// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.storage.control.v2;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/field_info.proto";
import "google/api/resource.proto";
import "google/api/routing.proto";
import "google/iam/v1/iam_policy.proto";
import "google/iam/v1/policy.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/duration.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";
import "google/rpc/status.proto";
import "google/type/interval.proto";

option csharp_namespace = "Google.Cloud.Storage.Control.V2";
option go_package = "cloud.google.com/go/storage/control/apiv2/controlpb;controlpb";
option java_multiple_files = true;
option java_outer_classname = "StorageControlProto";
option java_package = "com.google.storage.control.v2";
option php_namespace = "Google\\Cloud\\Storage\\Control\\V2";
option ruby_package = "Google::Cloud::Storage::Control::V2";
option (google.api.resource_definition) = {
  type: "storage.googleapis.com/Bucket"
  pattern: "projects/{project}/buckets/{bucket}"
};

// StorageControl service includes selected control plane operations.
service StorageControl {
  option (google.api.default_host) = "storage.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform,"
      "https://www.googleapis.com/auth/cloud-platform.read-only,"
      "https://www.googleapis.com/auth/devstorage.full_control,"
      "https://www.googleapis.com/auth/devstorage.read_only,"
      "https://www.googleapis.com/auth/devstorage.read_write";

  // Creates a new folder. This operation is only applicable to a hierarchical
  // namespace enabled bucket.
  rpc CreateFolder(CreateFolderRequest) returns (Folder) {
    option (google.api.routing) = {
      routing_parameters { field: "parent" path_template: "{bucket=**}" }
    };
    option (google.api.method_signature) = "parent,folder,folder_id";
  }

  // Permanently deletes an empty folder. This operation is only applicable to a
  // hierarchical namespace enabled bucket.
  rpc DeleteFolder(DeleteFolderRequest) returns (google.protobuf.Empty) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Returns metadata for the specified folder. This operation is only
  // applicable to a hierarchical namespace enabled bucket.
  rpc GetFolder(GetFolderRequest) returns (Folder) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Retrieves a list of folders. This operation is only applicable to a
  // hierarchical namespace enabled bucket.
  rpc ListFolders(ListFoldersRequest) returns (ListFoldersResponse) {
    option (google.api.routing) = {
      routing_parameters { field: "parent" path_template: "{bucket=**}" }
    };
    option (google.api.method_signature) = "parent";
  }

  // Renames a source folder to a destination folder. This operation is only
  // applicable to a hierarchical namespace enabled bucket. During a rename, the
  // source and destination folders are locked until the long running operation
  // completes.
  rpc RenameFolder(RenameFolderRequest) returns (google.longrunning.Operation) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name,destination_folder_id";
    option (google.longrunning.operation_info) = {
      response_type: "Folder"
      metadata_type: "RenameFolderMetadata"
    };
  }

  // Deletes a folder recursively. This operation is only applicable to a
  // hierarchical namespace enabled bucket.
  rpc DeleteFolderRecursive(DeleteFolderRecursiveRequest)
      returns (google.longrunning.Operation) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "DeleteFolderRecursiveMetadata"
    };
  }

  // Returns the storage layout configuration for a given bucket.
  rpc GetStorageLayout(GetStorageLayoutRequest) returns (StorageLayout) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new managed folder.
  rpc CreateManagedFolder(CreateManagedFolderRequest) returns (ManagedFolder) {
    option (google.api.routing) = {
      routing_parameters { field: "parent" path_template: "{bucket=**}" }
    };
    option (google.api.method_signature) =
        "parent,managed_folder,managed_folder_id";
  }

  // Permanently deletes an empty managed folder.
  rpc DeleteManagedFolder(DeleteManagedFolderRequest)
      returns (google.protobuf.Empty) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Returns metadata for the specified managed folder.
  rpc GetManagedFolder(GetManagedFolderRequest) returns (ManagedFolder) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Retrieves a list of managed folders for a given bucket.
  rpc ListManagedFolders(ListManagedFoldersRequest)
      returns (ListManagedFoldersResponse) {
    option (google.api.routing) = {
      routing_parameters { field: "parent" path_template: "{bucket=**}" }
    };
    option (google.api.method_signature) = "parent";
  }

  // Creates an Anywhere Cache instance.
  rpc CreateAnywhereCache(CreateAnywhereCacheRequest)
      returns (google.longrunning.Operation) {
    option (google.api.routing) = {
      routing_parameters { field: "parent" path_template: "{bucket=**}" }
    };
    option (google.api.method_signature) = "parent,anywhere_cache";
    option (google.longrunning.operation_info) = {
      response_type: "AnywhereCache"
      metadata_type: "CreateAnywhereCacheMetadata"
    };
  }

  // Updates an Anywhere Cache instance. Mutable fields include `ttl` and
  // `admission_policy`.
  rpc UpdateAnywhereCache(UpdateAnywhereCacheRequest)
      returns (google.longrunning.Operation) {
    option (google.api.routing) = {
      routing_parameters {
        field: "anywhere_cache.name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "anywhere_cache,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "AnywhereCache"
      metadata_type: "UpdateAnywhereCacheMetadata"
    };
  }

  // Disables an Anywhere Cache instance. A disabled instance is read-only. The
  // disablement could be revoked by calling ResumeAnywhereCache. The cache
  // instance will be deleted automatically if it remains in the disabled state
  // for at least one hour.
  rpc DisableAnywhereCache(DisableAnywhereCacheRequest)
      returns (AnywhereCache) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Pauses an Anywhere Cache instance.
  rpc PauseAnywhereCache(PauseAnywhereCacheRequest) returns (AnywhereCache) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Resumes a disabled or paused Anywhere Cache instance.
  rpc ResumeAnywhereCache(ResumeAnywhereCacheRequest) returns (AnywhereCache) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Gets an Anywhere Cache instance.
  rpc GetAnywhereCache(GetAnywhereCacheRequest) returns (AnywhereCache) {
    option (google.api.routing) = {
      routing_parameters {
        field: "name"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Lists Anywhere Cache instances for a given bucket.
  rpc ListAnywhereCaches(ListAnywhereCachesRequest)
      returns (ListAnywhereCachesResponse) {
    option (google.api.routing) = {
      routing_parameters { field: "parent" path_template: "{bucket=**}" }
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns the Project scoped singleton IntelligenceConfig resource.
  rpc GetProjectIntelligenceConfig(GetProjectIntelligenceConfigRequest)
      returns (IntelligenceConfig) {
    option (google.api.http) = {
      get: "/v2/{name=projects/*/locations/*/intelligenceConfig}"
    };
    option (google.api.method_signature) = "name";
  }

  // Updates the Project scoped singleton IntelligenceConfig resource.
  rpc UpdateProjectIntelligenceConfig(UpdateProjectIntelligenceConfigRequest)
      returns (IntelligenceConfig) {
    option (google.api.http) = {
      patch: "/v2/{intelligence_config.name=projects/*/locations/*/intelligenceConfig}"
      body: "intelligence_config"
    };
    option (google.api.method_signature) = "intelligence_config,update_mask";
  }

  // Returns the Folder scoped singleton IntelligenceConfig resource.
  rpc GetFolderIntelligenceConfig(GetFolderIntelligenceConfigRequest)
      returns (IntelligenceConfig) {
    option (google.api.http) = {
      get: "/v2/{name=folders/*/locations/*/intelligenceConfig}"
    };
    option (google.api.method_signature) = "name";
  }

