// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.agentidentity.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/field_info.proto";
import "google/api/resource.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option go_package = "cloud.google.com/go/agentidentity/apiv1/agentidentitypb;agentidentitypb";
option java_multiple_files = true;
option java_outer_classname = "AuthProviderServiceProto";
option java_package = "com.google.cloud.agentidentity.v1";

// Service describing handlers for resources
service AuthProviderService {
  option (google.api.default_host) = "agentidentity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists AuthProviders in a given project and location.
  rpc ListAuthProviders(ListAuthProvidersRequest)
      returns (ListAuthProvidersResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/authProviders"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single AuthProvider.
  rpc GetAuthProvider(GetAuthProviderRequest) returns (AuthProvider) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/authProviders/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new AuthProvider in a given project and location.
  rpc CreateAuthProvider(CreateAuthProviderRequest) returns (AuthProvider) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/authProviders"
      body: "auth_provider"
    };
    option (google.api.method_signature) =
        "parent,auth_provider,auth_provider_id";
  }

  // Updates the parameters of a single AuthProvider.
  rpc UpdateAuthProvider(UpdateAuthProviderRequest) returns (AuthProvider) {
    option (google.api.http) = {
      patch: "/v1/{auth_provider.name=projects/*/locations/*/authProviders/*}"
      body: "auth_provider"
    };
    option (google.api.method_signature) = "auth_provider,update_mask";
  }

  // Deletes a single AuthProvider.
  rpc DeleteAuthProvider(DeleteAuthProviderRequest)
      returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/authProviders/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Undeletes a single AuthProvider.
  rpc UndeleteAuthProvider(UndeleteAuthProviderRequest) returns (AuthProvider) {
    option (google.api.http) = {
      post: "/v1/{name=projects/*/locations/*/authProviders/*}:undelete"
      body: "*"
    };
    option (google.api.method_signature) = "name";
  }

  // Queries what all auth_providers are used by a given workload_id.
  rpc QueryAuthProviders(QueryAuthProvidersRequest)
      returns (QueryAuthProvidersResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/authProviders:query"
    };
    option (google.api.method_signature) = "parent,workload_id";
  }

  // Queries what all workloads are using a given auth_provider.
  rpc QueryWorkloads(QueryWorkloadsRequest) returns (QueryWorkloadsResponse) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/authProviders/*}:queryWorkloads"
    };
    option (google.api.method_signature) = "name";
  }

  // Lists Authorizations in a given project and location.
  rpc ListAuthorizations(ListAuthorizationsRequest)
      returns (ListAuthorizationsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/authProviders/*}/authorizations"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single Authorization.
  rpc GetAuthorization(GetAuthorizationRequest) returns (Authorization) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/authProviders/*/authorizations/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Deletes a single Authorization.
  rpc DeleteAuthorization(DeleteAuthorizationRequest)
      returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/authProviders/*/authorizations/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Lists AccessSummaries in a given project and location.
  // Supported Filters:
  // - `workload_id`: Filter by the SPIFFE ID of the agent.
  //   Example: `workload_id="spiffe://example.com/ns/default/sa/my-agent"`
  rpc ListAccessSummaries(ListAccessSummariesRequest)
      returns (ListAccessSummariesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/accessSummaries"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single AccessSummary.
  rpc GetAccessSummary(GetAccessSummaryRequest) returns (AccessSummary) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/accessSummaries/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Revokes all authorizations for a specific user on an AuthProvider.
  // This deletes all authorization records associated with the user and
  // AuthProvider, effectively revoking access across all agents.
  rpc RevokeAuthorization(RevokeAuthorizationRequest)
      returns (RevokeAuthorizationResponse) {
    option (google.api.http) = {
      post: "/v1/{name=projects/*/locations/*/authProviders/*}:revokeAuthorization"
      body: "*"
    };
    option (google.api.method_signature) = "name,user_id";
  }

  // Enables a single AuthProvider.
  rpc EnableAuthProvider(EnableAuthProviderRequest) returns (AuthProvider) {
    option (google.api.http) = {
      post: "/v1/{name=projects/*/locations/*/authProviders/*}:enable"
      body: "*"
    };
    option (google.api.method_signature) = "name";
  }

  // Disables a single AuthProvider.
  rpc DisableAuthProvider(DisableAuthProviderRequest) returns (AuthProvider) {
    option (google.api.http) = {
      post: "/v1/{name=projects/*/locations/*/authProviders/*}:disable"
      body: "*"
    };
    option (google.api.method_signature) = "name";
  }
}

// The type of the AuthProvider.
enum AuthProviderType {
  // Unspecified auth-provider type.
  AUTH_PROVIDER_TYPE_UNSPECIFIED = 0;

  // Three Legged OAuth auth-provider type.
  AUTH_PROVIDER_TYPE_THREE_LEGGED_OAUTH = 1;

