{
  "rootUrl": "https://agentidentitycredentials.googleapis.com/",
  "resources": {
    "projects": {
      "resources": {
        "locations": {
          "resources": {
            "authProviders": {
              "resources": {
                "credentials": {
                  "methods": {
                    "retrieve": {
                      "response": {
                        "$ref": "GoogleCloudAgentidentitycredentialsV1_RetrieveCredentialsResponse"
                      },
                      "scopes": [
                        "https://www.googleapis.com/auth/cloud-platform"
                      ],
                      "path": "v1/{+authProvider}/credentials:retrieve",
                      "parameterOrder": [
                        "authProvider"
                      ],
                      "request": {
                        "$ref": "GoogleCloudAgentidentitycredentialsV1_RetrieveCredentialsRequest"
                      },
                      "httpMethod": "POST",
                      "parameters": {
                        "authProvider": {
                          "location": "path",
                          "type": "string",
                          "description": "Required. The resource name of the auth provider. Format: `projects/{project}/locations/{location}/authProviders/{auth_provider}`",
                          "pattern": "^projects/[^/]+/locations/[^/]+/authProviders/[^/]+$",
                          "required": true
                        }
                      },
                      "description": "Retrieves authorization credentials for an auth provider, or indicates what action needs to be taken to obtain credentials. If the `token` field in the response is populated, credential retrieval was successful. If one of the fields in the `result` oneof is populated, further action is required to obtain credentials, such as redirecting the user for consent. View comments on `RetrieveCredentialsResponse` for more information.",
                      "id": "agentidentitycredentials.projects.locations.authProviders.credentials.retrieve",
                      "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/authProviders/{authProvidersId}/credentials:retrieve"
                    },
                    "finalize": {
                      "parameterOrder": [
                        "authProvider"
                      ],
                      "path": "v1/{+authProvider}/credentials:finalize",
                      "httpMethod": "POST",
                      "description": "Finalizes the credentials after a successful consent flow.",
                      "request": {
                        "$ref": "GoogleCloudAgentidentitycredentialsV1_FinalizeCredentialsRequest"
                      },
                      "scopes": [
                        "https://www.googleapis.com/auth/cloud-platform"
                      ],
                      "id": "agentidentitycredentials.projects.locations.authProviders.credentials.finalize",
                      "flatPath": "v1/projects/{projectsId}/locations/{locationsId}/authProviders/{authProvidersId}/credentials:finalize",
                      "response": {
                        "$ref": "GoogleCloudAgentidentitycredentialsV1_FinalizeCredentialsResponse"
                      },
                      "parameters": {
                        "authProvider": {
                          "pattern": "^projects/[^/]+/locations/[^/]+/authProviders/[^/]+$",
                          "required": true,
                          "type": "string",
                          "description": "Required. The resource name of the auth provider. Format: `projects/{project}/locations/{location}/authProviders/{auth_provider}`",
                          "location": "path"
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "description": "The Agent Identity Credentials API retrieves and finalizes authorization credentials for auth providers.",
  "ownerDomain": "google.com",
  "canonicalName": "Agent Identity Credentials",
  "fullyEncodeReservedExpansion": true,
  "baseUrl": "https://agentidentitycredentials.googleapis.com/",
  "icons": {
    "x16": "http://www.google.com/images/icons/product/search-16.gif",
    "x32": "http://www.google.com/images/icons/product/search-32.gif"
  },
  "revision": "20261008",
  "servicePath": "",
  "version_module": true,
  "ownerName": "Google",
  "discoveryVersion": "v1",
  "id": "agentidentitycredentials:v1",
  "protocol": "rest",
  "basePath": "",
  "schemas": {
    "GoogleCloudAgentidentitycredentialsV1_Pending": {
      "type": "object",
      "properties": {},
      "description": "Indicates that the credential retrieval is pending. The caller should retry the `RetrieveCredentials` request after some time.",
      "id": "GoogleCloudAgentidentitycredentialsV1_Pending"
    },
    "GoogleCloudAgentidentitycredentialsV1_FinalizeCredentialsResponse": {
      "type": "object",
      "properties": {},
      "description": "Response message for `FinalizeCredentials`. Intentionally empty.",
      "id": "GoogleCloudAgentidentitycredentialsV1_FinalizeCredentialsResponse"
    },
    "GoogleCloudAgentidentitycredentialsV1_FinalizeCredentialsRequest": {
      "properties": {
        "userIdValidationState": {
          "format": "byte",
          "type": "string",
          "description": "Required. The encrypted state passed back from the consent flow."
