--- title: "PATCH /v1/{+name}:iapSettings" method: PATCH path: "/v1/{+name}:iapSettings" tags: ["v1"] --- # PATCH /v1/{+name}:iapSettings `PATCH /v1/{+name}:iapSettings` Updates the IAP settings on a particular IAP protected resource. It replaces all fields unless the `update_mask` is set. ## Path parameters - `name` string, required ## Query parameters - `updateMask` string ## Request body - IapSettings — The IAP configurable settings. - `name` string — Required. The resource name of the IAP protected resource. - `accessSettings` AccessSettings — Access related settings for IAP protected apps. - `allowedDomainsSettings` AllowedDomainsSettings — Configuration for IAP allowed domains. Lets you to restrict access to an app and allow access to only the domains that you list. - `enable` boolean — Optional. Configuration for customers to opt in for the feature. - `domains` string[] — Optional. List of trusted domains. - `workforceIdentitySettings` WorkforceIdentitySettings — WorkforceIdentitySettings allows customers to configure workforce pools and OAuth 2.0 settings to gate their applications using a third-party IdP with access control. - `oauth2` OAuth2 — The OAuth 2.0 Settings - `clientSecretSha256` string — Output only. SHA256 hash value for the client secret. This field is returned by IAP when the settings are retrieved. - `clientId` string — The OAuth 2.0 client ID registered in the workforce identity federation OAuth 2.0 Server. - `clientSecret` string — Input only. The OAuth 2.0 client secret created while registering the client ID. - `workforcePools` string[] — The workforce pool resources. Only one workforce pool is accepted. - `oauthSettings` OAuthSettings — Configuration for OAuth login&consent flow behavior as well as for OAuth Credentials. - `clientSecretSha256` string — Output only. OAuth secret SHA256 paired with client ID. - `clientSecret` string — Optional. Input only. OAuth secret paired with client ID. - `loginHint` string — Domain hint to send as hd=? parameter in OAuth request flow. Enables redirect to primary IDP by skipping Google's login screen. https://developers.google.com/identity/protocols/OpenIDConnect#hd-param Note: IAP does not verify that the id token's hd claim matches this value since access behavior is managed by IAM policies. - `clientId` string — Optional. OAuth 2.0 client ID used in the OAuth flow. This allows for client sharing. The risks of client sharing are outlined here: https://cloud.google.com/iap/docs/sharing-oauth-clients#risks. - `programmaticClients` string[] — Optional. List of client ids allowed to use IAP programmatically. - `reauthSettings` ReauthSettings — Configuration for IAP reauthentication policies. - `maxAge` string, google-duration — Optional. Reauth session lifetime, how long before a user has to reauthenticate again. - `method` 'METHOD_UNSPECIFIED' | 'LOGIN' | 'PASSWORD' | 'SECURE_KEY' | 'ENROLLED_SECOND_FACTORS' — Optional. Reauth method requested. - `policyType` 'POLICY_TYPE_UNSPECIFIED' | 'MINIMUM' | 'DEFAULT' — Optional. How IAP determines the effective policy in cases of hierarchical policies. Policies are merged from higher in the hierarchy to lower in the hierarchy. - `identitySources` string[] — Optional. Identity sources that IAP can use to authenticate the end user. Only one identity source can be configured. - `gcipSettings` GcipSettings — Allows customers to configure tenant IDs for a Cloud Identity Platform (GCIP) instance for each application. - `tenantIds` string[] — Optional. GCIP tenant IDs that are linked to the IAP resource. `tenant_ids` could be a string beginning with a number character to indicate authenticating with GCIP tenant flow, or in the format of `_` to indicate authenticating with GCIP agent flow. If agent flow is used, `tenant_ids` should only contain one single element, while for tenant flow, `tenant_ids` can contain multiple elements. - `loginPageUri` string — Login page URI associated with the GCIP tenants. Typically, all resources within the same project share the same login page, though it could be overridden at the sub resource level. - `policyDelegationSettings` PolicyDelegationSettings — PolicyDelegationConfig allows google-internal teams to use IAP for apps hosted in a tenant project. Using these settings, the app can delegate permission check to happen against the linked customer project. This is only ever supposed to be used by google internal teams, hence the restriction on the proto. - `resource` Resource - `service` string — The name of the service this resource belongs to. It is configured using the official_service_name of the Service as defined in service configurations under //configs/cloud/resourcetypes. For example, the official_service_name of cloud resource manager service is set as 'cloudresourcemanager.googleapis.com' according to //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml This field is **required** for services integrated with resource-attribute-based IAM conditions and/or CustomOrgPolicy. This field requires special handling for parents-only permissions such as `create` and `list`. See the document linked below for further details. See go/iam-conditions-sig-g3#populate-resource-attributes