  // Updates the Folder scoped singleton IntelligenceConfig resource.
  rpc UpdateFolderIntelligenceConfig(UpdateFolderIntelligenceConfigRequest)
      returns (IntelligenceConfig) {
    option (google.api.http) = {
      patch: "/v2/{intelligence_config.name=folders/*/locations/*/intelligenceConfig}"
      body: "intelligence_config"
    };
    option (google.api.method_signature) = "intelligence_config,update_mask";
  }

  // Returns the Organization scoped singleton IntelligenceConfig resource.
  rpc GetOrganizationIntelligenceConfig(
      GetOrganizationIntelligenceConfigRequest) returns (IntelligenceConfig) {
    option (google.api.http) = {
      get: "/v2/{name=organizations/*/locations/*/intelligenceConfig}"
    };
    option (google.api.method_signature) = "name";
  }

  // Updates the Organization scoped singleton IntelligenceConfig resource.
  rpc UpdateOrganizationIntelligenceConfig(
      UpdateOrganizationIntelligenceConfigRequest)
      returns (IntelligenceConfig) {
    option (google.api.http) = {
      patch: "/v2/{intelligence_config.name=organizations/*/locations/*/intelligenceConfig}"
      body: "intelligence_config"
    };
    option (google.api.method_signature) = "intelligence_config,update_mask";
  }

  // Gets the IAM policy for a specified bucket.
  // The `resource` field in the request should be
  // `projects/_/buckets/{bucket}` for a bucket, or
  // `projects/_/buckets/{bucket}/managedFolders/{managedFolder}`
  // for a managed folder.
  rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest)
      returns (google.iam.v1.Policy) {
    option (google.api.routing) = {
      routing_parameters { field: "resource" path_template: "{bucket=**}" }
      routing_parameters {
        field: "resource"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "resource";
  }

  // Updates an IAM policy for the specified bucket.
  // The `resource` field in the request should be
  // `projects/_/buckets/{bucket}` for a bucket, or
  // `projects/_/buckets/{bucket}/managedFolders/{managedFolder}`
  // for a managed folder.
  rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest)
      returns (google.iam.v1.Policy) {
    option (google.api.routing) = {
      routing_parameters { field: "resource" path_template: "{bucket=**}" }
      routing_parameters {
        field: "resource"
        path_template: "{bucket=projects/*/buckets/*}/**"
      }
    };
    option (google.api.method_signature) = "resource,policy";
  }

  // Tests a set of permissions on the given bucket, object, or managed folder
  // to see which, if any, are held by the caller.
  // The `resource` field in the request should be
  // `projects/_/buckets/{bucket}` for a bucket,
  // `projects/_/buckets/{bucket}/objects/{object}` for an object, or
  // `projects/_/buckets/{bucket}/managedFolders/{managedFolder}`
  // for a managed folder.
  rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest)
      returns (google.iam.v1.TestIamPermissionsResponse) {
    option (google.api.routing) = {
      routing_parameters { field: "resource" path_template: "{bucket=**}" }
      routing_parameters {
        field: "resource"
        path_template: "{bucket=projects/*/buckets/*}/objects/**"
      }
      routing_parameters {
        field: "resource"
        path_template: "{bucket=projects/*/buckets/*}/managedFolders/**"
      }
    };
    option (google.api.method_signature) = "resource,permissions";
  }

  // Gets the `IntelligenceFinding` for a project.
  rpc GetIntelligenceFinding(GetIntelligenceFindingRequest)
      returns (IntelligenceFinding) {
    option (google.api.http) = {
      get: "/v2/{name=projects/*/locations/*/intelligenceFindings/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Lists the `IntelligenceFinding` resources for the specified project.
  rpc ListIntelligenceFindings(ListIntelligenceFindingsRequest)
      returns (ListIntelligenceFindingsResponse) {
    option (google.api.http) = {
      get: "/v2/{parent=projects/*/locations/*}/intelligenceFindings"
    };
    option (google.api.method_signature) = "parent";
  }

  // Summarize the intelligence findings for the specified scope(org, folder or
  // project).
  rpc SummarizeIntelligenceFindings(SummarizeIntelligenceFindingsRequest)
      returns (SummarizeIntelligenceFindingsResponse) {
    option (google.api.http) = {
      get: "/v2/{parent=projects/*/locations/*}/intelligenceFindings:summarize"
      additional_bindings {
        get: "/v2/{parent=folders/*/locations/*}/intelligenceFindings:summarize"
      }
      additional_bindings {
        get: "/v2/{parent=organizations/*/locations/*}/intelligenceFindings:summarize"
      }
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets the `IntelligenceFindingRevision` resource.
  rpc GetIntelligenceFindingRevision(GetIntelligenceFindingRevisionRequest)
      returns (IntelligenceFindingRevision) {
    option (google.api.http) = {
      get: "/v2/{name=projects/*/locations/*/intelligenceFindings/*/revisions/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Lists all the revisions of an `IntelligenceFinding` resource.
  rpc ListIntelligenceFindingRevisions(ListIntelligenceFindingRevisionsRequest)
      returns (ListIntelligenceFindingRevisionsResponse) {
    option (google.api.http) = {
      get: "/v2/{parent=projects/*/locations/*/intelligenceFindings/*}/revisions"
    };
    option (google.api.method_signature) = "parent";
  }
}

// Contains information about a pending rename operation.
message PendingRenameInfo {
  // Output only. The name of the rename operation.
  string operation = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// A folder resource. This resource can only exist in a hierarchical namespace
// enabled bucket.
message Folder {
  option (google.api.resource) = {
    type: "storage.googleapis.com/Folder"
    pattern: "projects/{project}/buckets/{bucket}/folders/{folder=**}"
    plural: "folders"
    singular: "folder"
  };

  // Identifier. The name of this folder.
  // Format: `projects/{project}/buckets/{bucket}/folders/{folder}`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. The version of the metadata for this folder. Used for
  // preconditions and for detecting changes in metadata.
  int64 metageneration = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The creation time of the folder.
  google.protobuf.Timestamp create_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The modification time of the folder.
  google.protobuf.Timestamp update_time = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Only present if the folder is part of an ongoing RenameFolder
  // operation. Contains information which can be used to query the operation
  // status. The presence of this field also indicates all write operations are
  // blocked for this folder, including folder, managed folder, and object
  // operations.
  PendingRenameInfo pending_rename_info = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request message for GetFolder. This operation is only applicable to a
// hierarchical namespace enabled bucket.
message GetFolderRequest {
  // Required. Name of the folder.
  // Format: `projects/{project}/buckets/{bucket}/folders/{folder}`
  string name = 6 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "storage.googleapis.com/Folder" }
  ];

  // Makes the operation only succeed conditional on whether the folder's
  // current metageneration matches the given value.
  optional int64 if_metageneration_match = 3;

  // Makes the operation only succeed conditional on whether the folder's
  // current metageneration does not match the given value.
  optional int64 if_metageneration_not_match = 4;

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 5 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for CreateFolder. This operation is only applicable to a
// hierarchical namespace enabled bucket.
message CreateFolderRequest {
  // Required. Name of the bucket in which the folder will reside. The bucket
  // must be a hierarchical namespace enabled bucket.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "storage.googleapis.com/Folder"
    }
  ];

