// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.auditmanager.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.AuditManager.V1";
option go_package = "cloud.google.com/go/auditmanager/apiv1/auditmanagerpb;auditmanagerpb";
option java_multiple_files = true;
option java_outer_classname = "V1mainProto";
option java_package = "com.google.cloud.auditmanager.v1";
option php_namespace = "Google\\Cloud\\AuditManager\\V1";
option ruby_package = "Google::Cloud::AuditManager::V1";
option (google.api.resource_definition) = {
  type: "auditmanager.googleapis.com/FolderLocation"
  pattern: "folders/{folder}/locations/{location}"
};
option (google.api.resource_definition) = {
  type: "auditmanager.googleapis.com/OrganizationLocation"
  pattern: "organizations/{organization}/locations/{location}"
};
option (google.api.resource_definition) = {
  type: "auditmanager.googleapis.com/Standard"
  pattern: "projects/{project}/locations/{location}/standards/{standard}"
  pattern: "folders/{folder}/locations/{location}/standards/{standard}"
  pattern: "organizations/{organization}/locations/{location}/standards/{standard}"
};
option (google.api.resource_definition) = {
  type: "auditmanager.googleapis.com/EnrollmentStatusScope"
  pattern: "folders/{folder}/locations/{location}"
  pattern: "organizations/{organization}/locations/{location}"
};

// Service describing handlers for resources
service AuditManager {
  option (google.api.default_host) = "auditmanager.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-auditmanager,"
      "https://www.googleapis.com/auth/cloud-platform";

  // Adds your project, folder, or organization to Audit
  // Manager. This method creates the Audit Manager service agent in your
  // workload and grants required permissions to the service agent.
  // If you make this request on a workload that's already enrolled,
  // then this method overrides the existing set of destinations.
  rpc EnrollResource(EnrollResourceRequest) returns (Enrollment) {
    option (google.api.http) = {
      post: "/v1/{scope=folders/*/locations/*}:enrollResource"
      body: "*"
      additional_bindings {
        post: "/v1/{scope=projects/*/locations/*}:enrollResource"
        body: "*"
      }
      additional_bindings {
        post: "/v1/{scope=organizations/*/locations/*}:enrollResource"
        body: "*"
      }
    };
    option (google.api.method_signature) = "scope,destinations";
  }

  // Generates an audit scope report for the given standard.
  //
  // The report includes the following:
  //
  // * The technical attributes and constraints that Audit Manager uses to
  //   verify your compliance with a framework.
  // * A list of Google Cloud services and resources that are within the
  //   scope of the framework.
  rpc GenerateAuditScopeReport(GenerateAuditScopeReportRequest)
      returns (AuditScopeReport) {
    option (google.api.http) = {
      post: "/v1/{scope=folders/*/locations/*}/auditScopeReports:generate"
      body: "*"
      additional_bindings {
        post: "/v1/{scope=projects/*/locations/*}/auditScopeReports:generate"
        body: "*"
      }
      additional_bindings {
        post: "/v1/{scope=organizations/*/locations/*}/auditScopeReports:generate"
        body: "*"
      }
    };
    option (google.api.method_signature) =
        "scope,compliance_standard,report_format";
  }