for specific details on populating this field. - `name` string — The **relative** name of the resource, which is the URI path of the resource without the leading "/". See https://cloud.google.com/iam/docs/conditions-resource-attributes#resource-name for examples used by other GCP Services. This field is **required** for services integrated with resource-attribute-based IAM conditions and/or CustomOrgPolicy. This field requires special handling for parents-only permissions such as `create` and `list`. See the document linked below for further details. See go/iam-conditions-sig-g3#populate-resource-attributes for specific details on populating this field. - `labels` object — The service defined labels of the resource on which the conditions will be evaluated. The semantics - including the key names - are vague to IAM. If the effective condition has a reference to a `resource.labels[foo]` construct, IAM consults with this map to retrieve the values associated with `foo` key for Conditions evaluation. If the provided key is not found in the labels map, the condition would evaluate to false. This field is in limited use. If your intended use case is not expected to express resource.labels attribute in IAM Conditions, leave this field empty. Before planning on using this attribute please: * Read go/iam-conditions-labels-comm and ensure your service can meet the data availability and management requirements. * Talk to iam-conditions-eng@ about your use case. - `locations` string[] — The locations of the resource. This field is used to determine whether the request is compliant with Trust Boundaries. Usage: - Must not be empty for services in-scope for Trust Boundaries. Once Trust Boundaries is GA, empty values will cause the request to be rejected if customers enforce Trust Boundaries on the parent CRM nodes. - For global resources: use a single value of "global". - For regional/multi-regional resources: use name of the GCP region(s) where the resource exists (e.g., ["us-east1", "us-west1"]). For multi-regional resources specify the name of each GCP region in the resource's multi-region. NOTE: Only GCP cloud region names are supported - go/cloud-region-names. - Constraints: - Individual location strings must be less than 1000 bytes. - The cumulative size of all locations must be less than 16KB. - `nextStateOfTags` NextStateOfTags — Used for calculating the next state of tags on the resource being passed for the CheckCustomConstraints RPC call. The detail evaluation of each field is described in go/op-create-update-time-tags and go/tags-in-orgpolicy-requests. - `tagsFullState` TagsFullState - `tags` object — If TagsFullState is initialized, the values in this field fully represent all the tags in the next state (the current tag values are not used). If tags.size() == 0, the next state of tags would be no tags for evaluation purposes. Only one type of tags reference (numeric or namespace) is required to be passed. - `tagsPartialState` TagsPartialState - `tagsToUpsert` object — Tags that’ll be updated or added to the current state of tags for evaluation purposes. If a key exists in both "tags_to_upsert" and "tag_keys_to_remove", the one in "tag_keys_to_remove" is ignored. Only one type of tags reference (numeric or namespace) is required to be passed. - `tagKeysToRemove` string[] — Keys of the tags that should be removed for evaluation purposes. IMPORTANT: Currently only numeric references are supported. Once support for namespace references is added, both the tag references (numeric and namespace) will be removed. - `tagsFullStateForChildResource` TagsFullStateForChildResource - `tags` object — If TagsFullStateForChildResource is initialized, the values in this field represent all the tags in the next state for the child resource. Only one type of tags reference (numeric or namespace) is required to be passed. IMPORTANT: This field should only be used when the target resource IAM policy name is UNKNOWN and the resource's parent IAM policy name is being passed in the request. - `type` string — The public resource type name of the resource. It is configured using the official_name of the ResourceType as defined in service configurations under //configs/cloud/resourcetypes. For example, the official_name for GCP projects is set as 'cloudresourcemanager.googleapis.com/Project' according to //configs/cloud/resourcetypes/google/cloud/resourcemanager/prod.yaml This field is **required** for services integrated with resource-attribute-based IAM conditions and/or CustomOrgPolicy. This field requires special handling for parents-only permissions such as `create` and `list`. See the document linked below for further details. See go/iam-conditions-sig-g3#populate-resource-attributes for specific details on populating this field. - `expectedNextState` object — The proto or JSON formatted expected next state of the resource, wrapped in a google.protobuf.Any proto, against which the policy rules are evaluated. Services not integrated with custom org policy can omit this field. Services integrated with custom org policy must populate this field for all requests where the API call changes the state of the resource. Custom org policy