// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networkservices.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/field_info.proto";
import "google/api/resource.proto";
import "google/cloud/networkservices/v1/common.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/duration.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/struct.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkServices.V1";
option go_package = "cloud.google.com/go/networkservices/apiv1/networkservicespb;networkservicespb";
option java_multiple_files = true;
option java_outer_classname = "DepProto";
option java_package = "com.google.cloud.networkservices.v1";
option php_namespace = "Google\\Cloud\\NetworkServices\\V1";
option ruby_package = "Google::Cloud::NetworkServices::V1";

// Service describing handlers for resources.
service DepService {
  option (google.api.default_host) = "networkservices.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists `LbTrafficExtension` resources in a given project and location.
  rpc ListLbTrafficExtensions(ListLbTrafficExtensionsRequest)
      returns (ListLbTrafficExtensionsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/lbTrafficExtensions"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of the specified `LbTrafficExtension` resource.
  rpc GetLbTrafficExtension(GetLbTrafficExtensionRequest)
      returns (LbTrafficExtension) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/lbTrafficExtensions/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new `LbTrafficExtension` resource in a given project and
  // location.
  rpc CreateLbTrafficExtension(CreateLbTrafficExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/lbTrafficExtensions"
      body: "lb_traffic_extension"
    };
    option (google.api.method_signature) =
        "parent,lb_traffic_extension,lb_traffic_extension_id";
    option (google.longrunning.operation_info) = {
      response_type: "LbTrafficExtension"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates the parameters of the specified `LbTrafficExtension` resource.
  rpc UpdateLbTrafficExtension(UpdateLbTrafficExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{lb_traffic_extension.name=projects/*/locations/*/lbTrafficExtensions/*}"
      body: "lb_traffic_extension"
    };
    option (google.api.method_signature) = "lb_traffic_extension,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "LbTrafficExtension"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes the specified `LbTrafficExtension` resource.
  rpc DeleteLbTrafficExtension(DeleteLbTrafficExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/lbTrafficExtensions/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists `LbRouteExtension` resources in a given project and location.
  rpc ListLbRouteExtensions(ListLbRouteExtensionsRequest)
      returns (ListLbRouteExtensionsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/lbRouteExtensions"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of the specified `LbRouteExtension` resource.
  rpc GetLbRouteExtension(GetLbRouteExtensionRequest)
      returns (LbRouteExtension) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/lbRouteExtensions/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new `LbRouteExtension` resource in a given project and location.
  rpc CreateLbRouteExtension(CreateLbRouteExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/lbRouteExtensions"
      body: "lb_route_extension"
    };
    option (google.api.method_signature) =
        "parent,lb_route_extension,lb_route_extension_id";
    option (google.longrunning.operation_info) = {
      response_type: "LbRouteExtension"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates the parameters of the specified `LbRouteExtension` resource.
  rpc UpdateLbRouteExtension(UpdateLbRouteExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{lb_route_extension.name=projects/*/locations/*/lbRouteExtensions/*}"
      body: "lb_route_extension"
    };
    option (google.api.method_signature) = "lb_route_extension,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "LbRouteExtension"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes the specified `LbRouteExtension` resource.
  rpc DeleteLbRouteExtension(DeleteLbRouteExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/lbRouteExtensions/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists `LbEdgeExtension` resources in a given project and location.
  rpc ListLbEdgeExtensions(ListLbEdgeExtensionsRequest)
      returns (ListLbEdgeExtensionsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/lbEdgeExtensions"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of the specified `LbEdgeExtension` resource.
  rpc GetLbEdgeExtension(GetLbEdgeExtensionRequest) returns (LbEdgeExtension) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/lbEdgeExtensions/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new `LbEdgeExtension` resource in a given project and location.
  rpc CreateLbEdgeExtension(CreateLbEdgeExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/lbEdgeExtensions"
      body: "lb_edge_extension"
    };
    option (google.api.method_signature) =
        "parent,lb_edge_extension,lb_edge_extension_id";
    option (google.longrunning.operation_info) = {
      response_type: "LbEdgeExtension"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates the parameters of the specified `LbEdgeExtension` resource.
  rpc UpdateLbEdgeExtension(UpdateLbEdgeExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{lb_edge_extension.name=projects/*/locations/*/lbEdgeExtensions/*}"
      body: "lb_edge_extension"
    };
    option (google.api.method_signature) = "lb_edge_extension,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "LbEdgeExtension"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes the specified `LbEdgeExtension` resource.
  rpc DeleteLbEdgeExtension(DeleteLbEdgeExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/lbEdgeExtensions/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists `AuthzExtension` resources in a given project and location.
  rpc ListAuthzExtensions(ListAuthzExtensionsRequest)
      returns (ListAuthzExtensionsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/authzExtensions"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of the specified `AuthzExtension` resource.
  rpc GetAuthzExtension(GetAuthzExtensionRequest) returns (AuthzExtension) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/authzExtensions/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new `AuthzExtension` resource in a given project
  // and location.
  rpc CreateAuthzExtension(CreateAuthzExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/authzExtensions"
      body: "authz_extension"
    };
    option (google.api.method_signature) =
        "parent,authz_extension,authz_extension_id";
    option (google.longrunning.operation_info) = {
      response_type: "AuthzExtension"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates the parameters of the specified `AuthzExtension`
  // resource.
  rpc UpdateAuthzExtension(UpdateAuthzExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{authz_extension.name=projects/*/locations/*/authzExtensions/*}"
      body: "authz_extension"
    };
    option (google.api.method_signature) = "authz_extension,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "AuthzExtension"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes the specified `AuthzExtension` resource.
  rpc DeleteAuthzExtension(DeleteAuthzExtensionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/authzExtensions/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }
}

