--- title: "POST /v1/{+parent}/gcpUserAccessBindings" method: POST path: "/v1/{+parent}/gcpUserAccessBindings" tags: ["organizations"] --- # POST /v1/{+parent}/gcpUserAccessBindings `POST /v1/{+parent}/gcpUserAccessBindings` Creates a GcpUserAccessBinding. If the client specifies a name, the server ignores it. Fails if a resource already exists with the same group_key. Completion of this long-running operation does not necessarily signify that the new binding is deployed onto all affected users, which may take more time. ## Path parameters - `parent` string, required ## Request body - GcpUserAccessBinding — Restricts access to Cloud Console and Google Cloud APIs for a set of users using Context-Aware Access. - `groupKey` string — Optional. Immutable. Google Group id whose users are subject to this binding's restrictions. See "id" in the [Google Workspace Directory API's Group Resource] (https://developers.google.com/admin-sdk/directory/v1/reference/groups#resource). If a group's email address/alias is changed, this resource will continue to point at the changed group. This field does not accept group email addresses or aliases. Example: "01d520gv4vjcrht" - `accessLevels` string[] — Optional. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted" - `sessionSettings` SessionSettings — Stores settings related to Google Cloud Session Length including session duration, the type of challenge (i.e. method) they should face when their session expires, and other related settings. - `maxInactivity` string, google-duration — Optional. How long a user is allowed to take between actions before a new access token must be issued. Only set for Google Cloud apps. - `useOidcMaxAge` boolean — Optional. Only useful for OIDC apps. When false, the OIDC max_age param, if passed in the authentication request will be ignored. When true, the re-auth period will be the minimum of the session_length field and the max_age OIDC param. - `sessionLengthEnabled` boolean — Optional. This field enables or disables Google Cloud session length. When false, all fields set above will be disregarded and the session length is basically infinite. - `sessionLength` string, google-duration — Optional. The session length. Setting this field to zero is equal to disabling session. Also can set infinite session by flipping the enabled bit to false below. If use_oidc_max_age is true, for OIDC apps, the session length will be the minimum of this field and OIDC max_age param. - `sessionReauthMethod` 'SESSION_REAUTH_METHOD_UNSPECIFIED' | 'LOGIN' | 'SECURITY_KEY' | 'PASSWORD' — Optional. Session method when user's Google Cloud session is up. - `name` string — Immutable. Assigned by the server during creation. The last segment has an arbitrary length and has only URI unreserved characters (as defined by [RFC 3986 Section 2.3](https://tools.ietf.org/html/rfc3986#section-2.3)). Should not be specified by the client during creation. Example: "organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N" - `restrictedClientApplications` Application[] — Optional. A list of applications that are subject to this binding's restrictions. If the list is empty, the binding restrictions will universally apply to all applications. - `clientId` string — The OAuth client ID of the application. - `name` string — The name of the application. Example: "Cloud Console" - `scopedAccessSettings` ScopedAccessSettings[] — Optional. A list of scoped access settings that set this binding's restrictions on a subset of applications. This field cannot be set if restricted_client_applications is set. - `activeSettings` AccessSettings — Access settings represent the set of conditions that must be met for access to be granted. At least one of the fields must be set. - `sessionSettings` SessionSettings — Stores settings related to Google Cloud Session Length including session duration, the type of challenge (i.e. method) they should face when their session expires, and other related settings. - `maxInactivity` string, google-duration — Optional. How long a user is allowed to take between actions before a new access token must be issued. Only set for Google Cloud apps. - `useOidcMaxAge` boolean — Optional. Only useful for OIDC apps. When false, the OIDC max_age param, if passed in the authentication request will be ignored. When true, the re-auth period will be the minimum of the session_length field and the max_age OIDC param. - `sessionLengthEnabled` boolean — Optional. This field enables or disables Google Cloud session length. When false, all fields set above will be disregarded and the session length is basically infinite. - `sessionLength` string, google-duration — Optional. The session length. Setting this field to zero is equal to disabling session. Also can set infinite session by flipping the enabled bit to false below. If use_oidc_max_age is true, for OIDC apps, the session length will be the minimum of this field and OIDC max_age param. - `sessionReauthMethod` 'SESSION_REAUTH_METHOD_UNSPECIFIED' | 'LOGIN' | 'SECURITY_KEY' | 'PASSWORD' — Optional. Session method when user's Google Cloud session is up. - `accessLevels` string[] — Optional. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted" - `scope` AccessScope — Access scope represents the client scope, etc. to which the settings will be applied to. - `clientScope` ClientScope — Client scope represents the application, etc. subject to this binding's restrictions. - `restrictedClientApplication` Application — An application that accesses Google Cloud APIs. - `clientId` string — The OAuth client ID of the application. - `name` string — The name of the application. Example: "Cloud Console" - `dryRunSettings` AccessSettings — Access settings represent the set of conditions that must be met for access to be granted. At least one of the fields must be set. - `sessionSettings` SessionSettings — Stores settings related to Google Cloud Session Length including session duration, the type of challenge (i.e. method) they should face when their session expires, and other related settings. - `maxInactivity` string, google-duration — Optional. How long a user is allowed to take between actions before a new access token must be issued. Only set for Google Cloud apps. - `useOidcMaxAge` boolean — Optional. Only useful for OIDC apps. When false, the OIDC max_age param, if passed in the authentication request will be ignored. When true, the re-auth period will be the minimum of the session_length field and the max_age OIDC param. - `sessionLengthEnabled` boolean — Optional. This field enables or disables Google Cloud session length. When false, all fields set above will be disregarded and the session length is basically infinite. - `sessionLength` string, google-duration — Optional. The session length. Setting this field to zero is equal to disabling session. Also can set infinite session by flipping the enabled bit to false below. If use_oidc_max_age is true, for OIDC apps, the session length will be the minimum of this field and OIDC max_age param. - `sessionReauthMethod` 'SESSION_REAUTH_METHOD_UNSPECIFIED' | 'LOGIN' | 'SECURITY_KEY' | 'PASSWORD' — Optional. Session method when user's Google Cloud session is up. - `accessLevels` string[] — Optional. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted" - `dryRunAccessLevels` string[] — Optional. Dry run access level that will be evaluated but will not be enforced. The access denial based on dry run policy will be logged. Only one access level is supported, not multiple. This list must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted" ## Response `200` Successful response --- [API](https://skmtc.dev/google/apis/accesscontextmanager.md) · [All operations](https://skmtc.dev/google/apis/accesscontextmanager/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/accesscontextmanager/revisions/af581187d9ba/schema)