feat(iam): update the api

#### iam:v1

The following keys were added:
- schemas.WorkloadIdentityPoolProvider.properties.x509.$ref (Total Keys: 1)
- schemas.X509 (Total Keys: 3)

Author: yoshi-automation

docs/dyn/iam_v1.projects.locations.workloadIdentityPools.providers.html

@@ -140,13 +140,27 @@ <h3>Method Details</h3>
     &quot;allowedAudiences&quot;: [ # Optional. Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ ```
       &quot;A String&quot;,
     ],
-    &quot;issuerUri&quot;: &quot;A String&quot;, # Required. The OIDC issuer URL. Must be an HTTPS endpoint.
+    &quot;issuerUri&quot;: &quot;A String&quot;, # Required. The OIDC issuer URL. Must be an HTTPS endpoint. Used per OpenID Connect Discovery 1.0 spec to locate the provider&#x27;s public keys (via `jwks_uri`) for verifying tokens like the OIDC ID token. These public key types must be &#x27;EC&#x27; or &#x27;RSA&#x27;.
     &quot;jwksJson&quot;: &quot;A String&quot;, # Optional. OIDC JWKs in JSON String format. For details on the definition of a JWK, see https://tools.ietf.org/html/rfc7517. If not set, the `jwks_uri` from the discovery document(fetched from the .well-known path of the `issuer_uri`) will be used. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: { &quot;keys&quot;: [ { &quot;kty&quot;: &quot;RSA/EC&quot;, &quot;alg&quot;: &quot;&quot;, &quot;use&quot;: &quot;sig&quot;, &quot;kid&quot;: &quot;&quot;, &quot;n&quot;: &quot;&quot;, &quot;e&quot;: &quot;&quot;, &quot;x&quot;: &quot;&quot;, &quot;y&quot;: &quot;&quot;, &quot;crv&quot;: &quot;&quot; } ] }
   },
   &quot;saml&quot;: { # Represents an SAML 2.0 identity provider. # An SAML 2.0 identity provider.
     &quot;idpMetadataXml&quot;: &quot;A String&quot;, # Required. SAML identity provider (IdP) configuration metadata XML doc. The XML document must comply with the [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf). The maximum size of an acceptable XML document is 128K characters. The SAML metadata XML document must satisfy the following constraints: * Must contain an IdP Entity ID. * Must contain at least one non-expired signing certificate. * For each signing certificate, the expiration must be: * From no more than 7 days in the future. * To no more than 20 years in the future. * Up to three IdP signing keys are allowed. When updating the provider&#x27;s metadata XML, at least one non-expired signing key must overlap with the existing metadata. This requirement is skipped if there are no non-expired signing keys present in the existing metadata.
   },
   &quot;state&quot;: &quot;A String&quot;, # Output only. The state of the provider.
+  &quot;x509&quot;: { # An X.509-type identity provider represents a CA. It is trusted to assert a client identity if the client has a certificate that chains up to this CA. # An X.509-type identity provider.
+    &quot;trustStore&quot;: { # Trust store that contains trust anchors and optional intermediate CAs used in PKI to build trust chain and verify client&#x27;s identity. # Required. A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported.
+      &quot;intermediateCas&quot;: [ # Optional. Set of intermediate CA certificates used for building the trust chain to trust anchor. IMPORTANT: * Intermediate CAs are only supported when configuring x509 federation.
+        { # Intermediate CA certificates used for building the trust chain to trust anchor
+          &quot;pemCertificate&quot;: &quot;A String&quot;, # PEM certificate of the PKI used for validation. Must only contain one ca certificate.
+        },
+      ],
+      &quot;trustAnchors&quot;: [ # Required. List of Trust Anchors to be used while performing validation against a given TrustStore. The incoming end entity&#x27;s certificate must be chained up to one of the trust anchors here.
+        { # Represents a root of trust.
+          &quot;pemCertificate&quot;: &quot;A String&quot;, # PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).
+        },
+      ],
+    },
+  },
 }
 