// The part of the request or response for which the extension is called.
enum EventType {
  // Unspecified value. Do not use.
  EVENT_TYPE_UNSPECIFIED = 0;

  // If included in `supported_events`,
  // the extension is called when the HTTP request headers arrive.
  REQUEST_HEADERS = 1;

  // If included in `supported_events`,
  // the extension is called when the HTTP request body arrives.
  REQUEST_BODY = 2;

  // If included in `supported_events`,
  // the extension is called when the HTTP response headers arrive.
  RESPONSE_HEADERS = 3;

  // If included in `supported_events`,
  // the extension is called when the HTTP response body arrives.
  RESPONSE_BODY = 4;

  // If included in `supported_events`,
  // the extension is called when the HTTP request trailers arrives.
  REQUEST_TRAILERS = 5;

  // If included in `supported_events`,
  // the extension is called when the HTTP response trailers arrives.
  RESPONSE_TRAILERS = 6;
}

// Load balancing schemes supported by the `LbTrafficExtension`,
// `LbRouteExtension`, and `LbEdgeExtension` resources.
// For more information, refer to [Backend services
// overview](https://cloud.google.com/load-balancing/docs/backend-service).
enum LoadBalancingScheme {
  // Default value. Do not use.
  LOAD_BALANCING_SCHEME_UNSPECIFIED = 0;

  // Signifies that this is used for Internal HTTP(S) Load Balancing.
  INTERNAL_MANAGED = 1;

  // Signifies that this is used for External Managed HTTP(S) Load
  // Balancing.
  EXTERNAL_MANAGED = 2;
}

// The format of communication supported by the extension.
enum WireFormat {
  // Not specified.
  WIRE_FORMAT_UNSPECIFIED = 0;

  // The extension service uses ext_proc gRPC API over a gRPC stream. This is
  // the default value if the wire format is not specified. The backend service
  // for the extension must use HTTP2 or H2C as the protocol. All
  // `supported_events` for a client request are sent as part of the same
  // gRPC stream.
  EXT_PROC_GRPC = 1;
}

// A single extension chain wrapper that contains the match conditions and
// extensions to execute.
message ExtensionChain {
  // Conditions under which this chain is invoked for a request.
  message MatchCondition {
    // Required. A Common Expression Language (CEL) expression that is used to
    // match requests for which the extension chain is executed.
    //
    // For more information, see [CEL matcher language
    // reference](https://cloud.google.com/service-extensions/docs/cel-matcher-language-reference).
    string cel_expression = 1 [(google.api.field_behavior) = REQUIRED];
  }

  // A single extension in the chain to execute for the matching request.
  message Extension {
    // Required. The name for this extension.
    // The name is logged as part of the HTTP request logs.
    // The name must conform with RFC-1034, is restricted to lower-cased
    // letters, numbers and hyphens, and can have a maximum length of 63
    // characters. Additionally, the first character must be a letter and the
    // last a letter or a number.
    string name = 1 [(google.api.field_behavior) = REQUIRED];

