Google.Cloud.Storage.V1

Options for CopyObject operations.

The generation of the object resource to copy. When not set, the latest generation will be copied.

The projection to retrieve.

A predefined set of ACLs for the new object.

Precondition for copying: the object is only copied if the existing destination object's generation matches the given value.

Precondition for copying: the object is only copied if the existing destination object's generation does not match the given value.

Precondition for copying: the object is only copied if the existing destination object's meta-generation matches the given value.

Precondition for copying: the object is only copied if the existing destination object's meta-generation does not match the given value.

Precondition for copying: the object is only copied if the source object's generation matches the given value.

Precondition for copying: the object is only copied if the source object's generation does not match the given value.

Precondition for copying: the object is only copied if the source object's meta-generation matches the given value.

Precondition for copying: the object is only copied if the source object's meta-generation does not match the given value.

Additional object metadata for the new object. This can be used to specify the storage class of the new object, the content type etc. If this property is not set, the existing object metadata will be used unchanged.

The encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

The encryption key to use for the source of the copy. If this property is null, the will be used instead. Use if the source is not encrypted.

The name of the Cloud KMS key to use to encrypt the new object.

Currently, either customer-supplied encryption or a Cloud KMS key can be used, but not both. If this property is null and customer-supplied encryption is not being used, the bucket encryption defaults will be used to determine the encryption for the object. If this property is non-null and the client object has a default encryption key, the property of this options object must be set to to make the intention clear.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Implementation of CRC32c for checking data integrity. At some point we may want to move this into GoogleApis.

Updates the hash with the given data.

Array containing the data to hash First offset of data to hash Number of bytes to hash

Returns the current hash.

Options for CreateBucket operations.

A pre-defined ACL of the bucket for simple access control scenarios.

A pre-defined default ACL for objects created in the bucket, for simple access control scenarios.

The projection to retrieve.

Options for CreateHmacKey operations.

Options for CreateNotification operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Upload subclass which allows us to modify headers, for customer-supplied encryption keys.

Options for DeleteBucket operations.

Precondition for deletion: the bucket is only deleted if its meta-generation matches the given value.

Precondition for deletion: the bucket is only deleted if its meta-generation does not match the given value.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

If set to true, all objects within the bucket will be deleted before attempting to delete the bucket itself.

This is a best-effort attempt, with no guarantees of atomicity: it's entirely possible for the operation to fail having deleted some objects but not all of them. If a precondition is specified, it is checked before deleting any objects, and applied again when deleting the bucket, but is not checked while deleting the objects. The behavior is unspecified if objects are modified, added or deleted while this operation is taking place. The objects are deleted sequentially. If you need to delete buckets with many objects, you may wish to implement a parallel solution in application code instead of using this option. If is set, that project will be billed for all operations.

If this set of options contains any preconditions, return a with the same set of options. Otherwise, return null.

Options for DeleteHmacKey operations.

Options for DeleteNotification operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for DeleteObject operations.

The generation to delete. If this is not specified, the latest generation will be deleted.

Precondition for deletion: the object is only deleted if the object's current generation matches the given value.

Precondition for deletion: the object is only deleted if the object's current generation does not match the given value.

Precondition for deletion: the object is only deleted if the object's current meta-generation matches the given value.

Precondition for deletion: the object is only deleted if the object's current meta-generation does not match the given value.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for DownloadObject operations.

The chunk size to use for each request.

The generation to download. When not specified, the latest version is always downloaded.

Precondition for download: the object is only downloaded if its generation matches the given value.

Precondition for download: the object is only downloaded if its generation does not match the given value.

Precondition for download: the object is only downloaded if its meta-generation matches the given value.

Precondition for download: the object is only downloaded if its meta-generation does not match the given value.

If non-null, limits the range of bytes of the object to download.

The encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Specifies whether or not the object's hash should be validated. If this property is null, the hash will always be validated.

This is effectively an escape hatch for situations where hash validation fails. See https://github.com/googleapis/google-cloud-dotnet/issues/1641 for background on this option. It is recommended that you leave this option unset unless you are knowingly downloading data for an object where hashing will fail.

Describes the circumstances under which the hash of an object is validated when downloading.

The hash is always validated.

The hash is never validated; data integrity errors may still be exposed via other network layers, but there is a risk of data loss.

An AES-256 key passed to the Google Cloud Storage servers via headers to allow objects to be encrypted at rest using a client-supplied key rather than a server-supplied default key. An alternative to customer-supplied encryption keys is to use customer-managed encryption keys, via Cloud KMS.

A "don't encrypt" key, used in call-specific options to indicate that a particular request should not use encryption even if the client has a default encryption key.

The base64 representation of the key. This will always be 45 characters long, or null for .

The base64 representation of the SHA-256 hash of the key. This will always be 45 characters long, or null for .

Creates an encryption key from the specified raw bytes.

The raw key data; must be non-null and 32 bytes long. An based on .

Generates a random encryption key using .

A generated encryption key.

Adds encryption headers to the specified request, unless this key is ,

The request to modify. Must not be null.

Options for GetBucketIamPolicy operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

The version of IAM policies to request. If a policy with a condition is requested without setting this, the server will return an error. This must be set to a value of 3 to retrieve IAM policies containing conditions. This is to prevent client code that isn't aware of IAM conditions from interpreting and modifying policies incorrectly.

Options for GetBucket operations.

Precondition for retrieval: the bucket is only fetched if its meta-generation matches the given value.

Precondition for retrieval: the bucket is only fetched if its meta-generation does not match the given value.

The projection to retrieve.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for GetHmacKey operations.

Options for GetNotification operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for GetObject operations.

The generation of the object resource to fetch. When not set, the latest generation will be retrieved.

The projection to retrieve.

Precondition for retrieval: the object is only fetched if the object's current generation matches the given value.

Precondition for retrieval: the object is only fetched if the object's current generation does not match the given value.

