Class PrivilegedAccessManagerClient (0.1.2) 

PrivilegedAccessManagerClient(*, credentials: typing.Optional[google.auth.credentials.Credentials] = None, transport: typing.Optional[typing.Union[str, google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.transports.base.PrivilegedAccessManagerTransport, typing.Callable[[...], google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.transports.base.PrivilegedAccessManagerTransport]]] = None, client_options: typing.Optional[typing.Union[google.api_core.client_options.ClientOptions, dict]] = None, client_info: google.api_core.gapic_v1.client_info.ClientInfo = <google.api_core.gapic_v1.client_info.ClientInfo object>)

This API allows customers to manage temporary, request based privileged access to their resources.

It defines the following resource model:

  • A collection of Entitlement resources. An entitlement allows configuring (among other things):

    • Some kind of privileged access that users can request.
    • A set of users called requesters who can request this access.
    • A maximum duration for which the access can be requested.
    • An optional approval workflow which must be satisfied before access is granted.

  • A collection of Grant resources. A grant is a request by a requester to get the privileged access specified in an entitlement for some duration.

    After the approval workflow as specified in the entitlement is satisfied, the specified access is given to the requester. The access is automatically taken back after the requested duration is over.

Properties

api_endpoint

Return the API endpoint used by the client instance.

Returns
Type Description
str The API endpoint used by the client instance.

transport

Returns the transport used by the client instance.

Returns
Type Description
PrivilegedAccessManagerTransport The transport used by the client instance.

universe_domain

Return the universe domain used by the client instance.

Returns
Type Description
str The universe domain used by the client instance.

Methods

PrivilegedAccessManagerClient

PrivilegedAccessManagerClient(*, credentials: typing.Optional[google.auth.credentials.Credentials] = None, transport: typing.Optional[typing.Union[str, google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.transports.base.PrivilegedAccessManagerTransport, typing.Callable[[...], google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.transports.base.PrivilegedAccessManagerTransport]]] = None, client_options: typing.Optional[typing.Union[google.api_core.client_options.ClientOptions, dict]] = None, client_info: google.api_core.gapic_v1.client_info.ClientInfo = <google.api_core.gapic_v1.client_info.ClientInfo object>)

Instantiates the privileged access manager client.

Parameters
Name Description
credentials Optional[google.auth.credentials.Credentials]

The authorization credentials to attach to requests. These credentials identify the application to the service; if none are specified, the client will attempt to ascertain the credentials from the environment.
transport Optional[Union[str,PrivilegedAccessManagerTransport,Callable[..., PrivilegedAccessManagerTransport]]]

The transport to use, or a Callable that constructs and returns a new transport. If a Callable is given, it will be called with the same set of initialization arguments as used in the PrivilegedAccessManagerTransport constructor. If set to None, a transport is chosen automatically.
client_options Optional[Union[google.api_core.client_options.ClientOptions, dict]]

Custom options for the client. 1. The api_endpoint property can be used to override the default endpoint provided by the client when transport is not explicitly provided. Only if this property is not set and transport was not explicitly provided, the endpoint is determined by the GOOGLE_API_USE_MTLS_ENDPOINT environment variable, which have one of the following values: "always" (always use the default mTLS endpoint), "never" (always use the default regular endpoint) and "auto" (auto-switch to the default mTLS endpoint if client certificate is present; this is the default value). 2. If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is "true", then the client_cert_source property can be used to provide a client certificate for mTLS transport. If not provided, the default SSL client certificate will be used if present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not set, no client certificate will be used. 3. The universe_domain property can be used to override the default "googleapis.com" universe. Note that the api_endpoint property still takes precedence; and universe_domain is currently not supported for mTLS.
client_info google.api_core.gapic_v1.client_info.ClientInfo

The client info used to send a user-agent string along with API requests. If None, then default info will be used. Generally, you only need to set this if you're developing your own client library.
Exceptions
Type Description
google.auth.exceptions.MutualTLSChannelError If mutual TLS transport creation failed for any reason.