    // Optional. The `:authority` header in the gRPC request sent from Envoy
    // to the extension service.
    // Required for Callout extensions.
    //
    // This field is not supported for plugin extensions. Setting it results in
    // a validation error.
    string authority = 2 [(google.api.field_behavior) = OPTIONAL];

    // Required. The reference to the service that runs the extension.
    //
    // To configure a callout extension, `service` must be a fully-qualified
    // reference
    // to a [backend
    // service](https://cloud.google.com/compute/docs/reference/rest/v1/backendServices)
    // in the format:
    // `https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/backendServices/{backendService}`
    // or
    // `https://www.googleapis.com/compute/v1/projects/{project}/global/backendServices/{backendService}`.
    //
    // To configure a plugin extension, `service` must be a reference
    // to a [`WasmPlugin`
    // resource](https://cloud.google.com/service-extensions/docs/reference/rest/v1beta1/projects.locations.wasmPlugins)
    // in the format:
    // `projects/{project}/locations/{location}/wasmPlugins/{plugin}`
    // or
    // `//networkservices.googleapis.com/projects/{project}/locations/{location}/wasmPlugins/{wasmPlugin}`.
    //
    // Plugin extensions are currently supported for the
    // `LbTrafficExtension`, the `LbRouteExtension`, and the `LbEdgeExtension`
    // resources.
    string service = 3 [(google.api.field_behavior) = REQUIRED];

    // Optional. A set of events during request or response processing for which
    // this extension is called.
    //
    // For the `LbTrafficExtension` resource, this field is required.
    //
    // For the `LbRouteExtension` resource, this field is optional. If
    // unspecified, `REQUEST_HEADERS` event is assumed as supported.
    //
    // For the `LbEdgeExtension` resource, this field is required and must only
    // contain `REQUEST_HEADERS` event.
    repeated EventType supported_events = 4
        [(google.api.field_behavior) = OPTIONAL];

    // Optional. Specifies the timeout for each individual message on the
    // stream. The timeout must be between `10`-`10000` milliseconds. Required
    // for callout extensions.
    //
    // This field is not supported for plugin extensions. Setting it results in
    // a validation error.
    google.protobuf.Duration timeout = 5
        [(google.api.field_behavior) = OPTIONAL];

    // Optional. Determines how the proxy behaves if the call to the extension
    // fails or times out.
    //
    // When set to `TRUE`, request or response processing continues without
    // error. Any subsequent extensions in the extension chain are also
    // executed. When set to `FALSE` or the default setting of `FALSE` is used,
    // one of the following happens:
    //
    // * If response headers have not been delivered to the downstream client,
    // a generic 500 error is returned to the client. The error response can be
    // tailored by configuring a custom error response in the load balancer.
    //
    // * If response headers have been delivered, then the HTTP stream to the
    // downstream client is reset.
    bool fail_open = 6 [(google.api.field_behavior) = OPTIONAL];

    // Optional. List of the HTTP headers to forward to the extension
    // (from the client or backend). If omitted, all headers are sent.
    // Each element is a string indicating the header name.
    repeated string forward_headers = 7
        [(google.api.field_behavior) = OPTIONAL];

    // Optional. The metadata provided here is included as part of the
    // `metadata_context` (of type `google.protobuf.Struct`) in the
    // `ProcessingRequest` message sent to the extension server.
    //
    // The metadata is available under the namespace
    // `com.google.<extension_type>.<resource_name>.<extension_chain_name>.<extension_name>`.
    // For example:
    // `com.google.lb_traffic_extension.lbtrafficextension1.chain1.ext1`.
    //
    // The following variables are supported in the metadata:
    //
    // `{forwarding_rule_id}` - substituted with the forwarding rule's fully
    //   qualified resource name.
    //
    // This field must not be set for plugin extensions. Setting it results in
    // a validation error.
    //
    // You can set metadata at either the resource level or the extension level.
    // The extension level metadata is recommended because you can pass a
    // different set of metadata through each extension to the backend.
    //
    // This field is subject to following limitations:
    //
    // * The total size of the metadata must be less than 1KiB.
    // * The total number of keys in the metadata must be less than 16.
    // * The length of each key must be less than 64 characters.
    // * The length of each value must be less than 1024 characters.
    // * All values must be strings.
    google.protobuf.Struct metadata = 9
        [(google.api.field_behavior) = OPTIONAL];
  }