Precondition for retrieval: the object is only fetched if the object's current meta-generation matches the given value.

Precondition for retrieval: the object is only fetched if the object's current meta-generation does not match the given value.

The encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for GetStorageServiceAccountEmail operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Subclass of which validates the data it receives against a CRC32c hash set in the header.

Constructs a new downloader with the given client service.

String constants for the names of the storage classes, as used in .

The key is active, and can be used for signing. It cannot be deleted in this state.

The key is inactive, and can be used for signing. It can be deleted.

The key has been deleted.

Options for ListBuckets operations.

The prefix to match. Only buckets with names that start with this string will be returned.

The number of results to return per page. (This modifies the per-request page size; it does not affect the total number of results returned.)

The projection to retrieve.

If set, this token is used to indicate a continued list operation. The value should be taken from the NextPageToken property of either a or a raw response from .

If set, this specifies the fields to fetch in the result to obtain partial responses, usually to improve performance. For example, to fetch just the name and location of each bucket, set this property to "items(name,location),nextPageToken". The "nextPageToken" field is required in order to fetch multiple pages; the library does not add this automatically. See https://cloud.google.com/storage/docs/json_api/v1/how-tos/performance#partial for more details on specifying fields for partial responses.

Modifies the specified request for all non-null properties of this options object.

The request to modify

Options for ListHmacKey operations.

The number of results to return per page. (This modifies the per-request page size; it does not affect the total number of results returned.)

If set, this token is used to indicate a continued list operation. The value should be taken from the NextPageToken property of either a or a raw response from .

If set, this determines whether deleted keys are included in the results.

Options for ListNotifications operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for ListObjects operations.

Used to list in "directory mode". Only objects whose names (aside from the prefix) do not contain the delimiter will be returned.

If true, objects that end in exactly one instance of delimiter will have their metadata included in the returned.

The number of results to return per page. (This modifies the per-request page size; it does not affect the total number of results returned.)

Controls whether or not multiple versions of an object are listed separately (true) or not (false). The default API behavior is equivalent to setting this to false, but it is still a nullable property to allow the intention of "definitely false" to be separate from "not set".

The projection to retrieve.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

If set, this token is used to indicate a continued list operation. The value should be taken from the NextPageToken property of either a or a raw response from .

If set, this specifies the fields to fetch in the result to obtain partial responses, usually to improve performance. For example, to fetch just the name and content type of each object, set this property to "items(name,contentType),nextPageToken". The "nextPageToken" field is required in order to fetch multiple pages; the library does not add this automatically. See https://cloud.google.com/storage/docs/json_api/v1/how-tos/performance#partial for more details on specifying fields for partial responses.

Modifies the specified request for all non-null properties of this options object.

The request to modify

Options for LockBucketRetentionPolicy operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for operations which modify bucket labels.

The default number of retries.

Precondition for modification: the labels are only modified if its current meta-generation matches the given value.

The number of times to retry the modification if the bucket's metageneration changes in the read/modify/write cycle. If this property is not set, a suitable default is used. The value must not be negative.

Modifying bucket labels involves reading the bucket metadata in one request, then sending another request with the new labels, including a metageneration check to ensure that the bucket hasn't changed between the two requests. If the metageneration *has* changed, the overall operation can be retried from the start. This property indicates the number of retries, so it has a minimum value of 0.

Options for PatchBucket operations.

Precondition for patch: the bucket is only patched if its current meta-generation matches the given value.

Precondition for patch: the bucket is only patched if its current meta-generation does not match the given value.

The projection of the updated object to return.

A pre-defined ACL of the bucket for simple access control scenarios.

A pre-defined default ACL for objects created in the bucket, for simple access control scenarios.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for PatchObject operations.

If present, selects a specific revision of this object (as opposed to the latest version, the default).

Precondition for patch: the object is only patched if the existing object's generation matches the given value.

Precondition for patch: the object is only patched if the existing object's generation does not match the given value.

Precondition for patch: the object is only patched if the existing object's meta-generation matches the given value.

Precondition for patch: the object is only patched if the existing object's meta-generation does not match the given value.

The projection of the updated object to return.

A pre-defined ACL for simple access control scenarios.

The encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Predefined access control lists (ACLs) that can be specified when creating or updating buckets.

Object owner gets owner access, and all authenticated users get reader access.

Object owner gets owner access.

Object owner gets owner access, and project team members get access according to their roles.

Object owner gets owner access, and all users get reader access.

Object owner gets owner access, and all users get writer access.

Predefined access control lists (ACLs) that can be specified when creating or updating objects.

Object owner gets owner access, and all authenticated users get reader access.

Object owner gets owner access, and project team owners get owner access.

Object owner gets owner access, and project team owners get reader access.

Object owner gets owner access.

Object owner gets owner access, and project team members get access according to their roles.

Object owner gets owner access, and all users get reader access.

Projections that can be specified as options in various operations.

Include all properties.

Omit the Acl property.

Options for SetBucketIamPolicy operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Class which can perform a resumable upload using a signed URL to initiate the session.

Creates a instance.

The signed URL which can be used to initiate a resumable upload session. See UrlSigner.ResumableHttpMethod for more information. The data to be uploaded. The options for the upload operation. The instance which can be used to upload the specified content.

Initiates the resumable upload session by posting to the signed URL and returns the session URI.

The signed URL which can be used to initiate a resumable upload session. See UrlSigner.ResumableHttpMethod for more information. The options for the upload operation. The session URI to use for the resumable upload.

Initiates the resumable upload session by posting to the signed URL and returns the session URI.

The signed URL which can be used to initiate a resumable upload session. See UrlSigner.ResumableHttpMethod for more information. The options for the upload operation. The token to monitor for cancellation requests. A task containing the session URI to use for the resumable upload.

The algorithm version to use in . See for usage.

The default signing version, where the version to use is chosen by the client library implementation.

Always use V2 URL signing.

Always use V4 URL signing.