  // Registers audit report generation requests. This method returns the
  // operation identifier that you can use to track the report generation
  // progress.
  rpc GenerateAuditReport(GenerateAuditReportRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{scope=folders/*/locations/*}/auditReports:generate"
      body: "*"
      additional_bindings {
        post: "/v1/{scope=projects/*/locations/*}/auditReports:generate"
        body: "*"
      }
      additional_bindings {
        post: "/v1/{scope=organizations/*/locations/*}/auditReports:generate"
        body: "*"
      }
    };
    option (google.api.method_signature) =
        "scope,gcs_uri,compliance_standard,report_format";
    option (google.longrunning.operation_info) = {
      response_type: "AuditReport"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists the audit reports for the organization, folder, or project that you
  // specify as the parent scope.
  rpc ListAuditReports(ListAuditReportsRequest)
      returns (ListAuditReportsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=organizations/*/locations/*}/auditReports"
      additional_bindings {
        get: "/v1/{parent=folders/*/locations/*}/auditReports"
      }
      additional_bindings {
        get: "/v1/{parent=projects/*/locations/*}/auditReports"
      }
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets the full metadata and findings for an audit report.
  rpc GetAuditReport(GetAuditReportRequest) returns (AuditReport) {
    option (google.api.http) = {
      get: "/v1/{name=folders/*/locations/*/auditReports/*}"
      additional_bindings {
        get: "/v1/{name=projects/*/locations/*/auditReports/*}"
      }
      additional_bindings {
        get: "/v1/{name=organizations/*/locations/*/auditReports/*}"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Gets a resource and its enrollment status.
  rpc GetResourceEnrollmentStatus(GetResourceEnrollmentStatusRequest)
      returns (ResourceEnrollmentStatus) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/resourceEnrollmentStatuses/*}"
      additional_bindings {
        get: "/v1/{name=folders/*/locations/*/resourceEnrollmentStatuses/*}"
      }
      additional_bindings {
        get: "/v1/{name=organizations/*/locations/*/resourceEnrollmentStatuses/*}"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Lists all the folders and projects in an organization or folder, along with
  // their enrollments.
  rpc ListResourceEnrollmentStatuses(ListResourceEnrollmentStatusesRequest)
      returns (ListResourceEnrollmentStatusesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=organizations/*/locations/*}/resourceEnrollmentStatuses"
      additional_bindings {
        get: "/v1/{parent=folders/*/locations/*}/resourceEnrollmentStatuses"
      }
    };
    option (google.api.method_signature) = "parent";
  }

  // Lists the controls that you must implement to become compliant to a
  // regulatory standard.
  rpc ListControls(ListControlsRequest) returns (ListControlsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=organizations/*/locations/*/standards/*}/controls"
      additional_bindings {
        get: "/v1/{parent=folders/*/locations/*/standards/*}/controls"
      }
      additional_bindings {
        get: "/v1/{parent=projects/*/locations/*/standards/*}/controls"
      }
    };
    option (google.api.method_signature) = "parent";
  }
}

// Different execution states of the Audit Manager service.
enum OperationState {
  // Default value. This value is unused.
  OPERATION_STATE_UNSPECIFIED = 0;

  // Audit generation process hasn't started.
  OPERATION_STATE_NOT_STARTED = 10;

  // Evaluation process is in progress.
  OPERATION_STATE_EVALUATION_IN_PROGRESS = 20;

  // Evaluation process is completed.
  OPERATION_STATE_EVALUATION_DONE = 21;

  // Report generation process is in progress.
  OPERATION_STATE_EVIDENCE_REPORT_GENERATION_IN_PROGRESS = 30;

  // Report generation process is completed.
  OPERATION_STATE_EVIDENCE_REPORT_GENERATION_DONE = 31;

  // The audit report and evidence are being uploaded to your bucket.
  OPERATION_STATE_EVIDENCE_UPLOAD_IN_PROGRESS = 40;

  // The audit report and evidence are uploaded to your bucket.
  OPERATION_STATE_DONE = 50;

  // Audit report generation process failed.
  OPERATION_STATE_FAILED = 60;
}

// Compliance state after evaluation.
enum ComplianceState {
  // Default value. This value is unused.
  COMPLIANCE_STATE_UNSPECIFIED = 0;

  // The resource is compliant.
  COMPLIANT = 1;

  // The resource isn't compliant.
  VIOLATION = 2;

  // You must complete a manual review.
  MANUAL_REVIEW_NEEDED = 3;

  // An error was encountered during the evaluation or evidence gathering
  // process.
  ERROR = 4;

