gcf-merge-on-green · Oct 16, 2026 · Oct 16, 2026
@@ -22,7 +22,7 @@ Add the following lines to your `pom.xml` file:
     <dependency>
       <groupId>com.google.apis</groupId>
       <artifactId>google-api-services-iam</artifactId>
-      <version>v1-rev20260925-2.0.0</version>
+      <version>v1-rev20261012-2.0.0</version>
     </dependency>
   </dependencies>
 </project>
@@ -35,7 +35,7 @@ repositories {
   mavenCentral()
 }
 dependencies {
-  implementation 'com.google.apis:google-api-services-iam:v1-rev20260925-2.0.0'
+  implementation 'com.google.apis:google-api-services-iam:v1-rev20261012-2.0.0'
 }
 ```
 

@@ -6573,16 +6573,18 @@ public Delete set(String parameterName, Object value) {
           }
         }
         /**
-         * Revokes all sessions for a given WorkforcePoolSubject.
+         * Revokes all sessions for the specified WorkforcePoolSubject. Revoking sessions invalidates all
+         * active sessions and previously issued credentials for the subject, requiring the user to re-
+         * authenticate with the identity provider.
          *
          * Create a request for the method "subjects.revokeSessions".
          *
          * This request holds the parameters needed by the iam server.  After setting any optional
          * parameters, call the {@link RevokeSessions#execute()} method to invoke the remote operation.
          *
-         * @param name Required. The resource name of the WorkforcePoolSubject. Special characters, like `/` and `:`, must
-         *        be escaped, because all URLs need to conform to the "When to Escape and Unescape" section
-         *        of [RFC3986](https://www.ietf.org/rfc/rfc2396.txt). Format:
+         * @param name Required. The resource name of the WorkforcePoolSubject. Special characters, such as `/` and `:`,
+         *        must be escaped, because all URLs must conform to the "When to Escape and Unescape"
+         *        section of [RFC 3986](https://www.rfc-editor.org/info/rfc3986/). Format:
          *        `locations/{location}/workforcePools/{workforce_pool_id}/subjects/{subject_id}`
          * @param content the {@link com.google.api.services.iam.v1.model.RevokeWorkforcePoolSubjectSessionsRequest}
          * @return the request
@@ -6601,7 +6603,9 @@ public class RevokeSessions extends IamRequest<com.google.api.services.iam.v1.mo
               java.util.regex.Pattern.compile("^locations/[^/]+/workforcePools/[^/]+/subjects/[^/]+$");
 
           /**
-           * Revokes all sessions for a given WorkforcePoolSubject.
+           * Revokes all sessions for the specified WorkforcePoolSubject. Revoking sessions invalidates all
+           * active sessions and previously issued credentials for the subject, requiring the user to re-
+           * authenticate with the identity provider.
            *
            * Create a request for the method "subjects.revokeSessions".
            *
@@ -6611,9 +6615,9 @@ public class RevokeSessions extends IamRequest<com.google.api.services.iam.v1.mo
            * ientRequest)} must be called to initialize this instance immediately after invoking the
            * constructor. </p>
            *
-           * @param name Required. The resource name of the WorkforcePoolSubject. Special characters, like `/` and `:`, must
-         *        be escaped, because all URLs need to conform to the "When to Escape and Unescape" section
-         *        of [RFC3986](https://www.ietf.org/rfc/rfc2396.txt). Format:
+           * @param name Required. The resource name of the WorkforcePoolSubject. Special characters, such as `/` and `:`,
+         *        must be escaped, because all URLs must conform to the "When to Escape and Unescape"
+         *        section of [RFC 3986](https://www.rfc-editor.org/info/rfc3986/). Format:
          *        `locations/{location}/workforcePools/{workforce_pool_id}/subjects/{subject_id}`
            * @param content the {@link com.google.api.services.iam.v1.model.RevokeWorkforcePoolSubjectSessionsRequest}
            * @since 1.13
@@ -6684,27 +6688,27 @@ public RevokeSessions setUploadProtocol(java.lang.String uploadProtocol) {
           }
 
           /**
-           * Required. The resource name of the WorkforcePoolSubject. Special characters, like `/`
-           * and `:`, must be escaped, because all URLs need to conform to the "When to Escape and
-           * Unescape" section of [RFC3986](https://www.ietf.org/rfc/rfc2396.txt). Format:
+           * Required. The resource name of the WorkforcePoolSubject. Special characters, such as