__exit__

__exit__(type, value, traceback)

Releases underlying transport's resources.

approve_grant

approve_grant(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.ApproveGrantRequest,
            dict,
        ]
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.Grant

ApproveGrant is used to approve a grant. This method can only be called on a grant when it's in the APPROVAL_AWAITED state. This operation can't be undone.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_approve_grant():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.ApproveGrantRequest(
        name="name_value",
    )

    # Make the request
    response = client.approve_grant(request=request)

    # Handle the response
    print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.ApproveGrantRequest, dict]

The request object. Request message for ApproveGrant method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.cloud.privilegedaccessmanager_v1.types.Grant This is to ensure that the Grants and ProducerGrants proto are byte compatible. A grant represents a request from a user for obtaining the access specified in an entitlement they are eligible for.

check_onboarding_status

check_onboarding_status(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.CheckOnboardingStatusRequest,
            dict,
        ]
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> (
    google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.CheckOnboardingStatusResponse
)

CheckOnboardingStatus reports the onboarding status for a project/folder/organization. Any findings reported by this API need to be fixed before PAM can be used on the resource.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_check_onboarding_status():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.CheckOnboardingStatusRequest(
        parent="parent_value",
    )

    # Make the request
    response = client.check_onboarding_status(request=request)

    # Handle the response
    print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.CheckOnboardingStatusRequest, dict]

The request object. Request message for CheckOnboardingStatus method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.cloud.privilegedaccessmanager_v1.types.CheckOnboardingStatusResponse Response message for CheckOnboardingStatus method.

common_billing_account_path

common_billing_account_path(billing_account: str) -> str

Returns a fully-qualified billing_account string.

common_folder_path

common_folder_path(folder: str) -> str

Returns a fully-qualified folder string.

common_location_path

common_location_path(project: str, location: str) -> str

Returns a fully-qualified location string.

common_organization_path

common_organization_path(organization: str) -> str

Returns a fully-qualified organization string.

common_project_path

common_project_path(project: str) -> str

Returns a fully-qualified project string.

create_entitlement

create_entitlement(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.CreateEntitlementRequest,
            dict,
        ]
    ] = None,
    *,
    parent: typing.Optional[str] = None,
    entitlement: typing.Optional[
        google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.Entitlement
    ] = None,
    entitlement_id: typing.Optional[str] = None,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.api_core.operation.Operation

Creates a new entitlement in a given project/folder/organization and location.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_create_entitlement():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.CreateEntitlementRequest(
        parent="parent_value",
        entitlement_id="entitlement_id_value",
    )

    # Make the request
    operation = client.create_entitlement(request=request)

    print("Waiting for operation to complete...")

    response = operation.result()

    # Handle the response
    print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.CreateEntitlementRequest, dict]

The request object. Message for creating an entitlement.
parent str

Required. Name of the parent resource for the entitlement. Possible formats: - organizations/{organization-number}/locations/{region} - folders/{folder-number}/locations/{region} - projects/{project-id|project-number}/locations/{region} This corresponds to the parent field on the request instance; if request is provided, this should not be set.
entitlement google.cloud.privilegedaccessmanager_v1.types.Entitlement

Required. The resource being created This corresponds to the entitlement field on the request instance; if request is provided, this should not be set.
entitlement_id str

Required. The ID to use for this entitlement. This becomes the last part of the resource name. This value should be 4-63 characters in length, and valid characters are "[a-z]", "[0-9]", and "-". The first character should be from [a-z]. This value should be unique among all other entitlements under the specified parent. This corresponds to the entitlement_id field on the request instance; if request is provided, this should not be set.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.api_core.operation.Operation An object representing a long-running operation. The result type for the operation will be Entitlement An entitlement defines the eligibility of a set of users to obtain predefined access for some time possibly after going through an approval workflow.

create_grant

create_grant(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.CreateGrantRequest,
            dict,
        ]
    ] = None,
    *,
    parent: typing.Optional[str] = None,
    grant: typing.Optional[
        google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.Grant
    ] = None,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.Grant