  // The resource can't be audited.
  AUDIT_NOT_SUPPORTED = 5;
}

// Request message for
// [EnrollResource][google.cloud.auditmanager.v1.AuditManager.EnrollResource].
message EnrollResourceRequest {
  // Details about the bucket where you want to upload the audit report.
  message EligibleDestination {
    // Available Cloud Storage buckets.
    oneof eligible_destinations {
      // The location of the Cloud Storage bucket where you want to upload the
      // audit report and evidence during the
      // [GenerateAuditReport][google.cloud.auditmanager.v1.AuditManager.GenerateAuditReport]
      // API call.
      string eligible_gcs_bucket = 3;
    }
  }

  // Required. Organization, folder, or project to enroll in Audit Manager, in
  // one of the following formats:
  //
  // * `projects/{project}/locations/{location}`
  // * `folders/{folder}/locations/{location}`
  // * `organizations/{organization}/locations/{location}`
  string scope = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Cloud Storage buckets that you can upload your audit reports to
  // during the audit process.
  //
  // When you enroll an organization or folder, you can choose a Cloud Storage
  // bucket from any project in the organization or folder. If you run an audit
  // at the project level using the service agent at the organization or folder
  // level, all the buckets that are associated with the service agent are
  // available.
  repeated EligibleDestination destinations = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request message for
// [GenerateAuditScopeReport][google.cloud.auditmanager.v1.AuditManager.GenerateAuditScopeReport].
message GenerateAuditScopeReportRequest {
  // Format for the audit scope report.
  enum AuditScopeReportFormat {
    // Default value. This value is unused.
    AUDIT_SCOPE_REPORT_FORMAT_UNSPECIFIED = 0;

    // Open Document format.
    AUDIT_SCOPE_REPORT_FORMAT_ODF = 1;
  }

  // Required. Project or folder that the audit scope report is generated for,
  // in one of the following formats:
  //
  // * `projects/{project}/locations/{location}`
  // * `folders/{folder}/locations/{location}`
  // * `organizations/{organization}/locations/{location}`
  string scope = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. Deprecated. The standard (industry or regulatory requirements)
  // that the audit scope report is run against.
  //
  // Use the `compliance_framework` field instead.
  string compliance_standard = 3
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Required. Format for the audit scope report.
  AuditScopeReportFormat report_format = 4
      [(google.api.field_behavior) = REQUIRED];

  // Required. Framework (set of controls) that the audit scope report is
  // generated against. For example, `NIST_800_53`.
  string compliance_framework = 5 [(google.api.field_behavior) = REQUIRED];
}

// Request message for
// [GenerateAuditReport][google.cloud.auditmanager.v1.AuditManager.GenerateAuditReport].
message GenerateAuditReportRequest {
  // Format for the audit report.
  enum AuditReportFormat {
    // Default value. This value is unused.
    AUDIT_REPORT_FORMAT_UNSPECIFIED = 0;

    // Open Document format.
    AUDIT_REPORT_FORMAT_ODF = 1;
  }

  // Options for the report destination location.
  oneof destination {
    // URL for the Cloud Storage bucket where the report and evidence is
    // uploaded. You must select a bucket that was provided during the
    // enrollment process.
    string gcs_uri = 2;
  }

  // Required. Organization, folder, or project that the audit applies to, in
  // one of the following formats:
  //
  // * `projects/{project}/locations/{location}`
  // * `folders/{folder}/locations/{location}`
  // * `organizations/{organization}/locations/{location}`
  string scope = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Deprecated. Compliance standard for the audit report.
  //
  // Use the `compliance_framework` field instead.
  string compliance_standard = 3
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Required. Format for the audit report.
  AuditReportFormat report_format = 4 [(google.api.field_behavior) = REQUIRED];

  // Required. The framework that's used for the audit report. For example,
  // `NIST_800_53`.
  string compliance_framework = 5 [(google.api.field_behavior) = REQUIRED];