String constants for the names of the storage classes and location types, as used in and . See https://cloud.google.com/storage/docs/storage-classes for details.

Name for the Multi-Regional location type.

Name for the Regional location type.

Name for the Nearline storage class.

Name for the Coldline storage class.

Name of the Standard storage class, which is equivalent to Multi-Regional or Regional depending on the location.

Name of the Durable Reduced Availability (DRA) location type. Use of this storage class is not recommended; Regional storage has lower pricing for some operations but otherwise the same pricing structure, and better performance/availability.

Name for the Archive storage class.

Abstract class providing operations for Google Cloud Storage.

This abstract class is provided to enable testability while permitting additional operations to be added in the future. See and to construct instances; alternatively, you can construct a directly from a . All instance methods declared in this class are virtual, with an implementation which simply throws . All these methods are overridden in . This class implements ; however, the method only requires calling if many short-lived instances of are being created. Most code would be expected to create a single StorageClient instance, and use this instance throughout the lifetime of the application. In this case, Dispose need not be called.

Creates a copy of an object synchronously, potentially to a different bucket. This method uses the rewriteObject underlying API operation for more flexibility and reliability.

The name of the bucket containing the object to copy. Must not be null. The name of the object to copy within the bucket. Must not be null. The name of the bucket to copy the object to. Must not be null. The name of the object within the destination bucket. Must not be null. Additional options for the copy operation. May be null, in which case appropriate defaults will be used. The representation of the new storage object resulting from the copy.

Creates a copy of an object synchronously, potentially to a different bucket. This method uses the rewriteObject underlying API operation for more flexibility and reliability.

The name of the bucket containing the object to copy. Must not be null. The name of the object to copy within the bucket. Must not be null. The name of the bucket to copy the object to. Must not be null. The name of the object within the destination bucket. Must not be null. Additional options for the copy operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the new storage object resulting from the copy.

Creates a storage bucket synchronously.

The ID of the project to create the buckets in. Must not be null. The name of the bucket to create. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The resource representation of the newly-created bucket.

Creates a storage bucket asynchronously.

The ID of the project to create the buckets in. Must not be null. The name of the bucket to create. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the resource representation of the newly-created bucket.

Creates a storage bucket synchronously.

The ID of the project to create the buckets in. Must not be null. The resource representation of the bucket to create. Must not be null, and must have a name. Additional options for the operation. May be null, in which case appropriate defaults will be used. The resource representation of the newly-created bucket.

Creates a storage bucket asynchronously.

The ID of the project to create the buckets in. Must not be null. The resource representation of the bucket to create. Must not be null, and must have a name. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the resource representation of the newly-created bucket.

The underlying storage service object used by this client.

The class only provides convenience operations built on top of an existing service object. Any more complex operations which are not supported by this wrapper may wish to use the same service object as the wrapper, in order to take advantage of its configuration (for authentication, application naming etc).

The customer-supplied encryption key used by default for all relevant object-based operations. This can be overridden in call-specific options. This will never return null in the built-in implementation; if no encryption key is specified, is returned.

Asynchronously creates a , using application default credentials if no credentials are specified.

The credentials are scoped as necessary. Optional . Optional to use for all relevant object-based operations by default. May be null. The task representing the created .

Synchronously creates a , using application default credentials if no credentials are specified.

The credentials are scoped as necessary. Optional . Optional to use for all relevant object-based operations by default. May be null. The created .

Creates a with no credentials. This can only be used in limited situations (where authentication isn't required), primarily downloading public data.

The created .

Dispose of this instance. See the remarks on when this should be called.

Deletes a bucket synchronously.

The name of the bucket to delete. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used.

Deletes a bucket asynchronously.

The name of the bucket to delete. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation.

Deletes a bucket synchronously.

Bucket to delete. Must not be null, and must have the name populated. Additional options for the operation. May be null, in which case appropriate defaults will be used.

Deletes bucket asynchronously.

Bucket to delete. Must not be null, and must have the name populated. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation.

Deletes a version of the specified object synchronously.

By default this will delete the latest version of the object, but this can be controlled using . For buckets that support multiple versions, implicitly deleting the latest version only archives it so the object is still available and can be listed by specifying . If the version is explicitly specified, the object is permanently deleted. If the bucket containing the object supports versioning, after this operation completes successfully there may still be another version of the same object. In buckets which do not support versioning, this operation will permanently delete the object. If the request attempts to delete an object that does not exist or a specific version that does not exist, this counts as a failure with an HTTP status code of 404. The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used.

Deletes a version of the specified object asynchronously.

By default this will delete the latest version of the object, but this can be controlled using . For buckets that support multiple versions, implicitly deleting the latest version only archives it so the object is still available and can be listed by specifying . If the version is explicitly specified, the object is permanently deleted. If the bucket containing the object supports versioning, after this operation completes successfully there may still be another version of the same object. In buckets which do not support versioning, this operation will permanently delete the object. If the request attempts to delete an object that does not exist or a specific version that does not exist, this counts as a failure with an HTTP status code of 404. The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation.

Deletes a version of the specified object synchronously.

By default this will delete the latest version of the object, but this can be controlled using . Note that any generation information contained within is ignored; the generation to delete is only controlled via . For buckets that support multiple versions, implicitly deleting the latest version only archives it so the object is still available and can be listed by specifying . If the version is explicitly specified, the object is permanently deleted. If the bucket containing the object supports versioning, after this operation completes successfully there may still be another version of the same object. In buckets which do not support versioning, this operation will permanently delete the object. If the request attempts to delete an object that does not exist or a specific version that does not exist, this counts as a failure with an HTTP status code of 404. Object to delete. Must not be null, and must have the name and bucket populated. Additional options for the operation. May be null, in which case appropriate defaults will be used.

Deletes a version of the specified object asynchronously.