  // Required. Properties of the new folder being created.
  // The bucket and name of the folder are specified in the parent and folder_id
  // fields, respectively. Populating those fields in `folder` will result in an
  // error.
  Folder folder = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The full name of a folder, including all its parent folders.
  // Folders use single '/' characters as a delimiter.
  // The folder_id must end with a slash.
  // For example, the folder_id of "books/biographies/" would create a new
  // "biographies/" folder under the "books/" folder.
  string folder_id = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. If true, parent folder doesn't have to be present and all missing
  // ancestor folders will be created atomically.
  bool recursive = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 5 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for DeleteFolder. This operation is only applicable to a
// hierarchical namespace enabled bucket.
message DeleteFolderRequest {
  // Required. Name of the folder.
  // Format: `projects/{project}/buckets/{bucket}/folders/{folder}`
  string name = 6 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "storage.googleapis.com/Folder" }
  ];

  // Makes the operation only succeed conditional on whether the folder's
  // current metageneration matches the given value.
  optional int64 if_metageneration_match = 3;

  // Makes the operation only succeed conditional on whether the folder's
  // current metageneration does not match the given value.
  optional int64 if_metageneration_not_match = 4;

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 5 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for ListFolders. This operation is only applicable to a
// hierarchical namespace enabled bucket.
message ListFoldersRequest {
  // Required. Name of the bucket in which to look for folders. The bucket must
  // be a hierarchical namespace enabled bucket.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "storage.googleapis.com/Folder"
    }
  ];

  // Optional. Maximum number of folders to return in a single response. The
  // service will use this parameter or 1,000 items, whichever is smaller.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A previously-returned page token representing part of the larger
  // set of results to view.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filter results to folders whose names begin with this prefix.
  // If set, the value must either be an empty string or end with a '/'.
  string prefix = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. If set, returns results in a directory-like mode. The results
  // will only include folders that either exactly match the above prefix, or
  // are one level below the prefix. The only supported value is '/'.
  string delimiter = 8 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filter results to folders whose names are lexicographically equal
  // to or after lexicographic_start. If lexicographic_end is also set, the
  // folders listed have names between lexicographic_start (inclusive) and
  // lexicographic_end (exclusive).
  string lexicographic_start = 6 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filter results to folders whose names are lexicographically
  // before lexicographic_end. If lexicographic_start is also set, the folders
  // listed have names between lexicographic_start (inclusive) and
  // lexicographic_end (exclusive).
  string lexicographic_end = 7 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 9 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Response message for ListFolders.
message ListFoldersResponse {
  // The list of child folders
  repeated Folder folders = 1;

  // The continuation token, used to page through large result sets. Provide
  // this value in a subsequent request to return the next page of results.
  string next_page_token = 2;
}

// Request message for RenameFolder. This operation is only applicable to a
// hierarchical namespace enabled bucket.
message RenameFolderRequest {
  // Required. Name of the source folder being renamed.
  // Format: `projects/{project}/buckets/{bucket}/folders/{folder}`
  string name = 7 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "storage.googleapis.com/Folder" }
  ];

  // Required. The destination folder ID, e.g. `foo/bar/`.
  string destination_folder_id = 8 [(google.api.field_behavior) = REQUIRED];

  // Makes the operation only succeed conditional on whether the source
  // folder's current metageneration matches the given value.
  optional int64 if_metageneration_match = 4;

  // Makes the operation only succeed conditional on whether the source
  // folder's current metageneration does not match the given value.
  optional int64 if_metageneration_not_match = 5;

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted. This request is only
  // idempotent if a `request_id` is provided.
  string request_id = 6 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for DeleteFolderRecursive.
message DeleteFolderRecursiveRequest {
  // Required. Name of the folder being deleted, however all of its contents
  // will be deleted too. Format:
  // `projects/{project}/buckets/{bucket}/folders/{folder}`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "storage.googleapis.com/Folder" }
  ];

  // Optional. Makes the operation only succeed conditional on whether the root
  // folder's current metageneration matches the given value.
  optional int64 if_metageneration_match = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Makes the operation only succeed conditional on whether the root
  // folder's current metageneration does not match the given value.
  optional int64 if_metageneration_not_match = 3
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// The message contains metadata that is common to all Storage Control
// long-running operations, present in its `google.longrunning.Operation`
// messages, and accessible via `metadata.common_metadata`.
message CommonLongRunningOperationMetadata {
  // Output only. The time the operation was created.
  google.protobuf.Timestamp create_time = 1
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time the operation finished running.
  google.protobuf.Timestamp end_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time the operation was last modified.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The type of operation invoked.
  string type = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Identifies whether the user has requested cancellation.
  bool requested_cancellation = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The estimated progress of the operation in percentage [0,
  // 100]. The value -1 means the progress is unknown.
  int32 progress_percent = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Message returned in the metadata field of the Operation resource for
// RenameFolder operations.
message RenameFolderMetadata {
  // Generic metadata for the long running operation.
  CommonLongRunningOperationMetadata common_metadata = 1;

  // The path of the source folder.
  string source_folder_id = 2;

  // The path of the destination folder.
  string destination_folder_id = 3;
}

// Message returned in the metadata field of the Operation resource for
// DeleteFolderRecursive operations.
message DeleteFolderRecursiveMetadata {
  // Generic metadata for the long running operation.
  CommonLongRunningOperationMetadata common_metadata = 1;

  // The path of the folder recursively deleted.
  string folder_id = 2;
}

// The storage layout configuration of a bucket.
message StorageLayout {
  option (google.api.resource) = {
    type: "storage.googleapis.com/StorageLayout"
    pattern: "projects/{project}/buckets/{bucket}/storageLayout"
    plural: "storageLayouts"
    singular: "storageLayout"
  };

  // Configuration for Custom Dual Regions.  It should specify precisely two
  // eligible regions within the same Multiregion. More information on regions
  // may be found [here](https://cloud.google.com/storage/docs/locations).
  message CustomPlacementConfig {
    // List of locations to use for data placement.
    repeated string data_locations = 1;
  }

  // Configuration for a bucket's hierarchical namespace feature.
  message HierarchicalNamespace {
    // Enables the hierarchical namespace feature.
    bool enabled = 1;
  }

  // Output only. The name of the StorageLayout resource.
  // Format: `projects/{project}/buckets/{bucket}/storageLayout`
  string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The location of the bucket.
  string location = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The location type of the bucket (region, dual-region,
  // multi-region, etc).
  string location_type = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The data placement configuration for custom dual region. If
  // there is no configuration, this is not a custom dual region bucket.
  CustomPlacementConfig custom_placement_config = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The bucket's hierarchical namespace configuration. If there is
  // no configuration, the hierarchical namespace is disabled.
  HierarchicalNamespace hierarchical_namespace = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request message for GetStorageLayout.
message GetStorageLayoutRequest {
  // Required. The name of the StorageLayout resource.
  // Format: `projects/{project}/buckets/{bucket}/storageLayout`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/StorageLayout"
    }
  ];

  // An optional prefix used for permission check. It is useful when the caller
  // only has limited permissions under a specific prefix.
  string prefix = 2;

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 3 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// A managed folder.
message ManagedFolder {
  option (google.api.resource) = {
    type: "storage.googleapis.com/ManagedFolder"
    pattern: "projects/{project}/buckets/{bucket}/managedFolders/{managed_folder=**}"
    plural: "managedFolders"
    singular: "managedFolder"
  };

  // Identifier. The name of this managed folder.
  // Format:
  // `projects/{project}/buckets/{bucket}/managedFolders/{managedFolder}`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. The metadata version of this managed folder. It increases
  // whenever the metadata is updated. Used for preconditions and for detecting
  // changes in metadata. Managed folders don't have a generation number.
  int64 metageneration = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The creation time of the managed folder.
  google.protobuf.Timestamp create_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The modification time of the managed folder.
  google.protobuf.Timestamp update_time = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request message for GetManagedFolder.
message GetManagedFolderRequest {
  // Required. Name of the managed folder.
  // Format:
  // `projects/{project}/buckets/{bucket}/managedFolders/{managedFolder}`
  string name = 6 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/ManagedFolder"
    }
  ];