+           * `/` and `:`, must be escaped, because all URLs must conform to the "When to Escape and
+           * Unescape" section of [RFC 3986](https://www.rfc-editor.org/info/rfc3986/). Format:
            * `locations/{location}/workforcePools/{workforce_pool_id}/subjects/{subject_id}`
            */
           @com.google.api.client.util.Key
           private java.lang.String name;
 
-          /** Required. The resource name of the WorkforcePoolSubject. Special characters, like `/` and `:`, must
-         be escaped, because all URLs need to conform to the "When to Escape and Unescape" section of
-         [RFC3986](https://www.ietf.org/rfc/rfc2396.txt). Format:
+          /** Required. The resource name of the WorkforcePoolSubject. Special characters, such as `/` and `:`,
+         must be escaped, because all URLs must conform to the "When to Escape and Unescape" section of [RFC
+         3986](https://www.rfc-editor.org/info/rfc3986/). Format:
          `locations/{location}/workforcePools/{workforce_pool_id}/subjects/{subject_id}`
            */
           public java.lang.String getName() {
             return name;
           }
 
           /**
-           * Required. The resource name of the WorkforcePoolSubject. Special characters, like `/`
-           * and `:`, must be escaped, because all URLs need to conform to the "When to Escape and
-           * Unescape" section of [RFC3986](https://www.ietf.org/rfc/rfc2396.txt). Format:
+           * Required. The resource name of the WorkforcePoolSubject. Special characters, such as
+           * `/` and `:`, must be escaped, because all URLs must conform to the "When to Escape and
+           * Unescape" section of [RFC 3986](https://www.rfc-editor.org/info/rfc3986/). Format:
            * `locations/{location}/workforcePools/{workforce_pool_id}/subjects/{subject_id}`
            */
           public RevokeSessions setName(java.lang.String name) {

@@ -43,6 +43,23 @@ public final class Oidc extends com.google.api.client.json.GenericJson {
   @com.google.api.client.util.Key
   private java.util.List<java.lang.String> allowedAudiences;
 
+  /**
+   * Optional. The URL to fetch the OIDC discovery document from, overriding the default URL derived
+   * from `issuer_uri`. If not set, `discovery_uri` defaults to `issuer_uri` with `/.well-
+   * known/openid-configuration` appended, as per the OpenID Connect Discovery 1.0 specification. If
+   * set, `discovery_uri` must meet the following requirements: - Must start with `https://`. - Must
+   * not exceed 2000 characters. - The scheme, host, and port must match `issuer_uri`. - The path
+   * must contain `/.well-known/` (where `` is not empty, such as `openid-configuration`) and
+   * conform to the `issuer_uri` topology: - The well-known path segment is inserted before the
+   * issuer path (for example, `https://example.com/.well-known/openid-configuration/tenant1` for
+   * issuer `https://example.com/tenant1`), or - The well-known path segment is appended under the
+   * issuer path (for example, `https://example.com/tenant1/.well-known/openid-configuration` for
+   * issuer `https://example.com/tenant1`).
+   * The value may be {@code null}.
+   */
+  @com.google.api.client.util.Key
+  private java.lang.String discoveryUri;
+
   /**
    * Required. The OIDC `issuer_uri`. Must be an HTTPS endpoint. Per OpenID Connect Discovery 1.0
    * spec, the OIDC issuer URL is used to locate the provider's public keys (via `jwks_uri`) for
@@ -93,6 +110,43 @@ public Oidc setAllowedAudiences(java.util.List<java.lang.String> allowedAudience
     return this;
   }
 
+  /**
+   * Optional. The URL to fetch the OIDC discovery document from, overriding the default URL derived
+   * from `issuer_uri`. If not set, `discovery_uri` defaults to `issuer_uri` with `/.well-
+   * known/openid-configuration` appended, as per the OpenID Connect Discovery 1.0 specification. If
+   * set, `discovery_uri` must meet the following requirements: - Must start with `https://`. - Must
+   * not exceed 2000 characters. - The scheme, host, and port must match `issuer_uri`. - The path
+   * must contain `/.well-known/` (where `` is not empty, such as `openid-configuration`) and
+   * conform to the `issuer_uri` topology: - The well-known path segment is inserted before the
+   * issuer path (for example, `https://example.com/.well-known/openid-configuration/tenant1` for
+   * issuer `https://example.com/tenant1`), or - The well-known path segment is appended under the
+   * issuer path (for example, `https://example.com/tenant1/.well-known/openid-configuration` for
+   * issuer `https://example.com/tenant1`).
