v1

type APIKey struct {

	// Identifier of this key
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// URL of this key.
	Url string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
	// User represented by this key
	UserId string `protobuf:"bytes,3,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	// If set, this key only grants access to this organization.
	OrganizationId string `protobuf:"bytes,4,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
	// If set, this key only grants access to read-only API's (List..., Get...)
	IsReadonly bool `protobuf:"varint,5,opt,name=is_readonly,json=isReadonly,proto3" json:"is_readonly,omitempty"`
	// The creation timestamp of the key
	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	// The expiration timestamp of the key
	ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
	// Set when this key is expired.
	IsExpired bool `protobuf:"varint,8,opt,name=is_expired,json=isExpired,proto3" json:"is_expired,omitempty"`
	// The revocation timestamp of the key (if any)
	RevokedAt *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=revoked_at,json=revokedAt,proto3" json:"revoked_at,omitempty"`
	// Set when this key is explicitly revoked.
	IsRevoked bool `protobuf:"varint,10,opt,name=is_revoked,json=isRevoked,proto3" json:"is_revoked,omitempty"`
	// contains filtered or unexported fields
}

type APIKeyCallback func(context.Context, *APIKey) error

type APIKeyList struct {
	Items []*APIKey `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	// contains filtered or unexported fields
}

type APIKeySecret struct {

	// ID of the API key
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Secret of the API key
	Secret string `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
	// contains filtered or unexported fields
}

type AuthenticateAPIKeyRequest struct {

	// API key id
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Secret of the API key
	Secret string `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
	// Life time of the token.
	// If set, then this TTL is used reduce the default TTL
	// of an authentication token. It cannot be used to increase the default
	// lifetime of a token.
	TimeToLive *durationpb.Duration `protobuf:"bytes,3,opt,name=time_to_live,json=timeToLive,proto3" json:"time_to_live,omitempty"`
	// contains filtered or unexported fields
}

type AuthenticateAPIKeyResponse struct {

	// Bearer token
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// Actual life time of the token.
	TimeToLive *durationpb.Duration `protobuf:"bytes,2,opt,name=time_to_live,json=timeToLive,proto3" json:"time_to_live,omitempty"`
	// contains filtered or unexported fields
}

type CreateAPIKeyRequest struct {

	// If set, the created key only grants access to this organization.
	OrganizationId string `protobuf:"bytes,1,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
	// If set, the created key only grants access to read-only API's (List..., Get...).
	// If not set, the created key grants access to all API's (that the user has access to).
	Readonly bool `protobuf:"varint,2,opt,name=readonly,proto3" json:"readonly,omitempty"`
	// Duration between now and the expiration date of the created key.
	// A value of 0 means that the API key will not expire.
	// You can still use RevokeAPIKey to revoke such API keys.
	TimeToLive *durationpb.Duration `protobuf:"bytes,3,opt,name=time_to_live,json=timeToLive,proto3" json:"time_to_live,omitempty"`
	// contains filtered or unexported fields
}

type GetMultipleEffectivePermissionsRequest struct {

	// URLs of the resources to fetch.
	Urls []string `protobuf:"bytes,1,rep,name=urls,proto3" json:"urls,omitempty"`
	// contains filtered or unexported fields
}

type GetPolicyByFilterRequest struct {

	// URL of the resource to which this policy applies.
	// This field is required.
	ResourceUrl string `protobuf:"bytes,1,opt,name=resource_url,json=resourceUrl,proto3" json:"resource_url,omitempty"`
	// common listing options (context field is ignored)
	// used for pagination
	Options *v1.ListOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// Filter role bindings based on member identifier
	// Member ID is formatted as:
	// - user:<user_id>
	// - group:<group_id>
	// This field is optional.
	MemberId string `protobuf:"bytes,3,opt,name=member_id,json=memberId,proto3" json:"member_id,omitempty"`
	// Filter based on role identifier
	// This field is optional.
	RoleId string `protobuf:"bytes,4,opt,name=role_id,json=roleId,proto3" json:"role_id,omitempty"`
	// contains filtered or unexported fields
}

