// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.kms.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/duration.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.Kms.V1";
option go_package = "cloud.google.com/go/kms/apiv1/kmspb;kmspb";
option java_multiple_files = true;
option java_outer_classname = "HsmManagementProto";
option java_package = "com.google.cloud.kms.v1";
option php_namespace = "Google\\Cloud\\Kms\\V1";

// Google Cloud HSM Management Service
//
// Provides interfaces for managing HSM instances.
//
// Implements a REST model with the following objects:
// * [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
// * [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
service HsmManagement {
  option (google.api.default_host) = "cloudkms.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform,"
      "https://www.googleapis.com/auth/cloudkms";

  // Lists
  // [SingleTenantHsmInstances][google.cloud.kms.v1.SingleTenantHsmInstance].
  rpc ListSingleTenantHsmInstances(ListSingleTenantHsmInstancesRequest)
      returns (ListSingleTenantHsmInstancesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/singleTenantHsmInstances"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns metadata for a given
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  rpc GetSingleTenantHsmInstance(GetSingleTenantHsmInstanceRequest)
      returns (SingleTenantHsmInstance) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/singleTenantHsmInstances/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] in a
  // given Project and Location. User must create a RegisterTwoFactorAuthKeys
  // proposal with this single-tenant HSM instance to finish setup of the
  // instance.
  rpc CreateSingleTenantHsmInstance(CreateSingleTenantHsmInstanceRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/singleTenantHsmInstances"
      body: "single_tenant_hsm_instance"
    };
    option (google.api.method_signature) =
        "parent,single_tenant_hsm_instance,single_tenant_hsm_instance_id";
    option (google.longrunning.operation_info) = {
      response_type: "SingleTenantHsmInstance"
      metadata_type: "CreateSingleTenantHsmInstanceMetadata"
    };
  }

  // Creates a new
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // for a given
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  rpc CreateSingleTenantHsmInstanceProposal(
      CreateSingleTenantHsmInstanceProposalRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*/singleTenantHsmInstances/*}/proposals"
      body: "single_tenant_hsm_instance_proposal"
    };
    option (google.api.method_signature) =
        "parent,single_tenant_hsm_instance_proposal,single_tenant_hsm_instance_proposal_id";
    option (google.longrunning.operation_info) = {
      response_type: "SingleTenantHsmInstanceProposal"
      metadata_type: "CreateSingleTenantHsmInstanceProposalMetadata"
    };
  }

  // Approves a
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // for a given
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]. The
  // proposal must be in the
  // [PENDING][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.State.PENDING]
  // state.
  rpc ApproveSingleTenantHsmInstanceProposal(
      ApproveSingleTenantHsmInstanceProposalRequest)
      returns (ApproveSingleTenantHsmInstanceProposalResponse) {
    option (google.api.http) = {
      post: "/v1/{name=projects/*/locations/*/singleTenantHsmInstances/*/proposals/*}:approve"
      body: "*"
    };
    option (google.api.method_signature) = "name,quorum_reply";
  }

  // Executes a
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // for a given
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]. The
  // proposal must be in the
  // [APPROVED][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.State.APPROVED]
  // state.
  rpc ExecuteSingleTenantHsmInstanceProposal(
      ExecuteSingleTenantHsmInstanceProposalRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{name=projects/*/locations/*/singleTenantHsmInstances/*/proposals/*}:execute"
      body: "*"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "ExecuteSingleTenantHsmInstanceProposalResponse"
      metadata_type: "ExecuteSingleTenantHsmInstanceProposalMetadata"
    };
  }

  // Returns metadata for a given
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
  rpc GetSingleTenantHsmInstanceProposal(
      GetSingleTenantHsmInstanceProposalRequest)
      returns (SingleTenantHsmInstanceProposal) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/singleTenantHsmInstances/*/proposals/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Lists
  // [SingleTenantHsmInstanceProposals][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
  rpc ListSingleTenantHsmInstanceProposals(
      ListSingleTenantHsmInstanceProposalsRequest)
      returns (ListSingleTenantHsmInstanceProposalsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/singleTenantHsmInstances/*}/proposals"
    };
    option (google.api.method_signature) = "parent";
  }