Creates a new grant in a given project and location.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_create_grant():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.CreateGrantRequest(
        parent="parent_value",
    )

    # Make the request
    response = client.create_grant(request=request)

    # Handle the response
    print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.CreateGrantRequest, dict]

The request object. Message for creating a grant
parent str

Required. Name of the parent entitlement for which this grant is being requested. This corresponds to the parent field on the request instance; if request is provided, this should not be set.
grant google.cloud.privilegedaccessmanager_v1.types.Grant

Required. The resource being created. This corresponds to the grant field on the request instance; if request is provided, this should not be set.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.cloud.privilegedaccessmanager_v1.types.Grant This is to ensure that the Grants and ProducerGrants proto are byte compatible. A grant represents a request from a user for obtaining the access specified in an entitlement they are eligible for.

delete_entitlement

delete_entitlement(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.DeleteEntitlementRequest,
            dict,
        ]
    ] = None,
    *,
    name: typing.Optional[str] = None,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.api_core.operation.Operation

Deletes a single entitlement. This method can only be called when there are no in-progress (ACTIVE/ACTIVATING/REVOKING) grants under the entitlement.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_delete_entitlement():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.DeleteEntitlementRequest(
        name="name_value",
    )

    # Make the request
    operation = client.delete_entitlement(request=request)

    print("Waiting for operation to complete...")

    response = operation.result()

    # Handle the response
    print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.DeleteEntitlementRequest, dict]

The request object. Message for deleting an entitlement.
name str

Required. Name of the resource. This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.api_core.operation.Operation An object representing a long-running operation. The result type for the operation will be Entitlement An entitlement defines the eligibility of a set of users to obtain predefined access for some time possibly after going through an approval workflow.

delete_operation

delete_operation(
    request: typing.Optional[
        google.longrunning.operations_pb2.DeleteOperationRequest
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> None

Deletes a long-running operation.

This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn't support this method, it returns google.rpc.Code.UNIMPLEMENTED.

Parameters
Name Description
request .operations_pb2.DeleteOperationRequest

The request object. Request message for DeleteOperation method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.

deny_grant

deny_grant(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.DenyGrantRequest,
            dict,
        ]
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.Grant

DenyGrant is used to deny a grant. This method can only be called on a grant when it's in the APPROVAL_AWAITED state. This operation can't be undone.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_deny_grant():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.DenyGrantRequest(
        name="name_value",
    )

    # Make the request
    response = client.deny_grant(request=request)

    # Handle the response
    print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.DenyGrantRequest, dict]

The request object. Request message for DenyGrant method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.cloud.privilegedaccessmanager_v1.types.Grant This is to ensure that the Grants and ProducerGrants proto are byte compatible. A grant represents a request from a user for obtaining the access specified in an entitlement they are eligible for.

entitlement_path

entitlement_path(project: str, location: str, entitlement: str) -> str

Returns a fully-qualified entitlement string.

from_service_account_file

from_service_account_file(filename: str, *args, **kwargs)

Creates an instance of this client using the provided credentials file.

Parameter
Name Description
filename str

The path to the service account private key json file.
Returns
Type Description
PrivilegedAccessManagerClient The constructed client.

from_service_account_info

from_service_account_info(info: dict, *args, **kwargs)

Creates an instance of this client using the provided credentials info.

Parameter
Name Description
info dict

The service account private key info.
Returns
Type Description
PrivilegedAccessManagerClient The constructed client.

from_service_account_json

from_service_account_json(filename: str, *args, **kwargs)

Creates an instance of this client using the provided credentials file.