  // Two Legged OAuth auth-provider type.
  AUTH_PROVIDER_TYPE_TWO_LEGGED_OAUTH = 2;

  // API Key auth-provider type.
  AUTH_PROVIDER_TYPE_API_KEY = 3;

  // Gemini Enterprise auth-provider type.
  AUTH_PROVIDER_TYPE_GEMINI_ENTERPRISE = 4;
}

// Message describing AuthProvider object
message AuthProvider {
  option (google.api.resource) = {
    type: "agentidentity.googleapis.com/AuthProvider"
    pattern: "projects/{project}/locations/{location}/authProviders/{auth_provider}"
    plural: "authProviders"
    singular: "authProvider"
  };

  // AuthProvider type specific parameters.
  // Required when creating an auth_provider.
  message AuthProviderTypeParams {
    // AuthProvider type.
    oneof type {
      // ThreeLeggedOAuth AuthProvider type parameters.
      ThreeLeggedOAuth three_legged_oauth = 1;

      // TwoLeggedOAuth AuthProvider type parameters.
      TwoLeggedOAuth two_legged_oauth = 2;

      // ApiKey AuthProvider type parameters.
      ApiKeyParams api_key = 3;

      // GeminiEnterprise auth_provider type parameters.
      GeminiEnterpriseAuthProviderParams ge_auth_provider = 4;
    }
  }

  // Represents the state of the auth_provider.
  enum State {
    // Unspecified state.
    STATE_UNSPECIFIED = 0;

    // Enabled and can be used.
    ENABLED = 1;

    // Disabled and cannot be used.
    DISABLED = 2;
  }

  // Identifier. The full resource name of the auth_provider. Format:
  // projects/{project}/locations/{location}/authProviders/{auth_provider}
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. [Output only] Create time stamp
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. [Output only] Update time stamp
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Labels as key value pairs
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Required. AuthProvider type specific parameters.
  AuthProviderTypeParams auth_provider_type_params = 5
      [(google.api.field_behavior) = REQUIRED];

  // Optional. List of scopes that are allowed to be requested for this
  // auth_provider. If this list is non-empty, only scopes within this list may
  // be requested. If this list is empty, all scopes may be requested. Scopes
  // appearing in `blocked_scopes` are disallowed even if they appear in
  // `allowed_scopes`.
  // The number of allowed scopes is limited to 200.
  repeated string allowed_scopes = 6 [(google.api.field_behavior) = OPTIONAL];

  // Optional. List of scopes that are blocked from being requested for this
  // auth_provider. If a scope appears in this list, it will not be requested,
  // even if it also appears in `allowed_scopes`. `blocked_scopes` takes
  // precedence over `allowed_scopes`. The number of blocked scopes is limited
  // to 200.
  repeated string blocked_scopes = 7 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Description of the resource.
  // Must be less than 256 characters.
  string description = 8 [(google.api.field_behavior) = OPTIONAL];

  // Output only. This is set to true if the auth_provider is deleted.
  bool deleted = 9 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time when the auth_provider will expire.
  google.protobuf.Timestamp expire_time = 10
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The state of the auth_provider.
  State state = 11 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Input only. Represents the workload identity in IAM
  // `principal://` format of the agent(s) that will use this AuthProvider.
  // Example:
  // `principal://agents.global.org-${ORG_ID}.system.id.goog/resources/aiplatform/projects/{PROJECT_ID}/locations/{LOCATIONS}/reasoningEngines/{ID}`
  repeated string workload_ids = 12 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = INPUT_ONLY
  ];
}

// Message describing ThreeLeggedOAuth object.
message ThreeLeggedOAuth {
  // Optional. Input only. The client secret of the OAuth client.
  string client_secret = 1 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = INPUT_ONLY
  ];

  // Optional. The client ID of the OAuth client.
  string client_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The redirect URL this auth_provider uses for the OAuth
  // exchange. This is deterministic based on the name of the auth_provider.
  string redirect_url = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. The authorization endpoint to send users to for consenting to
  // delegate to the agent. eg. "https://auth.example.com/authorize"
  string authorization_url = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The token endpoint for requesting tokens on behalf of an end
  // user. eg. "https://auth.example.com/oauth/token"
  string token_url = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Enables Proof Key for Code Exchange (PKCE) for the OAuth flow to
  // prevent authorization code interception attacks.
  bool enable_pkce = 6 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The default continue URI for 3LO flow and it will be used when no
  // continue URI is provided in the RetrieveCredentials request.
  string default_continue_uri = 7 [(google.api.field_behavior) = OPTIONAL];
}

// Message describing TwoLeggedOAuth object.
message TwoLeggedOAuth {
  // Optional. Input only. The client secret of the OAuth client.
  string client_secret = 1 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = INPUT_ONLY
  ];