   workloadIdentityPoolProviderId: string, Required. The ID for the provider, which becomes the final component of the resource name. This value must be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix `gcp-` is reserved for use by Google, and may not be specified.
@@ -245,13 +259,27 @@ <h3>Method Details</h3>
     &quot;allowedAudiences&quot;: [ # Optional. Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ ```
       &quot;A String&quot;,
     ],
-    &quot;issuerUri&quot;: &quot;A String&quot;, # Required. The OIDC issuer URL. Must be an HTTPS endpoint.
+    &quot;issuerUri&quot;: &quot;A String&quot;, # Required. The OIDC issuer URL. Must be an HTTPS endpoint. Used per OpenID Connect Discovery 1.0 spec to locate the provider&#x27;s public keys (via `jwks_uri`) for verifying tokens like the OIDC ID token. These public key types must be &#x27;EC&#x27; or &#x27;RSA&#x27;.
     &quot;jwksJson&quot;: &quot;A String&quot;, # Optional. OIDC JWKs in JSON String format. For details on the definition of a JWK, see https://tools.ietf.org/html/rfc7517. If not set, the `jwks_uri` from the discovery document(fetched from the .well-known path of the `issuer_uri`) will be used. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: { &quot;keys&quot;: [ { &quot;kty&quot;: &quot;RSA/EC&quot;, &quot;alg&quot;: &quot;&quot;, &quot;use&quot;: &quot;sig&quot;, &quot;kid&quot;: &quot;&quot;, &quot;n&quot;: &quot;&quot;, &quot;e&quot;: &quot;&quot;, &quot;x&quot;: &quot;&quot;, &quot;y&quot;: &quot;&quot;, &quot;crv&quot;: &quot;&quot; } ] }
   },
   &quot;saml&quot;: { # Represents an SAML 2.0 identity provider. # An SAML 2.0 identity provider.
     &quot;idpMetadataXml&quot;: &quot;A String&quot;, # Required. SAML identity provider (IdP) configuration metadata XML doc. The XML document must comply with the [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf). The maximum size of an acceptable XML document is 128K characters. The SAML metadata XML document must satisfy the following constraints: * Must contain an IdP Entity ID. * Must contain at least one non-expired signing certificate. * For each signing certificate, the expiration must be: * From no more than 7 days in the future. * To no more than 20 years in the future. * Up to three IdP signing keys are allowed. When updating the provider&#x27;s metadata XML, at least one non-expired signing key must overlap with the existing metadata. This requirement is skipped if there are no non-expired signing keys present in the existing metadata.
   },
   &quot;state&quot;: &quot;A String&quot;, # Output only. The state of the provider.
+  &quot;x509&quot;: { # An X.509-type identity provider represents a CA. It is trusted to assert a client identity if the client has a certificate that chains up to this CA. # An X.509-type identity provider.
+    &quot;trustStore&quot;: { # Trust store that contains trust anchors and optional intermediate CAs used in PKI to build trust chain and verify client&#x27;s identity. # Required. A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported.
+      &quot;intermediateCas&quot;: [ # Optional. Set of intermediate CA certificates used for building the trust chain to trust anchor. IMPORTANT: * Intermediate CAs are only supported when configuring x509 federation.
+        { # Intermediate CA certificates used for building the trust chain to trust anchor
+          &quot;pemCertificate&quot;: &quot;A String&quot;, # PEM certificate of the PKI used for validation. Must only contain one ca certificate.
+        },
+      ],
+      &quot;trustAnchors&quot;: [ # Required. List of Trust Anchors to be used while performing validation against a given TrustStore. The incoming end entity&#x27;s certificate must be chained up to one of the trust anchors here.
+        { # Represents a root of trust.
+          &quot;pemCertificate&quot;: &quot;A String&quot;, # PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).
+        },
+      ],
+    },
+  },
 }</pre>
 </div>
 