  // Required. The name for this extension chain.
  // The name is logged as part of the HTTP request logs.
  // The name must conform with RFC-1034, is restricted to lower-cased letters,
  // numbers and hyphens, and can have a maximum length of 63 characters.
  // Additionally, the first character must be a letter and the last a letter or
  // a number.
  string name = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Conditions under which this chain is invoked for a request.
  MatchCondition match_condition = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. A set of extensions to execute for the matching request.
  // At least one extension is required.
  // Up to 3 extensions can be defined for each extension chain
  // for `LbTrafficExtension` resource.
  // `LbRouteExtension` and `LbEdgeExtension` chains are limited to 1 extension
  // per extension chain.
  repeated Extension extensions = 3 [(google.api.field_behavior) = REQUIRED];
}

// `LbTrafficExtension` is a resource that lets the extension service modify the
// headers and payloads of both requests and responses without impacting the
// choice of backend services or any other security policies associated with the
// backend service.
message LbTrafficExtension {
  option (google.api.resource) = {
    type: "networkservices.googleapis.com/LbTrafficExtension"
    pattern: "projects/{project}/locations/{location}/lbTrafficExtensions/{lb_traffic_extension}"
    plural: "lbTrafficExtensions"
    singular: "lbTrafficExtension"
  };

  // Required. Identifier. Name of the `LbTrafficExtension` resource in the
  // following format:
  // `projects/{project}/locations/{location}/lbTrafficExtensions/{lb_traffic_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = IDENTIFIER
  ];

  // Output only. The timestamp when the resource was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the resource was updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. A human-readable description of the resource.
  string description = 9 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Set of labels associated with the `LbTrafficExtension` resource.
  //
  // The format must comply with [the requirements for
  // labels](https://cloud.google.com/compute/docs/labeling-resources#requirements)
  // for Google Cloud resources.
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A list of references to the forwarding rules to which this
  // service extension is attached. At least one forwarding rule is required.
  // Only one `LbTrafficExtension` resource can be associated with a forwarding
  // rule.
  repeated string forwarding_rules = 5 [(google.api.field_behavior) = OPTIONAL];

  // Required. A set of ordered extension chains that contain the match
  // conditions and extensions to execute. Match conditions for each extension
  // chain are evaluated in sequence for a given request. The first extension
  // chain that has a condition that matches the request is executed.
  // Any subsequent extension chains do not execute.
  // Limited to 5 extension chains per resource.
  repeated ExtensionChain extension_chains = 7
      [(google.api.field_behavior) = REQUIRED];

  // Required. All backend services and forwarding rules referenced by this
  // extension must share the same load balancing scheme. Supported values:
  // `INTERNAL_MANAGED` and `EXTERNAL_MANAGED`. For more information, refer to
  // [Backend services
  // overview](https://cloud.google.com/load-balancing/docs/backend-service).
  LoadBalancingScheme load_balancing_scheme = 8
      [(google.api.field_behavior) = REQUIRED];

  // Optional. The metadata provided here is included as part of the
  // `metadata_context` (of type `google.protobuf.Struct`) in the
  // `ProcessingRequest` message sent to the extension server.
  //
  // The metadata applies to all extensions in all extensions chains in this
  // resource.
  //
  // The metadata is available under the key
  // `com.google.lb_traffic_extension.<resource_name>`.
  //
  // The following variables are supported in the metadata:
  //
  // `{forwarding_rule_id}` - substituted with the forwarding rule's fully
  //   qualified resource name.
  //
  // This field must not be set if at least one of the extension chains
  // contains plugin extensions. Setting it results in a validation error.
  //
  // You can set metadata at either the resource level or the extension level.
  // The extension level metadata is recommended because you can pass a
  // different set of metadata through each extension to the backend.
  google.protobuf.Struct metadata = 10 [(google.api.field_behavior) = OPTIONAL];
}

// Message for requesting list of `LbTrafficExtension` resources.
message ListLbTrafficExtensionsRequest {
  // Required. The project and location from which the `LbTrafficExtension`
  // resources are listed. These values are specified in the following format:
  // `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkservices.googleapis.com/LbTrafficExtension"
    }
  ];

  // Optional. Requested page size. The server might return fewer items than
  // requested. If unspecified, the server picks an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token identifying a page of results that the server returns.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filtering results.
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Hint about how to order the results.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Message for response to listing `LbTrafficExtension` resources.
message ListLbTrafficExtensionsResponse {
  // The list of `LbTrafficExtension` resources.
  repeated LbTrafficExtension lb_traffic_extensions = 1;

