Admin SDK API . roleAssignments

close()

Close httplib2 connections.

delete(customer, roleAssignmentId, x__xgafv=None)

Deletes a role assignment.

Args:
  customer: string, Immutable ID of the Google Workspace account. (required)
  roleAssignmentId: string, Immutable ID of the role assignment. (required)
  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

get(customer, roleAssignmentId, x__xgafv=None)

Retrieves a role assignment.

Args:
  customer: string, The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`. The `customerId` is also returned as part of the [Users](/admin-sdk/directory/v1/reference/users) resource. You must provide either the `customer` or the `domain` parameter. (required)
  roleAssignmentId: string, Immutable ID of the role assignment. (required)
  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

Returns:
  An object of the form:

    { # Defines an assignment of a role.
  "assignedTo": "A String", # The unique ID of the entity this role is assigned to—either the `user_id` of a user, the `group_id` of a group, or the `uniqueId` of a service account as defined in [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts).
  "assigneeType": "A String", # Output only. The type of the assignee (`USER` or `GROUP`).
  "condition": "A String", # Optional. The condition associated with this role assignment. Note: Feature is available to Enterprise Standard, Enterprise Plus, Google Workspace for Education Plus and Cloud Identity Premium customers. A `RoleAssignment` with the `condition` field set will only take effect when the resource being accessed meets the condition. If `condition` is empty, the role (`role_id`) is applied to the actor (`assigned_to`) at the scope (`scope_type`) unconditionally. Currently, the following conditions are supported: - To make the `RoleAssignment` only applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` - To make the `RoleAssignment` not applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` Currently, the condition strings have to be verbatim and they only work with the following [pre-built administrator roles](https://support.google.com/a/answer/2405986): - Groups Editor - Groups Reader The condition follows [Cloud IAM condition syntax](https://cloud.google.com/iam/docs/conditions-overview). Additional conditions related to Locked Groups are available under Open Beta. - To make the `RoleAssignment` not applicable to [Locked Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.locked']) && resource.type == 'cloudidentity.googleapis.com/Group'` This condition can also be used in conjunction with a Security-related condition.
  "etag": "A String", # ETag of the resource.
  "kind": "admin#directory#roleAssignment", # The type of the API resource. This is always `admin#directory#roleAssignment`.
  "orgUnitId": "A String", # If the role is restricted to an organization unit, this contains the ID for the organization unit the exercise of this role is restricted to.
  "roleAssignmentId": "A String", # ID of this roleAssignment.
  "roleId": "A String", # The ID of the role that is assigned.
  "scopeType": "A String", # The scope in which this role is assigned.
}

insert(customer, body=None, x__xgafv=None)

Creates a role assignment.

Args:
  customer: string, Immutable ID of the Google Workspace account. (required)
  body: object, The request body.
    The object takes the form of:

{ # Defines an assignment of a role.
  "assignedTo": "A String", # The unique ID of the entity this role is assigned to—either the `user_id` of a user, the `group_id` of a group, or the `uniqueId` of a service account as defined in [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts).
  "assigneeType": "A String", # Output only. The type of the assignee (`USER` or `GROUP`).
  "condition": "A String", # Optional. The condition associated with this role assignment. Note: Feature is available to Enterprise Standard, Enterprise Plus, Google Workspace for Education Plus and Cloud Identity Premium customers. A `RoleAssignment` with the `condition` field set will only take effect when the resource being accessed meets the condition. If `condition` is empty, the role (`role_id`) is applied to the actor (`assigned_to`) at the scope (`scope_type`) unconditionally. Currently, the following conditions are supported: - To make the `RoleAssignment` only applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` - To make the `RoleAssignment` not applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` Currently, the condition strings have to be verbatim and they only work with the following [pre-built administrator roles](https://support.google.com/a/answer/2405986): - Groups Editor - Groups Reader The condition follows [Cloud IAM condition syntax](https://cloud.google.com/iam/docs/conditions-overview). Additional conditions related to Locked Groups are available under Open Beta. - To make the `RoleAssignment` not applicable to [Locked Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.locked']) && resource.type == 'cloudidentity.googleapis.com/Group'` This condition can also be used in conjunction with a Security-related condition.
  "etag": "A String", # ETag of the resource.
  "kind": "admin#directory#roleAssignment", # The type of the API resource. This is always `admin#directory#roleAssignment`.
  "orgUnitId": "A String", # If the role is restricted to an organization unit, this contains the ID for the organization unit the exercise of this role is restricted to.
  "roleAssignmentId": "A String", # ID of this roleAssignment.
  "roleId": "A String", # The ID of the role that is assigned.
  "scopeType": "A String", # The scope in which this role is assigned.
}

  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

Returns:
  An object of the form:

    { # Defines an assignment of a role.
  "assignedTo": "A String", # The unique ID of the entity this role is assigned to—either the `user_id` of a user, the `group_id` of a group, or the `uniqueId` of a service account as defined in [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts).
  "assigneeType": "A String", # Output only. The type of the assignee (`USER` or `GROUP`).
  "condition": "A String", # Optional. The condition associated with this role assignment. Note: Feature is available to Enterprise Standard, Enterprise Plus, Google Workspace for Education Plus and Cloud Identity Premium customers. A `RoleAssignment` with the `condition` field set will only take effect when the resource being accessed meets the condition. If `condition` is empty, the role (`role_id`) is applied to the actor (`assigned_to`) at the scope (`scope_type`) unconditionally. Currently, the following conditions are supported: - To make the `RoleAssignment` only applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` - To make the `RoleAssignment` not applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` Currently, the condition strings have to be verbatim and they only work with the following [pre-built administrator roles](https://support.google.com/a/answer/2405986): - Groups Editor - Groups Reader The condition follows [Cloud IAM condition syntax](https://cloud.google.com/iam/docs/conditions-overview). Additional conditions related to Locked Groups are available under Open Beta. - To make the `RoleAssignment` not applicable to [Locked Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.locked']) && resource.type == 'cloudidentity.googleapis.com/Group'` This condition can also be used in conjunction with a Security-related condition.
  "etag": "A String", # ETag of the resource.
  "kind": "admin#directory#roleAssignment", # The type of the API resource. This is always `admin#directory#roleAssignment`.
  "orgUnitId": "A String", # If the role is restricted to an organization unit, this contains the ID for the organization unit the exercise of this role is restricted to.
  "roleAssignmentId": "A String", # ID of this roleAssignment.
  "roleId": "A String", # The ID of the role that is assigned.
  "scopeType": "A String", # The scope in which this role is assigned.
}

list(customer, includeIndirectRoleAssignments=None, maxResults=None, pageToken=None, roleId=None, userKey=None, x__xgafv=None)

Retrieves a paginated list of all roleAssignments.

Args:
  customer: string, The unique ID for the customer's Google Workspace account. In case of a multi-domain account, to fetch all groups for a customer, use this field instead of `domain`. You can also use the `my_customer` alias to represent your account's `customerId`. The `customerId` is also returned as part of the [Users](/admin-sdk/directory/v1/reference/users) resource. You must provide either the `customer` or the `domain` parameter. (required)
  includeIndirectRoleAssignments: boolean, When set to `true`, fetches indirect role assignments (i.e. role assignment via a group) as well as direct ones. Defaults to `false`. You must specify `user_key` or the indirect role assignments will not be included.
  maxResults: integer, Maximum number of results to return.
  pageToken: string, Token to specify the next page in the list.
  roleId: string, Immutable ID of a role. If included in the request, returns only role assignments containing this role ID.
  userKey: string, The primary email address, alias email address, or unique user or group ID. If included in the request, returns role assignments only for this user or group.
  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

Returns:
  An object of the form:

    {
  "etag": "A String", # ETag of the resource.
  "items": [ # A list of RoleAssignment resources.
    { # Defines an assignment of a role.
      "assignedTo": "A String", # The unique ID of the entity this role is assigned to—either the `user_id` of a user, the `group_id` of a group, or the `uniqueId` of a service account as defined in [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts).
      "assigneeType": "A String", # Output only. The type of the assignee (`USER` or `GROUP`).
      "condition": "A String", # Optional. The condition associated with this role assignment. Note: Feature is available to Enterprise Standard, Enterprise Plus, Google Workspace for Education Plus and Cloud Identity Premium customers. A `RoleAssignment` with the `condition` field set will only take effect when the resource being accessed meets the condition. If `condition` is empty, the role (`role_id`) is applied to the actor (`assigned_to`) at the scope (`scope_type`) unconditionally. Currently, the following conditions are supported: - To make the `RoleAssignment` only applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` - To make the `RoleAssignment` not applicable to [Security Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.security']) && resource.type == 'cloudidentity.googleapis.com/Group'` Currently, the condition strings have to be verbatim and they only work with the following [pre-built administrator roles](https://support.google.com/a/answer/2405986): - Groups Editor - Groups Reader The condition follows [Cloud IAM condition syntax](https://cloud.google.com/iam/docs/conditions-overview). Additional conditions related to Locked Groups are available under Open Beta. - To make the `RoleAssignment` not applicable to [Locked Groups](https://cloud.google.com/identity/docs/groups#group_types): `!api.getAttribute('cloudidentity.googleapis.com/groups.labels', []).hasAny(['groups.locked']) && resource.type == 'cloudidentity.googleapis.com/Group'` This condition can also be used in conjunction with a Security-related condition.
      "etag": "A String", # ETag of the resource.
      "kind": "admin#directory#roleAssignment", # The type of the API resource. This is always `admin#directory#roleAssignment`.
      "orgUnitId": "A String", # If the role is restricted to an organization unit, this contains the ID for the organization unit the exercise of this role is restricted to.
      "roleAssignmentId": "A String", # ID of this roleAssignment.
      "roleId": "A String", # The ID of the role that is assigned.
      "scopeType": "A String", # The scope in which this role is assigned.
    },
  ],
  "kind": "admin#directory#roleAssignments", # The type of the API resource. This is always `admin#directory#roleAssignments`.
  "nextPageToken": "A String",
}

list_next()

Retrieves the next page of results.

        Args:
          previous_request: The request for the previous page. (required)
          previous_response: The response from the request for the previous page. (required)

        Returns:
          A request object that you can call 'execute()' on to request the next
          page. Returns None if there are no more items in the collection.