Google.Cloud.Storage.V1

Options for CopyObject operations.

The generation of the object resource to copy. When not set, the latest generation will be copied.

The projection to retrieve.

A predefined set of ACLs for the new object.

Precondition for copying: the object is only copied if the existing destination object's generation matches the given value.

Precondition for copying: the object is only copied if the existing destination object's generation does not match the given value.

Precondition for copying: the object is only copied if the existing destination object's meta-generation matches the given value.

Precondition for copying: the object is only copied if the existing destination object's meta-generation does not match the given value.

Precondition for copying: the object is only copied if the source object's generation matches the given value.

Precondition for copying: the object is only copied if the source object's generation does not match the given value.

Precondition for copying: the object is only copied if the source object's meta-generation matches the given value.

Precondition for copying: the object is only copied if the source object's meta-generation does not match the given value.

Additional object metadata for the new object. This can be used to specify the storage class of the new object, the content type etc. If this property is not set, the existing object metadata will be used unchanged.

The encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

The encryption key to use for the source of the copy. If this property is null, the will be used instead. Use if the source is not encrypted.

The name of the Cloud KMS key to use to encrypt the new object.

Currently, either customer-supplied encryption or a Cloud KMS key can be used, but not both. If this property is null and customer-supplied encryption is not being used, the bucket encryption defaults will be used to determine the encryption for the object. If this property is non-null and the client object has a default encryption key, the property of this options object must be set to to make the intention clear.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Implementation of CRC32c for checking data integrity. At some point we may want to move this into GoogleApis.

Updates the hash with the given data.

Array containing the data to hash First offset of data to hash Number of bytes to hash

Returns the current hash.

Options for CreateBucket operations.

A pre-defined ACL of the bucket for simple access control scenarios.

A pre-defined default ACL for objects created in the bucket, for simple access control scenarios.

The projection to retrieve.

Options to pass custom retry configuration for each API request.

Options for CreateHmacKey operations.

Options to pass custom retry configuration for each API request.

Options for CreateNotification operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Upload subclass which allows us to modify headers, for customer-supplied encryption keys.

Options for DeleteBucket operations.

Precondition for deletion: the bucket is only deleted if its meta-generation matches the given value.

Precondition for deletion: the bucket is only deleted if its meta-generation does not match the given value.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

If set to true, all objects within the bucket will be deleted before attempting to delete the bucket itself.

This is a best-effort attempt, with no guarantees of atomicity: it's entirely possible for the operation to fail having deleted some objects but not all of them. If a precondition is specified, it is checked before deleting any objects, and applied again when deleting the bucket, but is not checked while deleting the objects. The behavior is unspecified if objects are modified, added or deleted while this operation is taking place. The objects are deleted sequentially. If you need to delete buckets with many objects, you may wish to implement a parallel solution in application code instead of using this option. If is set, that project will be billed for all operations.

Options to pass custom retry configuration for each API request.

If this set of options contains any preconditions, return a with the same set of options. Otherwise, return null.

Options for DeleteHmacKey operations.

Options to pass custom retry configuration for each API request.

Options for DeleteNotification operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Options for DeleteObject operations.

The generation to delete. If this is not specified, the latest generation will be deleted.

Precondition for deletion: the object is only deleted if the object's current generation matches the given value.

Precondition for deletion: the object is only deleted if the object's current generation does not match the given value.

Precondition for deletion: the object is only deleted if the object's current meta-generation matches the given value.

Precondition for deletion: the object is only deleted if the object's current meta-generation does not match the given value.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Options for DownloadObject operations.

The chunk size to use for each request.

The generation to download. When not specified, the latest version is always downloaded.

Precondition for download: the object is only downloaded if its generation matches the given value.

Precondition for download: the object is only downloaded if its generation does not match the given value.

Precondition for download: the object is only downloaded if its meta-generation matches the given value.

Precondition for download: the object is only downloaded if its meta-generation does not match the given value.

If non-null, limits the range of bytes of the object to download.

The encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Specifies whether or not the object's hash should be validated. If this property is null, the hash will always be validated.

This is effectively an escape hatch for situations where hash validation fails. See https://github.com/googleapis/google-cloud-dotnet/issues/1641 for background on this option. It is recommended that you leave this option unset (or use ) unless you are knowingly downloading data for an object where hashing will fail. The current implementation defaults to ; in a future major version the default will change to which will automatically ignore the hash where validation is expected to fail (even with valid data).

Describes the circumstances under which the hash of an object is validated when downloading.

The hash is always validated.

The hash is never validated; data integrity errors may still be exposed via other network layers, but there is a risk of data loss.

The hash is validated if the library can detect that validation should be feasible. If response headers provide information to indicate that hash validation will fail (even in the face of correct data), the hash is not validated.

An AES-256 key passed to the Google Cloud Storage servers via headers to allow objects to be encrypted at rest using a client-supplied key rather than a server-supplied default key. An alternative to customer-supplied encryption keys is to use customer-managed encryption keys, via Cloud KMS.

A "don't encrypt" key, used in call-specific options to indicate that a particular request should not use encryption even if the client has a default encryption key.

The base64 representation of the key. This will always be 45 characters long, or null for .

The base64 representation of the SHA-256 hash of the key. This will always be 45 characters long, or null for .

Creates an encryption key from the specified raw bytes.

The raw key data; must be non-null and 32 bytes long. An based on .

Generates a random encryption key using .

A generated encryption key.

Adds encryption headers to the specified request, unless this key is ,

The request to modify. Must not be null.

Options for GetBucketIamPolicy operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

The version of IAM policies to request. If a policy with a condition is requested without setting this, the server will return an error. This must be set to a value of 3 to retrieve IAM policies containing conditions. This is to prevent client code that isn't aware of IAM conditions from interpreting and modifying policies incorrectly.

Options to pass custom retry configuration for each API request.

Options for GetBucket operations.

Precondition for retrieval: the bucket is only fetched if its meta-generation matches the given value.

Precondition for retrieval: the bucket is only fetched if its meta-generation does not match the given value.

The projection to retrieve.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Options for GetHmacKey operations.

Options to pass custom retry configuration for each API request.

Options for GetNotification operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Options for GetObject operations.

The generation of the object resource to fetch. When not set, the latest generation will be retrieved.

The projection to retrieve.

Precondition for retrieval: the object is only fetched if the object's current generation matches the given value.