backend uses these attributes to enforce custom org policies. For create operations, GCP service is expected to pass resource from customer request as is. For update/patch operations, GCP service is expected to compute the next state with the patch provided by the user. See go/federated-custom-org-policy-integration-guide for additional details. - `iamPermission` string — Permission to check in IAM. - `policyName` PolicyName — An internal name for an IAM policy, based on the resource to which the policy applies. Not to be confused with a resource's external full resource name. For more information on this distinction, see go/iam-full-resource-names. - `id` string — Identifies an instance of the type. ID format varies by type. The ID format is defined in the IAM .service file that defines the type, either in path_mapping or in a comment. - `region` string — For Cloud IAM: The location of the Policy. Must be empty or "global" for Policies owned by global IAM. Must name a region from prodspec/cloud-iam-cloudspec for Regional IAM Policies, see go/iam-faq#where-is-iam-currently-deployed. For Local IAM: This field should be set to "local". - `type` string — Resource type. Types are defined in IAM's .service files. Valid values for type might be 'storage_buckets', 'compute_instances', 'resourcemanager_customers', 'billing_accounts', etc. - `iamServiceName` string — The DNS name of the service (e.g. "resourcemanager.googleapis.com"). This should be the domain name part of the full resource names (see https://aip.dev/122#full-resource-names), which is usually the same as IamServiceSpec.service of the service where the resource type is defined. - `corsSettings` CorsSettings — Allows customers to configure HTTP request paths that'll allow HTTP `OPTIONS` call to bypass authentication and authorization. - `allowHttpOptions` boolean — Configuration to allow HTTP `OPTIONS` calls to skip authentication and authorization. If undefined, IAP will not apply any special logic to `OPTIONS` requests. - `applicationSettings` ApplicationSettings — Wrapper over application specific settings for IAP. - `csmSettings` CsmSettings — Configuration for RCToken generated for service mesh workloads protected by IAP. RCToken are IAP generated JWTs that can be verified at the application. The RCToken is primarily used for service mesh deployments, and can be scoped to a single mesh by configuring the audience field accordingly. - `rctokenAud` string — Audience claim set in the generated RCToken. This value is not validated by IAP. - `accessDeniedPageSettings` AccessDeniedPageSettings — Custom content configuration for access denied page. IAP allows customers to define a custom URI to use as the error page when access is denied to users. If IAP prevents access to this page, the default IAP error page will be displayed instead. - `accessDeniedPageUri` string — The URI to be redirected to when access is denied. - `generateTroubleshootingUri` boolean — Whether to generate a troubleshooting URL on access denied events to this application. - `remediationTokenGenerationEnabled` boolean — Whether to generate remediation token on access denied events to this application. - `cookieDomain` string — The Domain value to set for cookies generated by IAP. This value is not validated by the API, but will be ignored at runtime if invalid. - `attributePropagationSettings` AttributePropagationSettings — Configuration for propagating attributes to applications protected by IAP. - `outputCredentials` string[] — Optional. Which output credentials attributes selected by the CEL expression should be propagated in. All attributes will be fully duplicated in each selected output credential. - `expression` string — Optional. Raw string CEL expression. Must return a list of attributes. A maximum of 45 attributes can be selected. Expressions can select different attribute types from `attributes`: `attributes.saml_attributes`, `attributes.iap_attributes`. The following functions are supported: - filter `.filter(, )`: Returns a subset of `` where `` is true for every item. - in ` in `: Returns true if `` contains ``. - selectByName `.selectByName()`: Returns the attribute in `` with the given `` name, otherwise returns empty. - emitAs `.emitAs()`: Sets the `` name field to the given `` for propagation in selected output credentials. - strict `.strict()`: Ignores the `x-goog-iap-attr-` prefix for the provided `` when propagating with the `HEADER` output credential, such as request headers. - append `.append()` OR `.append()`: Appends the provided `` or `` to the end of ``. Example expression: `attributes.saml_attributes.filter(x, x.name in ['test']).append(attributes.iap_attributes.selectByName('exact').emitAs('custom').strict())` - `enable` boolean — Optional. Whether the provided attribute propagation settings should be evaluated on user requests. If set to true, attributes returned from the expression will be propagated in the set output credentials. ## Response `200` Successful response --- [API](https://skmtc.dev/google/apis/iap.md) · [All operations](https://skmtc.dev/google/apis/iap/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/iap/revisions/3ef63a4c0acd/schema)