  // Optional. The client ID of the OAuth client.
  string client_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The token endpoint of the OAuth client.
  string token_url = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Message describing ApiKeyParams object.
message ApiKeyParams {
  // Optional. Input only. The API key for this auth_provider.
  string api_key = 1 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.field_behavior) = INPUT_ONLY
  ];
}

// Message describing GeminiEnterpriseAuthProviderParams object.
message GeminiEnterpriseAuthProviderParams {}

// Message for requesting list of AuthProviders
message ListAuthProvidersRequest {
  // Required. The parent resource where the search is performed.
  // Format: projects/{project}/locations/{location}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token, which can be sent as `page_token` to retrieve the next
  // page. If this field is omitted, the first page is returned.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filter results. This field is currently ignored.
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Currently ignored.
  // Defaults to ordering by auth_provider_id in ascending order.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Deleted auth_providers will be kept with a soft-delete for 30
  // days before being purged. If this field is set to true, deleted
  // auth_providers will also
  //  be returned.
  bool show_deleted = 6 [(google.api.field_behavior) = OPTIONAL];
}

// Message for response to listing AuthProviders
message ListAuthProvidersResponse {
  // The list of AuthProvider
  repeated AuthProvider auth_providers = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Unordered list. Locations that could not be reached.
  repeated string unreachable = 3
      [(google.api.field_behavior) = UNORDERED_LIST];
}

// Message for getting a AuthProvider
message GetAuthProviderRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];
}

// Message for creating a AuthProvider
message CreateAuthProviderRequest {
  // Required. The parent resource where the AuthProvider is created.
  // Format: projects/{project}/locations/{location}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];

  // Required. The ID to use for the AuthProvider, which will become the final
  // segment of the AuthProvider's resource name. This value should be 1-63
  // characters, and valid characters are /[a-z][0-9]-/. The first character
  // must be a lowercase letter, and the last character must be a lowercase
  // letter or a number.
  string auth_provider_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The AuthProvider to create.
  AuthProvider auth_provider = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for updating a AuthProvider
message UpdateAuthProviderRequest {
  // Optional. Field mask is used to specify the fields to be overwritten in the
  // AuthProvider resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask. If the
  // user does not provide a mask then all fields present in the request will be
  // overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. The AuthProvider resource which replaces the resource on the
  // server.
  AuthProvider auth_provider = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for deleting a AuthProvider
message DeleteAuthProviderRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for undeleting a AuthProvider
message UndeleteAuthProviderRequest {
  // Required. Name of the resource
  // Format:
  // projects/{project}/locations/{location}/authProviders/{auth_provider}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for enabling an AuthProvider
message EnableAuthProviderRequest {
  // Required. Name of the resource
  // Format:
  // projects/{project}/locations/{location}/authProviders/{auth_provider}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message for disabling an AuthProvider
message DisableAuthProviderRequest {
  // Required. Name of the resource
  // Format:
  // projects/{project}/locations/{location}/authProviders/{auth_provider}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message describing Authorization object
message Authorization {
  option (google.api.resource) = {
    type: "agentidentity.googleapis.com/Authorization"
    pattern: "projects/{project}/locations/{location}/authProviders/{auth_provider}/authorizations/{authorization}"
    plural: "authorizations"
    singular: "authorization"
  };

  // Represents the state of the authorization.
  enum State {
    // Unspecified state.
    STATE_UNSPECIFIED = 0;

    // Active.
    ACTIVE = 1;

    // Suspended.
    SUSPENDED = 2;
  }

  // Identifier. name of resource
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. [Output only] Create time stamp
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. [Output only] Update time stamp
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The client_user_id provided by the client application for
  // their end user. Not verified by Google.
  string client_user_id = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The scopes actually granted by the end user during the consent
  // flow.
  repeated string scopes = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The state of the authorization.
  State state = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Message for requesting list of Authorizations
message ListAuthorizationsRequest {
  // Required. The parent resource where the search is performed.
  // Format:
  // projects/{project}/locations/{location}/authProviders/{auth_provider}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "agentidentity.googleapis.com/Authorization"
    }
  ];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A page token, received from a previous `ListAuthorizations` call.
  // Provide this to retrieve the subsequent page.
  // When paginating, all other parameters provided to `ListAuthorizations`
  // must match the call that provided the page token.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filter string to restrict the results.
  // Currently supports filtering by `client_user_id` only.
  // Format: `client_user_id="<value>"`
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. This field is currently ignored.
  // Defaults to ordering by authorization_id in ascending order.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Message for response to listing Authorizations
message ListAuthorizationsResponse {
  // The list of Authorization
  repeated Authorization authorizations = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Unordered list. Locations that could not be reached.
  repeated string unreachable = 3
      [(google.api.field_behavior) = UNORDERED_LIST];
}

// Message for getting a Authorization
message GetAuthorizationRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/Authorization"
    }
  ];
}

