auth_configs

Creates, updates, deletes, gets or lists an auth_configs resource.

Overview

Name	auth_configs
Type	Resource
Id	google.integrations.auth_configs

Fields

The following fields are returned by SELECT queries:

projects_locations_products_auth_configs_get

Successful response

Name	Datatype	Description
name	string	Resource name of the auth config. For more information, see Manage authentication profiles. projects/{project}/locations/{location}/authConfigs/{authConfig}.
certificateId	string	Certificate id for client certificate
createTime	string (google-datetime)	Output only. The timestamp when the auth config is created.
creatorEmail	string	The creator's email address. Generated based on the End User Credentials/LOAS role of the user making the call.
credentialType	string	Required. Credential type of the encrypted credential.
decryptedCredential	object	Raw auth credentials. (id: GoogleCloudIntegrationsV1alphaCredential)
description	string	Optional. A description of the auth config.
displayName	string	Required. The name of the auth config.
encryptedCredential	string (byte)	Auth credential encrypted by Cloud KMS. Can be decrypted as Credential with proper KMS key.
expiryNotificationDuration	array	Optional. User can define the time to receive notification after which the auth config becomes invalid. Support up to 30 days. Support granularity in hours.
lastModifierEmail	string	The last modifier's email address. Generated based on the End User Credentials/LOAS role of the user making the call.
overrideValidTime	string (google-datetime)	Optional. User provided expiry time to override. For the example of Salesforce, username/password credentials can be valid for 6 months depending on the instance settings.
reason	string	Output only. The reason / details of the current status.
state	string	Output only. The status of the auth config.
updateTime	string (google-datetime)	Output only. The timestamp when the auth config is modified.
validTime	string (google-datetime)	Optional. The time until the auth config is valid. Empty or max value is considered the auth config won't expire.
visibility	string	Optional. The visibility of the auth config.

projects_locations_products_auth_configs_list

Successful response

Name	Datatype	Description
name	string	Resource name of the auth config. For more information, see Manage authentication profiles. projects/{project}/locations/{location}/authConfigs/{authConfig}.
certificateId	string	Certificate id for client certificate
createTime	string (google-datetime)	Output only. The timestamp when the auth config is created.
creatorEmail	string	The creator's email address. Generated based on the End User Credentials/LOAS role of the user making the call.
credentialType	string	Required. Credential type of the encrypted credential.
decryptedCredential	object	Raw auth credentials. (id: GoogleCloudIntegrationsV1alphaCredential)
description	string	Optional. A description of the auth config.
displayName	string	Required. The name of the auth config.
encryptedCredential	string (byte)	Auth credential encrypted by Cloud KMS. Can be decrypted as Credential with proper KMS key.
expiryNotificationDuration	array	Optional. User can define the time to receive notification after which the auth config becomes invalid. Support up to 30 days. Support granularity in hours.
lastModifierEmail	string	The last modifier's email address. Generated based on the End User Credentials/LOAS role of the user making the call.
overrideValidTime	string (google-datetime)	Optional. User provided expiry time to override. For the example of Salesforce, username/password credentials can be valid for 6 months depending on the instance settings.
reason	string	Output only. The reason / details of the current status.
state	string	Output only. The status of the auth config.
updateTime	string (google-datetime)	Output only. The timestamp when the auth config is modified.
validTime	string (google-datetime)	Optional. The time until the auth config is valid. Empty or max value is considered the auth config won't expire.
visibility	string	Optional. The visibility of the auth config.

projects_locations_auth_configs_get

Successful response

Name	Datatype	Description
name	string	Resource name of the auth config. For more information, see Manage authentication profiles. projects/{project}/locations/{location}/authConfigs/{authConfig}.
certificateId	string	Certificate id for client certificate
createTime	string (google-datetime)	Output only. The timestamp when the auth config is created.
creatorEmail	string	The creator's email address. Generated based on the End User Credentials/LOAS role of the user making the call.
credentialType	string	Required. Credential type of the encrypted credential.
decryptedCredential	object	Raw auth credentials. (id: GoogleCloudIntegrationsV1alphaCredential)
description	string	Optional. A description of the auth config.
displayName	string	Required. The name of the auth config.
encryptedCredential	string (byte)	Auth credential encrypted by Cloud KMS. Can be decrypted as Credential with proper KMS key.
expiryNotificationDuration	array	Optional. User can define the time to receive notification after which the auth config becomes invalid. Support up to 30 days. Support granularity in hours.
lastModifierEmail	string	The last modifier's email address. Generated based on the End User Credentials/LOAS role of the user making the call.
overrideValidTime	string (google-datetime)	Optional. User provided expiry time to override. For the example of Salesforce, username/password credentials can be valid for 6 months depending on the instance settings.
reason	string	Output only. The reason / details of the current status.
state	string	Output only. The status of the auth config.
updateTime	string (google-datetime)	Output only. The timestamp when the auth config is modified.
validTime	string (google-datetime)	Optional. The time until the auth config is valid. Empty or max value is considered the auth config won't expire.
visibility	string	Optional. The visibility of the auth config.