Precondition for retrieval: the object is only fetched if the object's current generation does not match the given value.

Precondition for retrieval: the object is only fetched if the object's current meta-generation matches the given value.

Precondition for retrieval: the object is only fetched if the object's current meta-generation does not match the given value.

The encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Options for GetStorageServiceAccountEmail operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Subclass of which (potentially) validates the data it receives against a CRC32c hash set in the header.

Constructs a new downloader with the given client service.

String constants for the names of the storage classes, as used in .

The key is active, and can be used for signing. It cannot be deleted in this state.

The key is inactive, and can be used for signing. It can be deleted.

The key has been deleted.

Options for ListBuckets operations.

The prefix to match. Only buckets with names that start with this string will be returned.

The number of results to return per page. (This modifies the per-request page size; it does not affect the total number of results returned.)

The projection to retrieve.

If set, this token is used to indicate a continued list operation. The value should be taken from the NextPageToken property of either a or a raw response from .

If set, this specifies the fields to fetch in the result to obtain partial responses, usually to improve performance. For example, to fetch just the name and location of each bucket, set this property to "items(name,location),nextPageToken". The "nextPageToken" field is required in order to fetch multiple pages; the library does not add this automatically. See https://cloud.google.com/storage/docs/json_api/v1/how-tos/performance#partial for more details on specifying fields for partial responses.

Options to pass custom retry configuration for each API request.

Modifies the specified request for all non-null properties of this options object.

The request to modify

Options for ListHmacKey operations.

The number of results to return per page. (This modifies the per-request page size; it does not affect the total number of results returned.)

If set, this token is used to indicate a continued list operation. The value should be taken from the NextPageToken property of either a or a raw response from .

If set, this determines whether deleted keys are included in the results.

Options to pass custom retry configuration for each API request.

Options for ListNotifications operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Options for ListObjects operations.

Used to list in "directory mode". Only objects whose names (aside from the prefix) do not contain the delimiter will be returned.

If true, objects that end in exactly one instance of delimiter will have their metadata included in the returned.

The number of results to return per page. (This modifies the per-request page size; it does not affect the total number of results returned.)

Controls whether or not multiple versions of an object are listed separately (true) or not (false). The default API behavior is equivalent to setting this to false, but it is still a nullable property to allow the intention of "definitely false" to be separate from "not set".

The projection to retrieve.

A glob pattern used to filter results. See https://cloud.google.com/storage/docs/json_api/v1/objects/list#list-object-glob for more details.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

If set, this token is used to indicate a continued list operation. The value should be taken from the NextPageToken property of either a or a raw response from .

If set, this specifies the fields to fetch in the result to obtain partial responses, usually to improve performance. For example, to fetch just the name and content type of each object, set this property to "items(name,contentType),nextPageToken". The "nextPageToken" field is required in order to fetch multiple pages; the library does not add this automatically. See https://cloud.google.com/storage/docs/json_api/v1/how-tos/performance#partial for more details on specifying fields for partial responses.

If set, filters results to objects whose names are lexicographically equal to or after this value. (Objects whose names are exactly the start offset are included.)

If set, filters results to objects whose names are lexicographically before this value. (Objects whose names are exactly the end offset are excluded.)

Options to pass custom retry configuration for each API request.

Modifies the specified request for all non-null properties of this options object.

The request to modify

Options for LockBucketRetentionPolicy operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

MediaDownloader subclass which populates an instance from the headers it sees on a successful response. Note: if this ever becomes public, we should put more effort into naming it carefully.

Constructs a new downloader with the given client service.

The object in which to record metadata. The client service.

Options for operations which modify bucket labels.

The default number of retries.

Precondition for modification: the labels are only modified if its current meta-generation matches the given value.

The number of times to retry the modification if the bucket's metageneration changes in the read/modify/write cycle. If this property is not set, a suitable default is used. The value must not be negative.

Modifying bucket labels involves reading the bucket metadata in one request, then sending another request with the new labels, including a metageneration check to ensure that the bucket hasn't changed between the two requests. If the metageneration *has* changed, the overall operation can be retried from the start. This property indicates the number of retries, so it has a minimum value of 0.

Options for PatchBucket operations.

Precondition for patch: the bucket is only patched if its current meta-generation matches the given value.

Precondition for patch: the bucket is only patched if its current meta-generation does not match the given value.

The projection of the updated object to return.

A pre-defined ACL of the bucket for simple access control scenarios.

A pre-defined default ACL for objects created in the bucket, for simple access control scenarios.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Options for PatchObject operations.

If present, selects a specific revision of this object (as opposed to the latest version, the default).

Precondition for patch: the object is only patched if the existing object's generation matches the given value.

Precondition for patch: the object is only patched if the existing object's generation does not match the given value.

Precondition for patch: the object is only patched if the existing object's meta-generation matches the given value.

Precondition for patch: the object is only patched if the existing object's meta-generation does not match the given value.

The projection of the updated object to return.

A pre-defined ACL for simple access control scenarios.

The encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Predefined access control lists (ACLs) that can be specified when creating or updating buckets.

Object owner gets owner access, and all authenticated users get reader access.

Object owner gets owner access.

Object owner gets owner access, and project team members get access according to their roles.

Object owner gets owner access, and all users get reader access.

Object owner gets owner access, and all users get writer access.

Predefined access control lists (ACLs) that can be specified when creating or updating objects.

Object owner gets owner access, and all authenticated users get reader access.

Object owner gets owner access, and project team owners get owner access.

Object owner gets owner access, and project team owners get reader access.

Object owner gets owner access.

Object owner gets owner access, and project team members get access according to their roles.

Object owner gets owner access, and all users get reader access.

Projections that can be specified as options in various operations.

Include all properties.

Omit the Acl property.

Handler for exponential backoff for request messages which permit retries. This is similar to BackoffHandler in Google.Apis.Http, but that doesn't give us enough flexibility. This handler does not enforce a maximum number of retries; that's configured via .

It marks the request as retriable with the retry options as provided. In case null retry options or Never is passed, retry will not happen in case of failure.

Interceptor which adds a random invocation ID within the x-goog-api-client header, along with an attempt count.

Options used to indicate the retry configuration for an API request in case of failure. This class is immutable. These determine whether and how the request should be retried.

Options used by default for idempotent operations upon failure. It has all retry timings reset to defaults and retry predicate based on default error codes.

This configuration ensures that the API request is never retried on failure.