        },
        "userId": {
          "description": "Required. The identity of the end user.",
          "type": "string"
        },
        "consentNonce": {
          "description": "Required. The same `consent_nonce` value that was provided during retrieval in the [UriConsentRequired](https://cloud.google.com/iam/docs/reference/agentidentitycredentials/rest/v1/projects.locations.authProviders.credentials/retrieve#UriConsentRequired) metadata.",
          "type": "string"
        }
      },
      "type": "object",
      "description": "Request message for `FinalizeCredentials`.",
      "id": "GoogleCloudAgentidentitycredentialsV1_FinalizeCredentialsRequest"
    },
    "GoogleCloudAgentidentitycredentialsV1_RetrieveCredentialsResponse": {
      "properties": {
        "success": {
          "$ref": "GoogleCloudAgentidentitycredentialsV1_Success",
          "description": "Message indicating credentials were successfully retrieved."
        },
        "uriConsentRequired": {
          "description": "Message indicating URI-based consent is required.",
          "$ref": "GoogleCloudAgentidentitycredentialsV1_UriConsentRequired"
        },
        "consentRejected": {
          "$ref": "GoogleCloudAgentidentitycredentialsV1_ConsentRejected",
          "description": "Message indicating consent was rejected."
        },
        "pending": {
          "description": "Message indicating credential retrieval is pending.",
          "$ref": "GoogleCloudAgentidentitycredentialsV1_Pending"
        }
      },
      "id": "GoogleCloudAgentidentitycredentialsV1_RetrieveCredentialsResponse",
      "description": "Response message for `RetrieveCredentials`. Contains the access tokens and related artifacts.",
      "type": "object"
    },
    "GoogleCloudAgentidentitycredentialsV1_Success": {
      "description": "Message indicating successful retrieval of credentials.",
      "properties": {
        "header": {
          "description": "The HTTP header name where the token should be placed.",
          "type": "string"
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The scopes actually associated with the retrieved token. End users may have rejected some requested scopes, or the third-party authorization servers can return a different set of scopes than what was asked for. Callers should verify that all required scopes for their intended use are included in this list."
        },
        "token": {
          "type": "string",
          "description": "The retrieved access token or credential for the end user. On an MCP tool call, for an invalid token the OAuth spec states that this should return `401` or `403`, but MCP servers may implement this differently. If you get any flavor of `PERMISSION_DENIED`, retry your original request to `RetrieveCredentials` with force_refresh_token set to the expired/invalid token string, which will fetch a new token or initiate a new consent flow."
        },
        "expireTime": {
          "description": "The expiration time of the token. This does not guarantee that the token will be valid until this time, since the token could be revoked earlier. There could also be clock skew between the auth provider and the client so it may expire slightly earlier. If not set, the token might be permanent or it may be that the service does not (or cannot) know when it will expire.",
          "format": "google-datetime",
          "type": "string"
        }
      },
      "type": "object",
      "id": "GoogleCloudAgentidentitycredentialsV1_Success"
    },
    "GoogleCloudAgentidentitycredentialsV1_RetrieveCredentialsRequest": {
      "id": "GoogleCloudAgentidentitycredentialsV1_RetrieveCredentialsRequest",
      "description": "Request message for `RetrieveCredentials`.",
      "type": "object",
      "properties": {
        "userId": {
          "type": "string",
          "description": "Required. The identity of the end user."