@@ -292,13 +320,27 @@ <h3>Method Details</h3>
         &quot;allowedAudiences&quot;: [ # Optional. Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ ```
           &quot;A String&quot;,
         ],
-        &quot;issuerUri&quot;: &quot;A String&quot;, # Required. The OIDC issuer URL. Must be an HTTPS endpoint.
+        &quot;issuerUri&quot;: &quot;A String&quot;, # Required. The OIDC issuer URL. Must be an HTTPS endpoint. Used per OpenID Connect Discovery 1.0 spec to locate the provider&#x27;s public keys (via `jwks_uri`) for verifying tokens like the OIDC ID token. These public key types must be &#x27;EC&#x27; or &#x27;RSA&#x27;.
         &quot;jwksJson&quot;: &quot;A String&quot;, # Optional. OIDC JWKs in JSON String format. For details on the definition of a JWK, see https://tools.ietf.org/html/rfc7517. If not set, the `jwks_uri` from the discovery document(fetched from the .well-known path of the `issuer_uri`) will be used. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: { &quot;keys&quot;: [ { &quot;kty&quot;: &quot;RSA/EC&quot;, &quot;alg&quot;: &quot;&quot;, &quot;use&quot;: &quot;sig&quot;, &quot;kid&quot;: &quot;&quot;, &quot;n&quot;: &quot;&quot;, &quot;e&quot;: &quot;&quot;, &quot;x&quot;: &quot;&quot;, &quot;y&quot;: &quot;&quot;, &quot;crv&quot;: &quot;&quot; } ] }
       },
       &quot;saml&quot;: { # Represents an SAML 2.0 identity provider. # An SAML 2.0 identity provider.
         &quot;idpMetadataXml&quot;: &quot;A String&quot;, # Required. SAML identity provider (IdP) configuration metadata XML doc. The XML document must comply with the [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf). The maximum size of an acceptable XML document is 128K characters. The SAML metadata XML document must satisfy the following constraints: * Must contain an IdP Entity ID. * Must contain at least one non-expired signing certificate. * For each signing certificate, the expiration must be: * From no more than 7 days in the future. * To no more than 20 years in the future. * Up to three IdP signing keys are allowed. When updating the provider&#x27;s metadata XML, at least one non-expired signing key must overlap with the existing metadata. This requirement is skipped if there are no non-expired signing keys present in the existing metadata.
       },
       &quot;state&quot;: &quot;A String&quot;, # Output only. The state of the provider.
+      &quot;x509&quot;: { # An X.509-type identity provider represents a CA. It is trusted to assert a client identity if the client has a certificate that chains up to this CA. # An X.509-type identity provider.
+        &quot;trustStore&quot;: { # Trust store that contains trust anchors and optional intermediate CAs used in PKI to build trust chain and verify client&#x27;s identity. # Required. A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported.
+          &quot;intermediateCas&quot;: [ # Optional. Set of intermediate CA certificates used for building the trust chain to trust anchor. IMPORTANT: * Intermediate CAs are only supported when configuring x509 federation.
+            { # Intermediate CA certificates used for building the trust chain to trust anchor
+              &quot;pemCertificate&quot;: &quot;A String&quot;, # PEM certificate of the PKI used for validation. Must only contain one ca certificate.
+            },
+          ],
+          &quot;trustAnchors&quot;: [ # Required. List of Trust Anchors to be used while performing validation against a given TrustStore. The incoming end entity&#x27;s certificate must be chained up to one of the trust anchors here.
+            { # Represents a root of trust.
+              &quot;pemCertificate&quot;: &quot;A String&quot;, # PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).
+            },
+          ],
+        },
+      },
     },
   ],
 }</pre>
@@ -344,13 +386,27 @@ <h3>Method Details</h3>