  // Optional. If `true`, only validate the request and don't generate the audit
  // report.
  bool validate_only = 8 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for
// [GetResourceEnrollmentStatus][google.cloud.auditmanager.v1.AuditManager.GetResourceEnrollmentStatus].
message GetResourceEnrollmentStatusRequest {
  // Required. Name of the resource enrollment status, in one of the following
  // formats:
  //
  // * `folders/{folder}/locations/{location}/resourceEnrollmentStatuses/{resource_enrollment_status}`
  // * `projects/{project}/locations/{location}/resourceEnrollmentStatuses/{resource_enrollment_status}`
  // * `organizations/{organization}/locations/{location}/resourceEnrollmentStatuses/{resource_enrollment_status}`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "auditmanager.googleapis.com/ResourceEnrollmentStatus"
    }
  ];
}

// Request message for
// [ListResourceEnrollmentStatuses][google.cloud.auditmanager.v1.AuditManager.ListResourceEnrollmentStatuses].
message ListResourceEnrollmentStatusesRequest {
  // Required. Parent organization or folder to list enrollment statuses for,
  // in one of the following formats:
  //
  // * `folders/{folder}/locations/{location}`
  // * `organizations/{organization}/locations/{location}`
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "auditmanager.googleapis.com/EnrollmentStatusScope"
    }
  ];

  // Optional. Maximum number of items to return in a single page. The service
  // might return fewer items than this value. If unspecified, the service picks
  // an appropriate default. The maximum value is 100; values above 100 are
  // reduced to 100.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A page token, received from a previous call, to retrieve the next
  // page of results.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for
// [ListResourceEnrollmentStatuses][google.cloud.auditmanager.v1.AuditManager.ListResourceEnrollmentStatuses].
message ListResourceEnrollmentStatusesResponse {
  // Resources with their enrollment status.
  repeated ResourceEnrollmentStatus resource_enrollment_statuses = 1;

  // Output only. A token that you can send as the `page_token` in a subsequent
  // request to retrieve the next page of results. If this field is empty, there
  // are no subsequent pages.
  string next_page_token = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request message for
// [ListAuditReports][google.cloud.auditmanager.v1.AuditManager.ListAuditReports].
message ListAuditReportsRequest {
  // Required. Parent organization, folder, or project to list reports for,
  // in one of the following formats:
  //
  // * `projects/{project}/locations/{location}`
  // * `folders/{folder}/locations/{location}`
  // * `organizations/{organization}/locations/{location}`
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "auditmanager.googleapis.com/AuditReport"
    }
  ];

  // Optional. Maximum number of items to return in a single page. The service
  // might return fewer items than this value. If unspecified, the service picks
  // an appropriate default. The maximum value is 100; values above 100 are
  // reduced to 100.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A page token, received from a previous call, to retrieve the next
  // page of results.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for
// [ListAuditReports][google.cloud.auditmanager.v1.AuditManager.ListAuditReports].
message ListAuditReportsResponse {
  // Output only. Audit reports.
  repeated AuditReport audit_reports = 1
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. A token that you can send as the `page_token` in a subsequent
  // request to retrieve the next page of results. If this field is empty, there
  // are no subsequent pages.
  string next_page_token = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request message for
// [GetAuditReport][google.cloud.auditmanager.v1.AuditManager.GetAuditReport].
message GetAuditReportRequest {
  // Required. Name of the audit report, in one of the following formats:
  //
  // * `projects/{project}/locations/{location}/auditReports/{audit_report}`
  // * `folders/{folder}/locations/{location}/auditReports/{audit_report}`
  // * `organizations/{organization}/locations/{location}/auditReports/{audit_report}`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "auditmanager.googleapis.com/AuditReport"
    }
  ];
}

// Request message for
// [ListControls][google.cloud.auditmanager.v1.AuditManager.ListControls].
message ListControlsRequest {
  // Required. Standard to list controls for, in one of the following formats:
  //
  // * `projects/{project}/locations/{location}/standards/{standard}`
  // * `folders/{folder}/locations/{location}/standards/{standard}`
  // * `organizations/{organization}/locations/{location}/standards/{standard}`
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "auditmanager.googleapis.com/Standard"
    }
  ];