In case of partially idempotent operations, this method checks the conditions required to mark it as retriable. If the condition is available then the operation is retried.

An indicator of whether the operation should be retried or not. This method returns if the value is not null, or if the value is null.

Creates an instance based on the given timing and predicate.

Timing configuration to apply when retrying. May be null, in which case the default timing will be used. Predicate to apply to determine whether an error response can be retried. May be null, in which case default error codes will be used.

Specifies the conditions under which a failed operation is retried. This class is immutable.

Default retriable error codes for which the operation would retry unless otherwise specified by the user.

Returns a Retry Predicate which will ensure that the operation will never retry in case of failure.

Returns a predicate which will retry on the specified HTTP error codes. Note that only these error codes will be retried; the default error codes are not used by the returned predicate.

Error codes on which to retry. Returns a predicate which retries on the specified error codes.

Returns a predicate which will retry based on the result of the specified delegate, which is provided with the HTTP error code for the response.

Predicate used to determine whether or not to retry. May be null, in which case will be returned. Returns the retry predicate with the conditions specified for retrying.

Options to control the delays between attempts when retrying failed API requests. This class is immutable.

The default initial backoff time between the first attempt and the first retry. The default is 1 second.

The default maximum backoff time between retries. The default is 32 seconds.

The default maximum backoff multiplier to be applied on each iteration. The default is 2.

Returns the retry timing configurations all set to default.

The backoff time between the first attempt and the first retry.

Maximum backoff time between retries.

The multiplier to apply to the previous backoff on each iteration, leading to exponential backoff.

Creates an instance with the specified values.

Initial backoff for retry. Must be non-negative. Maximum backoff for retry. Must be greater than or equal to . Backoff multiplier for retry. Must be greater than or equal to 1.0.

Returns a new instance with the same values as the current instance, but with the specified initial backoff.

The new value for . A new instance based on the existing values, but with the specified initial backoff.

Returns the existing retry timings configurations using the specified maximum backoff.

The new value for . A new instance based on the existing values, but with the specified max backoff.

Returns the existing retry timings configurations using the specified backoff multiplier.

The new value for . A new instance based on the existing values, but with the specified backoff multiplier.

Options for SetBucketIamPolicy operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Class which can perform a resumable upload using a signed URL to initiate the session.

Creates a instance.

The signed URL which can be used to initiate a resumable upload session. See UrlSigner.ResumableHttpMethod for more information. The data to be uploaded. The options for the upload operation. The instance which can be used to upload the specified content.

Initiates the resumable upload session by posting to the signed URL and returns the session URI.

The signed URL which can be used to initiate a resumable upload session. See UrlSigner.ResumableHttpMethod for more information. The options for the upload operation. The session URI to use for the resumable upload.

Initiates the resumable upload session by posting to the signed URL and returns the session URI.

The signed URL which can be used to initiate a resumable upload session. See UrlSigner.ResumableHttpMethod for more information. The options for the upload operation. The token to monitor for cancellation requests. A task containing the session URI to use for the resumable upload.

The algorithm version to use in . See and for usage.

The default signing version, where the version to use is chosen by the client library implementation.

Always use V2 URL signing.

Always use V4 URL signing.

String constants for the names of the storage classes and location types, as used in and . See https://cloud.google.com/storage/docs/storage-classes for details.

Name for the Multi-Regional location type.

Name for the Regional location type.

Name for the Nearline storage class.

Name for the Coldline storage class.

Name of the Standard storage class, which is equivalent to Multi-Regional or Regional depending on the location.

Name of the Durable Reduced Availability (DRA) location type. Use of this storage class is not recommended; Regional storage has lower pricing for some operations but otherwise the same pricing structure, and better performance/availability.

Name for the Archive storage class.

Abstract class providing operations for Google Cloud Storage.

This abstract class is provided to enable testability while permitting additional operations to be added in the future. See and to construct instances; alternatively, you can construct a directly from a . All instance methods declared in this class are virtual, with an implementation which simply throws . All these methods are overridden in . This class implements ; however, the method only requires calling if many short-lived instances of are being created. Most code would be expected to create a single StorageClient instance, and use this instance throughout the lifetime of the application. In this case, Dispose need not be called.

Creates a copy of an object synchronously, potentially to a different bucket. This method uses the rewriteObject underlying API operation for more flexibility and reliability.

The name of the bucket containing the object to copy. Must not be null. The name of the object to copy within the bucket. Must not be null. The name of the bucket to copy the object to. Must not be null. The name of the object within the destination bucket. Must not be null. Additional options for the copy operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. The fact that and are optional is a mistake. The default value of null for these parameters is invalid for this method, meaning that any call which doesn't specify the parameters explicitly will fail. Making these parameters required would be a compile-time breaking change; this will be implemented in the next major version of this library. A task representing the asynchronous operation, with a result returning the representation of the new storage object resulting from the copy.

Creates a storage bucket synchronously.

Creates a storage bucket asynchronously.

The ID of the project to create the buckets in. Must not be null. The name of the bucket to create. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the resource representation of the newly-created bucket.

Creates a storage bucket synchronously.

The ID of the project to create the buckets in. Must not be null. The resource representation of the bucket to create. Must not be null, and must have a name. Additional options for the operation. May be null, in which case appropriate defaults will be used. The resource representation of the newly-created bucket.

Creates a storage bucket asynchronously.

The ID of the project to create the buckets in. Must not be null. The resource representation of the bucket to create. Must not be null, and must have a name. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the resource representation of the newly-created bucket.

The underlying storage service object used by this client.

The class only provides convenience operations built on top of an existing service object. Any more complex operations which are not supported by this wrapper may wish to use the same service object as the wrapper, in order to take advantage of its configuration (for authentication, application naming etc).

The customer-supplied encryption key used by default for all relevant object-based operations. This can be overridden in call-specific options. This will never return null in the built-in implementation; if no encryption key is specified, is returned.

Asynchronously creates a using application default credentials. For any non-default values, please use .

The task representing the created .

Synchronously creates a using application default credentials. For any non-default values, please use .

Asynchronously creates a , using application default credentials if no credentials are specified.

If a credential is supplied, the default scopes are applied to it (for credential types that support scoping), overriding any existing scopes in the credentials. To use scoped credentials without any modifications, create a and set the property. Optional . If this is non-null, default scopes are applied to it (for credential types that support scoping), overriding any existing scopes in the credentials. To use scoped credentials without any modifications, create a and set the property. Optional to use for all relevant object-based operations by default. May be null. The task representing the created .