  // Deletes a
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
  rpc DeleteSingleTenantHsmInstanceProposal(
      DeleteSingleTenantHsmInstanceProposalRequest)
      returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/singleTenantHsmInstances/*/proposals/*}"
    };
    option (google.api.method_signature) = "name";
  }
}

// A [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
// represents a single-tenant HSM instance. It can be used for creating
// [CryptoKeys][google.cloud.kms.v1.CryptoKey] with a
// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
// [HSM_SINGLE_TENANT][CryptoKeyVersion.ProtectionLevel.HSM_SINGLE_TENANT], as
// well as performing cryptographic operations using keys created within the
// [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
message SingleTenantHsmInstance {
  option (google.api.resource) = {
    type: "cloudkms.googleapis.com/SingleTenantHsmInstance"
    pattern: "projects/{project}/locations/{location}/singleTenantHsmInstances/{single_tenant_hsm_instance}"
    plural: "singleTenantHsmInstances"
    singular: "singleTenantHsmInstance"
  };

  // The set of states of a
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  enum State {
    // Not specified.
    STATE_UNSPECIFIED = 0;

    // The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] is
    // being created.
    CREATING = 1;

    // The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] is
    // waiting for 2FA keys to be registered. This can be done by calling
    // [CreateSingleTenantHsmInstanceProposal][google.cloud.kms.v1.HsmManagement.CreateSingleTenantHsmInstanceProposal]
    // with the [RegisterTwoFactorAuthKeys][] operation.
    PENDING_TWO_FACTOR_AUTH_REGISTRATION = 2;

    // The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] is
    // ready to use. A
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // must be in the
    // [ACTIVE][google.cloud.kms.v1.SingleTenantHsmInstance.State.ACTIVE] state
    // for all [CryptoKeys][google.cloud.kms.v1.CryptoKey] created within the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] to
    // be usable.
    ACTIVE = 3;

    // The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] is
    // being disabled.
    DISABLING = 4;

    // The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] is
    // disabled.
    DISABLED = 5;

    // The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] is
    // being deleted. Requests to the instance will be rejected in this state.
    DELETING = 6;

    // The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // has been deleted.
    DELETED = 7;

    // The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // has failed and can not be recovered or used.
    FAILED = 8;
  }

  // Configuration for M of N quorum auth.
  message QuorumAuth {
    // Required. The total number of approvers. This is the N value used
    // for M of N quorum auth. Must be greater than or equal to 3 and less than
    // or equal to 16.
    int32 total_approver_count = 1 [(google.api.field_behavior) = REQUIRED];

    // Output only. The required numbers of approvers. The M value used for M of
    // N quorum auth. Must be greater than or equal to 2 and less than or equal
    // to
    // [total_approver_count][google.cloud.kms.v1.SingleTenantHsmInstance.QuorumAuth.total_approver_count]
    // - 1.
    int32 required_approver_count = 2
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The public keys associated with the 2FA keys for M of N
    // quorum auth.
    repeated string two_factor_public_key_pems = 3
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Identifier. The resource name for this
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] in
  // the format `projects/*/locations/*/singleTenantHsmInstances/*`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. The time at which the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] was
  // created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The state of the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  State state = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Required. The quorum auth configuration for the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  QuorumAuth quorum_auth = 4 [(google.api.field_behavior) = REQUIRED];

  // Output only. The time at which the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] was
  // deleted.
  google.protobuf.Timestamp delete_time = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The system-defined duration that an instance can remain
  // unrefreshed until it is automatically disabled. This will have a value of
  // 730 days.
  google.protobuf.Duration unrefreshed_duration_until_disable = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time at which the instance will be automatically disabled
  // if not refreshed. This field is updated upon creation and after each
  // successful refresh operation and enable. A
  // [RefreshSingleTenantHsmInstance][] operation must be made via a
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // before this time otherwise the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] will
  // become disabled.
  google.protobuf.Timestamp disable_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Immutable. Indicates whether key portability is enabled for the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  // This can only be set at creation time. Key portability features are
  // disabled by default and not yet available in GA.
  bool key_portability_enabled = 8 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = IMMUTABLE
  ];
}