  // The operation succeeds conditional on the managed folder's current
  // metageneration matching the value here specified.
  optional int64 if_metageneration_match = 3;

  // The operation succeeds conditional on the managed folder's current
  // metageneration NOT matching the value here specified.
  optional int64 if_metageneration_not_match = 4;

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 5 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for CreateManagedFolder.
message CreateManagedFolderRequest {
  // Required. Name of the bucket this managed folder belongs to.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "storage.googleapis.com/ManagedFolder"
    }
  ];

  // Required. Properties of the managed folder being created.
  // The bucket and managed folder names are specified in the `parent` and
  // `managed_folder_id` fields. Populating these fields in `managed_folder`
  // will result in an error.
  ManagedFolder managed_folder = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The name of the managed folder. It uses a single `/` as delimiter
  // and leading and trailing `/` are allowed.
  string managed_folder_id = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// DeleteManagedFolder RPC request message.
message DeleteManagedFolderRequest {
  // Required. Name of the managed folder.
  // Format:
  // `projects/{project}/buckets/{bucket}/managedFolders/{managedFolder}`
  string name = 7 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/ManagedFolder"
    }
  ];

  // The operation succeeds conditional on the managed folder's current
  // metageneration matching the value here specified.
  optional int64 if_metageneration_match = 3;

  // The operation succeeds conditional on the managed folder's current
  // metageneration NOT matching the value here specified.
  optional int64 if_metageneration_not_match = 4;

  // Allows deletion of a managed folder even if it is not empty.
  // A managed folder is empty if it manages no child managed folders or
  // objects. Caller must have permission for
  // storage.managedFolders.setIamPolicy.
  bool allow_non_empty = 5;

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 6 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for ListManagedFolders.
message ListManagedFoldersRequest {
  // Required. Name of the bucket this managed folder belongs to.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "storage.googleapis.com/ManagedFolder"
    }
  ];

  // Optional. Maximum number of managed folders to return in a single response.
  // The service will use this parameter or 1,000 items, whichever is smaller.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A previously-returned page token representing part of the larger
  // set of results to view.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filter results to match managed folders with name starting with
  // this prefix.
  string prefix = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 5 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Response message for ListManagedFolders.
message ListManagedFoldersResponse {
  // The list of matching managed folders
  repeated ManagedFolder managed_folders = 1;

  // The continuation token, used to page through large result sets. Provide
  // this value in a subsequent request to return the next page of results.
  string next_page_token = 2;
}

// Message returned in the metadata field of the Operation resource for
// CreateAnywhereCache operations.
message CreateAnywhereCacheMetadata {
  // Generic metadata for the long running operation.
  CommonLongRunningOperationMetadata common_metadata = 1;

  // Anywhere Cache ID.
  optional string anywhere_cache_id = 2;

  // The zone in which the cache instance is running. For example,
  // us-central1-a.
  optional string zone = 6;

  // Anywhere Cache entry's TTL. A cache-level config that is applied to all new
  // cache entries on admission. Default ttl value (24hrs) is applied if not
  // specified in the create request.
  optional google.protobuf.Duration ttl = 3;

  // Anywhere Cache entry Admission Policy in kebab-case (e.g.,
  // "admit-on-first-miss"). Default admission policy (admit-on-first-miss) is
  // applied if not specified in the create request.
  optional string admission_policy = 5;
}

// Message returned in the metadata field of the Operation resource for
// UpdateAnywhereCache operation.
message UpdateAnywhereCacheMetadata {
  // Generic metadata for the long running operation.
  CommonLongRunningOperationMetadata common_metadata = 1;

  // Anywhere Cache ID.
  optional string anywhere_cache_id = 2;

  // The zone in which the cache instance is running. For example,
  // us-central1-a.
  optional string zone = 5;

  // Anywhere Cache entry's TTL between 1h and 7days. A cache-level config that
  // is applied to all new cache entries on admission. If `ttl` is pending
  // update, this field equals to the new value specified in the Update request.
  optional google.protobuf.Duration ttl = 3;

  // L4 Cache entry Admission Policy in kebab-case (e.g.,
  // "admit-on-first-miss"). If `admission_policy` is pending
  // update, this field equals to the new value specified in the Update request.
  optional string admission_policy = 4;
}

// An Anywhere Cache Instance.
message AnywhereCache {
  option (google.api.resource) = {
    type: "storage.googleapis.com/AnywhereCache"
    pattern: "projects/{project}/buckets/{bucket}/anywhereCaches/{anywhere_cache}"
    plural: "anywhereCaches"
    singular: "anywhereCache"
  };

  // Immutable. The resource name of this AnywhereCache.
  // Format:
  // `projects/{project}/buckets/{bucket}/anywhereCaches/{anywhere_cache}`
  string name = 1 [(google.api.field_behavior) = IMMUTABLE];

  // Immutable. The zone in which the cache instance is running. For example,
  // us-central1-a.
  string zone = 10 [(google.api.field_behavior) = IMMUTABLE];

  // Cache entry TTL (ranges between 1h to 7d). This is a cache-level config
  // that defines how long a cache entry can live. Default ttl value (24hrs)
  // is applied if not specified in the create request. TTL must be in whole
  // seconds.
  google.protobuf.Duration ttl = 3;

  // Cache admission policy. Valid policies includes:
  // `admit-on-first-miss` and `admit-on-second-miss`. Defaults to
  // `admit-on-first-miss`. Default value is applied if not specified in the
  // create request.
  string admission_policy = 9;

  // Output only. Cache state including RUNNING, CREATING, DISABLED and PAUSED.
  string state = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when Anywhere cache instance is allocated.
  google.protobuf.Timestamp create_time = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when Anywhere cache instance is last updated, including
  // creation.
  google.protobuf.Timestamp update_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. True if there is an active update operation against this cache
  // instance. Subsequential update requests will be rejected if this field is
  // true. Output only.
  bool pending_update = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request message for CreateAnywhereCache.
message CreateAnywhereCacheRequest {
  // Required. The bucket to which this cache belongs.
  // Format: `projects/{project}/buckets/{bucket}`
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "storage.googleapis.com/AnywhereCache"
    }
  ];

  // Required. Properties of the Anywhere Cache instance being created.
  // The parent bucket name is specified in the `parent` field. Server uses the
  // default value of `ttl` or `admission_policy` if not specified in
  // request.
  AnywhereCache anywhere_cache = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted. This request is only
  // idempotent if a `request_id` is provided.
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for UpdateAnywhereCache.
message UpdateAnywhereCacheRequest {
  // Required. The Anywhere Cache instance to be updated.
  AnywhereCache anywhere_cache = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. List of fields to be updated. Mutable fields of AnywhereCache
  // include `ttl` and `admission_policy`.
  //
  // To specify ALL fields, specify a single field with the value `*`. Note: We
  // recommend against doing this. If a new field is introduced at a later time,
  // an older client updating with the `*` may accidentally reset the new
  // field's value.
  //
  // Not specifying any fields is an error.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted. This request is only
  // idempotent if a `request_id` is provided.
  string request_id = 3 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for DisableAnywhereCache.
message DisableAnywhereCacheRequest {
  // Required. The name field in the request should be:
  // `projects/{project}/buckets/{bucket}/anywhereCaches/{anywhere_cache}`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/AnywhereCache"
    }
  ];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted. This request is only
  // idempotent if a `request_id` is provided.
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for PauseAnywhereCache.
message PauseAnywhereCacheRequest {
  // Required. The name field in the request should be:
  // `projects/{project}/buckets/{bucket}/anywhereCaches/{anywhere_cache}`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/AnywhereCache"
    }
  ];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted. This request is only
  // idempotent if a `request_id` is provided.
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for ResumeAnywhereCache.
message ResumeAnywhereCacheRequest {
  // Required. The name field in the request should be:
  // `projects/{project}/buckets/{bucket}/anywhereCaches/{anywhere_cache}`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/AnywhereCache"
    }
  ];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted. This request is only
  // idempotent if a `request_id` is provided.
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for GetAnywhereCache.
message GetAnywhereCacheRequest {
  // Required. The name field in the request should be:
  // `projects/{project}/buckets/{bucket}/anywhereCaches/{anywhere_cache}`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/AnywhereCache"
    }
  ];

