Google Workspace Policies API

openapi: 3.2.0
info:
  title: Cloud Identity Policies API
  version: v1
  description: Generated from Google's published Discovery document for Cloud Identity API (cloudidentity v1, revision 20261108). 5 operation(s).
  contact:
    name: Google
    url: https://developers.google.com/
  termsOfService: https://developers.google.com/terms
servers:
- url: https://cloudidentity.googleapis.com
tags:
- name: Policies
paths:
  /v1/policies/{policiesId}:
    get:
      operationId: cloudidentity.policies.get
      summary: Get policies
      description: Get a policy.
      parameters:
      - name: policiesId
        in: path
        required: true
        description: Resource name segment (policiesId).
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/cloud-identity.policies
        - https://www.googleapis.com/auth/cloud-identity.policies.readonly
      - apiKey: []
      tags:
      - Policies
    delete:
      operationId: cloudidentity.policies.delete
      summary: Delete policies
      description: Delete a policy.
      parameters:
      - name: policiesId
        in: path
        required: true
        description: Resource name segment (policiesId).
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Operation'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/cloud-identity.policies
      - apiKey: []
      tags:
      - Policies
    patch:
      operationId: cloudidentity.policies.patch
      summary: Patch policies
      description: Update a policy.
      parameters:
      - name: policiesId
        in: path
        required: true
        description: Resource name segment (policiesId).
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Policy'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Operation'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/cloud-identity.policies
      - apiKey: []
      tags:
      - Policies
  /v1/policies:
    get:
      operationId: cloudidentity.policies.list
      summary: List policies
      description: List policies.
      parameters:
      - name: filter
        in: query
        required: false
        description: 'Optional. A CEL expression for filtering the results. Policies can be filtered using the expression in the following ways: - Filter by application: `setting.type.matches(''^settings/gmail\\..*$'')` - Filter by setting type: `setting.type.matches(''^.*\\.service_status$'')` - Filter by customer: `customer == "customers/{customer}"` Where `customer` is the `id` from the [Admin SDK `Customer` resource](https://developers.google.com/admin-sdk/directory/reference/rest/v1/customers). You may use `customers/my_customer` to specify your own organization. When no `customer` is mentioned it will be default to `customers/my_customer`. You may only filter on policies for a single customer at a time. The above clauses can be combined together in a single filter expression with the `&&` and `||` operators, like in the following example: `customer == "customers/my_customer" && ( setting.type.matches(''^settings/gmail\\..*$'') || setting.type.matches(''^.*\\.service_status$'') )`.'
        schema:
          type: string
      - name: pageSize
        in: query
        required: false
        description: Optional. The maximum number of results to return. The service can return fewer than this number. If omitted or set to `0`, the default is `50` results per page. The maximum allowed value is `100`. `page_size` values greater than `100` default to `100`.
        schema:
          format: int32
          type: integer
      - name: pageToken
        in: query
        required: false
        description: Optional. The pagination token received from a prior call to PoliciesService.ListPolicies to retrieve the next page of results. When paginating, all other parameters provided to `ListPoliciesRequest` must match the call that provided the page token.
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPoliciesResponse'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/cloud-identity.policies
        - https://www.googleapis.com/auth/cloud-identity.policies.readonly
      - apiKey: []
      tags:
      - Policies
    post:
      operationId: cloudidentity.policies.create
      summary: Create policies
      description: Create a policy.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Policy'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Operation'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/cloud-identity.policies
      - apiKey: []
      tags:
      - Policies
components:
  schemas:
    GoogleRpcError:
      type: object
      description: The error envelope every Google API returns.
      properties:
        error:
          type: object
          properties:
            code:
              type: integer
            message:
              type: string
            status:
              type: string
            details:
              type: array
              items:
                type: object
    PolicyQuery:
      description: PolicyQuery
      type: object
      properties:
        query:
          description: 'Immutable. The CEL query that defines which entities the Policy applies to (ex. a User entity). For details about CEL see https://opensource.google.com/projects/cel. The OrgUnits the Policy applies to are represented by a clause like so: entity.org_units.exists(org_unit, org_unit.org_unit_id == orgUnitId(''{orgUnitId}'')) The Group the Policy applies to are represented by a clause like so: entity.groups.exists(group, group.group_id == groupId(''{groupId}'')) The Licenses the Policy applies to are represented by a clause like so: entity.licenses.exists(license, license in [''/product/{productId}/sku/{skuId}'']) **Note:** The licenses clause is not supported in mutate endpoints. The above clauses can be present in any combination, and used in conjunction with the &&, || and ! operators. The org_unit and group fields below are helper fields that contain the corresponding value(s) as the query to make the query easier to use.'
          type: string
        group:
          type: string
          description: Immutable. The group that the query applies to. This field is only set if there is a single value for group that satisfies all clauses of the query. If no group applies, this will be the empty string.
        orgUnit:
          type: string
          description: Required. Immutable. Non-empty default. The OrgUnit the query applies to. This field is only set if there is a single value for org_unit that satisfies all clauses of the query.