Synchronously creates a , using application default credentials if no credentials are specified.

Creates a with no credentials. This can only be used in limited situations (where authentication isn't required), primarily downloading public data.

The created .

Dispose of this instance. See the remarks on when this should be called.

Deletes a bucket synchronously.

The name of the bucket to delete. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used.

Deletes a bucket asynchronously.

The name of the bucket to delete. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation.

Deletes a bucket synchronously.

Bucket to delete. Must not be null, and must have the name populated. Additional options for the operation. May be null, in which case appropriate defaults will be used.

Deletes bucket asynchronously.

Bucket to delete. Must not be null, and must have the name populated. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation.

Deletes a version of the specified object synchronously.

By default this will delete the latest version of the object, but this can be controlled using . For buckets that support multiple versions, implicitly deleting the latest version only archives it so the object is still available and can be listed by specifying . If the version is explicitly specified, the object is permanently deleted. If the bucket containing the object supports versioning, after this operation completes successfully there may still be another version of the same object. In buckets which do not support versioning, this operation will permanently delete the object. If the request attempts to delete an object that does not exist or a specific version that does not exist, this counts as a failure with an HTTP status code of 404. The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used.

Deletes a version of the specified object asynchronously.

Deletes a version of the specified object synchronously.

By default this will delete the latest version of the object, but this can be controlled using . Note that any generation information contained within is ignored; the generation to delete is only controlled via . For buckets that support multiple versions, implicitly deleting the latest version only archives it so the object is still available and can be listed by specifying . If the version is explicitly specified, the object is permanently deleted. If the bucket containing the object supports versioning, after this operation completes successfully there may still be another version of the same object. In buckets which do not support versioning, this operation will permanently delete the object. If the request attempts to delete an object that does not exist or a specific version that does not exist, this counts as a failure with an HTTP status code of 404. Object to delete. Must not be null, and must have the name and bucket populated. Additional options for the operation. May be null, in which case appropriate defaults will be used.

Deletes a version of the specified object asynchronously.

Downloads the data for an object from storage synchronously, into a specified stream.

The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. The stream to write the data into. Must not be null. Additional options for the download. May be null, in which case appropriate defaults will be used. Progress reporter for the download. May be null. An representation of the metadata for the object that has been downloaded into the stream. This metadata is not the complete metadata for the object; it's just the information provided in headers while downloading. Additionally, the CRC32C hash is only the hash of the data downloaded; if the options specify a range which does not encompass the whole object, this will not be the same as the CRC32C hash of the complete object.

Downloads the data for an object from storage asynchronously, into a specified stream.

The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. The stream to write the data into. Must not be null. Additional options for the download. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. Progress reporter for the download. May be null. A task representing the asynchronous operation. The result of the task is an representation of the metadata for the object that has been downloaded into the stream. This metadata is not the complete metadata for the object; it's just the information provided in headers while downloading. Additionally, the CRC32C hash is only the hash of the data downloaded; if the options specify a range which does not encompass the whole object, this will not be the same as the CRC32C hash of the complete object.

Downloads the data for an object from storage synchronously, into a specified stream.

The generation number within is ignored by this method. To download a specific generation, use . Source object to download the data from. Must not be null. The stream to write the data into. Must not be null. Additional options for the download. May be null, in which case appropriate defaults will be used. Progress reporter for the download. May be null. An representation of the metadata for the object that has been downloaded into the stream. This metadata is not the complete metadata for the object; it's just the information provided in headers while downloading. Additionally, the CRC32C hash is only the hash of the data downloaded; if the options specify a range which does not encompass the whole object, this will not be the same as the CRC32C hash of the complete object.

Downloads the data for an object from storage asynchronously, into a specified stream.

The generation number within is ignored by this method. To download a specific generation, use . Source object to download the data from. Must not be null. The stream to write the data into. Must not be null. Additional options for the download. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. Progress reporter for the download. May be null. A task representing the asynchronous operation. The result of the task is an representation of the metadata for the object that has been downloaded into the stream. This metadata is not the complete metadata for the object; it's just the information provided in headers while downloading. Additionally, the CRC32C hash is only the hash of the data downloaded; if the options specify a range which does not encompass the whole object, this will not be the same as the CRC32C hash of the complete object.

Fetches the information about a bucket synchronously.

The name of the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The representation of the storage bucket.

Fetches the information about a bucket asynchronously.

The name of the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the storage bucket.

Fetches the IAM policy information about a bucket synchronously.

The name of the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The representation of the storage bucket IAM policy.

Fetches the IAM policy information about a bucket asynchronously.

Fetches the information about an object synchronously.

This does not retrieve the content of the object itself. Use to download the content. The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The representation of the storage object.

Fetches the information about an object asynchronously.

Synchronously creates a new HMAC key associated with a service account.

The project ID in which to create the HMAC key. Must not be null. The service account to associate with the HMAC key. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The new HMAC key, including the secret information in . This secret is only ever returned when creating a key.

Asynchronously creates a new HMAC key associated with a service account.

The project ID in which to create the HMAC key. Must not be null. The service account to associate with the HMAC key. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the the new HMAC key, including the secret information in . This secret is only ever returned when creating a key.

Synchronously fetches metadata for the specified HMAC key.

Asynchronously fetches metadata for the specified HMAC key.

The project containing the HMAC key. Must not be null. The ID of the HMAC key. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the HMAC key metadata.

Lists the HMAC keys in a given project, synchronously but lazily, optionally filtering by service account email address.

This method fetches the buckets lazily, making requests to the underlying service for a page of results at a time, as required. No network requests are made until the returned sequence is enumerated. This means that any exception due to an invalid request will be deferred until that time. Callers should be prepared for exceptions to be thrown while enumerating the results. In addition to failures due to invalid requests, network or service failures can cause exceptions even after the first results have been returned. The project containing the HMAC keys. Must not be null. The service account email address to list keys for. May be null, in which case all HMAC keys associated with the project are returned. Additional options for the operation. May be null, in which case appropriate defaults will be used. A sequence of HMAC keys within the project.

Lists the HMAC keys in a given project, asynchronously and lazily, optionally filtering by service account email address.

Synchronously updates an HMAC key's metadata.