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message for ListAnywhereCaches.
message ListAnywhereCachesRequest {
  // Required. The bucket to which this cache belongs.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "storage.googleapis.com/AnywhereCache"
    }
  ];

  // Maximum number of caches to return in a single response.
  // The service will use this parameter or 1,000 items, whichever is smaller.
  int32 page_size = 2;

  // A previously-returned page token representing part of the larger set of
  // results to view.
  string page_token = 3;

  // Optional. A unique identifier for this request. UUID is the recommended
  // format, but other formats are still accepted.
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Response message for ListAnywhereCaches.
message ListAnywhereCachesResponse {
  // The list of items.
  repeated AnywhereCache anywhere_caches = 1;

  // A token, which can be sent as `page_token` to retrieve the next page.
  // If this field is omitted, there are no subsequent pages.
  string next_page_token = 2;
}

// The `IntelligenceConfig` resource associated with your organization, folder,
// or project.
message IntelligenceConfig {
  option (google.api.resource) = {
    type: "storage.googleapis.com/IntelligenceConfig"
    pattern: "folders/{folder}/locations/{location}/intelligenceConfig"
    pattern: "organizations/{org}/locations/{location}/intelligenceConfig"
    pattern: "projects/{project}/locations/{location}/intelligenceConfig"
    plural: "intelligenceConfigs"
    singular: "intelligenceConfig"
  };

  // The edition configuration of the `IntelligenceConfig` resource. This
  // signifies the edition used for configuring the `IntelligenceConfig`
  // resource and can only take the following values:
  // `EDITION_CONFIG_UNSPECIFIED`, `INHERIT`, `DISABLED`, `STANDARD` and
  // `TRIAL`.
  enum EditionConfig {
    // This is an unknown edition of the resource.
    EDITION_CONFIG_UNSPECIFIED = 0;

    // The inherited edition from the parent and filters. This is the default
    // edition when there is no `IntelligenceConfig` setup for a GCP resource.
    INHERIT = 1;

    // The edition configuration is disabled for the `IntelligenceConfig`
    // resource and its children. Filters are not applicable.
    DISABLED = 2;

    // The `IntelligenceConfig` resource is of STANDARD edition.
    STANDARD = 3;

    // The `IntelligenceConfig` resource is available in `TRIAL` edition. During
    // the trial period, Cloud Storage does not charge for Storage Intelligence
    // usage. You can specify the buckets to include in the trial period by
    // using filters. At the end of the trial period, the `IntelligenceConfig`
    // resource is upgraded to `STANDARD` edition.
    TRIAL = 5;
  }

  // Filter over location and bucket using include or exclude semantics.
  // Resources that match the include or exclude filter are exclusively included
  // or excluded from the Storage Intelligence plan.
  message Filter {
    // Collection of bucket locations.
    message CloudStorageLocations {
      // Optional. Bucket locations. Location can be any of the Cloud Storage
      // regions specified in lower case format. For example, `us-east1`,
      // `us-west1`.
      repeated string locations = 1 [(google.api.field_behavior) = OPTIONAL];
    }

    // Collection of buckets.
    message CloudStorageBuckets {
      // Optional. A regex pattern for matching bucket names. Regex should
      // follow the syntax specified in
      // [google/re2](https://github.com/google/re2). For example,
      // `^sample_.*` matches all buckets of the form
      // `gs://sample_bucket-1`, `gs://sample_bucket-2`,
      // `gs://sample_bucket-n` but not `gs://test_sample_bucket`.
      // If you want to match a single bucket, say `gs://sample_bucket`,
      // use `sample_bucket`.
      repeated string bucket_id_regexes = 1
          [(google.api.field_behavior) = OPTIONAL];
    }

    // Bucket locations to include or exclude.
    oneof cloud_storage_locations {
      // Bucket locations to include.
      CloudStorageLocations included_cloud_storage_locations = 1;

      // Bucket locations to exclude.
      CloudStorageLocations excluded_cloud_storage_locations = 2;
    }

    // Buckets to include or exclude.
    oneof cloud_storage_buckets {
      // Buckets to include.
      CloudStorageBuckets included_cloud_storage_buckets = 3;

      // Buckets to exclude.
      CloudStorageBuckets excluded_cloud_storage_buckets = 4;
    }
  }

  // The effective `IntelligenceConfig` for the resource.
  message EffectiveIntelligenceConfig {
    // The effective edition of the `IntelligenceConfig` resource.
    enum EffectiveEdition {
      // This is an unknown edition of the resource.
      EFFECTIVE_EDITION_UNSPECIFIED = 0;

      // No edition.
      NONE = 1;

      // The `IntelligenceConfig` resource is of STANDARD edition.
      STANDARD = 2;
    }

    // Output only. The `IntelligenceConfig` edition that is applicable for the
    // resource.
    EffectiveEdition effective_edition = 1
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The `IntelligenceConfig` resource that is applied for the
    // target resource. Format:
    // `{organizations|folders|projects}/{id}/locations/{location}/intelligenceConfig`
    string intelligence_config = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // The trial configuration of the `IntelligenceConfig` resource.
  message TrialConfig {
    // Output only. The time at which the trial expires.
    google.protobuf.Timestamp expire_time = 3
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Identifier. The name of the `IntelligenceConfig` resource associated with
  // your organization, folder, or project.
  //
  // The name format varies based on the GCP resource hierarchy as follows:
  //
  // * For project:
  // `projects/{project_number}/locations/global/intelligenceConfig`
  // * For organization:
  // `organizations/{org_id}/locations/global/intelligenceConfig`
  // * For folder: `folders/{folder_id}/locations/global/intelligenceConfig`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Optional. The edition configuration of the `IntelligenceConfig` resource.
  EditionConfig edition_config = 2 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The time at which the `IntelligenceConfig` resource is last
  // updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Filter over location and bucket.
  Filter filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The `IntelligenceConfig` resource that is applicable for the
  // resource.
  EffectiveIntelligenceConfig effective_intelligence_config = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // The trial configuration of the `IntelligenceConfig` resource.
  TrialConfig trial_config = 7;
}