  // Optional. Maximum number of items to return in a single page. The service
  // might return fewer items than this value. If unspecified, the service picks
  // an appropriate default. The maximum value is 100; values above 100 are
  // reduced to 100.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A page token, received from a previous call, to retrieve the next
  // page of results.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for
// [ListControls][google.cloud.auditmanager.v1.AuditManager.ListControls].
message ListControlsResponse {
  // Output only. Controls for a given regulatory standard.
  repeated Control controls = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. A token that you can send as the `page_token` in a subsequent
  // request to retrieve the next page of results. If this field is empty, there
  // are no subsequent pages.
  string next_page_token = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Details about the current status of the report-generation process.
message ReportGenerationProgress {
  // Output only. Current state of execution for report generation.
  OperationState state = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Reason for failure during the audit report generation process.
  // This field is set only if the `OperationState` attribute is
  // `OPERATION_STATE_FAILED`.
  string failure_reason = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Progress of the evaluation process. The progress is
  // defined in terms of percentage complete.
  double evaluation_percent_complete = 20;

  // Report generation progress, defined in terms of percentage complete.
  // Until evaluation is complete, this value is always `0`.
  double report_generation_percent_complete = 30;

  // Report uploading progress, defined in terms of percentage complete.
  // Until evaluation and report generation are complete, this value is always
  // `0`.
  double report_uploading_percent_complete = 40;

  // Output only. Cloud Storage bucket where the audit report is uploaded to
  // after the evaluation process is completed.
  string destination_gcs_bucket = 50
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Name of the audit report.
  string audit_report = 51 [
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.resource_reference) = {
      type: "auditmanager.googleapis.com/AuditReport"
    }
  ];
}

// Organization, folder, or project to enroll for audit reports.
message Enrollment {
  option (google.api.resource) = {
    type: "auditmanager.googleapis.com/Enrollment"
    pattern: "projects/{project}/locations/{location}/enrollments/{enrollment}"
    pattern: "folders/{folder}/locations/{location}/enrollments/{enrollment}"
    pattern: "organizations/{organization}/locations/{location}/enrollments/{enrollment}"
    plural: "enrollments"
    singular: "enrollment"
  };

  // Identifier. Name of the enrollment, in one of the following formats:
  //
  // * `projects/{project}/locations/{location}/enrollments/{enrollment}`
  // * `folders/{folder}/locations/{location}/enrollments/{enrollment}`
  // * `organizations/{organization}/locations/{location}/enrollments/{enrollment}`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. Cloud Storage buckets where you want to upload the audit
  // reports.
  repeated DestinationDetails destination_details = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Audit scope report.
message AuditScopeReport {
  option (google.api.resource) = {
    type: "auditmanager.googleapis.com/AuditScopeReport"
    pattern: "projects/{project}/locations/{location}/auditScopeReports/{audit_scope_report}"
    pattern: "folders/{folder}/locations/{location}/auditScopeReports/{audit_scope_report}"
    pattern: "organizations/{organization}/locations/{location}/auditScopeReports/{audit_scope_report}"
    plural: "auditScopeReports"
    singular: "auditScopeReport"
  };

  // Specific format or delivery method for the exported audit scope report.
  oneof audit_report {
    // Audit scope report content in byte format.
    bytes scope_report_contents = 1;
  }

  // Identifier. Name for the audit scope report, in one of the following
  // formats:
  //
  // * `projects/{project}/locations/{location}/auditScopeReports/{audit_scope_report}`
  // * `folders/{folder}/locations/{location}/auditScopeReports/{audit_scope_report}`
  // * `organizations/{organization}/locations/{location}/auditScopeReports/{audit_scope_report}`
  string name = 2 [(google.api.field_behavior) = IDENTIFIER];
}