By default this will delete the latest version of the object, but this can be controlled using . Note that any generation information contained within is ignored; the generation to delete is only controlled via . For buckets that support multiple versions, implicitly deleting the latest version only archives it so the object is still available and can be listed by specifying . If the version is explicitly specified, the object is permanently deleted. If the bucket containing the object supports versioning, after this operation completes successfully there may still be another version of the same object. In buckets which do not support versioning, this operation will permanently delete the object. If the request attempts to delete an object that does not exist or a specific version that does not exist, this counts as a failure with an HTTP status code of 404. Object to delete. Must not be null, and must have the name and bucket populated. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation.

Downloads the data for an object from storage synchronously, into a specified stream.

The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. The stream to write the data into. Must not be null. Additional options for the download. May be null, in which case appropriate defaults will be used. Progress reporter for the download. May be null.

Downloads the data for an object from storage asynchronously, into a specified stream.

The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. The stream to write the data into. Must not be null. Additional options for the download. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. Progress reporter for the download. May be null. A task representing the asynchronous operation.

Downloads the data for an object from storage synchronously, into a specified stream.

The generation number within is ignored by this method. To download a specific generation, use . Source object to download the data from. Must not be null. The stream to write the data into. Must not be null. Additional options for the download. May be null, in which case appropriate defaults will be used. Progress reporter for the download. May be null.

Downloads the data for an object from storage asynchronously, into a specified stream.

The generation number within is ignored by this method. To download a specific generation, use . Source object to download the data from. Must not be null. The stream to write the data into. Must not be null. Additional options for the download. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. Progress reporter for the download. May be null. A task representing the asynchronous operation.

Fetches the information about a bucket synchronously.

The name of the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The representation of the storage bucket.

Fetches the information about a bucket asynchronously.

The name of the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the storage bucket.

Fetches the IAM policy information about a bucket synchronously.

The name of the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The representation of the storage bucket IAM policy.

Fetches the IAM policy information about a bucket asynchronously.

The name of the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the storage bucket IAM policy.

Fetches the information about an object synchronously.

This does not retrieve the content of the object itself. Use to download the content. The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The representation of the storage object.

Fetches the information about an object asynchronously.

This does not retrieve the content of the object itself. Use to download the content. The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the storage object.

Synchronously creates a new HMAC key associated with a service account.

The project ID in which to create the HMAC key. Must not be null. The service account to associate with the HMAC key. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The new HMAC key, including the secret information in . This secret is only ever returned when creating a key.

Asynchronously creates a new HMAC key associated with a service account.

The project ID in which to create the HMAC key. Must not be null. The service account to associate with the HMAC key. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the the new HMAC key, including the secret information in . This secret is only ever returned when creating a key.

Synchronously fetches metadata for the specified HMAC key.

The project containing the HMAC key. Must not be null. The ID of the HMAC key. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The HMAC key metadata

Asynchronously fetches metadata for the specified HMAC key.

The project containing the HMAC key. Must not be null. The ID of the HMAC key. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the HMAC key metadata.

Lists the HMAC keys in a given project, synchronously but lazily, optionally filtering by service account email address.

This method fetches the buckets lazily, making requests to the underlying service for a page of results at a time, as required. No network requests are made until the returned sequence is enumerated. This means that any exception due to an invalid request will be deferred until that time. Callers should be prepared for exceptions to be thrown while enumerating the results. In addition to failures due to invalid requests, network or service failures can cause exceptions even after the first results have been returned. The project containing the HMAC keys. Must not be null. The service account email address to list keys for. May be null, in which case all HMAC keys associated with the project are returned. Additional options for the operation. May be null, in which case appropriate defaults will be used. A sequence of HMAC keys within the project.

Lists the HMAC keys in a given project, asynchronously and lazily, optionally filtering by service account email address.

This method fetches the buckets lazily, making requests to the underlying service for a page of results at a time, as required. No network requests are made until the returned sequence is enumerated. This means that any exception due to an invalid request will be deferred until that time. Callers should be prepared for exceptions to be thrown while enumerating the results. In addition to failures due to invalid requests, network or service failures can cause exceptions even after the first results have been returned. The project containing the HMAC keys. Must not be null. The service account email address to list keys for. May be null, in which case all HMAC keys associated with the project are returned. Additional options for the operation. May be null, in which case appropriate defaults will be used. An asynchronous sequence of HMAC keys within the project.

Synchronously updates an HMAC key's metadata.

The key to update. Must not be null, and the and properties must be set. Additional options for the operation. May be null, in which case appropriate defaults will be used. The updated key metadata.

Asynchronously updates an HMAC key's metadata.

The key to update. Must not be null, and the and properties must be set. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the updated key metadata.

Synchronously deletes an HMAC key, which must already have been deactivated.

The ID of the project containing the HMAC key to delete. The ID of the HMAC key to delete. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used.

Asynchronously deletes an HMAC key, which must already have been deactivated.

The ID of the project containing the HMAC key to delete. The ID of the HMAC key to delete. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation.

Asynchronously lists the buckets in a given project.

This method fetches the buckets lazily, making requests to the underlying service for a page of results at a time, as required. No network requests are made until the returned sequence is enumerated. This means that any exception due to an invalid request will be deferred until that time. Callers should be prepared for exceptions to be thrown while enumerating the results. In addition to failures due to invalid requests, network or service failures can cause exceptions even after the first results have been returned. The ID of the project to list the buckets from. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. An asynchronous sequence of buckets.

Lists the buckets for a given project, synchronously but lazily.

This method fetches the buckets lazily, making requests to the underlying service for a page of results at a time, as required. No network requests are made until the returned sequence is enumerated. This means that any exception due to an invalid request will be deferred until that time. Callers should be prepared for exceptions to be thrown while enumerating the results. In addition to failures due to invalid requests, network or service failures can cause exceptions even after the first results have been returned. The ID of the project to list the buckets from. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. A sequence of buckets within the project.

Asynchronously lists the objects in a given bucket.