type Group struct {

	// System identifier of the group.
	// This is a read-only value.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Identifier of the organization that owns this group.
	OrganizationId string `protobuf:"bytes,2,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
	// Name of the group
	Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
	// Description of the group
	Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
	// The creation timestamp of the group
	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	// The deletion timestamp of the group
	DeletedAt *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=deleted_at,json=deletedAt,proto3" json:"deleted_at,omitempty"`
	// Set when this organization is deleted.
	// This is a read-only value.
	IsDeleted bool `protobuf:"varint,7,opt,name=is_deleted,json=isDeleted,proto3" json:"is_deleted,omitempty"`
	// URL of this resource
	// This is a read-only value and cannot be initialized.
	Url string `protobuf:"bytes,8,opt,name=url,proto3" json:"url,omitempty"`
	// Set if this group is virtual and managed by the system.
	// This is a read-only value.
	IsVirtual bool `protobuf:"varint,9,opt,name=is_virtual,json=isVirtual,proto3" json:"is_virtual,omitempty"`
	// If set, new users are automatically added to this group.
	// If there are multiple default groups, new users are added to all of them.
	IsDefault bool `protobuf:"varint,10,opt,name=is_default,json=isDefault,proto3" json:"is_default,omitempty"`
	// contains filtered or unexported fields
}

type GroupCallback func(context.Context, *Group) error

type GroupList struct {
	Items []*Group `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	// contains filtered or unexported fields
}

type GroupMemberCallback func(context.Context, string) error

type GroupMemberList struct {

	// List of ID's of users that are member of the group.
	Items []string `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	// List of users that are member of the group.
	Users []*User `protobuf:"bytes,2,rep,name=users,proto3" json:"users,omitempty"`
	// contains filtered or unexported fields
}

type GroupMembersRequest struct {

	// ID of the group to add/remove members to/from.
	GroupId string `protobuf:"bytes,1,opt,name=group_id,json=groupId,proto3" json:"group_id,omitempty"`
	// ID's of users to add/remove to/from the group.
	UserIds []string `protobuf:"bytes,2,rep,name=user_ids,json=userIds,proto3" json:"user_ids,omitempty"`
	// contains filtered or unexported fields
}

type HasPermissionsRequest struct {

	// URL of the resource to query permissions for.
	Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
	// The list of permissions that are required.
	Permissions []string `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
	// contains filtered or unexported fields
}