projects_locations_auth_configs_list

Successful response

Name	Datatype	Description
name	string	Resource name of the auth config. For more information, see Manage authentication profiles. projects/{project}/locations/{location}/authConfigs/{authConfig}.
certificateId	string	Certificate id for client certificate
createTime	string (google-datetime)	Output only. The timestamp when the auth config is created.
creatorEmail	string	The creator's email address. Generated based on the End User Credentials/LOAS role of the user making the call.
credentialType	string	Required. Credential type of the encrypted credential.
decryptedCredential	object	Raw auth credentials. (id: GoogleCloudIntegrationsV1alphaCredential)
description	string	Optional. A description of the auth config.
displayName	string	Required. The name of the auth config.
encryptedCredential	string (byte)	Auth credential encrypted by Cloud KMS. Can be decrypted as Credential with proper KMS key.
expiryNotificationDuration	array	Optional. User can define the time to receive notification after which the auth config becomes invalid. Support up to 30 days. Support granularity in hours.
lastModifierEmail	string	The last modifier's email address. Generated based on the End User Credentials/LOAS role of the user making the call.
overrideValidTime	string (google-datetime)	Optional. User provided expiry time to override. For the example of Salesforce, username/password credentials can be valid for 6 months depending on the instance settings.
reason	string	Output only. The reason / details of the current status.
state	string	Output only. The status of the auth config.
updateTime	string (google-datetime)	Output only. The timestamp when the auth config is modified.
validTime	string (google-datetime)	Optional. The time until the auth config is valid. Empty or max value is considered the auth config won't expire.
visibility	string	Optional. The visibility of the auth config.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
projects_locations_products_auth_configs_get	select	projectsId, locationsId, productsId, authConfigsId		Gets a complete auth config. If the auth config doesn't exist, Code.NOT_FOUND exception will be thrown. Returns the decrypted auth config.
projects_locations_products_auth_configs_list	select	projectsId, locationsId, productsId	pageSize, pageToken, filter, readMask	Lists all auth configs that match the filter. Restrict to auth configs belong to the current client only.
projects_locations_auth_configs_get	select	projectsId, locationsId, authConfigsId		Gets a complete auth config. If the auth config doesn't exist, Code.NOT_FOUND exception will be thrown. Returns the decrypted auth config.
projects_locations_auth_configs_list	select	projectsId, locationsId	pageSize, pageToken, filter, readMask	Lists all auth configs that match the filter. Restrict to auth configs belong to the current client only.
projects_locations_products_auth_configs_create	insert	projectsId, locationsId, productsId	clientCertificate.sslCertificate, clientCertificate.encryptedPrivateKey, clientCertificate.passphrase	Creates an auth config record. Fetch corresponding credentials for specific auth types, e.g. access token for OAuth 2.0, JWT token for JWT. Encrypt the auth config with Cloud KMS and store the encrypted credentials in Spanner. Returns the encrypted auth config.
projects_locations_auth_configs_create	insert	projectsId, locationsId	clientCertificate.sslCertificate, clientCertificate.encryptedPrivateKey, clientCertificate.passphrase	Creates an auth config record. Fetch corresponding credentials for specific auth types, e.g. access token for OAuth 2.0, JWT token for JWT. Encrypt the auth config with Cloud KMS and store the encrypted credentials in Spanner. Returns the encrypted auth config.
projects_locations_products_auth_configs_patch	update	projectsId, locationsId, productsId, authConfigsId	updateMask, clientCertificate.sslCertificate, clientCertificate.encryptedPrivateKey, clientCertificate.passphrase	Updates an auth config. If credential is updated, fetch the encrypted auth config from Spanner, decrypt with Cloud KMS key, update the credential fields, re-encrypt with Cloud KMS key and update the Spanner record. For other fields, directly update the Spanner record. Returns the encrypted auth config.
projects_locations_auth_configs_patch	update	projectsId, locationsId, authConfigsId	updateMask, clientCertificate.sslCertificate, clientCertificate.encryptedPrivateKey, clientCertificate.passphrase	Updates an auth config. If credential is updated, fetch the encrypted auth config from Spanner, decrypt with Cloud KMS key, update the credential fields, re-encrypt with Cloud KMS key and update the Spanner record. For other fields, directly update the Spanner record. Returns the encrypted auth config.
projects_locations_products_auth_configs_delete	delete	projectsId, locationsId, productsId, authConfigsId		Deletes an auth config.
projects_locations_auth_configs_delete	delete	projectsId, locationsId, authConfigsId		Deletes an auth config.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
authConfigsId	string
locationsId	string
productsId	string
projectsId	string
clientCertificate.encryptedPrivateKey	string
clientCertificate.passphrase	string
clientCertificate.sslCertificate	string
filter	string
pageSize	integer (int32)
pageToken	string
readMask	string (google-fieldmask)
updateMask	string (google-fieldmask)