// Metadata for the long-running operation.
message OperationMetadata {
  // Output only. Time that the operation was created.
  google.protobuf.Timestamp create_time = 1
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time that the operation finished running.
  google.protobuf.Timestamp end_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. A server-defined resource path for the target of the
  // operation.
  string target = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The name of the verb that was executed by the operation.
  string verb = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. A human-readable status of the operation, if any.
  string status_message = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Whether you requested that the operation be cancelled.
  // Operations that were cancelled successfully have an
  // [Operation.error][google.longrunning.Operation.error]
  // value with a status code
  // [Code.CANCELLED][google.rpc.Status.code.CANCELLED].
  bool requested_cancellation = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The API version used to start the operation. For example,
  // `v1`.
  string api_version = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// An organization, folder, or project with its enrollment status.
message ResourceEnrollmentStatus {
  option (google.api.resource) = {
    type: "auditmanager.googleapis.com/ResourceEnrollmentStatus"
    pattern: "folders/{folder}/locations/{location}/resourceEnrollmentStatuses/{resource_enrollment_status}"
    pattern: "projects/{project}/locations/{location}/resourceEnrollmentStatuses/{resource_enrollment_status}"
    pattern: "organizations/{organization}/locations/{location}/resourceEnrollmentStatuses/{resource_enrollment_status}"
    plural: "resourceEnrollmentStatuses"
    singular: "resourceEnrollmentStatus"
  };

  // Different enrollment states of the resource and its parent.
  enum ResourceEnrollmentState {
    // Default value. This value is unused.
    RESOURCE_ENROLLMENT_STATE_UNSPECIFIED = 0;

    // The resource isn't enrolled.
    NOT_ENROLLED = 1;

    // The resource isn't enrolled but the parent is enrolled.
    INHERITED = 2;

    // The resource is enrolled.
    ENROLLED = 3;
  }

  // Identifier. Name of the resource enrollment status, in one of the following
  // formats:
  //
  // * `folders/{folder}/locations/{location}/resourceEnrollmentStatuses/{resource_enrollment_status}`
  // * `projects/{project}/locations/{location}/resourceEnrollmentStatuses/{resource_enrollment_status}`
  // * `organizations/{organization}/locations/{location}/resourceEnrollmentStatuses/{resource_enrollment_status}`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. Enrolled destination details for the organization, folder, or
  // project.
  Enrollment enrollment = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Deprecated. Whether the organization, folder, or project is
  // enrolled. Use `enrollment_state` instead.
  bool enrolled = 3
      [deprecated = true, (google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Display name for the organization, folder, or project.
  string display_name = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Enrollment state of the organization, folder, or project.
  ResourceEnrollmentState enrollment_state = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// An audit report.
message AuditReport {
  option (google.api.resource) = {
    type: "auditmanager.googleapis.com/AuditReport"
    pattern: "projects/{project}/locations/{location}/auditReports/{audit_report}"
    pattern: "folders/{folder}/locations/{location}/auditReports/{audit_report}"
    pattern: "organizations/{organization}/locations/{location}/auditReports/{audit_report}"
    plural: "auditReports"
    singular: "auditReport"
  };

  // Different states of report generation.
  enum ReportGenerationState {
    // Default value. This value is unused.
    REPORT_GENERATION_STATE_UNSPECIFIED = 0;

    // The process is in progress. The operation can have any state
    // except for `OPERATION_STATE_DONE` or `OPERATION_STATE_FAILED`.
    IN_PROGRESS = 1;

    // The process is completed. The operation state is
    // `OPERATION_STATE_DONE`.
    COMPLETED = 2;

    // The process has failed. The operation state is
    // `OPERATION_STATE_FAILED`.
    FAILED = 3;

    // The process completed, but the report summary's status is unknown. This
    // state isn't used for new reports.
    SUMMARY_UNKNOWN = 4;
  }