// Request message to update the `IntelligenceConfig` resource associated with
// your organization.
//
// **IAM Permissions**:
//
// Requires `storage.intelligenceConfigs.update`
// [IAM](https://cloud.google.com/iam/docs/overview#permissions) permission on
// the organization.
message UpdateOrganizationIntelligenceConfigRequest {
  // Required. The `IntelligenceConfig` resource to be updated.
  IntelligenceConfig intelligence_config = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. The `update_mask` that specifies the fields within the
  // `IntelligenceConfig` resource that should be modified by this update. Only
  // the listed fields are updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. The ID that uniquely identifies the request, preventing duplicate
  // processing.
  string request_id = 3 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message to update the `IntelligenceConfig` resource associated with
// your folder.
//
// **IAM Permissions**:
//
// Requires `storage.intelligenceConfigs.update`
// [IAM](https://cloud.google.com/iam/docs/overview#permissions) permission on
// the folder.
message UpdateFolderIntelligenceConfigRequest {
  // Required. The `IntelligenceConfig` resource to be updated.
  IntelligenceConfig intelligence_config = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. The `update_mask` that specifies the fields within the
  // `IntelligenceConfig` resource that should be modified by this update. Only
  // the listed fields are updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. The ID that uniquely identifies the request, preventing duplicate
  // processing.
  string request_id = 3 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message to update the `IntelligenceConfig` resource associated with
// your project.
//
// **IAM Permissions**:
//
// Requires `storage.intelligenceConfigs.update`
// [IAM](https://cloud.google.com/iam/docs/overview#permissions) permission on
// the folder.
message UpdateProjectIntelligenceConfigRequest {
  // Required. The `IntelligenceConfig` resource to be updated.
  IntelligenceConfig intelligence_config = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. The `update_mask` that specifies the fields within the
  // `IntelligenceConfig` resource that should be modified by this update. Only
  // the listed fields are updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. The ID that uniquely identifies the request, preventing duplicate
  // processing.
  string request_id = 3 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request message to get the `IntelligenceConfig` resource associated with your
// organization.
//
// **IAM Permissions**
//
// Requires `storage.intelligenceConfigs.get`
// [IAM](https://cloud.google.com/iam/docs/overview#permissions) permission on
// the organization.
message GetOrganizationIntelligenceConfigRequest {
  // Required. The name of the `IntelligenceConfig` resource associated with
  // your organization.
  //
  // Format: `organizations/{org_id}/locations/global/intelligenceConfig`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/IntelligenceConfig"
    }
  ];
}

// Request message to get the `IntelligenceConfig` resource associated with your
// folder.
//
// **IAM Permissions**
//
// Requires `storage.intelligenceConfigs.get`
// [IAM](https://cloud.google.com/iam/docs/overview#permissions) permission on
// the folder.
message GetFolderIntelligenceConfigRequest {
  // Required. The name of the `IntelligenceConfig` resource associated with
  // your folder.
  //
  // Format: `folders/{id}/locations/global/intelligenceConfig`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/IntelligenceConfig"
    }
  ];
}

// Request message to get the `IntelligenceConfig` resource associated with your
// project.
//
// **IAM Permissions**:
//
// Requires `storage.intelligenceConfigs.get`
// [IAM](https://cloud.google.com/iam/docs/overview#permissions) permission
// on the project.
message GetProjectIntelligenceConfigRequest {
  // Required. The name of the `IntelligenceConfig` resource associated with
  // your project.
  //
  // Format: `projects/{id}/locations/global/intelligenceConfig`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/IntelligenceConfig"
    }
  ];
}

// The `IntelligenceFinding` resource that represents a security, performance,
// or cost-related finding about a project or bucket.
message IntelligenceFinding {
  option (google.api.resource) = {
    type: "storage.googleapis.com/IntelligenceFinding"
    pattern: "projects/{project}/locations/{location}/intelligenceFindings/{intelligence_finding}"
    plural: "intelligenceFindings"
    singular: "intelligenceFinding"
  };

  // Represents a finding about a spike in Class A/B operations on Coldline
  // or Archive Cloud Storage objects.
  // This corresponds to the `COLD_AND_ARCHIVAL_STORAGE_OPERATIONS_SPIKE`
  // finding type.
  message ColdlineAndArchivalStorageOperationsSpike {
    // Represents the operation spike details for a bucket.
    message BucketContribution {
      // Represents the contribution of the bucket towards the
      // `IntelligenceFinding`.
      message Contribution {
        // Represents the operation spike details for an object prefix.
        message PrefixContribution {
          // Output only. The object prefix.
          // Format: `a/b/c`, 'a/b/d', etc.
          string prefix = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

          // Output only. The percentage increase in operations for the object
          // prefix.
          double percentage_increase = 2
              [(google.api.field_behavior) = OUTPUT_ONLY];

          // Output only. The total count of operations for the object prefix.
          int64 total_operations_count = 3
              [(google.api.field_behavior) = OUTPUT_ONLY];
        }

        // Output only. A list of the top object prefixes driving the increase
        // in operations.
        repeated PrefixContribution top_prefixes = 1
            [(google.api.field_behavior) = OUTPUT_ONLY];
      }

      // Output only. The name of the bucket.
      string bucket = 1 [
        (google.api.field_behavior) = OUTPUT_ONLY,
        (google.api.resource_reference) = {
          type: "storage.googleapis.com/Bucket"
        }
      ];

      // Output only. The percentage increase in operations for the bucket.
      double percentage_increase = 2
          [(google.api.field_behavior) = OUTPUT_ONLY];

      // Output only. The total count of operations for the bucket.
      int64 total_operations_count = 3
          [(google.api.field_behavior) = OUTPUT_ONLY];

      // The details of the bucket's contribution towards the
      // `IntelligenceFinding`.
      oneof details {
        // Output only. The details about the contribution of the bucket.
        Contribution contribution = 4
            [(google.api.field_behavior) = OUTPUT_ONLY];

        // Output only. The error related to accessing the details about the
        // contribution of the bucket.
        google.rpc.Status error = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
      }
    }

    // Output only. The percentage increase in operations across the project.
    double percentage_increase = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The total count of operations across the project.
    int64 total_operations_count = 2
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. A list of the top buckets driving the increase in
    // operations.
    repeated BucketContribution top_buckets = 3
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Represents a finding about a spike in cross-region egress from Cloud
  // Storage.
  // This corresponds to the `CROSS_REGION_EGRESS_SPIKE` finding type.
  message CrossRegionEgressSpike {
    // Represents the cross-region egress spike details for a bucket.
    message BucketContribution {
      // Represents the contribution of the bucket towards the
      // `IntelligenceFinding`.
      message Contribution {
        // Represents the cross-region egress spike details for an object
        // prefix.
        message PrefixContribution {
          // Output only. The object prefix.
          // Format: `a/b/c`, 'a/b/d', etc.
          string prefix = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

          // Output only. The total cross-region egress volume in bytes from the
          // object prefix.
          int64 total_egress_bytes = 2
              [(google.api.field_behavior) = OUTPUT_ONLY];

          // Output only. The percentage increase in cross-region egress for the
          // object prefix.
          double percentage_increase = 3
              [(google.api.field_behavior) = OUTPUT_ONLY];
        }

        // Output only. A list of the top object prefixes driving the increase
        // in cross-region egress.
        repeated PrefixContribution top_prefixes = 1
            [(google.api.field_behavior) = OUTPUT_ONLY];
      }

      // Output only. The name of the bucket.
      string bucket = 1 [
        (google.api.field_behavior) = OUTPUT_ONLY,
        (google.api.resource_reference) = {
          type: "storage.googleapis.com/Bucket"
        }
      ];

      // Output only. The total cross-region egress volume in bytes for the
      // bucket.
      int64 total_egress_bytes = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

      // Output only. The percentage increase in cross-region egress for the
      // bucket.
      double percentage_increase = 3
          [(google.api.field_behavior) = OUTPUT_ONLY];