Parameter
Name Description
filename str

The path to the service account private key json file.
Returns
Type Description
PrivilegedAccessManagerClient The constructed client.

get_entitlement

get_entitlement(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.GetEntitlementRequest,
            dict,
        ]
    ] = None,
    *,
    name: typing.Optional[str] = None,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.Entitlement

Gets details of a single entitlement.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_get_entitlement():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.GetEntitlementRequest(
        name="name_value",
    )

    # Make the request
    response = client.get_entitlement(request=request)

    # Handle the response
    print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.GetEntitlementRequest, dict]

The request object. Message for getting an entitlement.
name str

Required. Name of the resource. This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.cloud.privilegedaccessmanager_v1.types.Entitlement An entitlement defines the eligibility of a set of users to obtain predefined access for some time possibly after going through an approval workflow.

get_grant

get_grant(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.GetGrantRequest,
            dict,
        ]
    ] = None,
    *,
    name: typing.Optional[str] = None,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.Grant

Get details of a single grant.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_get_grant():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.GetGrantRequest(
        name="name_value",
    )

    # Make the request
    response = client.get_grant(request=request)

    # Handle the response
    print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.GetGrantRequest, dict]

The request object. Message for getting a grant.
name str

Required. Name of the resource. This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.cloud.privilegedaccessmanager_v1.types.Grant This is to ensure that the Grants and ProducerGrants proto are byte compatible. A grant represents a request from a user for obtaining the access specified in an entitlement they are eligible for.

get_location

get_location(
    request: typing.Optional[
        google.cloud.location.locations_pb2.GetLocationRequest
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.cloud.location.locations_pb2.Location

Gets information about a location.

Parameters
Name Description
request .location_pb2.GetLocationRequest

The request object. Request message for GetLocation method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
.location_pb2.Location Location object.

get_mtls_endpoint_and_cert_source

get_mtls_endpoint_and_cert_source(
    client_options: typing.Optional[
        google.api_core.client_options.ClientOptions
    ] = None,
)

Deprecated. Return the API endpoint and client cert source for mutual TLS.

The client cert source is determined in the following order: (1) if GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is not "true", the client cert source is None. (2) if client_options.client_cert_source is provided, use the provided one; if the default client cert source exists, use the default one; otherwise the client cert source is None.

The API endpoint is determined in the following order: (1) if client_options.api_endpoint if provided, use the provided one. (2) if GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is "always", use the default mTLS endpoint; if the environment variable is "never", use the default API endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise use the default API endpoint.

More details can be found at https://google.aip.dev/auth/4114.

Parameter
Name Description
client_options google.api_core.client_options.ClientOptions

Custom options for the client. Only the api_endpoint and client_cert_source properties may be used in this method.
Exceptions
Type Description
google.auth.exceptions.MutualTLSChannelError If any errors happen.
Returns
Type Description
Tuple[str, Callable[[], Tuple[bytes, bytes]]] returns the API endpoint and the client cert source to use.

get_operation

get_operation(
    request: typing.Optional[
        google.longrunning.operations_pb2.GetOperationRequest
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.longrunning.operations_pb2.Operation

Gets the latest state of a long-running operation.

Parameters
Name Description
request .operations_pb2.GetOperationRequest

The request object. Request message for GetOperation method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
.operations_pb2.Operation An Operation object.

grant_path

grant_path(project: str, location: str, entitlement: str, grant: str) -> str

Returns a fully-qualified grant string.

list_entitlements

list_entitlements(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.ListEntitlementsRequest,
            dict,
        ]
    ] = None,
    *,
    parent: typing.Optional[str] = None,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> (
    google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.pagers.ListEntitlementsPager
)

Lists entitlements in a given project/folder/organization and location.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_list_entitlements():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.ListEntitlementsRequest(
        parent="parent_value",
    )

    # Make the request
    page_result = client.list_entitlements(request=request)

    # Handle the response
    for response in page_result:
        print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.ListEntitlementsRequest, dict]

The request object. Message for requesting list of entitlements.
parent str

Required. The parent which owns the entitlement resources. This corresponds to the parent field on the request instance; if request is provided, this should not be set.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.pagers.ListEntitlementsPager Message for response to listing entitlements. Iterating over this object will yield results and resolve additional pages automatically.

