Close httplib2 connections.
delete(customer, roleAssignmentId, x__xgafv=None)
Deletes a role assignment.
get(customer, roleAssignmentId, x__xgafv=None)
Retrieves a role assignment.
insert(customer, body=None, x__xgafv=None)
Creates a role assignment.
Retrieves a paginated list of all roleAssignments.
Retrieves the next page of results.
close()
Close httplib2 connections.
delete(customer, roleAssignmentId, x__xgafv=None)
Deletes a role assignment.
Args:
customer: string, Immutable ID of the Google Workspace account. (required)
roleAssignmentId: string, Immutable ID of the role assignment. (required)
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
get(customer, roleAssignmentId, x__xgafv=None)
Retrieves a role assignment.
Args:
customer: string, The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`. The `customerId` is also returned as part of the [Users](/admin-sdk/directory/v1/reference/users) resource. You must provide either the `customer` or the `domain` parameter. (required)
roleAssignmentId: string, Immutable ID of the role assignment. (required)
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
Returns:
An object of the form:
{ # Defines an assignment of a role.
"assignedTo": "A String", # The unique ID of the entity this role is assigned to—either the `user_id` of a user, the `group_id` of a group, or the `uniqueId` of a service account as defined in [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts).
"assigneeType": "A String", # Output only. The type of the assignee (`USER` or `GROUP`).
"condition": "A String", # Optional. The condition associated with this role assignment. Note: Feature is available to Enterprise Standard, Enterprise Plus, Google Workspace for Education Plus and Cloud Identity Premium customers. A `RoleAssignment` with the `condition` field set will only take effect when the resource being accessed meets the condition. If `condition` is empty, the role (`role_id`) is applied to the actor (`assigned_to`) at the scope (`scope_type`) unconditionally. Currently, the following conditions are supported: - To make the `RoleAssignment` only applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` - To make the `RoleAssignment` not applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` Currently, the condition strings have to be verbatim and they only work with the following [pre-built administrator roles](https://support.google.com/a/answer/2405986): - Groups Editor - Groups Reader The condition follows [Cloud IAM condition syntax](https://cloud.google.com/iam/docs/conditions-overview). Additional conditions related to Locked Groups are available under Open Beta. - To make the `RoleAssignment` not applicable to [Locked Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.locked']) && resource.type == 'cloudidentity.googleapis.com/Group'` This condition can also be used in conjunction with a Security-related condition.
"etag": "A String", # ETag of the resource.
"kind": "admin#directory#roleAssignment", # The type of the API resource. This is always `admin#directory#roleAssignment`.
"orgUnitId": "A String", # If the role is restricted to an organization unit, this contains the ID for the organization unit the exercise of this role is restricted to.
"roleAssignmentId": "A String", # ID of this roleAssignment.
"roleId": "A String", # The ID of the role that is assigned.
"scopeType": "A String", # The scope in which this role is assigned.
}
insert(customer, body=None, x__xgafv=None)
Creates a role assignment.
Args:
customer: string, Immutable ID of the Google Workspace account. (required)
body: object, The request body.
The object takes the form of:
{ # Defines an assignment of a role.
"assignedTo": "A String", # The unique ID of the entity this role is assigned to—either the `user_id` of a user, the `group_id` of a group, or the `uniqueId` of a service account as defined in [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts).
"assigneeType": "A String", # Output only. The type of the assignee (`USER` or `GROUP`).
"condition": "A String", # Optional. The condition associated with this role assignment. Note: Feature is available to Enterprise Standard, Enterprise Plus, Google Workspace for Education Plus and Cloud Identity Premium customers. A `RoleAssignment` with the `condition` field set will only take effect when the resource being accessed meets the condition. If `condition` is empty, the role (`role_id`) is applied to the actor (`assigned_to`) at the scope (`scope_type`) unconditionally. Currently, the following conditions are supported: - To make the `RoleAssignment` only applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` - To make the `RoleAssignment` not applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` Currently, the condition strings have to be verbatim and they only work with the following [pre-built administrator roles](https://support.google.com/a/answer/2405986): - Groups Editor - Groups Reader The condition follows [Cloud IAM condition syntax](https://cloud.google.com/iam/docs/conditions-overview). Additional conditions related to Locked Groups are available under Open Beta. - To make the `RoleAssignment` not applicable to [Locked Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.locked']) && resource.type == 'cloudidentity.googleapis.com/Group'` This condition can also be used in conjunction with a Security-related condition.
"etag": "A String", # ETag of the resource.
"kind": "admin#directory#roleAssignment", # The type of the API resource. This is always `admin#directory#roleAssignment`.
"orgUnitId": "A String", # If the role is restricted to an organization unit, this contains the ID for the organization unit the exercise of this role is restricted to.
"roleAssignmentId": "A String", # ID of this roleAssignment.
"roleId": "A String", # The ID of the role that is assigned.
"scopeType": "A String", # The scope in which this role is assigned.
}
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
Returns:
An object of the form:
{ # Defines an assignment of a role.