      // The details of the bucket's contribution towards the
      // `IntelligenceFinding`.
      oneof details {
        // Output only. The details about the contribution of the bucket.
        Contribution contribution = 4
            [(google.api.field_behavior) = OUTPUT_ONLY];

        // Output only. The error related to accessing the details about the
        // contribution of the bucket.
        google.rpc.Status error = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
      }
    }

    // Output only. The total cross-region egress volume in bytes across the
    // project.
    int64 total_egress_bytes = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The percentage increase in cross-region egress across the
    // project.
    double percentage_increase = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. A list of top buckets driving the increase in cross-region
    // egress.
    repeated BucketContribution top_buckets = 3
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Represents a finding about a spike in throttled requests (429 errors)
  // within a project.
  // This corresponds to the `THROTTLED_REQUEST_SPIKE` finding type.
  message ThrottledRequestSpike {
    // Represents the throttled requests details for a bucket.
    message BucketContribution {
      // Represents the contribution of the bucket towards the
      // `IntelligenceFinding`.
      message Contribution {
        // Represents throttled requests details for an object prefix.
        message PrefixContribution {
          // Output only. The object prefix.
          // Format: `a/b/c`, 'a/b/d', etc.
          string prefix = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

          // Output only. The count of throttled requests for the object prefix.
          int64 throttled_requests = 2
              [(google.api.field_behavior) = OUTPUT_ONLY];

          // Output only. The percentage increase in throttled requests for the
          // object prefix.
          double percentage_increase = 3
              [(google.api.field_behavior) = OUTPUT_ONLY];
        }

        // Output only. A list of top object prefixes driving the increase in
        // throttled requests.
        repeated PrefixContribution top_prefixes = 1
            [(google.api.field_behavior) = OUTPUT_ONLY];
      }

      // Output only. The name of the bucket.
      string bucket = 1 [
        (google.api.field_behavior) = OUTPUT_ONLY,
        (google.api.resource_reference) = {
          type: "storage.googleapis.com/Bucket"
        }
      ];

      // Output only. The count of throttled requests for the bucket.
      int64 throttled_requests = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

      // Output only. The percentage increase in throttled requests for the
      // bucket.
      double percentage_increase = 3
          [(google.api.field_behavior) = OUTPUT_ONLY];

      // The details of the bucket's contribution towards the
      // `IntelligenceFinding`.
      oneof details {
        // Output only. The details about the contribution of the bucket.
        Contribution contribution = 4
            [(google.api.field_behavior) = OUTPUT_ONLY];

        // Output only. The error related to accessing the details about the
        // contribution of the bucket.
        google.rpc.Status error = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
      }
    }

    // Output only. The count of throttled requests across the project.
    int64 throttled_requests = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The percentage increase in throttled requests across the
    // project.
    double percentage_increase = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. A list of top buckets driving the increase in throttled
    // requests.
    repeated BucketContribution top_buckets = 3
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Represents a finding about a storage growth above the expected trend.
  // This corresponds to the `STORAGE_GROWTH_ABOVE_TREND` finding type.
  message StorageGrowthAboveTrend {
    // Represents the storage growth details for a bucket.
    message BucketContribution {
      // Output only. The name of the bucket.
      string bucket = 1 [
        (google.api.field_behavior) = OUTPUT_ONLY,
        (google.api.resource_reference) = {
          type: "storage.googleapis.com/Bucket"
        }
      ];

      // Output only. The total storage growth in bytes for the bucket.
      int64 total_storage_growth_bytes = 2
          [(google.api.field_behavior) = OUTPUT_ONLY];

      // Output only. The percentage increase in storage growth for the bucket.
      double percentage_increase = 3
          [(google.api.field_behavior) = OUTPUT_ONLY];

      // The details of the bucket's contribution towards the
      // `IntelligenceFinding`.
      oneof details {
        // Output only. The error related to accessing the details about the
        // contribution of the bucket.
        google.rpc.Status error = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
      }
    }

    // Output only. The total storage growth in bytes.
    int64 total_storage_growth_bytes = 1
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The percentage increase in storage growth.
    double percentage_increase = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. A list of top buckets driving the increase in storage
    // growth.
    repeated BucketContribution top_buckets = 3
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Identifier. The resource name of `IntelligenceFinding`.
  // Format:
  // `projects/{project}/locations/{location}/intelligenceFindings/{intelligence_finding}`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. A short description about the finding.
  string description = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Type of this finding.
  FindingType type = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Category of this finding.
  FindingCategory category = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Severity of the finding.
  FindingSeverity severity = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time at which the finding was created.
  google.protobuf.Timestamp create_time = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time at which the finding was last updated.
  google.protobuf.Timestamp update_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The fully qualified resource name of the resource that this
  // `IntelligenceFinding` applies to. eg:
  // - `storage.googleapis.com/projects/_/buckets/b1`
  // - `cloudresourecemanager.googleapis.com/projects/p1`
  string target_resource = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Contains GCP resource names that are
  // relevant to this `IntelligenceFinding`. The `target_resource` is also added
  // as part of `associated_resources`. eg:
  // - `storage.googleapis.com/projects/_/buckets/b1`
  // - `cloudresourecemanager.googleapis.com/projects/p1`
  repeated string associated_resources = 9
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time interval during which the underlying data was used to
  // generate this `IntelligenceFinding`.
  google.type.Interval observation_period = 10
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // The specific details of the `IntelligenceFinding`.
  oneof intelligence_finding_details {
    // Output only. `IntelligenceFinding` about a spike in Class A/B operations
    // on Coldline or Archive Cloud Storage objects.
    ColdlineAndArchivalStorageOperationsSpike
        coldline_and_archival_storage_operations_spike = 11
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. `IntelligenceFinding` about a spike in throttled requests
    // (429 errors) within a project.
    ThrottledRequestSpike throttled_requests_spike = 12
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. `IntelligenceFinding` about a spike in cross-region egress.
    CrossRegionEgressSpike cross_region_egress_spike = 13
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. `IntelligenceFinding` about growth in storage above the
    // expected trend.
    StorageGrowthAboveTrend storage_growth_above_trend = 14
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }
}

// An `IntelligenceFindingRevision` represents a specific revision of an
// `IntelligenceFinding` resource.
message IntelligenceFindingRevision {
  option (google.api.resource) = {
    type: "storage.googleapis.com/IntelligenceFindingRevision"
    pattern: "projects/{project}/locations/{location}/intelligenceFindings/{intelligence_finding}/revisions/{revision}"
    plural: "intelligenceFindingRevisions"
    singular: "intelligenceFindingRevision"
  };

  // Identifier. The resource name of `IntelligenceFindingRevision`.
  // Format:
  // `projects/{project}/locations/{location}/intelligenceFindings/{intelligence_finding}/revisions/{revision}`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. The snapshot of the `IntelligenceFinding` at the time the
  // revision was created. This field contains the full finding details as they
  // existed for the revision.
  IntelligenceFinding snapshot = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the revision was created.
  google.protobuf.Timestamp create_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request message to get the `IntelligenceFinding` resource associated with a
// project.
message GetIntelligenceFindingRequest {
  // Required. The name of the `IntelligenceFinding` resource.
  //
  // Format:
  // `projects/{project}/locations/{location}/intelligenceFindings/{intelligence_finding}`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/IntelligenceFinding"
    }
  ];
}