type IAMServiceClient interface {
	// Get the current API version of this service.
	// Required permissions:
	// - None
	GetAPIVersion(ctx context.Context, in *v1.Empty, opts ...grpc.CallOption) (*v1.Version, error)
	// Fetch all available information of the currently authenticated user.
	// Required permissions:
	// - None
	GetThisUser(ctx context.Context, in *v1.Empty, opts ...grpc.CallOption) (*User, error)
	// Fetch all available information of the user identified by the given ID.
	// Required permissions:
	// - resourcemanager.organization.get on one of the organizations that the requested user and authenticated user are both a member of
	GetUser(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*User, error)
	// Update a user
	// Required permissions:
	// - None if the given user is the authenticated user.
	// or
	// - resourcemanager.organization.get on one of the organizations that the requested user and authenticated user are both a member of and
	// - iam.user.update on organization on one of the organizations that the requested user and authenticated user are both a member of
	UpdateUser(ctx context.Context, in *User, opts ...grpc.CallOption) (*User, error)
	// Verify the mobile phone number of a user, by provided the unique
	// code that was send to the number.
	// If the code is valid an empty result is returned, otherwise an InvalidArgument error is returned.
	// The authenticated user is always the subject of this request.
	// Required permissions:
	// - None (since the subject is always the authenticated user).
	VerifyUserMobilePhone(ctx context.Context, in *VerifyUserMobilePhoneRequest, opts ...grpc.CallOption) (*v1.Empty, error)
	// Resend a verification code to the mobile phone number listed for the
	// authenticated user.
	// Required permissions:
	// - None (since the subject is always the authenticated user).
	ResendUserMobilePhoneVerification(ctx context.Context, in *v1.Empty, opts ...grpc.CallOption) (*v1.Empty, error)
	// Fetch all groups of the organization identified by the given context ID.
	// Required permissions:
	// - iam.group.list on organization identified by given context ID.
	ListGroups(ctx context.Context, in *v1.ListOptions, opts ...grpc.CallOption) (*GroupList, error)
	// Fetch a group by its id.
	// Required permissions:
	// - iam.group.get on organization that owns the group
	GetGroup(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*Group, error)
	// Create a group
	// Required permissions:
	// - iam.group.create on organization that owns the group
	CreateGroup(ctx context.Context, in *Group, opts ...grpc.CallOption) (*Group, error)
	// Update a group
	// Required permissions:
	// - iam.group.update on organization that owns the group
	UpdateGroup(ctx context.Context, in *Group, opts ...grpc.CallOption) (*Group, error)
	// Delete a group
	// Required permissions:
	// - iam.group.delete on organization that owns the group
	DeleteGroup(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*v1.Empty, error)
	// List of members of the group identified by the given context ID.
	// Required permissions:
	// - iam.group.get on organization that owns the group
	ListGroupMembers(ctx context.Context, in *v1.ListOptions, opts ...grpc.CallOption) (*GroupMemberList, error)
	// Add one or more members to the group identified by given ID.
	// Required permissions:
	// - iam.group.update on organization that owns the group
	AddGroupMembers(ctx context.Context, in *GroupMembersRequest, opts ...grpc.CallOption) (*v1.Empty, error)
	// Remove one or more members from the group identified by given ID.
	// Required permissions:
	// - iam.group.update on organization that owns the group
	DeleteGroupMembers(ctx context.Context, in *GroupMembersRequest, opts ...grpc.CallOption) (*v1.Empty, error)
	// Is the user identified by the given user ID a member of the group identified by the given group ID.
	// Required permissions:
	// - iam.group.get on organization that owns the group, unless the requested user is identical to the authenticated user.
	// Note that if the identified group does not exist, no is returned.
	IsMemberOfGroup(ctx context.Context, in *IsMemberOfGroupRequest, opts ...grpc.CallOption) (*v1.YesOrNo, error)
	// Fetch all roles in the organization identified by the given context ID.
	// Required permissions:
	// - iam.role.list on organization identified by given context ID.
	ListRoles(ctx context.Context, in *v1.ListOptions, opts ...grpc.CallOption) (*RoleList, error)
	// Fetch a role by its id.
	// Required permissions:
	// - iam.role.get on organization that owns the role
	GetRole(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*Role, error)
	// Create a custom role
	// Required permissions:
	// - iam.role.create on organization that owns the role
	CreateRole(ctx context.Context, in *Role, opts ...grpc.CallOption) (*Role, error)