// Message for deleting an Authorization
message DeleteAuthorizationRequest {
  // Required. The name of the Authorization to delete.
  // Format:
  // projects/{project}/locations/{location}/authProviders/{auth_provider}/authorizations/{authorization}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/Authorization"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message describing AccessSummary object
message AccessSummary {
  option (google.api.resource) = {
    type: "agentidentity.googleapis.com/AccessSummary"
    pattern: "projects/{project}/locations/{location}/accessSummaries/{access_summary}"
    plural: "accessSummaries"
    singular: "accessSummary"
  };

  // Output only. Identifier. Name of the AccessSummary
  string name = 1 [
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = IDENTIFIER
  ];

  // Output only. The first time this user has interacted with this workload.
  // Rounded to the previous hour.
  google.protobuf.Timestamp first_access_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The most recent time this user has interacted with this
  // workload. Rounded to the previous hour.
  google.protobuf.Timestamp last_access_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Labels as key value pairs
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The user_id provided by the workload application for this
  // user. Not verified by Google.
  string user_id = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The identity bound to the workload that this user interacted
  // with to produce this AccessSummary. Will typically be an agentic spiffe id
  string workload_id = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The url of the authentication server that was accessed.
  string token_url = 7 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. All scopes that have been used by this user with this
  // workload. The number of scopes is limited to 200.
  repeated string scopes = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The auth_provider that this access summary is associated with.
  string auth_provider = 9 [
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];

  // Output only. The time when this access summary is permanently deleted.
  google.protobuf.Timestamp purge_time = 10
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The type of the connector that was used to create this access
  // summary.
  AuthProviderType auth_provider_type = 11
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Message for requesting list of AccessSummaries
message ListAccessSummariesRequest {
  // Required. The parent resource where the search is performed.
  // Format: projects/{project}/locations/{location}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "agentidentity.googleapis.com/AccessSummary"
    }
  ];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token identifying a page of results the server should return.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Filter string to restrict the results.
  //
  // Currently supports filtering by `workload_id` or `auth_provider_name`.
  // If no filter is provided, returns all access summaries for the requested
  // project and location. Format: `workload_id="<value>"` or
  // `auth_provider_name="<value>"`
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. This field is currently ignored.
  // Defaults to ordering by (auth_provider_id, user_id) in ascending order.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Message for response to listing AccessSummaries
message ListAccessSummariesResponse {
  // The list of AccessSummary
  repeated AccessSummary access_summaries = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Unordered list. Locations that could not be reached.
  repeated string unreachable = 3
      [(google.api.field_behavior) = UNORDERED_LIST];
}

// Message for getting a AccessSummary
message GetAccessSummaryRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/AccessSummary"
    }
  ];
}

// Request message for QueryAuthProviders.
message QueryAuthProvidersRequest {
  // Required. The parent resource where the search is performed.
  // Format: projects/{project}/locations/{location}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];

  // Required. The workload identifier to filter by.
  string workload_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default. The
  // maximum page size is 1000.
  int32 page_size = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token, which can be sent as `page_token` to retrieve the next
  // page. If this field is omitted, the first page is returned.
  //
  // A page token, received from a previous QueryAuthProviders call.
  // Provide this to retrieve the subsequent page. When paginating, all other
  // parameters provided to QueryAuthProviders must match the call that provided
  // the page token.
  string page_token = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for QueryAuthProviders.
message QueryAuthProvidersResponse {
  // The unique list of auth_provider resource names used by the workload.
  repeated string auth_provider_names = 1;

  // A token identifying a page of results the server should return.
  // If this field is omitted, there are no subsequent pages.
  string next_page_token = 2;
}

// Request message for QueryWorkloads.
message QueryWorkloadsRequest {
  // Required. The name of the auth_provider to query.
  // Format:
  // projects/{project}/locations/{location}/authProviders/{auth_provider}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token, which can be sent as `page_token` to retrieve the next
  // page. When paginating, all other parameters provided to QueryWorkloads must
  // match the call that provided the page token. If this field is omitted, the
  // first page is returned.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for QueryWorkloads.
message QueryWorkloadsResponse {
  // The unique list of workload identifiers (agents) that used the
  // auth_provider.
  repeated string workload_ids = 1;

  // A token to retrieve the next page of results.
  string next_page_token = 2;
}

// Request message for RevokeAuthorization.
message RevokeAuthorizationRequest {
  // Required. The resource name of the AuthProvider.
  // Format:
  // projects/{project}/locations/{location}/authProviders/{auth_provider}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "agentidentity.googleapis.com/AuthProvider"
    }
  ];

  // Required. The identity of the user to revoke authorization for.
  string user_id = 2 [(google.api.field_behavior) = REQUIRED];
}

// Response message for RevokeAuthorization.
message RevokeAuthorizationResponse {}