     &quot;allowedAudiences&quot;: [ # Optional. Acceptable values for the `aud` field (audience) in the OIDC token. Token exchange requests are rejected if the token audience does not match one of the configured values. Each audience may be at most 256 characters. A maximum of 10 audiences may be configured. If this list is empty, the OIDC token audience must be equal to the full canonical resource name of the WorkloadIdentityPoolProvider, with or without the HTTPS prefix. For example: ``` //iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations//workloadIdentityPools//providers/ ```
       &quot;A String&quot;,
     ],
-    &quot;issuerUri&quot;: &quot;A String&quot;, # Required. The OIDC issuer URL. Must be an HTTPS endpoint.
+    &quot;issuerUri&quot;: &quot;A String&quot;, # Required. The OIDC issuer URL. Must be an HTTPS endpoint. Used per OpenID Connect Discovery 1.0 spec to locate the provider&#x27;s public keys (via `jwks_uri`) for verifying tokens like the OIDC ID token. These public key types must be &#x27;EC&#x27; or &#x27;RSA&#x27;.
     &quot;jwksJson&quot;: &quot;A String&quot;, # Optional. OIDC JWKs in JSON String format. For details on the definition of a JWK, see https://tools.ietf.org/html/rfc7517. If not set, the `jwks_uri` from the discovery document(fetched from the .well-known path of the `issuer_uri`) will be used. Currently, RSA and EC asymmetric keys are supported. The JWK must use following format and include only the following fields: { &quot;keys&quot;: [ { &quot;kty&quot;: &quot;RSA/EC&quot;, &quot;alg&quot;: &quot;&quot;, &quot;use&quot;: &quot;sig&quot;, &quot;kid&quot;: &quot;&quot;, &quot;n&quot;: &quot;&quot;, &quot;e&quot;: &quot;&quot;, &quot;x&quot;: &quot;&quot;, &quot;y&quot;: &quot;&quot;, &quot;crv&quot;: &quot;&quot; } ] }
   },
   &quot;saml&quot;: { # Represents an SAML 2.0 identity provider. # An SAML 2.0 identity provider.
     &quot;idpMetadataXml&quot;: &quot;A String&quot;, # Required. SAML identity provider (IdP) configuration metadata XML doc. The XML document must comply with the [SAML 2.0 specification](https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf). The maximum size of an acceptable XML document is 128K characters. The SAML metadata XML document must satisfy the following constraints: * Must contain an IdP Entity ID. * Must contain at least one non-expired signing certificate. * For each signing certificate, the expiration must be: * From no more than 7 days in the future. * To no more than 20 years in the future. * Up to three IdP signing keys are allowed. When updating the provider&#x27;s metadata XML, at least one non-expired signing key must overlap with the existing metadata. This requirement is skipped if there are no non-expired signing keys present in the existing metadata.
   },
   &quot;state&quot;: &quot;A String&quot;, # Output only. The state of the provider.
+  &quot;x509&quot;: { # An X.509-type identity provider represents a CA. It is trusted to assert a client identity if the client has a certificate that chains up to this CA. # An X.509-type identity provider.
+    &quot;trustStore&quot;: { # Trust store that contains trust anchors and optional intermediate CAs used in PKI to build trust chain and verify client&#x27;s identity. # Required. A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported.
+      &quot;intermediateCas&quot;: [ # Optional. Set of intermediate CA certificates used for building the trust chain to trust anchor. IMPORTANT: * Intermediate CAs are only supported when configuring x509 federation.
+        { # Intermediate CA certificates used for building the trust chain to trust anchor
+          &quot;pemCertificate&quot;: &quot;A String&quot;, # PEM certificate of the PKI used for validation. Must only contain one ca certificate.
+        },
+      ],
+      &quot;trustAnchors&quot;: [ # Required. List of Trust Anchors to be used while performing validation against a given TrustStore. The incoming end entity&#x27;s certificate must be chained up to one of the trust anchors here.
+        { # Represents a root of trust.
+          &quot;pemCertificate&quot;: &quot;A String&quot;, # PEM certificate of the PKI used for validation. Must only contain one ca certificate(either root or intermediate cert).
+        },
+      ],
+    },
+  },
 }
 