	// Update a custom role
	// Required permissions:
	// - iam.role.update on organization that owns the role
	UpdateRole(ctx context.Context, in *Role, opts ...grpc.CallOption) (*Role, error)
	// Delete a custom role
	// Required permissions:
	// - iam.role.delete on organization that owns the role
	DeleteRole(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*v1.Empty, error)
	// Get the policy for a resource identified by given URL.
	// Required permissions:
	// - iam.policy.get on resource identified by the url
	GetPolicy(ctx context.Context, in *v1.URLOptions, opts ...grpc.CallOption) (*Policy, error)
	// Get the policies based on given filters.
	// Required permissions:
	// - iam.policy.get on resource identified by the url
	GetPolicyByFilter(ctx context.Context, in *GetPolicyByFilterRequest, opts ...grpc.CallOption) (*Policy, error)
	// Add one or more RoleBindings to the policy of a resource identified by given URL.
	// Required permissions:
	// - iam.policy.update on resource identified by the url
	AddRoleBindings(ctx context.Context, in *RoleBindingsRequest, opts ...grpc.CallOption) (*Policy, error)
	// Remove one or more RoleBindings from the policy of a resource identified by given URL.
	// Required permissions:
	// - iam.policy.update on resource identified by the url
	DeleteRoleBindings(ctx context.Context, in *RoleBindingsRequest, opts ...grpc.CallOption) (*Policy, error)
	// Return the list of permissions that are available to the currently authenticated
	// used for actions on the resource identified by the given URL.
	// Required permissions:
	// - None
	GetEffectivePermissions(ctx context.Context, in *v1.URLOptions, opts ...grpc.CallOption) (*PermissionList, error)
	// Return the lists of permissions that are available to the currently authenticated
	// used for actions on the resources identified by the given URLs.
	// This method can replace multiple GetEffectivePermissions calls into a single roundtrip.
	// Required permissions:
	// - None
	GetMultipleEffectivePermissions(ctx context.Context, in *GetMultipleEffectivePermissionsRequest, opts ...grpc.CallOption) (*MultiplePermissionLists, error)
	// Does the authenticated user have all of the requested permissions for the resource
	// identified by the given URL?
	// Required permissions:
	// - None
	HasPermissions(ctx context.Context, in *HasPermissionsRequest, opts ...grpc.CallOption) (*v1.YesOrNo, error)
	// List all known permissions.
	// Required permissions:
	// - None
	ListPermissions(ctx context.Context, in *v1.Empty, opts ...grpc.CallOption) (*PermissionList, error)
	// Fetch all API keys owned by the authenticated caller.
	// Required permissions:
	// - None
	ListAPIKeys(ctx context.Context, in *v1.ListOptions, opts ...grpc.CallOption) (*APIKeyList, error)
	// Fetch an API key by its id.
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	GetAPIKey(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*APIKey, error)
	// Create a new API key.
	// The API key will be owned by the authenticated caller.
	// Required permissions:
	// - None
	CreateAPIKey(ctx context.Context, in *CreateAPIKeyRequest, opts ...grpc.CallOption) (*APIKeySecret, error)
	// Ensure that the expiration date of the API key identified by given ID
	// is either in the past or set to now.
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	RevokeAPIKey(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*v1.Empty, error)
	// Delete the API key identified by given ID
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	DeleteAPIKey(ctx context.Context, in *v1.IDOptions, opts ...grpc.CallOption) (*v1.Empty, error)
	// Authenticate using an API key.
	// If authentication succeeds, this function returns a bearer token.
	// That token must be used to authenticate all other API requests.
	// If the given API key identifier is invalid or expired, or an incorrect secret
	// is given, this function will return an unauthenticated error.
	// Required permissions:
	// - None
	AuthenticateAPIKey(ctx context.Context, in *AuthenticateAPIKeyRequest, opts ...grpc.CallOption) (*AuthenticateAPIKeyResponse, error)
	// Renew a non-expired API key authentication token.
	// This allows to extend the lifetime of a token created by AuthenticateAPIKey.
	// If the given token is invalid or expired, or the underlying API key is expired
	// this function will return an unauthenticated error.
	// Required permissions:
	// - None
	RenewAPIKeyToken(ctx context.Context, in *RenewAPIKeyTokenRequest, opts ...grpc.CallOption) (*RenewAPIKeyTokenResponse, error)
	// Revoke an API key authentication token.
	// This function will return a non-error response, even if the given token
	// is invalid or already expired.
	// Required permissions:
	// - None
	RevokeAPIKeyToken(ctx context.Context, in *RevokeAPIKeyTokenRequest, opts ...grpc.CallOption) (*v1.Empty, error)
}

