feat(iam): update the api

#### iam:v1

The following keys were deleted:
- schemas.WorkloadIdentityPool.properties.identityMode.type (Total Keys: 1)

The following keys were added:
- schemas.Permission.properties.onlyInPredefinedRoles.deprecated (Total Keys: 1)
- schemas.SignBlobRequest.properties.bytesToSign.deprecated (Total Keys: 1)
- schemas.SignBlobResponse.properties.keyId.deprecated (Total Keys: 1)
- schemas.SignBlobResponse.properties.signature.deprecated (Total Keys: 1)
- schemas.SignJwtRequest.properties.payload.deprecated (Total Keys: 1)
- schemas.SignJwtResponse.properties.keyId.deprecated (Total Keys: 1)
- schemas.SignJwtResponse.properties.signedJwt.deprecated (Total Keys: 1)
- schemas.WorkforcePool.properties.expireTime (Total Keys: 3)
- schemas.WorkforcePoolProvider.properties.expireTime (Total Keys: 3)
- schemas.WorkloadIdentityPool.properties.expireTime (Total Keys: 3)
- schemas.WorkloadIdentityPoolProvider.properties.expireTime (Total Keys: 3)

Author: yoshi-automation

docs/dyn/iam_v1.locations.workforcePools.html

@@ -141,6 +141,7 @@ <h3>Method Details</h3>
   &quot;description&quot;: &quot;A String&quot;, # A user-specified description of the pool. Cannot exceed 256 characters.
   &quot;disabled&quot;: True or False, # Disables the workforce pool. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
   &quot;displayName&quot;: &quot;A String&quot;, # A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters.
+  &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workforce pool will be permanently purged and cannot be recovered.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the pool. Format: `locations/{location}/workforcePools/{workforce_pool_id}`
   &quot;parent&quot;: &quot;A String&quot;, # Immutable. The resource name of the parent. Format: `organizations/{org-id}`.
   &quot;sessionDuration&quot;: &quot;A String&quot;, # Duration that the Google Cloud access tokens, console sign-in sessions, and `gcloud` sign-in sessions from this pool are valid. Must be greater than 15 minutes (900s) and less than 12 hours (43200s). If `session_duration` is not configured, minted credentials have a default duration of one hour (3600s). For SAML providers, the lifetime of the token is the minimum of the `session_duration` and the `SessionNotOnOrAfter` claim in the SAML assertion.
@@ -230,6 +231,7 @@ <h3>Method Details</h3>
   &quot;description&quot;: &quot;A String&quot;, # A user-specified description of the pool. Cannot exceed 256 characters.
   &quot;disabled&quot;: True or False, # Disables the workforce pool. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
   &quot;displayName&quot;: &quot;A String&quot;, # A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters.
+  &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workforce pool will be permanently purged and cannot be recovered.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the pool. Format: `locations/{location}/workforcePools/{workforce_pool_id}`
   &quot;parent&quot;: &quot;A String&quot;, # Immutable. The resource name of the parent. Format: `organizations/{org-id}`.
   &quot;sessionDuration&quot;: &quot;A String&quot;, # Duration that the Google Cloud access tokens, console sign-in sessions, and `gcloud` sign-in sessions from this pool are valid. Must be greater than 15 minutes (900s) and less than 12 hours (43200s). If `session_duration` is not configured, minted credentials have a default duration of one hour (3600s). For SAML providers, the lifetime of the token is the minimum of the `session_duration` and the `SessionNotOnOrAfter` claim in the SAML assertion.
@@ -318,6 +320,7 @@ <h3>Method Details</h3>
       &quot;description&quot;: &quot;A String&quot;, # A user-specified description of the pool. Cannot exceed 256 characters.
       &quot;disabled&quot;: True or False, # Disables the workforce pool. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
       &quot;displayName&quot;: &quot;A String&quot;, # A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters.
+      &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workforce pool will be permanently purged and cannot be recovered.
       &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the pool. Format: `locations/{location}/workforcePools/{workforce_pool_id}`
       &quot;parent&quot;: &quot;A String&quot;, # Immutable. The resource name of the parent. Format: `organizations/{org-id}`.
       &quot;sessionDuration&quot;: &quot;A String&quot;, # Duration that the Google Cloud access tokens, console sign-in sessions, and `gcloud` sign-in sessions from this pool are valid. Must be greater than 15 minutes (900s) and less than 12 hours (43200s). If `session_duration` is not configured, minted credentials have a default duration of one hour (3600s). For SAML providers, the lifetime of the token is the minimum of the `session_duration` and the `SessionNotOnOrAfter` claim in the SAML assertion.
@@ -354,6 +357,7 @@ <h3>Method Details</h3>
   &quot;description&quot;: &quot;A String&quot;, # A user-specified description of the pool. Cannot exceed 256 characters.
   &quot;disabled&quot;: True or False, # Disables the workforce pool. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
   &quot;displayName&quot;: &quot;A String&quot;, # A user-specified display name of the pool in Google Cloud Console. Cannot exceed 32 characters.
+  &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workforce pool will be permanently purged and cannot be recovered.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the pool. Format: `locations/{location}/workforcePools/{workforce_pool_id}`
   &quot;parent&quot;: &quot;A String&quot;, # Immutable. The resource name of the parent. Format: `organizations/{org-id}`.
   &quot;sessionDuration&quot;: &quot;A String&quot;, # Duration that the Google Cloud access tokens, console sign-in sessions, and `gcloud` sign-in sessions from this pool are valid. Must be greater than 15 minutes (900s) and less than 12 hours (43200s). If `session_duration` is not configured, minted credentials have a default duration of one hour (3600s). For SAML providers, the lifetime of the token is the minimum of the `session_duration` and the `SessionNotOnOrAfter` claim in the SAML assertion.