+   * @return value or {@code null} for none
+   */
+  public java.lang.String getDiscoveryUri() {
+    return discoveryUri;
+  }
+
+  /**
+   * Optional. The URL to fetch the OIDC discovery document from, overriding the default URL derived
+   * from `issuer_uri`. If not set, `discovery_uri` defaults to `issuer_uri` with `/.well-
+   * known/openid-configuration` appended, as per the OpenID Connect Discovery 1.0 specification. If
+   * set, `discovery_uri` must meet the following requirements: - Must start with `https://`. - Must
+   * not exceed 2000 characters. - The scheme, host, and port must match `issuer_uri`. - The path
+   * must contain `/.well-known/` (where `` is not empty, such as `openid-configuration`) and
+   * conform to the `issuer_uri` topology: - The well-known path segment is inserted before the
+   * issuer path (for example, `https://example.com/.well-known/openid-configuration/tenant1` for
+   * issuer `https://example.com/tenant1`), or - The well-known path segment is appended under the
+   * issuer path (for example, `https://example.com/tenant1/.well-known/openid-configuration` for
+   * issuer `https://example.com/tenant1`).
+   * @param discoveryUri discoveryUri or {@code null} for none
+   */
+  public Oidc setDiscoveryUri(java.lang.String discoveryUri) {
+    this.discoveryUri = discoveryUri;
+    return this;
+  }
+
   /**
    * Required. The OIDC `issuer_uri`. Must be an HTTPS endpoint. Per OpenID Connect Discovery 1.0
    * spec, the OIDC issuer URL is used to locate the provider's public keys (via `jwks_uri`) for

@@ -30,6 +30,15 @@
 @SuppressWarnings("javadoc")
 public final class WorkloadIdentityPoolProvider extends com.google.api.client.json.GenericJson {
 
+  /**
+   * Optional. A list of the resource names of WorkloadIdentityPoolProviders in the same pool that
+   * are authorized to issue actor tokens for this provider. An actor token represents the identity
+   * of the acting party to whom authority is delegated. At most 3 actor providers can be specified.
+   * The value may be {@code null}.
+   */
+  @com.google.api.client.util.Key
+  private java.util.List<java.lang.String> actorProviders;
+
   /**
    * Optional. [A Common Expression Language](https://opensource.google/projects/cel) expression, in
    * plain text, to restrict what otherwise valid authentication credentials issued by the provider
@@ -158,6 +167,27 @@ public final class WorkloadIdentityPoolProvider extends com.google.api.client.js
   @com.google.api.client.util.Key
   private X509 x509;
 
+  /**
+   * Optional. A list of the resource names of WorkloadIdentityPoolProviders in the same pool that
+   * are authorized to issue actor tokens for this provider. An actor token represents the identity
+   * of the acting party to whom authority is delegated. At most 3 actor providers can be specified.
+   * @return value or {@code null} for none
+   */
+  public java.util.List<java.lang.String> getActorProviders() {
+    return actorProviders;
+  }
+
+  /**
+   * Optional. A list of the resource names of WorkloadIdentityPoolProviders in the same pool that
+   * are authorized to issue actor tokens for this provider. An actor token represents the identity
+   * of the acting party to whom authority is delegated. At most 3 actor providers can be specified.
+   * @param actorProviders actorProviders or {@code null} for none
+   */
+  public WorkloadIdentityPoolProvider setActorProviders(java.util.List<java.lang.String> actorProviders) {
+    this.actorProviders = actorProviders;
+    return this;
+  }
+
   /**
    * Optional. [A Common Expression Language](https://opensource.google/projects/cel) expression, in
    * plain text, to restrict what otherwise valid authentication credentials issued by the provider

@@ -8,8 +8,8 @@
 
   <groupId>com.google.apis</groupId>
   <artifactId>google-api-services-iam</artifactId>
-  <version>v1-rev20260925-2.0.0</version>
-  <name>Identity and Access Management (IAM) API v1-rev20260925-2.0.0</name>
+  <version>v1-rev20261012-2.0.0</version>
+  <name>Identity and Access Management (IAM) API v1-rev20261012-2.0.0</name>
   <packaging>jar</packaging>
 
   <inceptionYear>2011</inceptionYear>

@@ -22,7 +22,7 @@ Add the following lines to your `pom.xml` file:
     <dependency>
       <groupId>com.google.apis</groupId>
       <artifactId>google-api-services-iam</artifactId>
-      <version>v1-rev20260925-2.0.0</version>
+      <version>v1-rev20261012-2.0.0</version>
     </dependency>
   </dependencies>
 </project>
@@ -35,7 +35,7 @@ repositories {
   mavenCentral()
 }
 dependencies {
-  implementation 'com.google.apis:google-api-services-iam:v1-rev20260925-2.0.0'
+  implementation 'com.google.apis:google-api-services-iam:v1-rev20261012-2.0.0'
 }
 ```