type IAMServiceServer interface {
	// Get the current API version of this service.
	// Required permissions:
	// - None
	GetAPIVersion(context.Context, *v1.Empty) (*v1.Version, error)
	// Fetch all available information of the currently authenticated user.
	// Required permissions:
	// - None
	GetThisUser(context.Context, *v1.Empty) (*User, error)
	// Fetch all available information of the user identified by the given ID.
	// Required permissions:
	// - resourcemanager.organization.get on one of the organizations that the requested user and authenticated user are both a member of
	GetUser(context.Context, *v1.IDOptions) (*User, error)
	// Update a user
	// Required permissions:
	// - None if the given user is the authenticated user.
	// or
	// - resourcemanager.organization.get on one of the organizations that the requested user and authenticated user are both a member of and
	// - iam.user.update on organization on one of the organizations that the requested user and authenticated user are both a member of
	UpdateUser(context.Context, *User) (*User, error)
	// Verify the mobile phone number of a user, by provided the unique
	// code that was send to the number.
	// If the code is valid an empty result is returned, otherwise an InvalidArgument error is returned.
	// The authenticated user is always the subject of this request.
	// Required permissions:
	// - None (since the subject is always the authenticated user).
	VerifyUserMobilePhone(context.Context, *VerifyUserMobilePhoneRequest) (*v1.Empty, error)
	// Resend a verification code to the mobile phone number listed for the
	// authenticated user.
	// Required permissions:
	// - None (since the subject is always the authenticated user).
	ResendUserMobilePhoneVerification(context.Context, *v1.Empty) (*v1.Empty, error)
	// Fetch all groups of the organization identified by the given context ID.
	// Required permissions:
	// - iam.group.list on organization identified by given context ID.
	ListGroups(context.Context, *v1.ListOptions) (*GroupList, error)
	// Fetch a group by its id.
	// Required permissions:
	// - iam.group.get on organization that owns the group
	GetGroup(context.Context, *v1.IDOptions) (*Group, error)
	// Create a group
	// Required permissions:
	// - iam.group.create on organization that owns the group
	CreateGroup(context.Context, *Group) (*Group, error)
	// Update a group
	// Required permissions:
	// - iam.group.update on organization that owns the group
	UpdateGroup(context.Context, *Group) (*Group, error)
	// Delete a group
	// Required permissions:
	// - iam.group.delete on organization that owns the group
	DeleteGroup(context.Context, *v1.IDOptions) (*v1.Empty, error)
	// List of members of the group identified by the given context ID.
	// Required permissions:
	// - iam.group.get on organization that owns the group
	ListGroupMembers(context.Context, *v1.ListOptions) (*GroupMemberList, error)
	// Add one or more members to the group identified by given ID.
	// Required permissions:
	// - iam.group.update on organization that owns the group
	AddGroupMembers(context.Context, *GroupMembersRequest) (*v1.Empty, error)
	// Remove one or more members from the group identified by given ID.
	// Required permissions:
	// - iam.group.update on organization that owns the group
	DeleteGroupMembers(context.Context, *GroupMembersRequest) (*v1.Empty, error)
	// Is the user identified by the given user ID a member of the group identified by the given group ID.
	// Required permissions:
	// - iam.group.get on organization that owns the group, unless the requested user is identical to the authenticated user.
	// Note that if the identified group does not exist, no is returned.
	IsMemberOfGroup(context.Context, *IsMemberOfGroupRequest) (*v1.YesOrNo, error)
	// Fetch all roles in the organization identified by the given context ID.
	// Required permissions:
	// - iam.role.list on organization identified by given context ID.
	ListRoles(context.Context, *v1.ListOptions) (*RoleList, error)
	// Fetch a role by its id.
	// Required permissions:
	// - iam.role.get on organization that owns the role
	GetRole(context.Context, *v1.IDOptions) (*Role, error)
	// Create a custom role
	// Required permissions:
	// - iam.role.create on organization that owns the role
	CreateRole(context.Context, *Role) (*Role, error)
	// Update a custom role