SELECT examples

projects_locations_products_auth_configs_get

Gets a complete auth config. If the auth config doesn't exist, Code.NOT_FOUND exception will be thrown. Returns the decrypted auth config.

SELECT
name,
certificateId,
createTime,
creatorEmail,
credentialType,
decryptedCredential,
description,
displayName,
encryptedCredential,
expiryNotificationDuration,
lastModifierEmail,
overrideValidTime,
reason,
state,
updateTime,
validTime,
visibility
FROM google.integrations.auth_configs
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND productsId = '{{ productsId }}' -- required
AND authConfigsId = '{{ authConfigsId }}' -- required;

projects_locations_products_auth_configs_list

Lists all auth configs that match the filter. Restrict to auth configs belong to the current client only.

SELECT
name,
certificateId,
createTime,
creatorEmail,
credentialType,
decryptedCredential,
description,
displayName,
encryptedCredential,
expiryNotificationDuration,
lastModifierEmail,
overrideValidTime,
reason,
state,
updateTime,
validTime,
visibility
FROM google.integrations.auth_configs
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND productsId = '{{ productsId }}' -- required
AND pageSize = '{{ pageSize }}'
AND pageToken = '{{ pageToken }}'
AND filter = '{{ filter }}'
AND readMask = '{{ readMask }}';

projects_locations_auth_configs_get

Gets a complete auth config. If the auth config doesn't exist, Code.NOT_FOUND exception will be thrown. Returns the decrypted auth config.

SELECT
name,
certificateId,
createTime,
creatorEmail,
credentialType,
decryptedCredential,
description,
displayName,
encryptedCredential,
expiryNotificationDuration,
lastModifierEmail,
overrideValidTime,
reason,
state,
updateTime,
validTime,
visibility
FROM google.integrations.auth_configs
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND authConfigsId = '{{ authConfigsId }}' -- required;

projects_locations_auth_configs_list

Lists all auth configs that match the filter. Restrict to auth configs belong to the current client only.

SELECT
name,
certificateId,
createTime,
creatorEmail,
credentialType,
decryptedCredential,
description,
displayName,
encryptedCredential,
expiryNotificationDuration,
lastModifierEmail,
overrideValidTime,
reason,
state,
updateTime,
validTime,
visibility
FROM google.integrations.auth_configs
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND pageSize = '{{ pageSize }}'
AND pageToken = '{{ pageToken }}'
AND filter = '{{ filter }}'
AND readMask = '{{ readMask }}';

INSERT examples

projects_locations_products_auth_configs_create

Creates an auth config record. Fetch corresponding credentials for specific auth types, e.g. access token for OAuth 2.0, JWT token for JWT. Encrypt the auth config with Cloud KMS and store the encrypted credentials in Spanner. Returns the encrypted auth config.

INSERT INTO google.integrations.auth_configs (
data__name,
data__displayName,
data__description,
data__encryptedCredential,
data__decryptedCredential,
data__certificateId,
data__credentialType,
data__creatorEmail,
data__lastModifierEmail,
data__visibility,
data__expiryNotificationDuration,
data__validTime,
data__overrideValidTime,
projectsId,
locationsId,
productsId,
clientCertificate.sslCertificate,
clientCertificate.encryptedPrivateKey,
clientCertificate.passphrase
)
SELECT 
'{{ name }}',
'{{ displayName }}',
'{{ description }}',
'{{ encryptedCredential }}',
'{{ decryptedCredential }}',
'{{ certificateId }}',
'{{ credentialType }}',
'{{ creatorEmail }}',
'{{ lastModifierEmail }}',
'{{ visibility }}',
'{{ expiryNotificationDuration }}',
'{{ validTime }}',
'{{ overrideValidTime }}',
'{{ projectsId }}',
'{{ locationsId }}',
'{{ productsId }}',
'{{ clientCertificate.sslCertificate }}',
'{{ clientCertificate.encryptedPrivateKey }}',
'{{ clientCertificate.passphrase }}'
RETURNING
name,
certificateId,
createTime,
creatorEmail,
credentialType,
decryptedCredential,
description,
displayName,
encryptedCredential,
expiryNotificationDuration,
lastModifierEmail,
overrideValidTime,
reason,
state,
updateTime,
validTime,
visibility
;