// Request message to list `IntelligenceFinding` resources associated with
// a project.
message ListIntelligenceFindingsRequest {
  // Required. The parent of the `IntelligenceFinding` resource.
  //
  // Format: `projects/{project}/locations/{location}`
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "storage.googleapis.com/IntelligenceFinding"
    }
  ];

  // Optional. The filter expression to be applied.
  // Supports filtering by `type` and `associated_resources`.
  string filter = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The maximum number of `IntelligenceFinding` resources to return.
  //
  // The maximum value is `100`; values above `100` will be coerced to `100`.
  // The default value is `100`.
  int32 page_size = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A page token, received from a previous `ListIntelligenceFindings`
  // call. Provide this to retrieve the subsequent page.
  //
  // When paginating, all other parameters provided to
  // `ListIntelligenceFindings` must match the call that provided the page
  // token.
  string page_token = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Response message to list the `IntelligenceFinding` resources associated with
// a project.
message ListIntelligenceFindingsResponse {
  // The `IntelligenceFinding` resources from the specified project.
  repeated IntelligenceFinding intelligence_findings = 1;

  // A token to retrieve the next page of results.
  // Pass this value in the `page_token` field in the subsequent call.
  string next_page_token = 2;
}

// Request message to summarize the intelligence findings for the specified
// scope(org, folder or project).
message SummarizeIntelligenceFindingsRequest {
  // The list of resource scopes.
  enum ResourceScope {
    // The default behavior. Falls back to PARENT behaviour
    RESOURCE_SCOPE_UNSPECIFIED = 0;

    // Summaries are aggregated at the level of the `parent` resource.
    PARENT = 1;

    // Summaries are broken down by each project within the `parent` scope.
    PROJECT = 2;
  }

  // Required. The scope to summarize the findings for.
  // Format:
  // - `organizations/{organization}/locations/{location}`
  // - `folders/{folder}/locations/{location}`
  // - `projects/{project}/locations/{location}`
  string parent = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Determines the granularity of the findings
  // when the `parent` is an organization or folder.
  //
  // - `PARENT` (or not set): A single summary is
  //   returned for each insight type, aggregated across the entire `parent`
  //   scope.
  // - `PROJECT`: A separate summary is returned for each
  //   insight type for every project within the `parent` scope.
  //
  // The only supported values are `PARENT` and `PROJECT`.
  // If no value is specified, the API behaviour defaults to the `PARENT`.
  ResourceScope resource_scope = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The filter expression, following AIP-160.
  // Supports filtering by FindingType.
  string filter = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The maximum number of findings to return.
  //
  // The maximum value is `100`; values above `100` will be coerced to `100`.
  // The default value is `100`.
  int32 page_size = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A page token, received from a previous
  // `SummarizeIntelligenceFindings` call. Provide this to retrieve the
  // subsequent page.
  //
  // When paginating, all other parameters provided to
  // `SummarizeIntelligenceFindings` must match the call that provided the page
  // token.
  string page_token = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Response message to summarize the intelligence findings for a specified
// scope(org, folder or project).
message SummarizeIntelligenceFindingsResponse {
  // The list of `FindingSummary` summaries.
  repeated FindingSummary finding_summaries = 1;

  // A token to retrieve the next page of results.
  // Pass this value in the `page_token` field in the subsequent call to
  // `SummarizeIntelligenceFindings` to retrieve the next page of results.
  string next_page_token = 2;
}

// Request message to get the `IntelligenceFindingRevision` resource associated
// with a project.
message GetIntelligenceFindingRevisionRequest {
  // Required. The name of the `IntelligenceFindingRevision` resource.
  // ## Format:
  //
  // `projects/{project}/locations/{location}/intelligenceFindings/{intelligence_finding}/revisions/{revision}`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "storage.googleapis.com/IntelligenceFindingRevision"
    }
  ];
}

// Request message to list `IntelligenceFindingRevision` resources associated
// with a project.
message ListIntelligenceFindingRevisionsRequest {
  // Required. The parent of the `IntelligenceFindingRevision` resource.
  // ## Format:
  //
  // `projects/{project}/locations/{location}/intelligenceFindings/{intelligence_finding}`
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "storage.googleapis.com/IntelligenceFindingRevision"
    }
  ];

  // Optional. The maximum number of `IntelligenceFindingRevision` resources to
  // return.
  //
  // The maximum value is `100`; values above `100` will be coerced to `100`.
  // The default value is `100`.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A page token, received from a previous
  // `ListIntelligenceFindingRevisions` call. Provide this to retrieve the
  // subsequent page.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Response message to list `IntelligenceFindingRevision` resources associated
// with a project.
message ListIntelligenceFindingRevisionsResponse {
  // The `IntelligenceFindingRevision` resources from the specified project.
  repeated IntelligenceFindingRevision intelligence_finding_revisions = 1;

  // A token that can be sent as `page_token` to retrieve the next page.
  string next_page_token = 2;
}

// A summary of findings generated for an organization, a folder, or a project.
message FindingSummary {
  // Details about the `FindingSummary` resource.
  message SummaryDetails {
    // The list of resource types.
    enum ResourceType {
      // Resource type is unspecified.
      RESOURCE_TYPE_UNSPECIFIED = 0;

      // Resource type is project.
      PROJECT = 1;

      // Resource type is bucket.
      BUCKET = 2;
    }

    // The value of the summary.
    oneof magnitude {
      // The count of impacted resources.
      int64 count = 1;

      // The percentage of impacted resources.
      float percentage = 2;
    }

    // Output only. The type of Cloud resource this summary detail applies to.
    ResourceType resource_type = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. A short description about the FindingSummary
    string description = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Output only. The type of the finding.
  FindingType type = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The category of finding.
  FindingCategory category = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The fully qualified Cloud resource name for which this
  // summary was generated.
  // eg: `//cloudresourcemanager.googleapis.com/projects/p1`
  string target_resource = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The creation time of the earliest finding that this summary is
  // based on.
  google.protobuf.Timestamp create_time = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time of the most recent update among all the findings that
  // this summary is based on.
  google.protobuf.Timestamp update_time = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Severity of the finding.
  FindingSeverity severity = 7 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. List of `SummaryDetails`.
  repeated SummaryDetails summary_details = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// List the finding types.
enum FindingType {
  // Finding type is unspecified.
  FINDING_TYPE_UNSPECIFIED = 0;

  // Finding is about a spike in Class A/B operations on Coldline or Archive
  // Cloud Storage objects.
  FINDING_TYPE_COLDLINE_AND_ARCHIVAL_STORAGE_OPERATIONS_SPIKE = 1;

  // Finding is about a spike in throttled requests (429 errors) within a
  // project.
  FINDING_TYPE_THROTTLED_REQUEST_SPIKE = 2;

  // Finding is about a spike in cross region egress in Cloud Storage.
  FINDING_TYPE_CROSS_REGION_EGRESS_SPIKE = 3;

  // Finding is about growth in storage above the expected trend.
  FINDING_TYPE_STORAGE_GROWTH_ABOVE_TREND = 4;
}

// List of categories a finding falls under.
enum FindingCategory {
  // Category is unspecified.
  FINDING_CATEGORY_UNSPECIFIED = 0;

  // Category is 'Data Management'.
  FINDING_CATEGORY_DATA_MANAGEMENT = 1;

  // Category is 'Performance'.
  FINDING_CATEGORY_PERFORMANCE = 2;
}

// Severity of the `IntelligenceFinding` resource.
enum FindingSeverity {
  // Severity is unspecified.
  FINDING_SEVERITY_UNSPECIFIED = 0;

  // Severity is critical.
  FINDING_SEVERITY_CRITICAL = 1;
}