This method fetches the objects lazily, making requests to the underlying service for a page of results at a time, as required. No network requests are made until the returned sequence is enumerated. This means that any exception due to an invalid request will be deferred until that time. Callers should be prepared for exceptions to be thrown while enumerating the results. In addition to failures due to invalid requests, network or service failures can cause exceptions even after the first results have been returned. The bucket to list the objects from. Must not be null. The prefix to match. Only objects with names that start with this string will be returned. This parameter may be null or empty, in which case no filtering is performed. The options for the operation. May be null, in which case defaults will be supplied. An asynchronous sequence of objects in the specified bucket.

Lists the objects in a given bucket, synchronously but lazily.

This method fetches the objects lazily, making requests to the underlying service for a page of results at a time, as required. No network requests are made until the returned sequence is enumerated. This means that any exception due to an invalid request will be deferred until that time. Callers should be prepared for exceptions to be thrown while enumerating the results. In addition to failures due to invalid requests, network or service failures can cause exceptions even after the first results have been returned. The bucket to list the objects from. Must not be null. The prefix to match. Only objects with names that start with this string will be returned. This parameter may be null or empty, in which case no filtering is performed. The options for the operation. May be null, in which case defaults will be supplied. A sequence of objects in the specified bucket.

Locks the retention policy of a bucket. This is a one-way process: once a retention policy is locked, it cannot be shortened, removed or unlocked, although it can be increased in duration. The lock persists until the bucket is deleted.

The name of the bucket whose retention policy should be locked. Must not be null. The current metageneration of the bucket, used to validate that the bucket version to be locked is the intended one. The options for the operation. May be null, in which case defaults will be supplied.

Asynchronously locks the retention policy of a bucket. This is a one-way process: once a retention policy is locked, it cannot be shortened, removed or unlocked, although it can be increased in duration. The lock persists until the bucket is deleted.

The name of the bucket whose retention policy should be locked. Must not be null. The current metageneration of the bucket, used to validate that the bucket version to be locked is the intended one. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A task representing the asynchronous operation.

Sets the value for a single label on a bucket. The label will be added if it does not exist, or updated if it already exists.

This method is implemented by creating a single-element dictionary which is passed to . The name of the bucket. Must not be null. The name of the label to set. Must not be null. The value of the label to set. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The previous value of the label, or null if the label did not previously exist.

Removes a label from a bucket, if it previously existed. It is not an error to attempt to remove a label that doesn't already exist.

This method is implemented by creating a single-element dictionary which is passed to . The name of the bucket. Must not be null. The name of the label to remove. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The previous value of the label, or null if the label did not previously exist.

Sets or removes one or more labels on a bucket.

Each entry in is treated as a label to set or remove. If the value is null, it will be removed from the bucket; otherwise, it will be set/added. Labels which do not have an entry in the dictionary will be ignored. The name of the bucket. Must not be null. The labels to set. Must contain at least one entry; keys must not be null, but values may be (indicating label removal). The options for the operation. May be null, in which case defaults will be supplied. A dictionary with the same keys as , and values indicating the corresponding label value before this operation completed. Labels which weren't present on the bucket before the modification have corresponding null values in the returned dictionary.

Clears all labels on a bucket.

The name of the bucket. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. A dictionary with the labels on the bucket before they were cleared.

Sets the value for a single label on a bucket asynchronously. The label will be added if it does not exist, or updated if it already exists.

This method is implemented by creating a single-element dictionary which is passed to . The name of the bucket. Must not be null. The name of the label to set. Must not be null. The value of the label to set. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. The previous value of the label, or null if the label did not previously exist.

Removes a label from a bucket, if it previously existed, asynchronously. It is not an error to attempt to remove a label that doesn't already exist.

This method is implemented by creating a single-element dictionary which is passed to . The name of the bucket. Must not be null. The name of the label to remove. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. The previous value of the label, or null if the label did not previously exist.

Sets or removes one or more labels on a bucket asynchronously.

Each entry in is treated as a label to set or remove. If the value is null, it will be removed from the bucket; otherwise, it will be set/added. Labels which do not have an entry in the dictionary will be ignored. The name of the bucket. Must not be null. The labels to set. Must contain at least one entry; keys must not be null, but values may be (indicating label removal). The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A dictionary with the same keys as , and values indicating the corresponding label value before this operation completed. Labels which weren't present on the bucket before the modification have corresponding null values in the returned dictionary.

Clears all labels on a bucket asynchronously.

The name of the bucket. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A dictionary with the labels on the bucket before they were cleared.

Retrieves the service account email address that Google Cloud Storage uses for operations on other services such as Google Cloud Pub/Sub.

ID of the project to retrieve the service account for. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The email address of the service account.

Asynchronously retrieves the service account email address that Google Cloud Storage uses for operations on other services such as Google Cloud Pub/Sub.

ID of the project to retrieve the service account for. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the email address of the service account.

Creates a notification configuration.

The bucket for which to create the notification configuration. Must not be null. The notification configuration to create. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The representation of the newly-created notification configuration.

Asynchronously creates a notification configuration.

The bucket for which to create the notification configuration. Must not be null. The notification configuration to create. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the newly-created notification configuration.

Fetches a notification configuration.

The bucket associated with the notification configuration. Must not be null. ID of the notification configuration to fetch. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The representation of the notification configuration.

Asynchronously fetches a notification configuration.

The bucket associated with the notification configuration. Must not be null. ID of the notification configuration to fetch. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the notification configuration.

Lists notification configurations associated with a bucket.

The bucket for which to list associated notification configurations. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. A list of notification configurations associated with the specified bucket. This method never returns null.

Asynchronously lists notification configurations associated with a bucket.

The bucket for which to list associated notification configurations. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the list of notification configurations associated with the specified bucket. The result is never null.

Deletes a notification configuration.

The bucket associated with the notification configuration. Must not be null. ID of the notification configuration to delete. Must not be null. The options for the operation. May be null, in which case defaults will be supplied.