	// Required permissions:
	// - iam.role.update on organization that owns the role
	UpdateRole(context.Context, *Role) (*Role, error)
	// Delete a custom role
	// Required permissions:
	// - iam.role.delete on organization that owns the role
	DeleteRole(context.Context, *v1.IDOptions) (*v1.Empty, error)
	// Get the policy for a resource identified by given URL.
	// Required permissions:
	// - iam.policy.get on resource identified by the url
	GetPolicy(context.Context, *v1.URLOptions) (*Policy, error)
	// Get the policies based on given filters.
	// Required permissions:
	// - iam.policy.get on resource identified by the url
	GetPolicyByFilter(context.Context, *GetPolicyByFilterRequest) (*Policy, error)
	// Add one or more RoleBindings to the policy of a resource identified by given URL.
	// Required permissions:
	// - iam.policy.update on resource identified by the url
	AddRoleBindings(context.Context, *RoleBindingsRequest) (*Policy, error)
	// Remove one or more RoleBindings from the policy of a resource identified by given URL.
	// Required permissions:
	// - iam.policy.update on resource identified by the url
	DeleteRoleBindings(context.Context, *RoleBindingsRequest) (*Policy, error)
	// Return the list of permissions that are available to the currently authenticated
	// used for actions on the resource identified by the given URL.
	// Required permissions:
	// - None
	GetEffectivePermissions(context.Context, *v1.URLOptions) (*PermissionList, error)
	// Return the lists of permissions that are available to the currently authenticated
	// used for actions on the resources identified by the given URLs.
	// This method can replace multiple GetEffectivePermissions calls into a single roundtrip.
	// Required permissions:
	// - None
	GetMultipleEffectivePermissions(context.Context, *GetMultipleEffectivePermissionsRequest) (*MultiplePermissionLists, error)
	// Does the authenticated user have all of the requested permissions for the resource
	// identified by the given URL?
	// Required permissions:
	// - None
	HasPermissions(context.Context, *HasPermissionsRequest) (*v1.YesOrNo, error)
	// List all known permissions.
	// Required permissions:
	// - None
	ListPermissions(context.Context, *v1.Empty) (*PermissionList, error)
	// Fetch all API keys owned by the authenticated caller.
	// Required permissions:
	// - None
	ListAPIKeys(context.Context, *v1.ListOptions) (*APIKeyList, error)
	// Fetch an API key by its id.
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	GetAPIKey(context.Context, *v1.IDOptions) (*APIKey, error)
	// Create a new API key.
	// The API key will be owned by the authenticated caller.
	// Required permissions:
	// - None
	CreateAPIKey(context.Context, *CreateAPIKeyRequest) (*APIKeySecret, error)
	// Ensure that the expiration date of the API key identified by given ID
	// is either in the past or set to now.
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	RevokeAPIKey(context.Context, *v1.IDOptions) (*v1.Empty, error)
	// Delete the API key identified by given ID
	// The API key must be owned by the authenticated caller.
	// Required permissions:
	// - None
	DeleteAPIKey(context.Context, *v1.IDOptions) (*v1.Empty, error)
	// Authenticate using an API key.
	// If authentication succeeds, this function returns a bearer token.
	// That token must be used to authenticate all other API requests.
	// If the given API key identifier is invalid or expired, or an incorrect secret
	// is given, this function will return an unauthenticated error.
	// Required permissions:
	// - None
	AuthenticateAPIKey(context.Context, *AuthenticateAPIKeyRequest) (*AuthenticateAPIKeyResponse, error)
	// Renew a non-expired API key authentication token.
	// This allows to extend the lifetime of a token created by AuthenticateAPIKey.
	// If the given token is invalid or expired, or the underlying API key is expired
	// this function will return an unauthenticated error.
	// Required permissions:
	// - None
	RenewAPIKeyToken(context.Context, *RenewAPIKeyTokenRequest) (*RenewAPIKeyTokenResponse, error)
	// Revoke an API key authentication token.
	// This function will return a non-error response, even if the given token
	// is invalid or already expired.
	// Required permissions:
	// - None
	RevokeAPIKeyToken(context.Context, *RevokeAPIKeyTokenRequest) (*v1.Empty, error)
}