  // A token identifying a page of results that the server returns.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Message for getting a `LbTrafficExtension` resource.
message GetLbTrafficExtensionRequest {
  // Required. A name of the `LbTrafficExtension` resource to get. Must be in
  // the format
  // `projects/{project}/locations/{location}/lbTrafficExtensions/{lb_traffic_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkservices.googleapis.com/LbTrafficExtension"
    }
  ];
}

// Message for creating a `LbTrafficExtension` resource.
message CreateLbTrafficExtensionRequest {
  // Required. The parent resource of the `LbTrafficExtension` resource. Must be
  // in the format `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkservices.googleapis.com/LbTrafficExtension"
    }
  ];

  // Required. User-provided ID of the `LbTrafficExtension` resource to be
  // created.
  string lb_traffic_extension_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. `LbTrafficExtension` resource to be created.
  LbTrafficExtension lb_traffic_extension = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for updating a `LbTrafficExtension` resource.
message UpdateLbTrafficExtensionRequest {
  // Optional. Used to specify the fields to be overwritten in the
  // `LbTrafficExtension` resource by the update.
  // The fields specified in the `update_mask` are relative to the resource, not
  // the full request. A field is overwritten if it is in the mask. If the
  // user does not specify a mask, then all fields are overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. `LbTrafficExtension` resource being updated.
  LbTrafficExtension lb_traffic_extension = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for deleting a `LbTrafficExtension` resource.
message DeleteLbTrafficExtensionRequest {
  // Required. The name of the `LbTrafficExtension` resource to delete. Must be
  // in the format
  // `projects/{project}/locations/{location}/lbTrafficExtensions/{lb_traffic_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkservices.googleapis.com/LbTrafficExtension"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// `LbRouteExtension` is a resource that lets you control where traffic is
// routed to for a given request.
message LbRouteExtension {
  option (google.api.resource) = {
    type: "networkservices.googleapis.com/LbRouteExtension"
    pattern: "projects/{project}/locations/{location}/lbRouteExtensions/{lb_route_extension}"
    plural: "lbRouteExtensions"
    singular: "lbRouteExtension"
  };

  // Required. Identifier. Name of the `LbRouteExtension` resource in the
  // following format:
  // `projects/{project}/locations/{location}/lbRouteExtensions/{lb_route_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = IDENTIFIER
  ];

  // Output only. The timestamp when the resource was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the resource was updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. A human-readable description of the resource.
  string description = 9 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Set of labels associated with the `LbRouteExtension` resource.
  //
  // The format must comply with [the requirements for
  // labels](https://cloud.google.com/compute/docs/labeling-resources#requirements)
  // for Google Cloud resources.
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Required. A list of references to the forwarding rules to which this
  // service extension is attached. At least one forwarding rule is required.
  // Only one `LbRouteExtension` resource can be associated with a forwarding
  // rule.
  repeated string forwarding_rules = 5 [(google.api.field_behavior) = REQUIRED];

  // Required. A set of ordered extension chains that contain the match
  // conditions and extensions to execute. Match conditions for each extension
  // chain are evaluated in sequence for a given request. The first extension
  // chain that has a condition that matches the request is executed.
  // Any subsequent extension chains do not execute.
  // Limited to 5 extension chains per resource.
  repeated ExtensionChain extension_chains = 7
      [(google.api.field_behavior) = REQUIRED];

  // Required. All backend services and forwarding rules referenced by this
  // extension must share the same load balancing scheme. Supported values:
  // `INTERNAL_MANAGED`, `EXTERNAL_MANAGED`. For more information, refer to
  // [Backend services
  // overview](https://cloud.google.com/load-balancing/docs/backend-service).
  LoadBalancingScheme load_balancing_scheme = 8
      [(google.api.field_behavior) = REQUIRED];

  // Optional. The metadata provided here is included as part of the
  // `metadata_context` (of type `google.protobuf.Struct`) in the
  // `ProcessingRequest` message sent to the extension server.
  //
  // The metadata applies to all extensions in all extensions chains in this
  // resource.
  //
  // The metadata is available under the key
  // `com.google.lb_route_extension.<resource_name>`.
  //
  // The following variables are supported in the metadata:
  //
  // `{forwarding_rule_id}` - substituted with the forwarding rule's fully
  //   qualified resource name.
  //
  // This field must not be set if at least one of the extension chains
  // contains plugin extensions. Setting it results in a validation error.
  //
  // You can set metadata at either the resource level or the extension level.
  // The extension level metadata is recommended because you can pass a
  // different set of metadata through each extension to the backend.
  google.protobuf.Struct metadata = 10 [(google.api.field_behavior) = OPTIONAL];
}