docs/dyn/iam_v1.locations.workforcePools.providers.html

@@ -131,6 +131,7 @@ <h3>Method Details</h3>
   &quot;description&quot;: &quot;A String&quot;, # A user-specified description of the provider. Cannot exceed 256 characters.
   &quot;disabled&quot;: True or False, # Disables the workforce pool provider. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.
   &quot;displayName&quot;: &quot;A String&quot;, # A user-specified display name for the provider. Cannot exceed 32 characters.
+  &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workload pool provider will be permanently purged and cannot be recovered.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the provider. Format: `locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}`
   &quot;oidc&quot;: { # Represents an OpenId Connect 1.0 identity provider. # An OpenId Connect 1.0 identity provider configuration.
     &quot;clientId&quot;: &quot;A String&quot;, # Required. The client ID. Must match the audience claim of the JWT issued by the identity provider.
@@ -146,7 +147,7 @@ <h3>Method Details</h3>
         &quot;A String&quot;,
       ],
       &quot;assertionClaimsBehavior&quot;: &quot;A String&quot;, # Required. The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition.
-      &quot;responseType&quot;: &quot;A String&quot;, # Required. The Response Type to request for in the OIDC Authorization Request for web sign-in.
+      &quot;responseType&quot;: &quot;A String&quot;, # Required. The Response Type to request for in the OIDC Authorization Request for web sign-in. The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons.
     },
   },
   &quot;saml&quot;: { # Represents a SAML identity provider. # A SAML identity provider configuration.
@@ -242,6 +243,7 @@ <h3>Method Details</h3>
   &quot;description&quot;: &quot;A String&quot;, # A user-specified description of the provider. Cannot exceed 256 characters.
   &quot;disabled&quot;: True or False, # Disables the workforce pool provider. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.
   &quot;displayName&quot;: &quot;A String&quot;, # A user-specified display name for the provider. Cannot exceed 32 characters.
+  &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workload pool provider will be permanently purged and cannot be recovered.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the provider. Format: `locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}`
   &quot;oidc&quot;: { # Represents an OpenId Connect 1.0 identity provider. # An OpenId Connect 1.0 identity provider configuration.
     &quot;clientId&quot;: &quot;A String&quot;, # Required. The client ID. Must match the audience claim of the JWT issued by the identity provider.
@@ -257,7 +259,7 @@ <h3>Method Details</h3>
         &quot;A String&quot;,
       ],
       &quot;assertionClaimsBehavior&quot;: &quot;A String&quot;, # Required. The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition.
-      &quot;responseType&quot;: &quot;A String&quot;, # Required. The Response Type to request for in the OIDC Authorization Request for web sign-in.
+      &quot;responseType&quot;: &quot;A String&quot;, # Required. The Response Type to request for in the OIDC Authorization Request for web sign-in. The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons.
     },
   },
   &quot;saml&quot;: { # Represents a SAML identity provider. # A SAML identity provider configuration.
@@ -295,6 +297,7 @@ <h3>Method Details</h3>
       &quot;description&quot;: &quot;A String&quot;, # A user-specified description of the provider. Cannot exceed 256 characters.
       &quot;disabled&quot;: True or False, # Disables the workforce pool provider. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.
       &quot;displayName&quot;: &quot;A String&quot;, # A user-specified display name for the provider. Cannot exceed 32 characters.
+      &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workload pool provider will be permanently purged and cannot be recovered.
       &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the provider. Format: `locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}`
       &quot;oidc&quot;: { # Represents an OpenId Connect 1.0 identity provider. # An OpenId Connect 1.0 identity provider configuration.
         &quot;clientId&quot;: &quot;A String&quot;, # Required. The client ID. Must match the audience claim of the JWT issued by the identity provider.
@@ -310,7 +313,7 @@ <h3>Method Details</h3>
             &quot;A String&quot;,
           ],
           &quot;assertionClaimsBehavior&quot;: &quot;A String&quot;, # Required. The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition.
-          &quot;responseType&quot;: &quot;A String&quot;, # Required. The Response Type to request for in the OIDC Authorization Request for web sign-in.
+          &quot;responseType&quot;: &quot;A String&quot;, # Required. The Response Type to request for in the OIDC Authorization Request for web sign-in. The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons.
         },
       },
       &quot;saml&quot;: { # Represents a SAML identity provider. # A SAML identity provider configuration.
@@ -353,6 +356,7 @@ <h3>Method Details</h3>
   &quot;description&quot;: &quot;A String&quot;, # A user-specified description of the provider. Cannot exceed 256 characters.
   &quot;disabled&quot;: True or False, # Disables the workforce pool provider. You cannot use a disabled provider to exchange tokens. However, existing tokens still grant access.
   &quot;displayName&quot;: &quot;A String&quot;, # A user-specified display name for the provider. Cannot exceed 32 characters.
+  &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workload pool provider will be permanently purged and cannot be recovered.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the provider. Format: `locations/{location}/workforcePools/{workforce_pool_id}/providers/{provider_id}`
   &quot;oidc&quot;: { # Represents an OpenId Connect 1.0 identity provider. # An OpenId Connect 1.0 identity provider configuration.
     &quot;clientId&quot;: &quot;A String&quot;, # Required. The client ID. Must match the audience claim of the JWT issued by the identity provider.
@@ -368,7 +372,7 @@ <h3>Method Details</h3>
         &quot;A String&quot;,
       ],
       &quot;assertionClaimsBehavior&quot;: &quot;A String&quot;, # Required. The behavior for how OIDC Claims are included in the `assertion` object used for attribute mapping and attribute condition.
-      &quot;responseType&quot;: &quot;A String&quot;, # Required. The Response Type to request for in the OIDC Authorization Request for web sign-in.
+      &quot;responseType&quot;: &quot;A String&quot;, # Required. The Response Type to request for in the OIDC Authorization Request for web sign-in. The `CODE` Response Type is recommended to avoid the Implicit Flow, for security reasons.
     },
   },
   &quot;saml&quot;: { # Represents a SAML identity provider. # A SAML identity provider configuration.