type IsMemberOfGroupRequest struct {

	// Identifier of the user
	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	// Identifier of the group
	GroupId string `protobuf:"bytes,2,opt,name=group_id,json=groupId,proto3" json:"group_id,omitempty"`
	// contains filtered or unexported fields
}

type MultiplePermissionLists struct {
	Items []*PermissionList `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	// contains filtered or unexported fields
}

type PermissionList struct {

	// The permissions
	Items []string `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	// URL of the resource (filled out when GetMultipleEffectivePermissions was called).
	Url string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
	// contains filtered or unexported fields
}

type Policy struct {

	// URL of the resource to which this policy applies.
	ResourceUrl string `protobuf:"bytes,1,opt,name=resource_url,json=resourceUrl,proto3" json:"resource_url,omitempty"`
	// Role bindings to apply to the resource.
	Bindings []*RoleBinding `protobuf:"bytes,2,rep,name=bindings,proto3" json:"bindings,omitempty"`
	// contains filtered or unexported fields
}

type RenewAPIKeyTokenRequest struct {

	// Bearer token
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// Extended life time of the token.
	// By default, a renewed token will have a default lifetime from the moment
	// of the renew call.
	// If this field is set, then this TTL is used reduce the default TTL
	// of the renewed token. It cannot be used to increase the default
	// lifetime of the renewed token.
	TimeToLive *durationpb.Duration `protobuf:"bytes,2,opt,name=time_to_live,json=timeToLive,proto3" json:"time_to_live,omitempty"`
	// contains filtered or unexported fields
}

type RenewAPIKeyTokenResponse struct {

	// Actual life time of the token.
	TimeToLive *durationpb.Duration `protobuf:"bytes,1,opt,name=time_to_live,json=timeToLive,proto3" json:"time_to_live,omitempty"`
	// contains filtered or unexported fields
}

type RevokeAPIKeyTokenRequest struct {

	// Bearer token
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type Role struct {

	// System identifier of the role.
	// This is a read-only value.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Identifier of the organization that owns this role.
	// This value is undefined for predefined roles.
	OrganizationId string `protobuf:"bytes,2,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
	// Name of the role
	Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
	// Description of the role
	Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
	// Permissions to grant when this role is bound.
	Permissions []string `protobuf:"bytes,5,rep,name=permissions,proto3" json:"permissions,omitempty"`
	// Set if this role is predefined.
	// This is a read-only value.
	IsPredefined bool `protobuf:"varint,6,opt,name=is_predefined,json=isPredefined,proto3" json:"is_predefined,omitempty"`
	// The creation timestamp of the role
	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	// The deletion timestamp of the role
	DeletedAt *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=deleted_at,json=deletedAt,proto3" json:"deleted_at,omitempty"`
	// Set when this organization is deleted.
	// This is a read-only value.
	IsDeleted bool `protobuf:"varint,9,opt,name=is_deleted,json=isDeleted,proto3" json:"is_deleted,omitempty"`
	// URL of this resource
	// This is a read-only value and cannot be initialized.
	Url string `protobuf:"bytes,10,opt,name=url,proto3" json:"url,omitempty"`
	// contains filtered or unexported fields
}

type RoleBinding struct {

	// System identifier of the role-binding.
	// This is a read-only value.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Identifier of the member to bind a role to.
	// Member ID is formatted as:
	// - user:<user_id>
	// - group:<group_id>
	MemberId string `protobuf:"bytes,2,opt,name=member_id,json=memberId,proto3" json:"member_id,omitempty"`
	// Identifier of the Role to grant to member
	RoleId string `protobuf:"bytes,3,opt,name=role_id,json=roleId,proto3" json:"role_id,omitempty"`
	// If set, this this role-binding cannot be deleted
	// This is a read-only value.
	DeleteNotAllowed bool `protobuf:"varint,4,opt,name=delete_not_allowed,json=deleteNotAllowed,proto3" json:"delete_not_allowed,omitempty"`
	// contains filtered or unexported fields
}

type RoleBindingsRequest struct {

	// URL of the resource to add/remove policy binding to/from.
	ResourceUrl string `protobuf:"bytes,1,opt,name=resource_url,json=resourceUrl,proto3" json:"resource_url,omitempty"`
	// Role bindings to add/remove to the policy.
	Bindings []*RoleBinding `protobuf:"bytes,2,rep,name=bindings,proto3" json:"bindings,omitempty"`
	// contains filtered or unexported fields
}

type RoleCallback func(context.Context, *Role) error

type RoleList struct {
	Items []*Role `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedIAMServiceServer struct {
}