        sortOrder:
          readOnly: true
          description: Output only. The decimal sort order of this PolicyQuery. The value is relative to all other policies with the same setting type for the customer. (There are no duplicates within this set).
          type: number
          format: double
    Status:
      properties:
        message:
          description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
          type: string
        details:
          description: A list of messages that carry the error details. There is a common set of message types for APIs to use.
          type: array
          items:
            type: object
            additionalProperties:
              description: Properties of the object. Contains field @type with type URL.
        code:
          description: The status code, which should be an enum value of google.rpc.Code.
          format: int32
          type: integer
      description: 'The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).'
      type: object
    ListPoliciesResponse:
      type: object
      properties:
        policies:
          type: array
          items:
            $ref: '#/components/schemas/Policy'
          description: The results
        nextPageToken:
          description: The pagination token to retrieve the next page of results. If this field is empty, there are no subsequent pages.
          type: string
      description: The response message for PoliciesService.ListPolicies.
    Policy:
      type: object
      description: A Policy resource binds an instance of a single Setting with the scope of a PolicyQuery. The Setting instance will be applied to all entities that satisfy the query.
      properties:
        name:
          type: string
          readOnly: true
          description: 'Output only. Identifier. The [resource name](https://cloud.google.com/apis/design/resource_names) of the Policy. Format: policies/{policy}.'
        customer:
          description: Immutable. Customer that the Policy belongs to. The value is in the format 'customers/{customerId}'. The `customerId` must begin with "C" To find your customer ID in Admin Console see https://support.google.com/a/answer/10070793.
          type: string
        setting:
          $ref: '#/components/schemas/Setting'
          description: Required. The Setting configured by this Policy.
        type:
          type: string
          description: Output only. The type of the policy.
          readOnly: true
          enum:
          - POLICY_TYPE_UNSPECIFIED
          - SYSTEM
          - ADMIN
        policyQuery:
          $ref: '#/components/schemas/PolicyQuery'
          description: Required. The PolicyQuery the Setting applies to.
    Setting:
      type: object
      properties:
        value:
          additionalProperties:
            description: Properties of the object.
          type: object
          description: Required. The value of the Setting.
        type:
          description: Required. Immutable. The type of the Setting.
          type: string
      description: Setting
    Operation:
      properties:
        metadata:
          description: Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
          additionalProperties:
            description: Properties of the object. Contains field @type with type URL.
          type: object
        error:
          $ref: '#/components/schemas/Status'
          description: The error result of the operation in case of failure or cancellation.
        name:
          description: The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
          type: string
        done:
          description: If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
          type: boolean
        response:
          additionalProperties:
            description: Properties of the object. Contains field @type with type URL.
          type: object
          description: The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
      description: This resource represents a long-running operation that is the result of a network API call.
      type: object
  securitySchemes:
    apiKey:
      type: apiKey
      in: query
      name: key
      description: API key; accepted by methods that do not need user data.
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://accounts.google.com/o/oauth2/auth
          tokenUrl: https://oauth2.googleapis.com/token
          scopes:
            https://www.googleapis.com/auth/cloud-identity.policies: See and edit policies in your Cloud Identity Organization.
            https://www.googleapis.com/auth/cloud-identity.inboundsso: See and edit all of the Inbound SSO profiles and their assignments to any Org Units or Google Groups in your Cloud Identity Organization.
            https://www.googleapis.com/auth/cloud-identity.devices.readonly: 'Private Service: https://www.googleapis.com/auth/cloud-identity.devices.readonly'
            https://www.googleapis.com/auth/cloud-identity.groups.readonly: See any Cloud Identity Groups that you can access, including group members and their emails
            https://www.googleapis.com/auth/cloud-identity.devices: 'Private Service: https://www.googleapis.com/auth/cloud-identity.devices'
            https://www.googleapis.com/auth/cloud-platform: See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account.
            https://www.googleapis.com/auth/cloud-identity.allowlisteddomains: See and edit allowlisted domains in your Cloud Identity Organization
            https://www.googleapis.com/auth/cloud-identity.allowlisteddomains.readonly: See allowlisted domains in your Cloud Identity Organization
            https://www.googleapis.com/auth/cloud-identity.policies.readonly: See policies in your Cloud Identity Organization.
            https://www.googleapis.com/auth/cloud-identity.devices.lookup: See your device details
            https://www.googleapis.com/auth/cloud-identity.inboundsso.readonly: See all of the Inbound SSO profiles and their assignments to any Org Units or Google Groups in your Cloud Identity Organization.
            https://www.googleapis.com/auth/cloud-identity.groups: See, change, create, and delete any of the Cloud Identity Groups that you can access, including the members of each group
externalDocs:
  url: https://cloud.google.com/identity/
x-provenance:
  method: harvested
  publisher: Google
  source: https://cloudidentity.googleapis.com/$discovery/rest?version=v1
  note: converted by discovery-to-openapi.py from Google's Discovery document (revision 20261108)