docs/dyn/iam_v1.projects.locations.workloadIdentityPools.html

@@ -132,7 +132,7 @@ <h3>Method Details</h3>
   &quot;description&quot;: &quot;A String&quot;, # A description of the pool. Cannot exceed 256 characters.
   &quot;disabled&quot;: True or False, # Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
   &quot;displayName&quot;: &quot;A String&quot;, # A display name for the pool. Cannot exceed 32 characters.
-  &quot;identityMode&quot;: &quot;A String&quot;, # Immutable. The identity mode of the pool.
+  &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workload identity pool will be permanently purged and cannot be recovered.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the pool.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The state of the pool.
 }
@@ -220,7 +220,7 @@ <h3>Method Details</h3>
   &quot;description&quot;: &quot;A String&quot;, # A description of the pool. Cannot exceed 256 characters.
   &quot;disabled&quot;: True or False, # Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
   &quot;displayName&quot;: &quot;A String&quot;, # A display name for the pool. Cannot exceed 32 characters.
-  &quot;identityMode&quot;: &quot;A String&quot;, # Immutable. The identity mode of the pool.
+  &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workload identity pool will be permanently purged and cannot be recovered.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the pool.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The state of the pool.
 }</pre>
@@ -250,7 +250,7 @@ <h3>Method Details</h3>
       &quot;description&quot;: &quot;A String&quot;, # A description of the pool. Cannot exceed 256 characters.
       &quot;disabled&quot;: True or False, # Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
       &quot;displayName&quot;: &quot;A String&quot;, # A display name for the pool. Cannot exceed 32 characters.
-      &quot;identityMode&quot;: &quot;A String&quot;, # Immutable. The identity mode of the pool.
+      &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workload identity pool will be permanently purged and cannot be recovered.
       &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the pool.
       &quot;state&quot;: &quot;A String&quot;, # Output only. The state of the pool.
     },
@@ -285,7 +285,7 @@ <h3>Method Details</h3>
   &quot;description&quot;: &quot;A String&quot;, # A description of the pool. Cannot exceed 256 characters.
   &quot;disabled&quot;: True or False, # Whether the pool is disabled. You cannot use a disabled pool to exchange tokens, or use existing tokens to access resources. If the pool is re-enabled, existing tokens grant access again.
   &quot;displayName&quot;: &quot;A String&quot;, # A display name for the pool. Cannot exceed 32 characters.
-  &quot;identityMode&quot;: &quot;A String&quot;, # Immutable. The identity mode of the pool.
+  &quot;expireTime&quot;: &quot;A String&quot;, # Output only. Time after which the workload identity pool will be permanently purged and cannot be recovered.
   &quot;name&quot;: &quot;A String&quot;, # Output only. The resource name of the pool.
   &quot;state&quot;: &quot;A String&quot;, # Output only. The state of the pool.
 }