type User struct {

	// Identifier of the user.
	// This is a read-only value.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Primary email address of the user.
	// All emails send to this user will use this address.
	// This is a read-only value.
	Email string `protobuf:"bytes,2,opt,name=email,proto3" json:"email,omitempty"`
	// Name of the user.
	// This may be empty if not filled out by the user.
	Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
	// Given name of the user.
	// This may be empty if not filled out by the user.
	GivenName string `protobuf:"bytes,4,opt,name=given_name,json=givenName,proto3" json:"given_name,omitempty"`
	// Family name of the user.
	// This may be empty if not filled out by the user.
	FamilyName string `protobuf:"bytes,5,opt,name=family_name,json=familyName,proto3" json:"family_name,omitempty"`
	// The creation timestamp of the user.
	// This is a read-only value.
	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	// Additional email addresses of the user.
	// This will be filled in when the authentication provided
	// knows multiple email addresses for the user.
	// This is a read-only value.
	AdditionalEmails []string `protobuf:"bytes,7,rep,name=additional_emails,json=additionalEmails,proto3" json:"additional_emails,omitempty"`
	// Mobile phone number of the user.
	// This value must be unique globally.
	//
	// This field will not be filled, unless:
	//   - The currently authenticated user is this user
	//   - The currently authenticated user has `iam.user.get-personal-data` permission
	//     on the organization that user is a member of.
	//
	// This value can only be changed to a non-empty value.
	// If changed, the new number has to be verified again.
	MobilePhone string `protobuf:"bytes,8,opt,name=mobile_phone,json=mobilePhone,proto3" json:"mobile_phone,omitempty"`
	// Set when the mobile phone number has been successfully verified.
	// This is a read-only value.
	MobilePhoneVerified bool `protobuf:"varint,9,opt,name=mobile_phone_verified,json=mobilePhoneVerified,proto3" json:"mobile_phone_verified,omitempty"`
	// Company name of the user
	// This may be empty if not filled out by the user.
	CompanyName string `protobuf:"bytes,10,opt,name=company_name,json=companyName,proto3" json:"company_name,omitempty"`
	// If set, this user is denied access to the dashboard.
	// This is a read-only value.
	DashboardAccessDenied bool `` /* 128-byte string literal not displayed */
	// If set, this field describes the reason why this user is denied access to the dashboard.
	// This is a read-only value.
	DashboardAccessDeniedReason string `` /* 147-byte string literal not displayed */
	// If set, this user is currently being authenticated using an API key (identified by this ID)
	ApikeyId string `protobuf:"bytes,13,opt,name=apikey_id,json=apikeyId,proto3" json:"apikey_id,omitempty"`
	// If set, contains Slack name of this user in the arangodb-community slack.
	SlackName string `protobuf:"bytes,14,opt,name=slack_name,json=slackName,proto3" json:"slack_name,omitempty"`
	// The timestamp of the last login of the user.
	// This is a read-only value.
	LastLoginAt *timestamppb.Timestamp `protobuf:"bytes,15,opt,name=last_login_at,json=lastLoginAt,proto3" json:"last_login_at,omitempty"`
	// If set, contains IP address from which the user last logged in.
	LastIp string `protobuf:"bytes,16,opt,name=last_ip,json=lastIp,proto3" json:"last_ip,omitempty"`
	// Defines if a user's mobile phone number needs verification based on email root domain address.
	MobilePhoneNeedsVerification bool `` /* 151-byte string literal not displayed */
	// If set, this user belongs to an educational institute.
	HasEducationalStatus bool `protobuf:"varint,18,opt,name=has_educational_status,json=hasEducationalStatus,proto3" json:"has_educational_status,omitempty"`
	// Defines the role of user at educational institute.
	// Possible values are student | teacher | other
	EducationalRole string `protobuf:"bytes,19,opt,name=educational_role,json=educationalRole,proto3" json:"educational_role,omitempty"`
	// Defines the user's experience with graph
	Experience string `protobuf:"bytes,20,opt,name=experience,proto3" json:"experience,omitempty"`
	// Defines other DBs that the user has used
	OtherDbs []string `protobuf:"bytes,21,rep,name=other_dbs,json=otherDbs,proto3" json:"other_dbs,omitempty"`
	// Defines if the user has opted out of enhanced troubleshooting
	DisableEnhancedTroubleshooting bool `` /* 155-byte string literal not displayed */
	// contains filtered or unexported fields
}

type VerifyUserMobilePhoneRequest struct {

	// Code that was send to the mobile phone number.
	Code string `protobuf:"bytes,1,opt,name=code,proto3" json:"code,omitempty"`
	// contains filtered or unexported fields
}