// A
// [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
// represents a proposal to perform an operation on a
// [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
message SingleTenantHsmInstanceProposal {
  option (google.api.resource) = {
    type: "cloudkms.googleapis.com/SingleTenantHsmInstanceProposal"
    pattern: "projects/{project}/locations/{location}/singleTenantHsmInstances/{single_tenant_hsm_instance}/proposals/{proposal}"
    plural: "singleTenantHsmInstanceProposals"
    singular: "singleTenantHsmInstanceProposal"
  };

  // The set of states of a
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
  enum State {
    // Not specified.
    STATE_UNSPECIFIED = 0;

    // The
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // is being created.
    CREATING = 1;

    // The
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // is pending approval.
    PENDING = 2;

    // The
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // has been approved.
    APPROVED = 3;

    // The
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // is being executed.
    RUNNING = 4;

    // The
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // has been executed successfully.
    SUCCEEDED = 5;

    // The
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // has failed.
    FAILED = 6;

    // The
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // has been deleted and will be purged after the purge_time.
    DELETED = 7;
  }

  // Parameters of quorum approval for the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
  message QuorumParameters {
    // Output only. The required numbers of approvers. This is the M value used
    // for M of N quorum auth. It is less than the number of public keys.
    int32 required_approver_count = 1
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The challenges to be signed by 2FA keys for quorum auth. M
    // of N of these challenges are required to be signed to approve the
    // operation.
    repeated Challenge challenges = 2
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The public keys associated with the 2FA keys that have
    // already approved the
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // by signing the challenge.
    repeated string approved_two_factor_public_key_pems = 3
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Parameters for an approval that has both required challenges and a
  // quorum.
  message RequiredActionQuorumParameters {
    // Output only. A list of specific challenges that must be signed.
    // For some operations, this will contain a single challenge.
    repeated Challenge required_challenges = 1
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The required number of quorum approvers. This is the M value
    // used for M of N quorum auth. It is less than the number of public keys.
    int32 required_approver_count = 2
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The challenges to be signed by 2FA keys for quorum auth. M
    // of N of these challenges are required to be signed to approve the
    // operation.
    repeated Challenge quorum_challenges = 3
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The public keys associated with the 2FA keys that have
    // already approved the
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // by signing the challenge.
    repeated string approved_two_factor_public_key_pems = 4
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Register 2FA keys for the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  // This operation requires all Challenges to be signed by 2FA keys. The
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] must
  // be in the
  // [PENDING_TWO_FACTOR_AUTH_REGISTRATION][google.cloud.kms.v1.SingleTenantHsmInstance.State.PENDING_TWO_FACTOR_AUTH_REGISTRATION]
  // state to perform this operation.
  message RegisterTwoFactorAuthKeys {
    // Required. The required numbers of approvers to set for the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
    // This is the M value used for M of N quorum auth. Must be greater than or
    // equal to 2 and less than or equal to
    // [total_approver_count][google.cloud.kms.v1.SingleTenantHsmInstance.QuorumAuth.total_approver_count]
    // - 1.
    int32 required_approver_count = 1 [(google.api.field_behavior) = REQUIRED];

    // Required. The public keys associated with the 2FA keys for M of N quorum
    // auth. Public keys must be associated with RSA 2048 keys.
    repeated string two_factor_public_key_pems = 2
        [(google.api.field_behavior) = REQUIRED];
  }

  // Disable the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]. The
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] must
  // be in the
  // [ACTIVE][google.cloud.kms.v1.SingleTenantHsmInstance.State.ACTIVE] state to
  // perform this operation.
  message DisableSingleTenantHsmInstance {}

  // Enable the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]. The
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] must
  // be in the
  // [DISABLED][google.cloud.kms.v1.SingleTenantHsmInstance.State.DISABLED]
  // state to perform this operation.
  message EnableSingleTenantHsmInstance {}