   updateMask: string, Required. The list of fields to update.

googleapiclient/discovery_cache/documents/iam.v1.json

@@ -3773,7 +3773,7 @@
 }
 }
 },
-"revision": "20250320",
+"revision": "20250411",
 "rootUrl": "https://iam.googleapis.com/",
 "schemas": {
 "AccessRestrictions": {
@@ -4163,8 +4163,8 @@
 ],
 "enumDescriptions": [
 "No AttributesType specified.",
-"Used to get the user's group claims from the Microsoft Entra ID identity provider using configuration provided in ExtraAttributesOAuth2Client and `mail` property of the `microsoft.graph.group` object is used for claim mapping. See https://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties for more details on `microsoft.graph.group` properties. The attributes obtained from idntity provider are mapped to `assertion.groups`.",
-"Used to get the user's group claims from the Microsoft Entra ID identity provider using configuration provided in ExtraAttributesOAuth2Client and `id` property of the `microsoft.graph.group` object is used for claim mapping. See https://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties for more details on `microsoft.graph.group` properties. The group IDs obtained from Microsoft Entra ID are present in `assertion. groups` for OIDC providers and `assertion.attributes.groups` for SAML providers for attribute mapping."
+"Used to get the user's group claims from the Microsoft Entra ID identity provider using the configuration provided in ExtraAttributesOAuth2Client. The `mail` property of the `microsoft.graph.group` object is used for claim mapping. See https://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties for more details on `microsoft.graph.group` properties. The group mail addresses of the user's groups that are returned from Microsoft Entra ID can be mapped by using the following attributes: * OIDC: `assertion.groups` * SAML: `assertion.attributes.groups`",
+"Used to get the user's group claims from the Microsoft Entra ID identity provider using the configuration provided in ExtraAttributesOAuth2Client. The `id` property of the `microsoft.graph.group` object is used for claim mapping. See https://learn.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0#properties for more details on `microsoft.graph.group` properties. The group IDs of the user's groups that are returned from Microsoft Entra ID can be mapped by using the following attributes: * OIDC: `assertion.groups` * SAML: `assertion.attributes.groups`"
 ],
 "type": "string"
 },
@@ -4886,7 +4886,7 @@
 "type": "array"
 },
 "issuerUri": {
-"description": "Required. The OIDC issuer URL. Must be an HTTPS endpoint.",
+"description": "Required. The OIDC issuer URL. Must be an HTTPS endpoint. Used per OpenID Connect Discovery 1.0 spec to locate the provider's public keys (via `jwks_uri`) for verifying tokens like the OIDC ID token. These public key types must be 'EC' or 'RSA'.",
 "type": "string"
 },
 "jwksJson": {
@@ -6197,6 +6197,10 @@ false
 ],
 "readOnly": true,
 "type": "string"
+},
+"x509": {
+"$ref": "X509",
+"description": "An X.509-type identity provider."
 }
 },
 "type": "object"
@@ -6249,6 +6253,17 @@ false
 }
 },
 "type": "object"
+},
+"X509": {
+"description": "An X.509-type identity provider represents a CA. It is trusted to assert a client identity if the client has a certificate that chains up to this CA.",
+"id": "X509",
+"properties": {
+"trustStore": {
+"$ref": "TrustStore",
+"description": "Required. A Trust store, use this trust store as a wrapper to config the trust anchor and optional intermediate cas to help build the trust chain for the incoming end entity certificate. Follow the x509 guidelines to define those PEM encoded certs. Only 1 trust store is currently supported."
+}
+},
+"type": "object"
 }
 },
 "servicePath": "",