// Message for requesting list of `LbRouteExtension` resources.
message ListLbRouteExtensionsRequest {
  // Required. The project and location from which the `LbRouteExtension`
  // resources are listed. These values are specified in the following format:
  // `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkservices.googleapis.com/LbRouteExtension"
    }
  ];

  // Optional. Requested page size. The server might return fewer items than
  // requested. If unspecified, the server picks an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token identifying a page of results that the server returns.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filtering results.
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Hint about how to order the results.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Message for response to listing `LbRouteExtension` resources.
message ListLbRouteExtensionsResponse {
  // The list of `LbRouteExtension` resources.
  repeated LbRouteExtension lb_route_extensions = 1;

  // A token identifying a page of results that the server returns.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Message for getting a `LbRouteExtension` resource.
message GetLbRouteExtensionRequest {
  // Required. A name of the `LbRouteExtension` resource to get. Must be in the
  // format
  // `projects/{project}/locations/{location}/lbRouteExtensions/{lb_route_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkservices.googleapis.com/LbRouteExtension"
    }
  ];
}

// Message for creating a `LbRouteExtension` resource.
message CreateLbRouteExtensionRequest {
  // Required. The parent resource of the `LbRouteExtension` resource. Must be
  // in the format `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkservices.googleapis.com/LbRouteExtension"
    }
  ];

  // Required. User-provided ID of the `LbRouteExtension` resource to be
  // created.
  string lb_route_extension_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. `LbRouteExtension` resource to be created.
  LbRouteExtension lb_route_extension = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for updating a `LbRouteExtension` resource.
message UpdateLbRouteExtensionRequest {
  // Optional. Used to specify the fields to be overwritten in the
  // `LbRouteExtension` resource by the update.
  // The fields specified in the `update_mask` are relative to the resource, not
  // the full request. A field is overwritten if it is in the mask. If the
  // user does not specify a mask, then all fields are overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. `LbRouteExtension` resource being updated.
  LbRouteExtension lb_route_extension = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for deleting a `LbRouteExtension` resource.
message DeleteLbRouteExtensionRequest {
  // Required. The name of the `LbRouteExtension` resource to delete. Must be in
  // the format
  // `projects/{project}/locations/{location}/lbRouteExtensions/{lb_route_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkservices.googleapis.com/LbRouteExtension"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// `LbEdgeExtension` is a resource that lets the extension service influence
// the selection of backend services and Cloud CDN cache keys by modifying
// request headers.
message LbEdgeExtension {
  option (google.api.resource) = {
    type: "networkservices.googleapis.com/LbEdgeExtension"
    pattern: "projects/{project}/locations/{location}/lbEdgeExtensions/{lb_edge_extension}"
    plural: "lbEdgeExtensions"
    singular: "lbEdgeExtension"
  };

  // Required. Identifier. Name of the `LbEdgeExtension` resource in the
  // following format:
  // `projects/{project}/locations/{location}/lbEdgeExtensions/{lb_edge_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = IDENTIFIER
  ];

  // Output only. The timestamp when the resource was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the resource was updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. A human-readable description of the resource.
  string description = 9 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Set of labels associated with the `LbEdgeExtension` resource.
  //
  // The format must comply with [the requirements for
  // labels](https://cloud.google.com/compute/docs/labeling-resources#requirements)
  // for Google Cloud resources.
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Required. A list of references to the forwarding rules to which this
  // service extension is attached. At least one forwarding rule is required.
  // Only one `LbEdgeExtension` resource can be associated with a forwarding
  // rule.
  repeated string forwarding_rules = 5 [(google.api.field_behavior) = REQUIRED];

  // Required. A set of ordered extension chains that contain the match
  // conditions and extensions to execute. Match conditions for each extension
  // chain are evaluated in sequence for a given request. The first extension
  // chain that has a condition that matches the request is executed.
  // Any subsequent extension chains do not execute.
  // Limited to 5 extension chains per resource.
  repeated ExtensionChain extension_chains = 6
      [(google.api.field_behavior) = REQUIRED];