  // Identifier. Name of the audit report, in one of the following formats:
  //
  // * `projects/{project}/locations/{location}/auditReports/{audit_report}`
  // * `folders/{folder}/locations/{location}/auditReports/{audit_report}`
  // * `organizations/{organization}/locations/{location}/auditReports/{audit_report}`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. Report summary that includes information about compliance and
  // violation counts.
  ReportSummary report_summary = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Client operation ID for the audit report.
  string operation_id = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Cloud Storage bucket where the audit report is uploaded to.
  DestinationDetails destination_details = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Deprecated. Compliance standard to be audited against.
  //
  // Use the `compliance_framework` field instead.
  string compliance_standard = 5
      [deprecated = true, (google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Organization, folder, or project that the report is generated
  // for, in one of the following formats:
  //
  // * `projects/{project}/locations/{location}`
  // * `folders/{folder}/locations/{location}`
  // * `organizations/{organization}/locations/{location}`
  string scope = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Creation time of the audit report.
  google.protobuf.Timestamp create_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Overall status of the controls.
  repeated ControlDetails control_details = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. State of audit report generation.
  ReportGenerationState report_generation_state = 9
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Compliance framework to use for the audit report. For example,
  // `CIS_GCP_FOUNDATIONS_V1_2_0`.
  string compliance_framework = 10 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Project number, folder ID, or organization ID that the audit
  // report was generated for.
  string scope_id = 11 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Regulatory family of the control.
message ControlFamily {
  // ID of the regulatory control family. To find the list of supported
  // control families, use the
  // [ListControls][google.cloud.auditmanager.v1.AuditManager.ListControls]
  // method and review the `control_family` field in the response.
  string family_id = 1;

  // Display name of the regulatory control family.
  string display_name = 2;
}

// A control.
message Control {
  // Category of the control.
  enum Family {
    // Default value. This value is unused.
    FAMILY_UNSPECIFIED = 0;

    // Access control.
    AC = 1;

    // Awareness and training.
    AT = 2;

    // Audit and accountability.
    AU = 3;

    // Certification, accreditation and security assessments.
    CA = 4;

    // Configuration management and change control.
    CM = 5;

    // Contingency planning and disaster recovery.
    CP = 6;

    // Identification and authentication.
    IA = 7;

    // Incident response.
    IR = 8;

    // Maintenance.
    MA = 9;

    // Media protection.
    MP = 10;

    // Physical and environmental protection.
    PE = 11;

    // Security planning.
    PL = 12;

    // Personnel security.
    PS = 13;

    // Risk assessment.
    RA = 14;

    // System services and acquisition.
    SA = 15;

    // System and communications protection.
    SC = 16;

    // System and information integrity.
    SI = 17;

    // Supply chain risk management.
    SR = 18;
  }

  // Output only. Control identifier that's used to fetch the findings. The
  // identifier is the same as the control report name.
  string id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Display name of the control.
  string display_name = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Category that the control belongs to.
  Family family = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Regulatory family of the control.
  ControlFamily control_family = 10 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Description of the control.
  string description = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Who is responsible for implementing this control. Set to one
  // of the following values: `GOOGLE`, `CUSTOMER`, or `SHARED`.
  string responsibility_type = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. A description of Google's responsibility for this control.
  string google_responsibility_description = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. A description of how Google implements its responsibility for
  // this control.
  string google_responsibility_implementation = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. A description of your responsibility for this control.
  string customer_responsibility_description = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. A description of how you can implement your responsibility for
  // this control.
  string customer_responsibility_implementation = 9
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Cloud Storage bucket where the audit report is uploaded to.
message DestinationDetails {
  // The specific destination where the audit report and evidence are stored.
  oneof destination {
    // URI for the Cloud Storage bucket, in the format
    // `gs://{bucket_name}`.
    string gcs_bucket_uri = 1;
  }
}

// Additional information about the number of checks that were made during an
// audit operation.
message ReportSummary {
  // Total number of evaluated checks.
  int32 total_count = 1;

  // Number of compliant checks.
  int32 compliant_count = 2;

  // Number of checks with violations.
  int32 violation_count = 3;

  // Number of checks that require a manual review.
  int32 manual_review_needed_count = 4;

  // Number of checks that can't be performed due to errors.
  int32 error_count = 5;
}

// Evaluation details for a control.
message ControlDetails {
  // Control that the findings are being reported for.
  Control control = 1;

  // Output only. Overall status of the findings for the control.
  ComplianceState compliance_state = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // A control report summary that provides a high-level overview of the
  // compliance controls and the assessment status.
  ReportSummary control_report_summary = 3;
}