"assignedTo": "A String", # The unique ID of the entity this role is assigned to—either the `user_id` of a user, the `group_id` of a group, or the `uniqueId` of a service account as defined in [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts).
"assigneeType": "A String", # Output only. The type of the assignee (`USER` or `GROUP`).
"condition": "A String", # Optional. The condition associated with this role assignment. Note: Feature is available to Enterprise Standard, Enterprise Plus, Google Workspace for Education Plus and Cloud Identity Premium customers. A `RoleAssignment` with the `condition` field set will only take effect when the resource being accessed meets the condition. If `condition` is empty, the role (`role_id`) is applied to the actor (`assigned_to`) at the scope (`scope_type`) unconditionally. Currently, the following conditions are supported: - To make the `RoleAssignment` only applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` - To make the `RoleAssignment` not applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` Currently, the condition strings have to be verbatim and they only work with the following [pre-built administrator roles](https://support.google.com/a/answer/2405986): - Groups Editor - Groups Reader The condition follows [Cloud IAM condition syntax](https://cloud.google.com/iam/docs/conditions-overview). Additional conditions related to Locked Groups are available under Open Beta. - To make the `RoleAssignment` not applicable to [Locked Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.locked']) && resource.type == 'cloudidentity.googleapis.com/Group'` This condition can also be used in conjunction with a Security-related condition.
"etag": "A String", # ETag of the resource.
"kind": "admin#directory#roleAssignment", # The type of the API resource. This is always `admin#directory#roleAssignment`.
"orgUnitId": "A String", # If the role is restricted to an organization unit, this contains the ID for the organization unit the exercise of this role is restricted to.
"roleAssignmentId": "A String", # ID of this roleAssignment.
"roleId": "A String", # The ID of the role that is assigned.
"scopeType": "A String", # The scope in which this role is assigned.
}
list(customer, includeIndirectRoleAssignments=None, maxResults=None, pageToken=None, roleId=None, userKey=None, x__xgafv=None)
Retrieves a paginated list of all roleAssignments.
Args:
customer: string, The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`. The `customerId` is also returned as part of the [Users](/admin-sdk/directory/v1/reference/users) resource. You must provide either the `customer` or the `domain` parameter. (required)
includeIndirectRoleAssignments: boolean, When set to `true`, fetches indirect role assignments (i.e. role assignment via a group) as well as direct ones. Defaults to `false`. You must specify `user_key` or the indirect role assignments will not be included.
maxResults: integer, Maximum number of results to return.
pageToken: string, Token to specify the next page in the list.
roleId: string, Immutable ID of a role. If included in the request, returns only role assignments containing this role ID.
userKey: string, The primary email address, alias email address, or unique user or group ID. If included in the request, returns role assignments only for this user or group.
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
Returns:
An object of the form:
{
"etag": "A String", # ETag of the resource.
"items": [ # A list of RoleAssignment resources.
{ # Defines an assignment of a role.
"assignedTo": "A String", # The unique ID of the entity this role is assigned to—either the `user_id` of a user, the `group_id` of a group, or the `uniqueId` of a service account as defined in [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts).
"assigneeType": "A String", # Output only. The type of the assignee (`USER` or `GROUP`).
"condition": "A String", # Optional. The condition associated with this role assignment. Note: Feature is available to Enterprise Standard, Enterprise Plus, Google Workspace for Education Plus and Cloud Identity Premium customers. A `RoleAssignment` with the `condition` field set will only take effect when the resource being accessed meets the condition. If `condition` is empty, the role (`role_id`) is applied to the actor (`assigned_to`) at the scope (`scope_type`) unconditionally. Currently, the following conditions are supported: - To make the `RoleAssignment` only applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` - To make the `RoleAssignment` not applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` Currently, the condition strings have to be verbatim and they only work with the following [pre-built administrator roles](https://support.google.com/a/answer/2405986): - Groups Editor - Groups Reader The condition follows [Cloud IAM condition syntax](https://cloud.google.com/iam/docs/conditions-overview). Additional conditions related to Locked Groups are available under Open Beta. - To make the `RoleAssignment` not applicable to [Locked Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.locked']) && resource.type == 'cloudidentity.googleapis.com/Group'` This condition can also be used in conjunction with a Security-related condition.
"etag": "A String", # ETag of the resource.
"kind": "admin#directory#roleAssignment", # The type of the API resource. This is always `admin#directory#roleAssignment`.
"orgUnitId": "A String", # If the role is restricted to an organization unit, this contains the ID for the organization unit the exercise of this role is restricted to.
"roleAssignmentId": "A String", # ID of this roleAssignment.
"roleId": "A String", # The ID of the role that is assigned.
"scopeType": "A String", # The scope in which this role is assigned.
},
],
"kind": "admin#directory#roleAssignments", # The type of the API resource. This is always `admin#directory#roleAssignments`.
"nextPageToken": "A String",
}
list_next()
Retrieves the next page of results.
Args:
previous_request: The request for the previous page. (required)
previous_response: The response from the request for the previous page. (required)
Returns:
A request object that you can call 'execute()' on to request the next
page. Returns None if there are no more items in the collection.