projects_locations_auth_configs_create

Creates an auth config record. Fetch corresponding credentials for specific auth types, e.g. access token for OAuth 2.0, JWT token for JWT. Encrypt the auth config with Cloud KMS and store the encrypted credentials in Spanner. Returns the encrypted auth config.

INSERT INTO google.integrations.auth_configs (
data__name,
data__displayName,
data__description,
data__encryptedCredential,
data__decryptedCredential,
data__certificateId,
data__credentialType,
data__creatorEmail,
data__lastModifierEmail,
data__visibility,
data__expiryNotificationDuration,
data__validTime,
data__overrideValidTime,
projectsId,
locationsId,
clientCertificate.sslCertificate,
clientCertificate.encryptedPrivateKey,
clientCertificate.passphrase
)
SELECT 
'{{ name }}',
'{{ displayName }}',
'{{ description }}',
'{{ encryptedCredential }}',
'{{ decryptedCredential }}',
'{{ certificateId }}',
'{{ credentialType }}',
'{{ creatorEmail }}',
'{{ lastModifierEmail }}',
'{{ visibility }}',
'{{ expiryNotificationDuration }}',
'{{ validTime }}',
'{{ overrideValidTime }}',
'{{ projectsId }}',
'{{ locationsId }}',
'{{ clientCertificate.sslCertificate }}',
'{{ clientCertificate.encryptedPrivateKey }}',
'{{ clientCertificate.passphrase }}'
RETURNING
name,
certificateId,
createTime,
creatorEmail,
credentialType,
decryptedCredential,
description,
displayName,
encryptedCredential,
expiryNotificationDuration,
lastModifierEmail,
overrideValidTime,
reason,
state,
updateTime,
validTime,
visibility
;

Manifest

# Description fields are for documentation purposes
- name: auth_configs
  props:
    - name: projectsId
      value: string
      description: Required parameter for the auth_configs resource.
    - name: locationsId
      value: string
      description: Required parameter for the auth_configs resource.
    - name: productsId
      value: string
      description: Required parameter for the auth_configs resource.
    - name: name
      value: string
      description: >
        Resource name of the auth config. For more information, see Manage authentication profiles. projects/{project}/locations/{location}/authConfigs/{authConfig}.
        
    - name: displayName
      value: string
      description: >
        Required. The name of the auth config.
        
    - name: description
      value: string
      description: >
        Optional. A description of the auth config.
        
    - name: encryptedCredential
      value: string
      description: >
        Auth credential encrypted by Cloud KMS. Can be decrypted as Credential with proper KMS key.
        
    - name: decryptedCredential
      value: object
      description: >
        Raw auth credentials.
        
    - name: certificateId
      value: string
      description: >
        Certificate id for client certificate
        
    - name: credentialType
      value: string
      description: >
        Required. Credential type of the encrypted credential.
        
      valid_values: ['CREDENTIAL_TYPE_UNSPECIFIED', 'USERNAME_AND_PASSWORD', 'API_KEY', 'OAUTH2_AUTHORIZATION_CODE', 'OAUTH2_IMPLICIT', 'OAUTH2_CLIENT_CREDENTIALS', 'OAUTH2_RESOURCE_OWNER_CREDENTIALS', 'JWT', 'AUTH_TOKEN', 'SERVICE_ACCOUNT', 'CLIENT_CERTIFICATE_ONLY', 'OIDC_TOKEN']
    - name: creatorEmail
      value: string
      description: >
        The creator's email address. Generated based on the End User Credentials/LOAS role of the user making the call.
        
    - name: lastModifierEmail
      value: string
      description: >
        The last modifier's email address. Generated based on the End User Credentials/LOAS role of the user making the call.
        
    - name: visibility
      value: string
      description: >
        Optional. The visibility of the auth config.
        
      valid_values: ['AUTH_CONFIG_VISIBILITY_UNSPECIFIED', 'PRIVATE', 'CLIENT_VISIBLE']
    - name: expiryNotificationDuration
      value: array
      description: >
        Optional. User can define the time to receive notification after which the auth config becomes invalid. Support up to 30 days. Support granularity in hours.
        