list_grants

list_grants(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.ListGrantsRequest,
            dict,
        ]
    ] = None,
    *,
    parent: typing.Optional[str] = None,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> (
    google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.pagers.ListGrantsPager
)

Lists grants for a given entitlement.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_list_grants():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.ListGrantsRequest(
        parent="parent_value",
    )

    # Make the request
    page_result = client.list_grants(request=request)

    # Handle the response
    for response in page_result:
        print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.ListGrantsRequest, dict]

The request object. Message for requesting list of grants.
parent str

Required. The parent resource which owns the grants. This corresponds to the parent field on the request instance; if request is provided, this should not be set.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.pagers.ListGrantsPager Message for response to listing grants. Iterating over this object will yield results and resolve additional pages automatically.

list_locations

list_locations(
    request: typing.Optional[
        google.cloud.location.locations_pb2.ListLocationsRequest
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.cloud.location.locations_pb2.ListLocationsResponse

Lists information about the supported locations for this service.

Parameters
Name Description
request .location_pb2.ListLocationsRequest

The request object. Request message for ListLocations method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
.location_pb2.ListLocationsResponse Response message for ListLocations method.

list_operations

list_operations(
    request: typing.Optional[
        google.longrunning.operations_pb2.ListOperationsRequest
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.longrunning.operations_pb2.ListOperationsResponse

Lists operations that match the specified filter in the request.

Parameters
Name Description
request .operations_pb2.ListOperationsRequest

The request object. Request message for ListOperations method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
.operations_pb2.ListOperationsResponse Response message for ListOperations method.

parse_common_billing_account_path

parse_common_billing_account_path(path: str) -> typing.Dict[str, str]

Parse a billing_account path into its component segments.

parse_common_folder_path

parse_common_folder_path(path: str) -> typing.Dict[str, str]

Parse a folder path into its component segments.

parse_common_location_path

parse_common_location_path(path: str) -> typing.Dict[str, str]

Parse a location path into its component segments.

parse_common_organization_path

parse_common_organization_path(path: str) -> typing.Dict[str, str]

Parse a organization path into its component segments.

parse_common_project_path

parse_common_project_path(path: str) -> typing.Dict[str, str]

Parse a project path into its component segments.

parse_entitlement_path

parse_entitlement_path(path: str) -> typing.Dict[str, str]

Parses a entitlement path into its component segments.

parse_grant_path

parse_grant_path(path: str) -> typing.Dict[str, str]

Parses a grant path into its component segments.

revoke_grant

revoke_grant(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.RevokeGrantRequest,
            dict,
        ]
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.api_core.operation.Operation

RevokeGrant is used to immediately revoke access for a grant. This method can be called when the grant is in a non-terminal state.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_revoke_grant():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.RevokeGrantRequest(
        name="name_value",
    )

    # Make the request
    operation = client.revoke_grant(request=request)

    print("Waiting for operation to complete...")

    response = operation.result()

    # Handle the response
    print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.RevokeGrantRequest, dict]

The request object. Request message for RevokeGrant method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.api_core.operation.Operation An object representing a long-running operation. The result type for the operation will be Grant This is to ensure that the Grants and ProducerGrants proto are byte compatible. A grant represents a request from a user for obtaining the access specified in an entitlement they are eligible for.

search_entitlements

search_entitlements(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.SearchEntitlementsRequest,
            dict,
        ]
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> (
    google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.pagers.SearchEntitlementsPager
)

SearchEntitlements returns entitlements on which the caller has the specified access.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_search_entitlements():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.SearchEntitlementsRequest(
        parent="parent_value",
        caller_access_type="GRANT_APPROVER",
    )

    # Make the request
    page_result = client.search_entitlements(request=request)

    # Handle the response
    for response in page_result:
        print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.SearchEntitlementsRequest, dict]

The request object. Request message for SearchEntitlements method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.pagers.SearchEntitlementsPager Response message for SearchEntitlements method. Iterating over this object will yield results and resolve additional pages automatically.