  // Delete the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  // Deleting a
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] will
  // make all [CryptoKeys][google.cloud.kms.v1.CryptoKey] attached to the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
  // unusable. The
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] must
  // not be in the
  // [DELETING][google.cloud.kms.v1.SingleTenantHsmInstance.State.DELETING] or
  // [DELETED][google.cloud.kms.v1.SingleTenantHsmInstance.State.DELETED] state
  // to perform this operation.
  message DeleteSingleTenantHsmInstance {}

  // Add a quorum member to the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  // This will increase the
  // [total_approver_count][google.cloud.kms.v1.SingleTenantHsmInstance.QuorumAuth.total_approver_count]
  // by 1. The
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] must
  // be in the
  // [ACTIVE][google.cloud.kms.v1.SingleTenantHsmInstance.State.ACTIVE] state to
  // perform this operation.
  message AddQuorumMember {
    // Required. The public key associated with the 2FA key for the new quorum
    // member to add. Public keys must be associated with RSA 2048 keys.
    string two_factor_public_key_pem = 1
        [(google.api.field_behavior) = REQUIRED];
  }

  // Remove a quorum member from the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  // This will reduce
  // [total_approver_count][google.cloud.kms.v1.SingleTenantHsmInstance.QuorumAuth.total_approver_count]
  // by 1. The
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] must
  // be in the
  // [ACTIVE][google.cloud.kms.v1.SingleTenantHsmInstance.State.ACTIVE] state to
  // perform this operation.
  message RemoveQuorumMember {
    // Required. The public key associated with the 2FA key for the quorum
    // member to remove. Public keys must be associated with RSA 2048 keys.
    string two_factor_public_key_pem = 1
        [(google.api.field_behavior) = REQUIRED];
  }

  // Refreshes the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  // This operation must be performed periodically to keep the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
  // active. This operation must be performed before
  // [unrefreshed_duration_until_disable][google.cloud.kms.v1.SingleTenantHsmInstance.unrefreshed_duration_until_disable]
  // has passed. The
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] must
  // be in the
  // [ACTIVE][google.cloud.kms.v1.SingleTenantHsmInstance.State.ACTIVE] state to
  // perform this operation.
  message RefreshSingleTenantHsmInstance {}

  // Identifier. The resource name for this
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] in
  // the format `projects/*/locations/*/singleTenantHsmInstances/*/proposals/*`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. The time at which the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The state of the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
  State state = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The root cause of the most recent failure. Only present if
  // [state][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.state] is
  // [FAILED][SingleTenantHsmInstanceProposal.FAILED].
  string failure_reason = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The approval parameters for the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
  // The type of parameters is determined by the operation being proposed.
  oneof approval_parameters {
    // Output only. The quorum approval parameters for the
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
    QuorumParameters quorum_parameters = 5
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. Parameters for an approval of a
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // that has both required challenges and a quorum.
    RequiredActionQuorumParameters required_action_quorum_parameters = 14
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // The expiration of the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
  // If not set, the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // will expire in 1 day. The maximum expire time is 7 days. The minimum expire
  // time is 5 minutes.
  oneof expiration {
    // The time at which the
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
    // will expire if not approved and executed.
    google.protobuf.Timestamp expire_time = 6;

    // Input only. The TTL for the
    // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
    // Proposals will expire after this duration.
    google.protobuf.Duration ttl = 7 [(google.api.field_behavior) = INPUT_ONLY];
  }

  // Output only. The time at which the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // was deleted.
  google.protobuf.Timestamp delete_time = 15
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time at which the soft-deleted
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // will be permanently purged. This field is only populated
  // when the state is DELETED and will be set a time after expiration of the
  // proposal, i.e. >= expire_time or (create_time + ttl).
  google.protobuf.Timestamp purge_time = 16
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // The operation to perform on the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
  oneof operation {
    // Register 2FA keys for the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
    // This operation requires all N Challenges to be signed by 2FA keys. The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // must be in the
    // [PENDING_TWO_FACTOR_AUTH_REGISTRATION][google.cloud.kms.v1.SingleTenantHsmInstance.State.PENDING_TWO_FACTOR_AUTH_REGISTRATION]
    // state to perform this operation.
    RegisterTwoFactorAuthKeys register_two_factor_auth_keys = 8;

