpdateRoleRequest.newBuilder()
           .setName("UpdateRoleRequest230834320".toString())
           .setRole(Role.newBuilder().build())
           .setUpdateMask(FieldMask.newBuilder().build())
           .build();
   Role response = iAMClient.updateRole(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • updateRoleCallable

        public final com.google.api.gax.rpc.UnaryCallable<UpdateRoleRequest,​Role> updateRoleCallable()
        Updates the definition of a custom [Role][google.iam.admin.v1.Role].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   UpdateRoleRequest request =
       UpdateRoleRequest.newBuilder()
           .setName("UpdateRoleRequest230834320".toString())
           .setRole(Role.newBuilder().build())
           .setUpdateMask(FieldMask.newBuilder().build())
           .build();
   ApiFuture<Role> future = iAMClient.updateRoleCallable().futureCall(request);
   // Do something.
   Role response = future.get();
 }

      • deleteRole

        public final Role deleteRole​(DeleteRoleRequest request)
        Deletes a custom [Role][google.iam.admin.v1.Role].

        When you delete a custom role, the following changes occur immediately:

        • You cannot bind a principal to the custom role in an IAM [Policy][google.iam.v1.Policy].
        • Existing bindings to the custom role are not changed, but they have no effect.
        • By default, the response from [ListRoles][google.iam.admin.v1.IAM.ListRoles] does not include the custom role.

        You have 7 days to undelete the custom role. After 7 days, the following changes occur:

        • The custom role is permanently deleted and cannot be recovered.
        • If an IAM policy contains a binding to the custom role, the binding is permanently removed.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   DeleteRoleRequest request =
       DeleteRoleRequest.newBuilder()
           .setName("DeleteRoleRequest1468559982".toString())
           .setEtag(ByteString.EMPTY)
           .build();
   Role response = iAMClient.deleteRole(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • deleteRoleCallable

        public final com.google.api.gax.rpc.UnaryCallable<DeleteRoleRequest,​Role> deleteRoleCallable()
        Deletes a custom [Role][google.iam.admin.v1.Role].

        When you delete a custom role, the following changes occur immediately:

        • You cannot bind a principal to the custom role in an IAM [Policy][google.iam.v1.Policy].
        • Existing bindings to the custom role are not changed, but they have no effect.
        • By default, the response from [ListRoles][google.iam.admin.v1.IAM.ListRoles] does not include the custom role.

        You have 7 days to undelete the custom role. After 7 days, the following changes occur:

        • The custom role is permanently deleted and cannot be recovered.
        • If an IAM policy contains a binding to the custom role, the binding is permanently removed.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   DeleteRoleRequest request =
       DeleteRoleRequest.newBuilder()
           .setName("DeleteRoleRequest1468559982".toString())
           .setEtag(ByteString.EMPTY)
           .build();
   ApiFuture<Role> future = iAMClient.deleteRoleCallable().futureCall(request);
   // Do something.
   Role response = future.get();
 }

      • undeleteRole

        public final Role undeleteRole​(UndeleteRoleRequest request)
        Undeletes a custom [Role][google.iam.admin.v1.Role].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   UndeleteRoleRequest request =
       UndeleteRoleRequest.newBuilder()
           .setName("UndeleteRoleRequest755355893".toString())
           .setEtag(ByteString.EMPTY)
           .build();
   Role response = iAMClient.undeleteRole(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • undeleteRoleCallable

        public final com.google.api.gax.rpc.UnaryCallable<UndeleteRoleRequest,​Role> undeleteRoleCallable()
        Undeletes a custom [Role][google.iam.admin.v1.Role].

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   UndeleteRoleRequest request =
       UndeleteRoleRequest.newBuilder()
           .setName("UndeleteRoleRequest755355893".toString())
           .setEtag(ByteString.EMPTY)
           .build();
   ApiFuture<Role> future = iAMClient.undeleteRoleCallable().futureCall(request);
   // Do something.
   Role response = future.get();
 }

      • queryTestablePermissions

        public final IAMClient.QueryTestablePermissionsPagedResponse queryTestablePermissions​(QueryTestablePermissionsRequest request)
        Lists every permission that you can test on a resource. A permission is testable if you can check whether a principal has that permission on the resource.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   QueryTestablePermissionsRequest request =
       QueryTestablePermissionsRequest.newBuilder()
           .setFullResourceName("fullResourceName-853732376")
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .build();
   for (Permission element : iAMClient.queryTestablePermissions(request).iterateAll()) {
     // doThingsWith(element);
   }
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • queryTestablePermissionsPagedCallable

        public final com.google.api.gax.rpc.UnaryCallable<QueryTestablePermissionsRequest,​IAMClient.QueryTestablePermissionsPagedResponse> queryTestablePermissionsPagedCallable()
        Lists every permission that you can test on a resource. A permission is testable if you can check whether a principal has that permission on the resource.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   QueryTestablePermissionsRequest request =
       QueryTestablePermissionsRequest.newBuilder()
           .setFullResourceName("fullResourceName-853732376")
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .build();
   ApiFuture<Permission> future =
       iAMClient.queryTestablePermissionsPagedCallable().futureCall(request);
   // Do something.
   for (Permission element : future.get().iterateAll()) {
     // doThingsWith(element);
   }
 }

