auth_providers

Creates, updates, deletes, gets or lists an auth_providers resource.

Overview

Name	auth_providers
Type	Resource
Id	google.agentidentity.auth_providers

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
name	string	Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
allowedScopes	array	Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in blocked_scopes are disallowed even if they appear in allowed_scopes. The number of allowed scopes is limited to 200.
authProviderTypeParams	object	Required. AuthProvider type specific parameters. (id: AuthProviderTypeParams)
blockedScopes	array	Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in allowed_scopes. blocked_scopes takes precedence over allowed_scopes. The number of blocked scopes is limited to 200.
createTime	string (google-datetime)	Output only. [Output only] Create time stamp
deleted	boolean	Output only. This is set to true if the auth_provider is deleted.
description	string	Optional. Description of the resource. Must be less than 256 characters.
expireTime	string (google-datetime)	Output only. The time when the auth_provider will expire.
labels	object	Optional. Labels as key value pairs
state	string	Output only. The state of the auth_provider. (STATE_UNSPECIFIED, ENABLED, DISABLED)
updateTime	string (google-datetime)	Output only. [Output only] Update time stamp
workloadIds	array	Optional. Input only. Represents the workload identity in IAM principal:// format of the agent(s) that will use this AuthProvider. Example: principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}

query_workloads

Name	Datatype	Description
nextPageToken	string	A token to retrieve the next page of results.
workloadIds	array	The unique list of workload identifiers (agents) that used the auth_provider.

query

Name	Datatype	Description
authProviderNames	array	The unique list of auth_provider resource names used by the workload.
nextPageToken	string	A token identifying a page of results the server should return. If this field is omitted, there are no subsequent pages.

list

Name	Datatype	Description

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	projectsId, locationsId, authProvidersId		Gets details of a single AuthProvider.
query_workloads	select	projectsId, locationsId, authProvidersId	pageSize, pageToken	Queries what all workloads are using a given auth_provider.
query	select	projectsId, locationsId	pageToken, workloadId, pageSize	Queries what all auth_providers are used by a given workload_id.
list	select	projectsId, locationsId	showDeleted, pageToken, pageSize, orderBy, filter	Lists AuthProviders in a given project and location.
create	insert	projectsId, locationsId	authProviderId, requestId	Creates a new AuthProvider in a given project and location.
patch	update	projectsId, locationsId, authProvidersId	updateMask, requestId	Updates the parameters of a single AuthProvider.
delete	delete	projectsId, locationsId, authProvidersId	requestId	Deletes a single AuthProvider.
undelete	exec	projectsId, locationsId, authProvidersId		Undeletes a single AuthProvider.
revoke_authorization	exec	projectsId, locationsId, authProvidersId		Revokes all authorizations for a specific user on an AuthProvider. This deletes all authorization records associated with the user and AuthProvider, effectively revoking access across all agents.
enable	exec	projectsId, locationsId, authProvidersId		Enables a single AuthProvider.
disable	exec	projectsId, locationsId, authProvidersId		Disables a single AuthProvider.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
authProvidersId	string
locationsId	string
projectsId	string
authProviderId	string
filter	string
orderBy	string
pageSize	integer (int32)
pageToken	string
requestId	string
showDeleted	boolean
updateMask	string (google-fieldmask)
workloadId	string

SELECT examples

get

Gets details of a single AuthProvider.

SELECT
name,
allowedScopes,
authProviderTypeParams,
blockedScopes,
createTime,
deleted,
description,
expireTime,
labels,
state,
updateTime,
workloadIds
FROM google.agentidentity.auth_providers
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND authProvidersId = '{{ authProvidersId }}' -- required
;

query_workloads

Queries what all workloads are using a given auth_provider.

SELECT
nextPageToken,
workloadIds
FROM google.agentidentity.auth_providers
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND authProvidersId = '{{ authProvidersId }}' -- required
AND pageSize = '{{ pageSize }}'
AND pageToken = '{{ pageToken }}'
;

query

Queries what all auth_providers are used by a given workload_id.

SELECT
authProviderNames,
nextPageToken
FROM google.agentidentity.auth_providers
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND pageToken = '{{ pageToken }}'
AND workloadId = '{{ workloadId }}'
AND pageSize = '{{ pageSize }}'
;

list

Lists AuthProviders in a given project and location.

SELECT
*
FROM google.agentidentity.auth_providers
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND showDeleted = '{{ showDeleted }}'
AND pageToken = '{{ pageToken }}'
AND pageSize = '{{ pageSize }}'
AND orderBy = '{{ orderBy }}'
AND filter = '{{ filter }}'
;

INSERT examples

create

Creates a new AuthProvider in a given project and location.