    // Disable the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
    // The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // must be in the
    // [ACTIVE][google.cloud.kms.v1.SingleTenantHsmInstance.State.ACTIVE] state
    // to perform this operation.
    DisableSingleTenantHsmInstance disable_single_tenant_hsm_instance = 9;

    // Enable the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
    // The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // must be in the
    // [DISABLED][google.cloud.kms.v1.SingleTenantHsmInstance.State.DISABLED]
    // state to perform this operation.
    EnableSingleTenantHsmInstance enable_single_tenant_hsm_instance = 10;

    // Delete the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
    // Deleting a
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // will make all [CryptoKeys][google.cloud.kms.v1.CryptoKey] attached to the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // unusable. The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // must be in the
    // [DISABLED][google.cloud.kms.v1.SingleTenantHsmInstance.State.DISABLED] or
    // [PENDING_TWO_FACTOR_AUTH_REGISTRATION][google.cloud.kms.v1.SingleTenantHsmInstance.State.PENDING_TWO_FACTOR_AUTH_REGISTRATION]
    // state to perform this operation.
    DeleteSingleTenantHsmInstance delete_single_tenant_hsm_instance = 11;

    // Add a quorum member to the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
    // This will increase the
    // [total_approver_count][google.cloud.kms.v1.SingleTenantHsmInstance.QuorumAuth.total_approver_count]
    // by 1. The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // must be in the
    // [ACTIVE][google.cloud.kms.v1.SingleTenantHsmInstance.State.ACTIVE] state
    // to perform this operation.
    AddQuorumMember add_quorum_member = 12;

    // Remove a quorum member from the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
    // This will reduce
    // [total_approver_count][google.cloud.kms.v1.SingleTenantHsmInstance.QuorumAuth.total_approver_count]
    // by 1. The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // must be in the
    // [ACTIVE][google.cloud.kms.v1.SingleTenantHsmInstance.State.ACTIVE] state
    // to perform this operation.
    RemoveQuorumMember remove_quorum_member = 13;

    // Refreshes the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance].
    // This operation must be performed periodically to keep the
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // active. This operation must be performed before
    // [unrefreshed_duration_until_disable][google.cloud.kms.v1.SingleTenantHsmInstance.unrefreshed_duration_until_disable]
    // has passed. The
    // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
    // must be in the
    // [ACTIVE][google.cloud.kms.v1.SingleTenantHsmInstance.State.ACTIVE] state
    // to perform this operation.
    RefreshSingleTenantHsmInstance refresh_single_tenant_hsm_instance = 17;
  }
}

// A challenge to be signed by a 2FA key.
message Challenge {
  // Output only. The challenge to be signed by the 2FA key indicated by the
  // public key.
  bytes challenge = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The public key associated with the 2FA key that should sign
  // the challenge.
  string public_key_pem = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// A reply to a challenge signed by a 2FA key.
message ChallengeReply {
  // Required. The signed challenge associated with the 2FA key.
  // The signature must be RSASSA-PKCS1 v1.5 with a SHA256 digest.
  bytes signed_challenge = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The public key associated with the 2FA key.
  string public_key_pem = 2 [(google.api.field_behavior) = REQUIRED];
}