    - name: validTime
      value: string
      description: >
        Optional. The time until the auth config is valid. Empty or max value is considered the auth config won't expire.
        
    - name: overrideValidTime
      value: string
      description: >
        Optional. User provided expiry time to override. For the example of Salesforce, username/password credentials can be valid for 6 months depending on the instance settings.
        
    - name: clientCertificate.sslCertificate
      value: string
    - name: clientCertificate.encryptedPrivateKey
      value: string
    - name: clientCertificate.passphrase
      value: string

UPDATE examples

projects_locations_products_auth_configs_patch

Updates an auth config. If credential is updated, fetch the encrypted auth config from Spanner, decrypt with Cloud KMS key, update the credential fields, re-encrypt with Cloud KMS key and update the Spanner record. For other fields, directly update the Spanner record. Returns the encrypted auth config.

UPDATE google.integrations.auth_configs
SET 
data__name = '{{ name }}',
data__displayName = '{{ displayName }}',
data__description = '{{ description }}',
data__encryptedCredential = '{{ encryptedCredential }}',
data__decryptedCredential = '{{ decryptedCredential }}',
data__certificateId = '{{ certificateId }}',
data__credentialType = '{{ credentialType }}',
data__creatorEmail = '{{ creatorEmail }}',
data__lastModifierEmail = '{{ lastModifierEmail }}',
data__visibility = '{{ visibility }}',
data__expiryNotificationDuration = '{{ expiryNotificationDuration }}',
data__validTime = '{{ validTime }}',
data__overrideValidTime = '{{ overrideValidTime }}'
WHERE 
projectsId = '{{ projectsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND productsId = '{{ productsId }}' --required
AND authConfigsId = '{{ authConfigsId }}' --required
AND updateMask = '{{ updateMask}}'
AND clientCertificate.sslCertificate = '{{ clientCertificate.sslCertificate}}'
AND clientCertificate.encryptedPrivateKey = '{{ clientCertificate.encryptedPrivateKey}}'
AND clientCertificate.passphrase = '{{ clientCertificate.passphrase}}'
RETURNING
name,
certificateId,
createTime,
creatorEmail,
credentialType,
decryptedCredential,
description,
displayName,
encryptedCredential,
expiryNotificationDuration,
lastModifierEmail,
overrideValidTime,
reason,
state,
updateTime,
validTime,
visibility;

projects_locations_auth_configs_patch

Updates an auth config. If credential is updated, fetch the encrypted auth config from Spanner, decrypt with Cloud KMS key, update the credential fields, re-encrypt with Cloud KMS key and update the Spanner record. For other fields, directly update the Spanner record. Returns the encrypted auth config.

UPDATE google.integrations.auth_configs
SET 
data__name = '{{ name }}',
data__displayName = '{{ displayName }}',
data__description = '{{ description }}',
data__encryptedCredential = '{{ encryptedCredential }}',
data__decryptedCredential = '{{ decryptedCredential }}',
data__certificateId = '{{ certificateId }}',
data__credentialType = '{{ credentialType }}',
data__creatorEmail = '{{ creatorEmail }}',
data__lastModifierEmail = '{{ lastModifierEmail }}',
data__visibility = '{{ visibility }}',
data__expiryNotificationDuration = '{{ expiryNotificationDuration }}',
data__validTime = '{{ validTime }}',
data__overrideValidTime = '{{ overrideValidTime }}'
WHERE 
projectsId = '{{ projectsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND authConfigsId = '{{ authConfigsId }}' --required
AND updateMask = '{{ updateMask}}'
AND clientCertificate.sslCertificate = '{{ clientCertificate.sslCertificate}}'
AND clientCertificate.encryptedPrivateKey = '{{ clientCertificate.encryptedPrivateKey}}'
AND clientCertificate.passphrase = '{{ clientCertificate.passphrase}}'
RETURNING
name,
certificateId,
createTime,
creatorEmail,
credentialType,
decryptedCredential,
description,
displayName,
encryptedCredential,
expiryNotificationDuration,
lastModifierEmail,
overrideValidTime,
reason,
state,
updateTime,
validTime,
visibility;

DELETE examples

projects_locations_products_auth_configs_delete

Deletes an auth config.

DELETE FROM google.integrations.auth_configs
WHERE projectsId = '{{ projectsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND productsId = '{{ productsId }}' --required
AND authConfigsId = '{{ authConfigsId }}' --required;

projects_locations_auth_configs_delete

Deletes an auth config.

DELETE FROM google.integrations.auth_configs
WHERE projectsId = '{{ projectsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND authConfigsId = '{{ authConfigsId }}' --required;