The key to update. Must not be null, and the and properties must be set. Additional options for the operation. May be null, in which case appropriate defaults will be used. The updated key metadata.

Asynchronously updates an HMAC key's metadata.

The key to update. Must not be null, and the and properties must be set. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the updated key metadata.

Synchronously deletes an HMAC key, which must already have been deactivated.

Asynchronously deletes an HMAC key, which must already have been deactivated.

The ID of the project containing the HMAC key to delete. The ID of the HMAC key to delete. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation.

Asynchronously lists the buckets in a given project.

This method fetches the buckets lazily, making requests to the underlying service for a page of results at a time, as required. No network requests are made until the returned sequence is enumerated. This means that any exception due to an invalid request will be deferred until that time. Callers should be prepared for exceptions to be thrown while enumerating the results. In addition to failures due to invalid requests, network or service failures can cause exceptions even after the first results have been returned. The ID of the project to list the buckets from. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. An asynchronous sequence of buckets.

Lists the buckets for a given project, synchronously but lazily.

This method fetches the buckets lazily, making requests to the underlying service for a page of results at a time, as required. No network requests are made until the returned sequence is enumerated. This means that any exception due to an invalid request will be deferred until that time. Callers should be prepared for exceptions to be thrown while enumerating the results. In addition to failures due to invalid requests, network or service failures can cause exceptions even after the first results have been returned. The ID of the project to list the buckets from. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. A sequence of buckets within the project.

Asynchronously lists the objects in a given bucket.

This method fetches the objects lazily, making requests to the underlying service for a page of results at a time, as required. No network requests are made until the returned sequence is enumerated. This means that any exception due to an invalid request will be deferred until that time. Callers should be prepared for exceptions to be thrown while enumerating the results. In addition to failures due to invalid requests, network or service failures can cause exceptions even after the first results have been returned. The bucket to list the objects from. Must not be null. The prefix to match. Only objects with names that start with this string will be returned. This parameter may be null or empty, in which case no filtering is performed. The options for the operation. May be null, in which case defaults will be supplied. An asynchronous sequence of objects in the specified bucket.

Lists the objects in a given bucket, synchronously but lazily.

Locks the retention policy of a bucket. This is a one-way process: once a retention policy is locked, it cannot be shortened, removed or unlocked, although it can be increased in duration. The lock persists until the bucket is deleted.

The name of the bucket whose retention policy should be locked. Must not be null. The current metageneration of the bucket, used to validate that the bucket version to be locked is the intended one. The options for the operation. May be null, in which case defaults will be supplied.

Asynchronously locks the retention policy of a bucket. This is a one-way process: once a retention policy is locked, it cannot be shortened, removed or unlocked, although it can be increased in duration. The lock persists until the bucket is deleted.

Sets the value for a single label on a bucket. The label will be added if it does not exist, or updated if it already exists.

This method is implemented by creating a single-element dictionary which is passed to . The name of the bucket. Must not be null. The name of the label to set. Must not be null. The value of the label to set. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The previous value of the label, or null if the label did not previously exist.

Removes a label from a bucket, if it previously existed. It is not an error to attempt to remove a label that doesn't already exist.

This method is implemented by creating a single-element dictionary which is passed to . The name of the bucket. Must not be null. The name of the label to remove. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The previous value of the label, or null if the label did not previously exist.

Sets or removes one or more labels on a bucket.

Each entry in is treated as a label to set or remove. If the value is null, it will be removed from the bucket; otherwise, it will be set/added. Labels which do not have an entry in the dictionary will be ignored. The name of the bucket. Must not be null. The labels to set. Must contain at least one entry; keys must not be null, but values may be (indicating label removal). The options for the operation. May be null, in which case defaults will be supplied. A dictionary with the same keys as , and values indicating the corresponding label value before this operation completed. Labels which weren't present on the bucket before the modification have corresponding null values in the returned dictionary.

Clears all labels on a bucket.

The name of the bucket. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. A dictionary with the labels on the bucket before they were cleared.

Sets the value for a single label on a bucket asynchronously. The label will be added if it does not exist, or updated if it already exists.

This method is implemented by creating a single-element dictionary which is passed to . The name of the bucket. Must not be null. The name of the label to set. Must not be null. The value of the label to set. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. The previous value of the label, or null if the label did not previously exist.

Removes a label from a bucket, if it previously existed, asynchronously. It is not an error to attempt to remove a label that doesn't already exist.

This method is implemented by creating a single-element dictionary which is passed to . The name of the bucket. Must not be null. The name of the label to remove. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. The previous value of the label, or null if the label did not previously exist.

Sets or removes one or more labels on a bucket asynchronously.

Each entry in is treated as a label to set or remove. If the value is null, it will be removed from the bucket; otherwise, it will be set/added. Labels which do not have an entry in the dictionary will be ignored. The name of the bucket. Must not be null. The labels to set. Must contain at least one entry; keys must not be null, but values may be (indicating label removal). The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A dictionary with the same keys as , and values indicating the corresponding label value before this operation completed. Labels which weren't present on the bucket before the modification have corresponding null values in the returned dictionary.

Clears all labels on a bucket asynchronously.

The name of the bucket. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A dictionary with the labels on the bucket before they were cleared.

Retrieves the service account email address that Google Cloud Storage uses for operations on other services such as Google Cloud Pub/Sub.

ID of the project to retrieve the service account for. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The email address of the service account.

Asynchronously retrieves the service account email address that Google Cloud Storage uses for operations on other services such as Google Cloud Pub/Sub.

ID of the project to retrieve the service account for. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the email address of the service account.

Creates a notification configuration.

The bucket for which to create the notification configuration. Must not be null. The notification configuration to create. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The representation of the newly-created notification configuration.

Asynchronously creates a notification configuration.

The bucket for which to create the notification configuration. Must not be null. The notification configuration to create. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the newly-created notification configuration.

Fetches a notification configuration.

The bucket associated with the notification configuration. Must not be null. ID of the notification configuration to fetch. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The representation of the notification configuration.

Asynchronously fetches a notification configuration.

Lists notification configurations associated with a bucket.

The bucket for which to list associated notification configurations. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. A list of notification configurations associated with the specified bucket. This method never returns null.

Asynchronously lists notification configurations associated with a bucket.

The bucket for which to list associated notification configurations. Must not be null. The options for the operation. May be null, in which case defaults will be supplied. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the list of notification configurations associated with the specified bucket. The result is never null.