  // Required. All forwarding rules referenced by this extension must
  // share the same load balancing scheme.
  // Supported values: `EXTERNAL_MANAGED`.
  LoadBalancingScheme load_balancing_scheme = 7
      [(google.api.field_behavior) = REQUIRED];
}

// Message for requesting list of `LbEdgeExtension` resources.
message ListLbEdgeExtensionsRequest {
  // Required. The project and location from which the `LbEdgeExtension`
  // resources are listed. These values are specified in the following format:
  // `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkservices.googleapis.com/LbEdgeExtension"
    }
  ];

  // Optional. Requested page size. The server might return fewer items than
  // requested. If unspecified, the server picks an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token identifying a page of results that the server returns.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filtering results.
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Hint about how to order the results.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Message for response to listing `LbEdgeExtension` resources.
message ListLbEdgeExtensionsResponse {
  // The list of `LbEdgeExtension` resources.
  repeated LbEdgeExtension lb_edge_extensions = 1;

  // A token identifying a page of results that the server returns.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Message for getting a `LbEdgeExtension` resource.
message GetLbEdgeExtensionRequest {
  // Required. A name of the `LbEdgeExtension` resource to get. Must be in the
  // format
  // `projects/{project}/locations/{location}/lbEdgeExtensions/{lb_edge_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkservices.googleapis.com/LbEdgeExtension"
    }
  ];
}

// Message for creating a `LbEdgeExtension` resource.
message CreateLbEdgeExtensionRequest {
  // Required. The parent resource of the `LbEdgeExtension` resource. Must be in
  // the format `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkservices.googleapis.com/LbEdgeExtension"
    }
  ];

  // Required. User-provided ID of the `LbEdgeExtension` resource to be created.
  string lb_edge_extension_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. `LbEdgeExtension` resource to be created.
  LbEdgeExtension lb_edge_extension = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for updating a `LbEdgeExtension` resource.
message UpdateLbEdgeExtensionRequest {
  // Optional. Used to specify the fields to be overwritten in the
  // `LbEdgeExtension` resource by the update.
  // The fields specified in the `update_mask` are relative to the resource, not
  // the full request. A field is overwritten if it is in the mask. If the
  // user does not specify a mask, then all fields are overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. `LbEdgeExtension` resource being updated.
  LbEdgeExtension lb_edge_extension = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for deleting a `LbEdgeExtension` resource.
message DeleteLbEdgeExtensionRequest {
  // Required. The name of the `LbEdgeExtension` resource to delete. Must be in
  // the format
  // `projects/{project}/locations/{location}/lbEdgeExtensions/{lb_edge_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkservices.googleapis.com/LbEdgeExtension"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// `AuthzExtension` is a resource that allows traffic forwarding
// to a callout backend service to make an authorization decision.
message AuthzExtension {
  option (google.api.resource) = {
    type: "networkservices.googleapis.com/AuthzExtension"
    pattern: "projects/{project}/locations/{location}/authzExtensions/{authz_extension}"
    plural: "authzExtensions"
    singular: "authzExtension"
  };

  // Required. Identifier. Name of the `AuthzExtension` resource in the
  // following format:
  // `projects/{project}/locations/{location}/authzExtensions/{authz_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = IDENTIFIER
  ];

  // Output only. The timestamp when the resource was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the resource was updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. A human-readable description of the resource.
  string description = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Set of labels associated with the `AuthzExtension`
  // resource.
  //
  // The format must comply with [the requirements for
  // labels](/compute/docs/labeling-resources#requirements) for Google Cloud
  // resources.
  map<string, string> labels = 5 [(google.api.field_behavior) = OPTIONAL];

  // Required. All backend services and forwarding rules referenced by this
  // extension must share the same load balancing scheme. Supported values:
  // `INTERNAL_MANAGED`, `EXTERNAL_MANAGED`. For more information, refer to
  // [Backend services
  // overview](https://cloud.google.com/load-balancing/docs/backend-service).
  LoadBalancingScheme load_balancing_scheme = 6
      [(google.api.field_behavior) = REQUIRED];

  // Required. The `:authority` header in the gRPC request sent from Envoy
  // to the extension service.
  string authority = 7 [(google.api.field_behavior) = REQUIRED];