      • queryTestablePermissionsCallable

        public final com.google.api.gax.rpc.UnaryCallable<QueryTestablePermissionsRequest,​QueryTestablePermissionsResponse> queryTestablePermissionsCallable()
        Lists every permission that you can test on a resource. A permission is testable if you can check whether a principal has that permission on the resource.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   QueryTestablePermissionsRequest request =
       QueryTestablePermissionsRequest.newBuilder()
           .setFullResourceName("fullResourceName-853732376")
           .setPageSize(883849137)
           .setPageToken("pageToken873572522")
           .build();
   while (true) {
     QueryTestablePermissionsResponse response =
         iAMClient.queryTestablePermissionsCallable().call(request);
     for (Permission element : response.getPermissionsList()) {
       // doThingsWith(element);
     }
     String nextPageToken = response.getNextPageToken();
     if (!Strings.isNullOrEmpty(nextPageToken)) {
       request = request.toBuilder().setPageToken(nextPageToken).build();
     } else {
       break;
     }
   }
 }

      • queryAuditableServices

        public final QueryAuditableServicesResponse queryAuditableServices​(QueryAuditableServicesRequest request)
        Returns a list of services that allow you to opt into audit logs that are not generated by default.

        To learn more about audit logs, see the [Logging documentation](https://cloud.google.com/logging/docs/audit).

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   QueryAuditableServicesRequest request =
       QueryAuditableServicesRequest.newBuilder()
           .setFullResourceName("fullResourceName-853732376")
           .build();
   QueryAuditableServicesResponse response = iAMClient.queryAuditableServices(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • queryAuditableServicesCallable

        public final com.google.api.gax.rpc.UnaryCallable<QueryAuditableServicesRequest,​QueryAuditableServicesResponse> queryAuditableServicesCallable()
        Returns a list of services that allow you to opt into audit logs that are not generated by default.

        To learn more about audit logs, see the [Logging documentation](https://cloud.google.com/logging/docs/audit).

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   QueryAuditableServicesRequest request =
       QueryAuditableServicesRequest.newBuilder()
           .setFullResourceName("fullResourceName-853732376")
           .build();
   ApiFuture<QueryAuditableServicesResponse> future =
       iAMClient.queryAuditableServicesCallable().futureCall(request);
   // Do something.
   QueryAuditableServicesResponse response = future.get();
 }

      • lintPolicy

        public final LintPolicyResponse lintPolicy​(LintPolicyRequest request)
        Lints, or validates, an IAM policy. Currently checks the [google.iam.v1.Binding.condition][google.iam.v1.Binding.condition] field, which contains a condition expression for a role binding.

        Successful calls to this method always return an HTTP `200 OK` status code, even if the linter detects an issue in the IAM policy.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   LintPolicyRequest request =
       LintPolicyRequest.newBuilder().setFullResourceName("fullResourceName-853732376").build();
   LintPolicyResponse response = iAMClient.lintPolicy(request);
 }
        Parameters:
        request - The request object containing all of the parameters for the API call.
        Throws:
        com.google.api.gax.rpc.ApiException - if the remote call fails

      • lintPolicyCallable

        public final com.google.api.gax.rpc.UnaryCallable<LintPolicyRequest,​LintPolicyResponse> lintPolicyCallable()
        Lints, or validates, an IAM policy. Currently checks the [google.iam.v1.Binding.condition][google.iam.v1.Binding.condition] field, which contains a condition expression for a role binding.

        Successful calls to this method always return an HTTP `200 OK` status code, even if the linter detects an issue in the IAM policy.

        Sample code: 

        
 // This snippet has been automatically generated and should be regarded as a code template only.
 // It will require modifications to work:
 // - It may require correct/in-range values for request initialization.
 // - It may require specifying regional endpoints when creating the service client as shown in
 // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
 try (IAMClient iAMClient = IAMClient.create()) {
   LintPolicyRequest request =
       LintPolicyRequest.newBuilder().setFullResourceName("fullResourceName-853732376").build();
   ApiFuture<LintPolicyResponse> future = iAMClient.lintPolicyCallable().futureCall(request);
   // Do something.
   LintPolicyResponse response = future.get();
 }

      • shutdown

        public void shutdown()
        Specified by:
        shutdown in interface com.google.api.gax.core.BackgroundResource

      • isShutdown

        public boolean isShutdown()
        Specified by:
        isShutdown in interface com.google.api.gax.core.BackgroundResource

      • isTerminated

        public boolean isTerminated()
        Specified by:
        isTerminated in interface com.google.api.gax.core.BackgroundResource

      • shutdownNow

        public void shutdownNow()
        Specified by:
        shutdownNow in interface com.google.api.gax.core.BackgroundResource