// Request message for
// [HsmManagement.ListSingleTenantHsmInstances][google.cloud.kms.v1.HsmManagement.ListSingleTenantHsmInstances].
message ListSingleTenantHsmInstancesRequest {
  // Required. The resource name of the location associated with the
  // [SingleTenantHsmInstances][google.cloud.kms.v1.SingleTenantHsmInstance] to
  // list, in the format `projects/*/locations/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // Optional. Optional limit on the number of
  // [SingleTenantHsmInstances][google.cloud.kms.v1.SingleTenantHsmInstance] to
  // include in the response. Further
  // [SingleTenantHsmInstances][google.cloud.kms.v1.SingleTenantHsmInstance] can
  // subsequently be
  // obtained by including the
  // [ListSingleTenantHsmInstancesResponse.next_page_token][google.cloud.kms.v1.ListSingleTenantHsmInstancesResponse.next_page_token]
  // in a subsequent request. If unspecified, the server will pick an
  // appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Optional pagination token, returned earlier via
  // [ListSingleTenantHsmInstancesResponse.next_page_token][google.cloud.kms.v1.ListSingleTenantHsmInstancesResponse.next_page_token].
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Only include resources that match the filter in the response. For
  // more information, see
  // [Sorting and filtering list
  // results](https://cloud.google.com/kms/docs/sorting-and-filtering).
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Specify how the results should be sorted. If not specified, the
  // results will be sorted in the default order.  For more information, see
  // [Sorting and filtering list
  // results](https://cloud.google.com/kms/docs/sorting-and-filtering).
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. If set to true,
  // [HsmManagement.ListSingleTenantHsmInstances][google.cloud.kms.v1.HsmManagement.ListSingleTenantHsmInstances]
  // will also return
  // [SingleTenantHsmInstances][google.cloud.kms.v1.SingleTenantHsmInstance] in
  // DELETED state.
  bool show_deleted = 6 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for
// [HsmManagement.ListSingleTenantHsmInstances][google.cloud.kms.v1.HsmManagement.ListSingleTenantHsmInstances].
message ListSingleTenantHsmInstancesResponse {
  // The list of
  // [SingleTenantHsmInstances][google.cloud.kms.v1.SingleTenantHsmInstance].
  repeated SingleTenantHsmInstance single_tenant_hsm_instances = 1;

  // A token to retrieve next page of results. Pass this value in
  // [ListSingleTenantHsmInstancesRequest.page_token][google.cloud.kms.v1.ListSingleTenantHsmInstancesRequest.page_token]
  // to retrieve the next page of results.
  string next_page_token = 2;

  // The total number of
  // [SingleTenantHsmInstances][google.cloud.kms.v1.SingleTenantHsmInstance]
  // that matched the query.
  //
  // This field is not populated if
  // [ListSingleTenantHsmInstancesRequest.filter][google.cloud.kms.v1.ListSingleTenantHsmInstancesRequest.filter]
  // is applied.
  int32 total_size = 3;
}

// Request message for
// [HsmManagement.GetSingleTenantHsmInstance][google.cloud.kms.v1.HsmManagement.GetSingleTenantHsmInstance].
message GetSingleTenantHsmInstanceRequest {
  // Required. The [name][google.cloud.kms.v1.SingleTenantHsmInstance.name] of
  // the [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
  // to get.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudkms.googleapis.com/SingleTenantHsmInstance"
    }
  ];
}

// Request message for
// [HsmManagement.CreateSingleTenantHsmInstance][google.cloud.kms.v1.HsmManagement.CreateSingleTenantHsmInstance].
message CreateSingleTenantHsmInstanceRequest {
  // Required. The resource name of the location associated with the
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance], in
  // the format `projects/*/locations/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // Optional. It must be unique within a location and match the regular
  // expression `[a-zA-Z0-9_-]{1,63}`.
  string single_tenant_hsm_instance_id = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Required. An
  // [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance] with
  // initial field values.
  SingleTenantHsmInstance single_tenant_hsm_instance = 3
      [(google.api.field_behavior) = REQUIRED];
}

// Metadata message for
// [CreateSingleTenantHsmInstance][google.cloud.kms.v1.HsmManagement.CreateSingleTenantHsmInstance]
// long-running operation response.
message CreateSingleTenantHsmInstanceMetadata {}

// Request message for
// [HsmManagement.CreateSingleTenantHsmInstanceProposal][google.cloud.kms.v1.HsmManagement.CreateSingleTenantHsmInstanceProposal].
message CreateSingleTenantHsmInstanceProposalRequest {
  // Required. The [name][google.cloud.kms.v1.SingleTenantHsmInstance.name] of
  // the [SingleTenantHsmInstance][google.cloud.kms.v1.SingleTenantHsmInstance]
  // associated with the
  // [SingleTenantHsmInstanceProposals][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudkms.googleapis.com/SingleTenantHsmInstance"
    }
  ];