Asynchronously deletes a notification configuration.

The bucket associated with the notification configuration. Must not be null. ID of the notification configuration to delete. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A task representing the asynchronous operation.

Patches the metadata for a storage bucket synchronously.

Bucket to update. Must not be null, and must have a populated Name property. Additional options for the update. May be null, in which case appropriate defaults will be used. The representation of the updated storage bucket.

Patches the metadata for a storage bucket asynchronously.

Bucket to update. Must not be null, and must have a populated Name property. Additional options for the update. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the bucket storage bucket.

Patches the metadata for an object in storage synchronously.

Object to update. Must not be null, and must have populated Name and Bucket properties. Additional options for the update. May be null, in which case appropriate defaults will be used. The representation of the updated storage object.

Patches the metadata for an object in storage asynchronously.

Object to update. Must not be null, and must have populated Name and Bucket properties. Additional options for the update. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the updated storage object.

Updates the IAM policy information about a bucket synchronously.

The name of the bucket. Must not be null. The new IAM policy for the bucket. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The representation of the resulting storage bucket IAM policy.

Updates the IAM policy information about a bucket asynchronously.

The name of the bucket. Must not be null. The new IAM policy for the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the resulting storage bucket IAM policy.

Tests the IAM permissions for a bucket synchronously.

The name of the bucket. Must not be null. The permissions to test. Must not be null or empty. Additional options for the operation. May be null, in which case appropriate defaults will be used. The permissions held by the caller.

Tests the IAM policy information about a bucket asynchronously.

The name of the bucket. Must not be null. The permissions to test. Must not be null or empty. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the permissions held by the caller.

Updates the metadata for a storage bucket synchronously.

If no preconditions are explicitly set in , the metageneration of is used as a precondition for the update, unless is set to true. Bucket to update. Must not be null, and must have a populated Name. Additional options for the update. May be null, in which case appropriate defaults will be used. The representation of the updated storage bucket.

Updates the metadata for storage bucket asynchronously.

If no preconditions are explicitly set in , the metageneration of is used as a precondition for the update, unless is set to true. Bucket to update. Must not be null, and must have a populated Name. Additional options for the update. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the storage bucket.

Updates the metadata for an object in storage synchronously.

If no preconditions are explicitly set in , the generation and metageneration of are used as a precondition for the update, unless is set to true. Object to update. Must not be null, and must have populated Name and Bucket properties. Additional options for the update. May be null, in which case appropriate defaults will be used. The representation of the updated storage object.

Updates the metadata for an object in storage asynchronously.

If no preconditions are explicitly set in , the generation and metageneration of are used as a precondition for the update, unless is set to true. Object to update. Must not be null, and must have populated Name and Bucket properties. Additional options for the update. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the storage object.

Creates an instance which is capable of starting a resumable upload for an object.

The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. The content type of the object. This should be a MIME type such as "text/html" or "application/octet-stream". May be null. The stream to read the data from. Must not be null. Additional options for the upload. May be null, in which case appropriate defaults will be used. The which can be used to upload the object.

Creates an instance which is capable of starting a resumable upload for an object.

Object to create or update. Must not be null, and must have the name, bucket and content type populated. The stream to read the data from. Must not be null. Additional options for the upload. May be null, in which case appropriate defaults will be used. The which can be used to upload the object.

Uploads the data for an object in storage synchronously, from a specified stream.

The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. The content type of the object. This should be a MIME type such as "text/html" or "application/octet-stream". May be null. The stream to read the data from. Must not be null. Additional options for the upload. May be null, in which case appropriate defaults will be used. Progress reporter for the upload. May be null. The representation of the uploaded object.

Uploads the data for an object in storage asynchronously, from a specified stream.

The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. The content type of the object. This should be a MIME type such as "text/html" or "application/octet-stream". May be null. The stream to read the data from. Must not be null. Additional options for the upload. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. Progress reporter for the upload. May be null. A task representing the asynchronous operation, with a result returning the representation of the uploaded object.

Uploads the data for an object in storage synchronously, from a specified stream.

Object to create or update. Must not be null, and must have the name, bucket and content type populated. The stream to read the data from. Must not be null. Additional options for the upload. May be null, in which case appropriate defaults will be used. Progress reporter for the upload. May be null. The representation of the uploaded object.

Uploads the data for an object in storage asynchronously, from a specified stream.

Object to create or update. Must not be null, and must have the name, bucket and content type populated. The stream to read the data from. Must not be null. Additional options for the upload. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. Progress reporter for the upload. May be null. A task representing the asynchronous operation, with a result returning the representation of the uploaded object.

A builder for , allowing simple client customization.

If set to true, no credentials are created when the client is built.

The customer-supplied encryption key used by default for all relevant object-based operations.

Wrapper around to provide simpler operations.

This is the "default" implementation of . Most client code should refer to , creating instances with and . The constructor of this class is public for the sake of constructor-based dependency injection.

The default application name used when creating a . Defaults to "google-cloud-dotnet"; must not be null.

Most applications will never want to set this, which is why it's in this class rather than .

Constructs a new client wrapping the given .

The service to wrap. Must not be null. Optional to use for object-based operations by default. May be null, in which case will be used.

Regular expression to be used for bucket validation when would throw the wrong exception.

Validates that a bucket only contains valid characters, and is not too long. This is far from complete validation, but is all that's required to ensure that it's safe to include in a URL. This method also checks for nullity, so callers don't need to do that first. This method is internal rather than private for testing purposes.

The input, to allow inline validation

Validates that the given Bucket has a "somewhat valid" (no URI encoding required) bucket name.

Bucket to validate The parameter name in the calling method The validated bucket name

Validates that the given Object has a "somewhat valid" (no URI encoding required) bucket name and an object name.

Object to validate The parameter name in the calling method

Applies an encryption key to a request. Note that there is no overload without a kmsNameFromOptions, even though most requests don't have one, just to avoid missing one accidentally.