Deletes a notification configuration.

The bucket associated with the notification configuration. Must not be null. ID of the notification configuration to delete. Must not be null. The options for the operation. May be null, in which case defaults will be supplied.

Asynchronously deletes a notification configuration.

Patches the metadata for a storage bucket synchronously.

Bucket to update. Must not be null, and must have a populated Name property. Additional options for the update. May be null, in which case appropriate defaults will be used. The representation of the updated storage bucket.

Patches the metadata for a storage bucket asynchronously.

Bucket to update. Must not be null, and must have a populated Name property. Additional options for the update. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the bucket storage bucket.

Patches the metadata for an object in storage synchronously.

Patches the metadata for an object in storage asynchronously.

Object to update. Must not be null, and must have populated Name and Bucket properties. Additional options for the update. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the updated storage object.

Updates the IAM policy information about a bucket synchronously.

The name of the bucket. Must not be null. The new IAM policy for the bucket. Must not be null. Additional options for the operation. May be null, in which case appropriate defaults will be used. The representation of the resulting storage bucket IAM policy.

Updates the IAM policy information about a bucket asynchronously.

The name of the bucket. Must not be null. The new IAM policy for the bucket. Must not be null. Additional options for the fetch operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the representation of the resulting storage bucket IAM policy.

Tests the IAM permissions for a bucket synchronously.

Tests the IAM policy information about a bucket asynchronously.

The name of the bucket. Must not be null. The permissions to test. Must not be null or empty. Additional options for the operation. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the permissions held by the caller.

Updates the metadata for a storage bucket synchronously.

If no preconditions are explicitly set in , the metageneration of is used as a precondition for the update, unless is set to true. Bucket to update. Must not be null, and must have a populated Name. Additional options for the update. May be null, in which case appropriate defaults will be used. The representation of the updated storage bucket.

Updates the metadata for storage bucket asynchronously.

Updates the metadata for an object in storage synchronously.

If no preconditions are explicitly set in , the generation and metageneration of are used as a precondition for the update, unless is set to true. Object to update. Must not be null, and must have populated Name and Bucket properties. Additional options for the update. May be null, in which case appropriate defaults will be used. The representation of the updated storage object.

Updates the metadata for an object in storage asynchronously.

Creates an instance which is capable of starting a resumable upload for an object.

The name of the bucket containing the object. Must not be null. The name of the object within the bucket. Must not be null. The content type of the object. This should be a MIME type such as "text/html" or "application/octet-stream". May be null. The stream to read the data from. Must not be null. Additional options for the upload. May be null, in which case appropriate defaults will be used. The which can be used to upload the object.

Creates an instance which is capable of starting a resumable upload for an object.

Uploads the data for an object in storage synchronously, from a specified stream.

Uploads the data for an object in storage asynchronously, from a specified stream.

Uploads the data for an object in storage synchronously, from a specified stream.

Object to create or update. Must not be null, and must have the name, bucket and content type populated. The stream to read the data from. Must not be null. Additional options for the upload. May be null, in which case appropriate defaults will be used. Progress reporter for the upload. May be null. The representation of the uploaded object.

Uploads the data for an object in storage asynchronously, from a specified stream.

Object to create or update. Must not be null, and must have the name, bucket and content type populated. The stream to read the data from. Must not be null. Additional options for the upload. May be null, in which case appropriate defaults will be used. The token to monitor for cancellation requests. Progress reporter for the upload. May be null. A task representing the asynchronous operation, with a result returning the representation of the uploaded object.

A builder for , allowing simple client customization.

If set to true, no credentials are created when the client is built.

The customer-supplied encryption key used by default for all relevant object-based operations.

Whether GZip should be enabled for the underlying client. This is currently internal so that we are able to modify it for retry conformance testing, but if we want to expose it publicly we should probably do so in ClientBuilderBase.

The scheduler to use for delays (e.g. in retry), for the sake of testability.

Creates a new builder with default settings.

Wrapper around to provide simpler operations.

This is the "default" implementation of . Most client code should refer to , creating instances with and . The constructor of this class is public for the sake of constructor-based dependency injection.

The default application name used when creating a . Defaults to "google-cloud-dotnet"; must not be null.

Most applications will never want to set this, which is why it's in this class rather than .

Scheduler used for retry delays, avoiding the use of Task.Delay in a way which is slow and hard to test thoroughly.

Constructs a new client wrapping the given .

The service to wrap. Must not be null. Optional to use for object-based operations by default. May be null, in which case will be used.

Regular expression to be used for bucket validation when would throw the wrong exception.

Validates that a bucket only contains valid characters, and is not too long. This is far from complete validation, but is all that's required to ensure that it's safe to include in a URL. This method also checks for nullity, so callers don't need to do that first. This method is internal rather than private for testing purposes.

The input, to allow inline validation

Validates that the given Bucket has a "somewhat valid" (no URI encoding required) bucket name.

Bucket to validate The parameter name in the calling method The validated bucket name

Validates that the given Object has a "somewhat valid" (no URI encoding required) bucket name and an object name.

Object to validate The parameter name in the calling method

Applies an encryption key to a request. Note that there is no overload without a kmsNameFromOptions, even though most requests don't have one, just to avoid missing one accidentally.

The encryption key specified in the operation-specific options, or null. The KMS key name specified in the operation-specific options, or null. The request to apply this to.

Constructs the media URL of an object from its bucket and name. This does not include the generation or any GaxPreconditions. The returned string will always have a query parameter, so later query parameters can unconditionally be appended with an "&" prefix.

Obtains the media URL of an object from its bucket and name. The returned string will always have a query parameter, so later query parameters can unconditionally be appended with an "&" prefix.

Helper class to provide common context between sync and async operations. Helps avoid quite so much duplicate code...

Options for TestBucketIamPermissions operations.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Options for UpdateBucket operations.

Precondition for update: the bucket is only updated if its current meta-generation matches the given value.

Precondition for update: the bucket is only updated if its current meta-generation does not match the given value.

The projection of the updated object to return.

A pre-defined ACL of the bucket for simple access control scenarios.

A pre-defined default ACL for objects created in the bucket, for simple access control scenarios.

If set to true, no other preconditions must be set, and the local metageneration of the bucket being updated is not used to create a precondition.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Options for UpdateHmacKey operations.

Options to pass custom retry configuration for each API request.

Options for UpdateObject operations.