  // Optional. It must be unique within a location and match the regular
  // expression `[a-zA-Z0-9_-]{1,63}`.
  string single_tenant_hsm_instance_proposal_id = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Required. The
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // to create.
  SingleTenantHsmInstanceProposal single_tenant_hsm_instance_proposal = 3
      [(google.api.field_behavior) = REQUIRED];
}

// Metadata message for
// [CreateSingleTenantHsmInstanceProposal][google.cloud.kms.v1.HsmManagement.CreateSingleTenantHsmInstanceProposal]
// long-running operation response.
message CreateSingleTenantHsmInstanceProposalMetadata {}

// Request message for
// [HsmManagement.GetSingleTenantHsmInstanceProposal][google.cloud.kms.v1.HsmManagement.GetSingleTenantHsmInstanceProposal].
message GetSingleTenantHsmInstanceProposalRequest {
  // Required. The
  // [name][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.name] of the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // to get.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudkms.googleapis.com/SingleTenantHsmInstanceProposal"
    }
  ];
}

// Request message for
// [HsmManagement.ApproveSingleTenantHsmInstanceProposal][google.cloud.kms.v1.HsmManagement.ApproveSingleTenantHsmInstanceProposal].
message ApproveSingleTenantHsmInstanceProposalRequest {
  // The reply to
  // [QuorumParameters][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.QuorumParameters]
  // for approving the proposal.
  message QuorumReply {
    // Required. The challenge replies to approve the proposal. Challenge
    // replies can be sent across multiple requests. The proposal will be
    // approved when
    // [required_approver_count][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.QuorumParameters.required_approver_count]
    // challenge replies are provided.
    repeated ChallengeReply challenge_replies = 1
        [(google.api.field_behavior) = REQUIRED];
  }

  // The reply to
  // [RequiredActionQuorumParameters][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.RequiredActionQuorumParameters]
  // for approving the proposal.
  message RequiredActionQuorumReply {
    // Required. All required challenges must be signed for the proposal to be
    // approved. These can be sent across multiple requests.
    repeated ChallengeReply required_challenge_replies = 1
        [(google.api.field_behavior) = REQUIRED];

    // Required. Quorum members' signed challenge replies. These can be provided
    // across multiple requests. The proposal will be approved when
    // [required_approver_count][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.RequiredActionQuorumParameters.required_approver_count]
    // quorum_challenge_replies are provided and when all
    // required_challenge_replies are provided.
    repeated ChallengeReply quorum_challenge_replies = 2
        [(google.api.field_behavior) = REQUIRED];
  }

  // Required. The
  // [name][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.name] of the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // to approve.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudkms.googleapis.com/SingleTenantHsmInstanceProposal"
    }
  ];

  // The approval payload. The type of approval payload must correspond to the
  // type of approval_parameters in the proposal.
  oneof approval_payload {
    // Required. The reply to
    // [QuorumParameters][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.QuorumParameters]
    // for approving the proposal.
    QuorumReply quorum_reply = 2 [(google.api.field_behavior) = REQUIRED];

    // Required. The reply to
    // [RequiredActionQuorumParameters][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.RequiredActionQuorumParameters]
    // for approving the proposal.
    RequiredActionQuorumReply required_action_quorum_reply = 3
        [(google.api.field_behavior) = REQUIRED];
  }
}

// Response message for
// [HsmManagement.ApproveSingleTenantHsmInstanceProposal][google.cloud.kms.v1.HsmManagement.ApproveSingleTenantHsmInstanceProposal].
message ApproveSingleTenantHsmInstanceProposalResponse {}

// Request message for
// [HsmManagement.ExecuteSingleTenantHsmInstanceProposal][google.cloud.kms.v1.HsmManagement.ExecuteSingleTenantHsmInstanceProposal].
message ExecuteSingleTenantHsmInstanceProposalRequest {
  // Required. The
  // [name][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.name] of the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // to execute.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudkms.googleapis.com/SingleTenantHsmInstanceProposal"
    }
  ];
}