The encryption key specified in the operation-specific options, or null. The KMS key name specified in the operation-specific options, or null. The request to apply this to.

Constructs the media URL of an object from its bucket and name. This does not include the generation or any GaxPreconditions. The returned string will always have a query parameter, so later query parameters can unconditionally be appended with an "&" prefix.

Obtains the media URL of an object from its bucket and name. The returned string will always have a query parameter, so later query parameters can unconditionally be appended with an "&" prefix.

Helper class to provide common context between sync and async operations. Helps avoid quite so much duplicate code...

Options for TestBucketIamPermissions operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for UpdateBucket operations.

Precondition for update: the bucket is only updated if its current meta-generation matches the given value.

Precondition for update: the bucket is only updated if its current meta-generation does not match the given value.

The projection of the updated object to return.

A pre-defined ACL of the bucket for simple access control scenarios.

A pre-defined default ACL for objects created in the bucket, for simple access control scenarios.

If set to true, no other preconditions must be set, and the local metageneration of the bucket being updated is not used to create a precondition.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for UpdateHmacKey operations.

Options for UpdateObject operations.

If present, selects a specific revision of this object (as opposed to the latest version, the default).

Precondition for update: the object is only updated if the existing object's generation matches the given value.

Precondition for update: the object is only updated if the existing object's generation does not match the given value.

Precondition for update: the object is only updated if the existing object's meta-generation matches the given value.

Precondition for update: the object is only updated if the existing object's meta-generation does not match the given value.

The projection of the updated object to return.

A pre-defined ACL for simple access control scenarios.

If set to true, no other preconditions must be set, and the local metageneration of the object being updated is not used to create a precondition.

The encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options for UploadObject operations.

The minimum chunk size for uploading.

Precondition for upload: the object is only uploaded if the existing object's generation matches the given value.

Precondition for upload: the object is only uploaded if the existing object's generation does not match the given value.

Precondition for upload: the object is only uploaded if the existing object's meta-generation matches the given value.

Precondition for upload: the object is only uploaded if the existing object's meta-generation does not match the given value.

The chunk size to use for each request. When setting to a non-null value, this must be a positive multiple of .

A pre-defined ACL for simple access control scenarios.

The projection of the uploaded object to retrieve.

The customer-supplied encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

The name of the Cloud KMS key to use to encrypt the object.

Currently, either customer-supplied encryption or a Cloud KMS key can be used, but not both. If this property is null and customer-supplied encryption is not being used, the bucket encryption defaults will be used to determine the encryption for the object. If this property is non-null and the client object has a default encryption key, the property of this options object must be set to to make the intention clear.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Specifies how the upload should be validated for data integrity. If this property is null, this is equivalent to .

The hash is only validated at the end of the upload, after the object has been created. An exception is thrown if it's incorrect, but the object will still exist unless the validation action deletes it.

If set, an Origin header is included when initiating the resumable upload. This allows for Cross-Origin Resource Sharing, as documented at https://cloud.google.com/storage/docs/cross-origin.

Exception thrown when an upload failed validation.

The hash computed locally, in base64.

The uploaded object.

A collection of additional failures following on from this one, if any. For example, if the validation mode indicates that on failure the file should be deleted, but the deletion fails, that exception would be present here. This property is either null, or returns an containing one or more exceptions; it will never return an empty .

Creates a new exception.

The hash of the uploaded data, as computed at the client. Must not be null. The object created by Google Cloud Storage. Must not be null. Any additional failures encountered while handling the error. May be null; if non-null, must contain at least one exception.

Describes the validation behavior when uploading data.

The upload is not validated.

The hash of the data is computed while uploading, and if the resulting object has a different hash, an is thrown, but the object remains present in Storage.

The hash of the data is computed while uploading, and if the resulting object has a different hash, an attempt is made to delete the object. Whether the deletion fails or not, an is thrown. If the deletion fails, that failure can be examined via

Class which helps create signed URLs which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs.

Gets a special HTTP method which can be used to create a signed URL for initiating a resumable upload. See https://cloud.google.com/storage/docs/access-control/signed-urls#signing-resumable for more information.

Note: When using the RESUMABLE method to create a signed URL, a URL will actually be signed for the POST method with a header of 'x-goog-resumable:start'. The caller must perform a POST request with this URL and specify the 'x-goog-resumable:start' header as well or signature validation will fail.

Creates a new instance for a service account.

The path to the JSON key file for a service account. Must not be null. The does not refer to a valid JSON service account key file.

Creates a new instance for a service account.

The stream from which to read the JSON key data for a service account. Must not be null. The does not contain valid JSON service account key data.

Creates a new instance for a service account.

The credential for the a service account. Must not be null.

Creates a new instance for a custom blob signer.

This method is typically used when a service account credential file isn't available, either for testing or to use the IAM service's blob signing capabilities. The blob signer to use. Must not be null. A new using the specified blob signer.

Returns a new instance of using the same signing source (e.g. a service account private key) but with the specified URL signing algorithm version.

The algorithm version to use when signing URLs. A new instance using the specified version.

Only available for testing purposes, this allows the clock used for signature generation to be replaced.

Creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When the is specified, some of its headers will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If is null, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the sample specified only needs to have the x-goog-encryption-algorithm request header. The other headers can be included, but will be ignored. Note that when GET is specified as the , both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The length of time for which the signed URL should remain usable. A sample request for which the signed URL might be used. May be null. The signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When the is specified, some of its headers will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If is null, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the sample specified only needs to have the x-goog-encryption-algorithm request header. The other headers can be included, but will be ignored. Note that when GET is specified as the , both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. Note that if a null value is passed for , an expiry date of 2038 is used. This is the maximum date that can be represented as an expiry date. This behavior maintains as much compatibility as possible with previous versions of this library, but ensures that an expiry date is always provided, in-keeping with server-side requirements. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The point in time after which the signed URL will be invalid. May be null, in which case the signed URL expires in 2038. A sample request for which the signed URL might be used. May be null. The signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When the is specified, some of its headers will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If is null, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the sample specified only needs to have the x-goog-encryption-algorithm request header. The other headers can be included, but will be ignored. Note that when GET is specified as the , both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The point in time after which the signed URL will be invalid. A sample request for which the signed URL might be used. May be null. The signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When either of the headers collections are specified, there are certain headers which will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If the headers collections are null or empty, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the specified only need to have the x-goog-encryption-algorithm header. The other headers can be included, but will be ignored. Note that when GET is specified as the (or it is null, in which case GET is used), both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The length of time for which the signed URL should remain usable. The HTTP request method for which the signed URL is allowed to be used. May be null, in which case GET will be used. The headers which will be included with the request. May be null. The headers for the content which will be included with the request. May be null. The signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When either of the headers collections are specified, there are certain headers which will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If the headers collections are null or empty, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the specified only need to have the x-goog-encryption-algorithm header. The other headers can be included, but will be ignored. Note that when GET is specified as the (or it is null, in which case GET is used), both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. Note that if a null value is passed for , an expiry date of 2038 is used. This is the maximum date that can be represented as an expiry date. This behavior maintains as much compatibility as possible with previous versions of this library, but ensures that an expiry date is always provided, in-keeping with server-side requirements. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The point in time after which the signed URL will be invalid. May be null, in which case the signed URL expires in 2038. The HTTP request method for which the signed URL is allowed to be used. May be null, in which case GET will be used. The headers which will be included with the request. May be null. The headers for the content which will be included with the request. May be null. The signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When either of the headers collections are specified, there are certain headers which will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If the headers collections are null or empty, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the specified only need to have the x-goog-encryption-algorithm header. The other headers can be included, but will be ignored. Note that when GET is specified as the (or it is null, in which case GET is used), both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The point in time after which the signed URL will be invalid. The HTTP request method for which the signed URL is allowed to be used. May be null, in which case GET will be used. The headers which will be included with the request. May be null. The headers for the content which will be included with the request. May be null. The signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Asynchronously creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When the is specified, some of its headers will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If is null, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the sample specified only needs to have the x-goog-encryption-algorithm request header. The other headers can be included, but will be ignored. Note that when GET is specified as the , both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The length of time for which the signed URL should remain usable. A sample request for which the signed URL might be used. May be null. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Asynchronously creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When the is specified, some of its headers will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If is null, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the sample specified only needs to have the x-goog-encryption-algorithm request header. The other headers can be included, but will be ignored. Note that when GET is specified as the , both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. Note that if a null value is passed for , an expiry date of 2038 is used. This is the maximum date that can be represented as an expiry date. This behavior maintains as much compatibility as possible with previous versions of this library, but ensures that an expiry date is always provided, in-keeping with server-side requirements. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The point in time after which the signed URL will be invalid. May be null, in which case the signed URL expires in 2038. A sample request for which the signed URL might be used. May be null. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Asynchronously creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When the is specified, some of its headers will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If is null, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the sample specified only needs to have the x-goog-encryption-algorithm request header. The other headers can be included, but will be ignored. Note that when GET is specified as the , both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The point in time after which the signed URL will be invalid. A sample request for which the signed URL might be used. May be null. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Asynchronously creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When either of the headers collections are specified, there are certain headers which will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If the headers collections are null or empty, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the specified only need to have the x-goog-encryption-algorithm header. The other headers can be included, but will be ignored. Note that when GET is specified as the (or it is null, in which case GET is used), both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The length of time for which the signed URL should remain usable. The HTTP request method for which the signed URL is allowed to be used. May be null, in which case GET will be used. The headers which will be included with the request. May be null. The headers for the content which will be included with the request. May be null. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Asynchronously creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When either of the headers collections are specified, there are certain headers which will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If the headers collections are null or empty, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the specified only need to have the x-goog-encryption-algorithm header. The other headers can be included, but will be ignored. Note that when GET is specified as the (or it is null, in which case GET is used), both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. Note that if a null value is passed for , an expiry date of 2038 is used. This is the maximum date that can be represented as an expiry date. This behavior maintains as much compatibility as possible with previous versions of this library, but ensures that an expiry date is always provided, in-keeping with server-side requirements. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The point in time after which the signed URL will be invalid. May be null, in which case the signed URL expires in 2038. The HTTP request method for which the signed URL is allowed to be used. May be null, in which case GET will be used. The headers which will be included with the request. May be null. The headers for the content which will be included with the request. May be null. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Asynchronously creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. When either of the headers collections are specified, there are certain headers which will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If the headers collections are null or empty, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the specified only need to have the x-goog-encryption-algorithm header. The other headers can be included, but will be ignored. Note that when GET is specified as the (or it is null, in which case GET is used), both GET and HEAD requests can be made with the created signed URL. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The point in time after which the signed URL will be invalid. The HTTP request method for which the signed URL is allowed to be used. May be null, in which case GET will be used. The headers which will be included with the request. May be null. The headers for the content which will be included with the request. May be null. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Prepares a header value for signing, trimming both ends and collapsing internal whitespace.

Represents the capability of signing a blob in a suitable form for Google Cloud Storage signed URLs. This allows testing URL signing without credentials being available, as well as using Google Cloud IAM to sign blobs.

Synchronously signs the given blob.

The data to sign. Must not be null. The blob signature as base64 text.

Asynchronously signs the given blob.

The data to sign. Must not be null. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the blob signature as base64 text.

The identity of the signer, typically an email address.

Abstraction over V2/V4 signing details.

Implementation of to sign a blob from a service account credential. We already have the private key, so don't need to perform any IO.

State which needs to be carried between the "pre-signing" stage and "post-signing" stages of the implementation.

State which needs to be carried between the "pre-signing" stage and "post-signing" stages of the implementation.