INSERT INTO google.agentidentity.auth_providers (
data__authProviderTypeParams,
data__allowedScopes,
data__workloadIds,
data__name,
data__blockedScopes,
data__description,
data__labels,
projectsId,
locationsId,
authProviderId,
requestId
)
SELECT 
'{{ authProviderTypeParams }}',
'{{ allowedScopes }}',
'{{ workloadIds }}',
'{{ name }}',
'{{ blockedScopes }}',
'{{ description }}',
'{{ labels }}',
'{{ projectsId }}',
'{{ locationsId }}',
'{{ authProviderId }}',
'{{ requestId }}'
RETURNING
name,
allowedScopes,
authProviderTypeParams,
blockedScopes,
createTime,
deleted,
description,
expireTime,
labels,
state,
updateTime,
workloadIds
;

Manifest

# Description fields are for documentation purposes
- name: auth_providers
props:
  - name: projectsId
    value: "{{ projectsId }}"
    description: Required parameter for the auth_providers resource.
  - name: locationsId
    value: "{{ locationsId }}"
    description: Required parameter for the auth_providers resource.
  - name: authProviderTypeParams
    description: |
      Required. AuthProvider type specific parameters.
    value:
      geAuthProvider: "{{ geAuthProvider }}"
      twoLeggedOauth:
        clientSecret: "{{ clientSecret }}"
        clientId: "{{ clientId }}"
        tokenUrl: "{{ tokenUrl }}"
      apiKey:
        apiKey: "{{ apiKey }}"
      threeLeggedOauth:
        clientSecret: "{{ clientSecret }}"
        clientId: "{{ clientId }}"
        enablePkce: {{ enablePkce }}
        redirectUrl: "{{ redirectUrl }}"
        defaultContinueUri: "{{ defaultContinueUri }}"
        authorizationUrl: "{{ authorizationUrl }}"
        tokenUrl: "{{ tokenUrl }}"
  - name: allowedScopes
    value:
      - "{{ allowedScopes }}"
    description: |
      Optional. List of scopes that are allowed to be requested for this auth_provider. If this list is non-empty, only scopes within this list may be requested. If this list is empty, all scopes may be requested. Scopes appearing in `blocked_scopes` are disallowed even if they appear in `allowed_scopes`. The number of allowed scopes is limited to 200.
  - name: workloadIds
    value:
      - "{{ workloadIds }}"
    description: |
      Optional. Input only. Represents the workload identity in IAM `principal://` format of the agent(s) that will use this AuthProvider. Example: `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
  - name: name
    value: "{{ name }}"
    description: |
      Identifier. The full resource name of the auth_provider. Format: projects/{project}/locations/{location}/authProviders/{auth_provider}
  - name: blockedScopes
    value:
      - "{{ blockedScopes }}"
    description: |
      Optional. List of scopes that are blocked from being requested for this auth_provider. If a scope appears in this list, it will not be requested, even if it also appears in `allowed_scopes`. `blocked_scopes` takes precedence over `allowed_scopes`. The number of blocked scopes is limited to 200.
  - name: description
    value: "{{ description }}"
    description: |
      Optional. Description of the resource. Must be less than 256 characters.
  - name: labels
    value: "{{ labels }}"
    description: |
      Optional. Labels as key value pairs
  - name: authProviderId
    value: "{{ authProviderId }}"
  - name: requestId
    value: "{{ requestId }}"

UPDATE examples

patch

Updates the parameters of a single AuthProvider.

UPDATE google.agentidentity.auth_providers
SET 
data__authProviderTypeParams = '{{ authProviderTypeParams }}',
data__allowedScopes = '{{ allowedScopes }}',
data__workloadIds = '{{ workloadIds }}',
data__name = '{{ name }}',
data__blockedScopes = '{{ blockedScopes }}',
data__description = '{{ description }}',
data__labels = '{{ labels }}'
WHERE 
projectsId = '{{ projectsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND authProvidersId = '{{ authProvidersId }}' --required
AND updateMask = '{{ updateMask}}'
AND requestId = '{{ requestId}}'
RETURNING
name,
allowedScopes,
authProviderTypeParams,
blockedScopes,
createTime,
deleted,
description,
expireTime,
labels,
state,
updateTime,
workloadIds;

DELETE examples

delete

Deletes a single AuthProvider.

DELETE FROM google.agentidentity.auth_providers
WHERE projectsId = '{{ projectsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND authProvidersId = '{{ authProvidersId }}' --required
AND requestId = '{{ requestId }}'
;

Lifecycle Methods

undelete

Undeletes a single AuthProvider.

EXEC google.agentidentity.auth_providers.undelete 
@projectsId='{{ projectsId }}' --required, 
@locationsId='{{ locationsId }}' --required, 
@authProvidersId='{{ authProvidersId }}' --required 
@@json=
'{
"requestId": "{{ requestId }}"
}'
;

revoke_authorization

Revokes all authorizations for a specific user on an AuthProvider. This deletes all authorization records associated with the user and AuthProvider, effectively revoking access across all agents.

EXEC google.agentidentity.auth_providers.revoke_authorization 
@projectsId='{{ projectsId }}' --required, 
@locationsId='{{ locationsId }}' --required, 
@authProvidersId='{{ authProvidersId }}' --required 
@@json=
'{
"userId": "{{ userId }}"
}'
;

enable

Enables a single AuthProvider.

EXEC google.agentidentity.auth_providers.enable 
@projectsId='{{ projectsId }}' --required, 
@locationsId='{{ locationsId }}' --required, 
@authProvidersId='{{ authProvidersId }}' --required 
@@json=
'{
"requestId": "{{ requestId }}"
}'
;

disable

Disables a single AuthProvider.

EXEC google.agentidentity.auth_providers.disable 
@projectsId='{{ projectsId }}' --required, 
@locationsId='{{ locationsId }}' --required, 
@authProvidersId='{{ authProvidersId }}' --required 
@@json=
'{
"requestId": "{{ requestId }}"
}'
;