        },
        "scopes": {
          "description": "Optional. The OAuth scopes required for this access.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "continueUri": {
          "type": "string",
          "description": "Optional. The URI to redirect the user to after consent is completed. This field is required for auth providers using the 3-legged OAuth flow. For other auth provider types, this field is unused but not rejected."
        },
        "forceRefreshToken": {
          "description": "Optional. Input only. Set this field only if the previous token was expired or invalid. This value must be the full, previously returned token string. Setting this field triggers a refresh of the access token with a stored refresh token, if possible, or a new consent flow.",
          "type": "string"
        }
      }
    },
    "GoogleCloudAgentidentitycredentialsV1_ConsentRejected": {
      "type": "object",
      "id": "GoogleCloudAgentidentitycredentialsV1_ConsentRejected",
      "description": "Indicates the user has rejected the permission delegation or canceled the request.",
      "properties": {}
    },
    "GoogleCloudAgentidentitycredentialsV1_UriConsentRequired": {
      "type": "object",
      "properties": {
        "authorizationUri": {
          "description": "Output only. The URL where the user should be redirected to grant consent. This will always be present.",
          "readOnly": true,
          "type": "string"
        },
        "consentNonce": {
          "description": "Output only. A one-time, randomly generated value that validates the entire consent flow is handled by a single user, avoiding CSRF attacks. It must be submitted with the `FinalizeCredentials` request to complete the OAuth exchange. This will always be present. Implemented per [RFC 6819 Section 5.3.5](https://www.rfc-editor.org/rfc/rfc6819#section-5.3.5).",
          "type": "string",
          "readOnly": true
        },
        "uid": {
          "description": "Output only. The unique ID of the credentials retrieval operation.",
          "readOnly": true,
          "type": "string"
        }
      },
      "id": "GoogleCloudAgentidentitycredentialsV1_UriConsentRequired",
      "description": "Indicates that the user must visit the provided URI to consent to delegate permission to the agent to act on their behalf. The caller can either poll the `RetrieveCredentials` method, or await the /ValidateUserId callback."
    }
  },
  "kind": "discovery#restDescription",
  "auth": {
    "oauth2": {
      "scopes": {
        "https://www.googleapis.com/auth/cloud-platform": {
          "description": "See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account."
        }
      }
    }
  },
  "version": "v1",
  "batchPath": "batch",
  "mtlsRootUrl": "https://agentidentitycredentials.mtls.googleapis.com/",
  "documentationLink": "https://cloud.google.com/iam/docs/",
  "parameters": {
    "alt": {
      "enum": [
        "json",
        "media",
        "proto"
      ],
      "type": "string",
      "location": "query",
      "enumDescriptions": [
        "Responses with Content-Type of application/json",
        "Media download with context-dependent Content-Type",
        "Responses with Content-Type of application/x-protobuf"
      ],
      "default": "json",
      "description": "Data format for response."
    },
    "upload_protocol": {
      "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").",
      "type": "string",
      "location": "query"
    },
    "oauth_token": {
      "description": "OAuth 2.0 token for the current user.",
      "type": "string",
      "location": "query"
    },
    "key": {
      "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.",
      "location": "query",
      "type": "string"
    },
    "uploadType": {
      "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\").",
      "location": "query",
      "type": "string"
    },
    "fields": {
      "location": "query",
      "type": "string",
      "description": "Selector specifying which fields to include in a partial response."
    },
    "$.xgafv": {
      "location": "query",
      "enum": [
        "1",
        "2"
      ],
      "type": "string",
      "description": "V1 error format.",
      "enumDescriptions": [
        "v1 error format",
        "v2 error format"
      ]
    },
    "access_token": {
      "description": "OAuth access token.",
      "location": "query",
      "type": "string"
    },
    "quotaUser": {
      "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.",
      "location": "query",
      "type": "string"
    },
    "callback": {
      "location": "query",
      "type": "string",
      "description": "JSONP"
    },
    "prettyPrint": {
      "default": "true",
      "type": "boolean",
      "location": "query",
      "description": "Returns response with indentations and line breaks."
    }
  },
  "name": "agentidentitycredentials",
  "title": "Agent Identity Credentials API"
}