search_grants

search_grants(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.SearchGrantsRequest,
            dict,
        ]
    ] = None,
    *,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> (
    google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.pagers.SearchGrantsPager
)

SearchGrants returns grants that are related to the calling user in the specified way.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_search_grants():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.SearchGrantsRequest(
        parent="parent_value",
        caller_relationship="HAD_APPROVED",
    )

    # Make the request
    page_result = client.search_grants(request=request)

    # Handle the response
    for response in page_result:
        print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.SearchGrantsRequest, dict]

The request object. Request message for SearchGrants method.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager.pagers.SearchGrantsPager Response message for SearchGrants method. Iterating over this object will yield results and resolve additional pages automatically.

update_entitlement

update_entitlement(
    request: typing.Optional[
        typing.Union[
            google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.UpdateEntitlementRequest,
            dict,
        ]
    ] = None,
    *,
    entitlement: typing.Optional[
        google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager.Entitlement
    ] = None,
    update_mask: typing.Optional[google.protobuf.field_mask_pb2.FieldMask] = None,
    retry: typing.Optional[
        typing.Union[
            google.api_core.retry.retry_unary.Retry,
            google.api_core.gapic_v1.method._MethodDefault,
        ]
    ] = _MethodDefault._DEFAULT_VALUE,
    timeout: typing.Union[float, object] = _MethodDefault._DEFAULT_VALUE,
    metadata: typing.Sequence[typing.Tuple[str, str]] = ()
) -> google.api_core.operation.Operation

Updates the entitlement specified in the request. Updated fields in the entitlement need to be specified in an update mask. The changes made to an entitlement are applicable only on future grants of the entitlement. However, if new approvers are added or existing approvers are removed from the approval workflow, the changes are effective on existing grants.

The following fields are not supported for updates:

  • All immutable fields
  • Entitlement name
  • Resource name
  • Resource type
  • Adding an approval workflow in an entitlement which previously had no approval workflow.
  • Deleting the approval workflow from an entitlement.
  • Adding or deleting a step in the approval workflow (only one step is supported)

Note that updates are allowed on the list of approvers in an approval workflow step.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import privilegedaccessmanager_v1

def sample_update_entitlement():
    # Create a client
    client = privilegedaccessmanager_v1.PrivilegedAccessManagerClient()

    # Initialize request argument(s)
    request = privilegedaccessmanager_v1.UpdateEntitlementRequest(
    )

    # Make the request
    operation = client.update_entitlement(request=request)

    print("Waiting for operation to complete...")

    response = operation.result()

    # Handle the response
    print(response)
Parameters
Name Description
request Union[google.cloud.privilegedaccessmanager_v1.types.UpdateEntitlementRequest, dict]

The request object. Message for updating an entitlement.
entitlement google.cloud.privilegedaccessmanager_v1.types.Entitlement

Required. The entitlement resource that is updated. This corresponds to the entitlement field on the request instance; if request is provided, this should not be set.
update_mask google.protobuf.field_mask_pb2.FieldMask

Required. The list of fields to update. A field is overwritten if, and only if, it is in the mask. Any immutable fields set in the mask are ignored by the server. Repeated fields and map fields are only allowed in the last position of a paths string and overwrite the existing values. Hence an update to a repeated field or a map should contain the entire list of values. The fields specified in the update_mask are relative to the resource and not to the request. (e.g. MaxRequestDuration; not entitlement.MaxRequestDuration) A value of '*' for this field refers to full replacement of the resource. This corresponds to the update_mask field on the request instance; if request is provided, this should not be set.
retry google.api_core.retry.Retry

Designation of what errors, if any, should be retried.
timeout float

The timeout for this request.
metadata Sequence[Tuple[str, str]]

Strings which should be sent along with the request as metadata.
Returns
Type Description
google.api_core.operation.Operation An object representing a long-running operation. The result type for the operation will be Entitlement An entitlement defines the eligibility of a set of users to obtain predefined access for some time possibly after going through an approval workflow.