  // Required. The reference to the service that runs the extension.
  //
  // To configure a callout extension, `service` must be a fully-qualified
  // reference
  // to a [backend
  // service](https://cloud.google.com/compute/docs/reference/rest/v1/backendServices)
  // in the format:
  // `https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/backendServices/{backendService}`
  // or
  // `https://www.googleapis.com/compute/v1/projects/{project}/global/backendServices/{backendService}`.
  string service = 8 [(google.api.field_behavior) = REQUIRED];

  // Required. Specifies the timeout for each individual message on the stream.
  // The timeout must be between 10-10000 milliseconds.
  google.protobuf.Duration timeout = 9 [(google.api.field_behavior) = REQUIRED];

  // Optional. Determines how the proxy behaves if the call to the extension
  // fails or times out.
  //
  // When set to `TRUE`, request or response processing continues without
  // error. Any subsequent extensions in the extension chain are also
  // executed. When set to `FALSE` or the default setting of `FALSE` is used,
  // one of the following happens:
  //
  // * If response headers have not been delivered to the downstream client,
  // a generic 500 error is returned to the client. The error response can be
  // tailored by configuring a custom error response in the load balancer.
  //
  // * If response headers have been delivered, then the HTTP stream to the
  // downstream client is reset.
  bool fail_open = 10 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The metadata provided here is included as part of the
  // `metadata_context` (of type `google.protobuf.Struct`) in the
  // `ProcessingRequest` message sent to the extension
  // server. The metadata is available under the namespace
  // `com.google.authz_extension.<resource_name>`.
  // The following variables are supported in the metadata Struct:
  //
  // `{forwarding_rule_id}` - substituted with the forwarding rule's fully
  //   qualified resource name.
  google.protobuf.Struct metadata = 11 [(google.api.field_behavior) = OPTIONAL];

  // Optional. List of the HTTP headers to forward to the extension
  // (from the client). If omitted, all headers are sent.
  // Each element is a string indicating the header name.
  repeated string forward_headers = 12 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The format of communication supported by the callout extension.
  // If not specified, the default value `EXT_PROC_GRPC` is used.
  WireFormat wire_format = 14 [(google.api.field_behavior) = OPTIONAL];
}

// Message for requesting list of `AuthzExtension` resources.
message ListAuthzExtensionsRequest {
  // Required. The project and location from which the `AuthzExtension`
  // resources are listed. These values are specified in the following format:
  // `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkservices.googleapis.com/AuthzExtension"
    }
  ];

  // Optional. Requested page size. The server might return fewer items than
  // requested. If unspecified, the server picks an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token identifying a page of results that the server returns.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filtering results.
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Hint about how to order the results.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Message for response to listing `AuthzExtension` resources.
message ListAuthzExtensionsResponse {
  // The list of `AuthzExtension` resources.
  repeated AuthzExtension authz_extensions = 1;

  // A token identifying a page of results that the server returns.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Message for getting a `AuthzExtension` resource.
message GetAuthzExtensionRequest {
  // Required. A name of the `AuthzExtension` resource to get. Must be in
  // the format
  // `projects/{project}/locations/{location}/authzExtensions/{authz_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkservices.googleapis.com/AuthzExtension"
    }
  ];
}

// Message for creating a `AuthzExtension` resource.
message CreateAuthzExtensionRequest {
  // Required. The parent resource of the `AuthzExtension` resource. Must
  // be in the format `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkservices.googleapis.com/AuthzExtension"
    }
  ];

  // Required. User-provided ID of the `AuthzExtension` resource to be
  // created.
  string authz_extension_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. `AuthzExtension` resource to be created.
  AuthzExtension authz_extension = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for updating a `AuthzExtension` resource.
message UpdateAuthzExtensionRequest {
  // Required. Used to specify the fields to be overwritten in the
  // `AuthzExtension` resource by the update.
  // The fields specified in the `update_mask` are relative to the resource, not
  // the full request. A field is overwritten if it is in the mask. If the
  // user does not specify a mask, then all fields are overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. `AuthzExtension` resource being updated.
  AuthzExtension authz_extension = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for deleting a `AuthzExtension` resource.
message DeleteAuthzExtensionRequest {
  // Required. The name of the `AuthzExtension` resource to delete. Must
  // be in the format
  // `projects/{project}/locations/{location}/authzExtensions/{authz_extension}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkservices.googleapis.com/AuthzExtension"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server can ignore
  // the request if it has already been completed. The server guarantees
  // that for 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server ignores the second request This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}