// Response message for
// [HsmManagement.ExecuteSingleTenantHsmInstanceProposal][google.cloud.kms.v1.HsmManagement.ExecuteSingleTenantHsmInstanceProposal].
message ExecuteSingleTenantHsmInstanceProposalResponse {}

// Metadata message for
// [ExecuteSingleTenantHsmInstanceProposal][google.cloud.kms.v1.HsmManagement.ExecuteSingleTenantHsmInstanceProposal]
// long-running operation response.
message ExecuteSingleTenantHsmInstanceProposalMetadata {}

// Request message for
// [HsmManagement.ListSingleTenantHsmInstanceProposals][google.cloud.kms.v1.HsmManagement.ListSingleTenantHsmInstanceProposals].
message ListSingleTenantHsmInstanceProposalsRequest {
  // Required. The resource name of the single tenant HSM instance associated
  // with the
  // [SingleTenantHsmInstanceProposals][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // to list, in the format `projects/*/locations/*/singleTenantHsmInstances/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudkms.googleapis.com/SingleTenantHsmInstance"
    }
  ];

  // Optional. Optional limit on the number of
  // [SingleTenantHsmInstanceProposals][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // to include in the response. Further
  // [SingleTenantHsmInstanceProposals][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // can subsequently be obtained by including the
  // [ListSingleTenantHsmInstanceProposalsResponse.next_page_token][google.cloud.kms.v1.ListSingleTenantHsmInstanceProposalsResponse.next_page_token]
  // in a subsequent request. If unspecified, the server will pick an
  // appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Optional pagination token, returned earlier via
  // [ListSingleTenantHsmInstanceProposalsResponse.next_page_token][google.cloud.kms.v1.ListSingleTenantHsmInstanceProposalsResponse.next_page_token].
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Only include resources that match the filter in the response. For
  // more information, see
  // [Sorting and filtering list
  // results](https://cloud.google.com/kms/docs/sorting-and-filtering).
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Specify how the results should be sorted. If not specified, the
  // results will be sorted in the default order.  For more information, see
  // [Sorting and filtering list
  // results](https://cloud.google.com/kms/docs/sorting-and-filtering).
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. If set to true,
  // [HsmManagement.ListSingleTenantHsmInstanceProposals][google.cloud.kms.v1.HsmManagement.ListSingleTenantHsmInstanceProposals]
  // will also return
  // [SingleTenantHsmInstanceProposals][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // in DELETED state.
  bool show_deleted = 6 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for
// [HsmManagement.ListSingleTenantHsmInstanceProposals][google.cloud.kms.v1.HsmManagement.ListSingleTenantHsmInstanceProposals].
message ListSingleTenantHsmInstanceProposalsResponse {
  // The list of
  // [SingleTenantHsmInstanceProposals][google.cloud.kms.v1.SingleTenantHsmInstanceProposal].
  repeated SingleTenantHsmInstanceProposal
      single_tenant_hsm_instance_proposals = 1;

  // A token to retrieve next page of results. Pass this value in
  // [ListSingleTenantHsmInstanceProposalsRequest.page_token][google.cloud.kms.v1.ListSingleTenantHsmInstanceProposalsRequest.page_token]
  // to retrieve the next page of results.
  string next_page_token = 2;

  // The total number of
  // [SingleTenantHsmInstanceProposals][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // that matched the query.
  //
  // This field is not populated if
  // [ListSingleTenantHsmInstanceProposalsRequest.filter][google.cloud.kms.v1.ListSingleTenantHsmInstanceProposalsRequest.filter]
  // is applied.
  int32 total_size = 3;
}

// Request message for
// [HsmManagement.DeleteSingleTenantHsmInstanceProposal][google.cloud.kms.v1.HsmManagement.DeleteSingleTenantHsmInstanceProposal].
message DeleteSingleTenantHsmInstanceProposalRequest {
  // Required. The
  // [name][google.cloud.kms.v1.SingleTenantHsmInstanceProposal.name] of the
  // [SingleTenantHsmInstanceProposal][google.cloud.kms.v1.SingleTenantHsmInstanceProposal]
  // to delete.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudkms.googleapis.com/SingleTenantHsmInstanceProposal"
    }
  ];
}