If present, selects a specific revision of this object (as opposed to the latest version, the default).

Precondition for update: the object is only updated if the existing object's generation matches the given value.

Precondition for update: the object is only updated if the existing object's generation does not match the given value.

Precondition for update: the object is only updated if the existing object's meta-generation matches the given value.

Precondition for update: the object is only updated if the existing object's meta-generation does not match the given value.

The projection of the updated object to return.

A pre-defined ACL for simple access control scenarios.

If set to true, no other preconditions must be set, and the local metageneration of the object being updated is not used to create a precondition.

The encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Options to pass custom retry configuration for each API request.

Options for UploadObject operations.

The minimum chunk size for uploading.

Precondition for upload: the object is only uploaded if the existing object's generation matches the given value.

Precondition for upload: the object is only uploaded if the existing object's generation does not match the given value.

Precondition for upload: the object is only uploaded if the existing object's meta-generation matches the given value.

Precondition for upload: the object is only uploaded if the existing object's meta-generation does not match the given value.

The chunk size to use for each request. When setting to a non-null value, this must be a positive multiple of .

A pre-defined ACL for simple access control scenarios.

The projection of the uploaded object to retrieve.

The customer-supplied encryption key to use for this operation. If this property is null, the will be used instead. Use to remove encryption headers from this request.

The name of the Cloud KMS key to use to encrypt the object.

If set, this is the ID of the project which will be billed for the request. The caller must have suitable permissions for the project being billed.

Specifies how the upload should be validated for data integrity. If this property is null, this is equivalent to .

The hash is only validated at the end of the upload, after the object has been created. An exception is thrown if it's incorrect, but the object will still exist unless the validation action deletes it.

If set, an Origin header is included when initiating the resumable upload. This allows for Cross-Origin Resource Sharing, as documented at https://cloud.google.com/storage/docs/cross-origin.

Exception thrown when an upload failed validation.

The hash computed locally, in base64.

The uploaded object.

A collection of additional failures following on from this one, if any. For example, if the validation mode indicates that on failure the file should be deleted, but the deletion fails, that exception would be present here. This property is either null, or returns an containing one or more exceptions; it will never return an empty .

Creates a new exception.

The hash of the uploaded data, as computed at the client. Must not be null. The object created by Google Cloud Storage. Must not be null. Any additional failures encountered while handling the error. May be null; if non-null, must contain at least one exception.

Describes the validation behavior when uploading data.

The upload is not validated.

The hash of the data is computed while uploading, and if the resulting object has a different hash, an is thrown, but the object remains present in Storage.

The hash of the data is computed while uploading, and if the resulting object has a different hash, an attempt is made to delete the object. Whether the deletion fails or not, an is thrown. If the deletion fails, that failure can be examined via

Class which helps create signed URLs which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs.

Implementation of to sign a blob from a supported credential.

Gets a special HTTP method which can be used to create a signed URL for initiating a resumable upload. See https://cloud.google.com/storage/docs/access-control/signed-urls#signing-resumable for more information.

Note: When using the RESUMABLE method to create a signed URL, a URL will actually be signed for the POST method with a header of 'x-goog-resumable:start'. The caller must perform a POST request with this URL and specify the 'x-goog-resumable:start' header as well or signature validation will fail.

Creates a new instance for a service account.

The credential for the a service account. Must not be null. Signing happens locally using the private key included on the service account credential.

Creates a new instance for an impersonated credential. Signing is done by the impersonated service account.

The impersonated credential. Must not be null. A request to the IAM API is executed for signing which increases latency as compared with and that counts towards IAM API quoata consumption.

Creates a new instance for a compute credential.

The compute credential. Must not be null. A request to the IAM API is executed for signing which increases latency as compared with and that counts towards IAM API quoata consumption. The first time a compute credential is used for signing, a request to the metadata server is executed, to obtain the associated service account ID, which may increase latency of the overall signing request.

Creates a new instance for a Google credential if the wrapped credential type is supported for signing. In that case, this method relies on the appropiate UrlSigner.FromCredential overload.

The Google credential. Must not be null. Must wrap a credential currently supported for signing. The credential wrapped by the Google credential is not currently supported for signing. Please see the specific UrlSigner.FromCredential overloads for more information.

Creates a new instance from the JSON configuration file of a Google credential. See for more information about supported credential types.

Creates a new instance from the JSON configuration file of a Google credential, which is read asyncrhonously. See for more information about supported credential types.

Creates a new instance from a Stream containing the JSON configuration file of a Google Credential. See for more information about supported credential types.

Creates a new instance from a Stream containing the JSON configuration file of a Google Credential. The data is read asynchronously. See for more information about supported credential types.

Creates a new instance for a service account.

The path to the JSON key file for a service account. Must not be null. The does not refer to a valid JSON service account key file.

Creates a new instance for a service account.

The stream from which to read the JSON key data for a service account. Must not be null. The does not contain valid JSON service account key data.

Creates a new instance for a service account.

The credential for the a service account. Must not be null.

Creates a new instance for a custom blob signer.

The blob signer to use. Must not be null. A new using the specified blob signer.

Creates a new instance for a custom blob signer obtained from the given blob signer provider. Note the provider will be only called once, and the returned blob signer will be reused for subsequent signing operations with this URL signer.

The blob signer async provider to use. Must not be null. When called, must not return a null reference or a task which completes with a null result. A new that will use a blob signer obtained from the specified provider function.

Only available for testing purposes, this allows the clock used for signature generation to be replaced.

Creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. Note that when GET is specified as the (or it is null, in which case GET is used), both GET and HEAD requests can be made with the created signed URL. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The length of time for which the signed URL should remain usable. The HTTP request method for which the signed URL is allowed to be used. May be null, in which case GET will be used. The signing version to use to generate the signed URL. May be null, in which case will be used. The signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

Signs the given post policy. The result can be used to make form posting requests matching the conditions set in the post policy.

Signing post policies is not supported by . A will be thrown if an attempt is made to sign a post policy using . When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. See https://cloud.google.com/storage/docs/xml-api/post-object for more information on signed post policies. The post policy to signed and that will be enforced when making the post request. Must not be null. The options used to generate the signed post policy. Must not be null. The signed post policy, which contains all the fields that should be including in the form to post.

Creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. See https://cloud.google.com/storage/docs/access-control/signed-urls for more information on signed URLs. Note that when GET is specified as the (or it is null, in which case GET is used), both GET and HEAD requests can be made with the created signed URL. The name of the bucket. Must not be null. The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object. The length of time for which the signed URL should remain usable. The HTTP request method for which the signed URL is allowed to be used. May be null, in which case GET will be used. The signing version to use to generate the signed URL. May be null, in which case will be used. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the signed URL which can be used to provide access to a bucket or object for a limited amount of time.

Asynchronously creates a signed URL which can be used to provide limited access to specific buckets and objects to anyone in possession of the URL, regardless of whether they have a Google account.

Signs the given post policy. The result can be used to make form posting requests matching the conditions set in the post policy.

Signing post policies is not supported by . A will be thrown if an attempt is made to sign a post policy using . When a is created with a service account credential, the signing can be performed with no network access. When it is created with an implementation of , that may require network access or other IO. In that case, one of the asynchronous methods should be used when the caller is in a context that should not block. See https://cloud.google.com/storage/docs/xml-api/post-object for more information on signed post policies. The post policy to signed and that will be enforced when making the post request. Most not be null. The options used to generate the signed post policy. Must not be null. The token to monitor for cancellation requests. The signed post policy, which contains all the fields that should be including in the form to post.

Prepares a header value for signing, trimming both ends and collapsing internal whitespace.

Blob signer to implement signing using an HMAC secret.

Creates a new HMAC Blob Signer from an HMAC Key ID and Secret.

The HMAC key ID. Must not be null or empty. The HMAC key secret. Must not be null or empty.

Creates a new HMAC Blob Signer from an HMAC Key ID and Secret.

The HMAC key ID. Must not be null or empty. The HMAC key secret. Must not be null or empty.

Represents the capability of signing a blob in a suitable form for Google Cloud Storage signed URLs. This allows testing URL signing without credentials being available, as well as using Google Cloud IAM to sign blobs.

Synchronously signs the given blob.

The data to sign. Must not be null. Parameters to use when deriving the signing key. Concrete implementations may allow a null value if no parameters are required. The blob signature as base64 text.

Asynchronously signs the given blob.

The data to sign. Must not be null. Parameters to use when deriving the signing key. Concrete implementations may allow a null value if no parameters are required. The token to monitor for cancellation requests. A task representing the asynchronous operation, with a result returning the blob signature as base64 text.

The identity of the signer, typically an email address.

The signing algorithm used by this blob signer.

Parameters that may be used by an IBlobSigner for deriving a signing key. Signers may ignore some or all of these parameters depending on how the derive the signing key.

Region to be used for deriving the signing key.

Service to be used for deriving the signing key.

Request type to be used for deriving the signing key.

The request date time to be used for deriving the signing key.

Create a new instance of for the given .

Class to allow UrlSigner to be independent of whether the IBlobSigner is obtained synchronously or asynchronously.

This is the blob signer that was used for building this instance via , if indeed this constructor was used. Null otherwise.

The cached blob signer building task if this instance was built via . Null otherwise.

Once this cached task completes and a blog signer is built, obtaining the blob signer is a sync operation. Basically, accessing the cached blob signer is async only for the first few threads that attempt it, before the blob signer has been built.

Abstraction over V2/V4 signing details.

Options for the UrlSigner. Options can be duration or expiration based regarding the validity of the signed URL.

The length of time for which the signed URL should remain usable, counting from the moment the signed URL is created. Exactly one of and will be set.

The point in time after which the signed URL will be invalid. Exactly one of and will be set.

The signing version to use for generating the signed URL. This will default to which is currently the same as .

The style of signed URL to generate. Defaults to .

When using only and are supported and and will throw if is other than one of these two values.

The Scheme to use for the request. Only http or https supported. This will never be null. If null is specified in then https will be used. Defaults to https.

A bucket bound host to use for generating the signed URL. If is this won't be null. It will be null otherwise. Use to set.

When using bucket bound host names are not supported and and will throw if is not null.

Creates a new from the given duration.

The duration to create these options with. A new options set.

Creates a new from the given expiration.

The expiration to create these options with. A new options set.

If this set of options was duration based, this method will return a new set of options whose expiration will be calculated based on this instance duration and the given . If this set of options was expiration based this same instance will be returned.

The that represents the current instant in time. An expiration based set of options.

Returns a new set of options with the same values as this one but duration based.

The new duration. A new set of options with the given duration.

Returns a new set of options with the same values as this one but expiration based.

The new expiration. A new set of options with the given expiration.

Returns a new set of options with the same values as this one except for the signing version.

The new signing version. A set of options with the given signing version.

Returns a new set of options with the same values as this one except for the value.

The new url style. A new set ofoptions with the given url style.

Returns a new set of options with the same values as this one except for the scheme.

The new scheme. May be null in which case https will be used. A new set of options with the given scheme.

Returns a new set of options with the same values as this one except for bucket bound domain and the url style which will be set to .

The new bucket bound domain. A new set of options with the given bucket bound domain and the url style set to .

A standard element that can be added to a .

The ACL that you want to allow for the objects that will be uploaded.

The name of the bucket that you want to allow uploads to. Alternatively, you can include the bucket name when you add the element.

The cache control you want to allow for the objects that will be uploaded.

The content disposition you want to allow for the objects that will be uploaded.

The content encoding you want to allow for the objects that will be uploaded.

The content length you want to allow for the objects that will be uploaded.

The content type you want to allow for the objects that will be uploaded.

The date and time you want to allow before objects that will be uploaded are considered stale by the browser. The value for this element will be included in the in ISO8601 basic format. When using this element for you should specify the part of the ISO8601 basic format representation that you want values on upload to start with.

The acceptable key name or a prefix for the uploaded objects. This element should always be present in a post policy.

The allowed URL to which the client is redirected upon successful upload.

The status code returned to the client upon successful upload if is not specified. Allowed values are , , .

A custom element that can be added to a .

Custom element used for requiering extra Google metadata to be included in the post request. The element name you provide should start with x-goog-meta-.

Custom element used for requiering extra fields to be included in the post request.

Represents an unsigned post policy. It needs to be signed with before it is used to enforced policies when posting objects via form.

Creates a new instance which sets the and requires an exact match for the element.

The exact value for the bucket name. The value to match against. Must not be null. A new instance.

Creates a new instance which sets the and requires a starts-with match for the element.

The exact value for the bucket name. The value to match against. Must not be null. A new instance.

Bucket name explicitly enforced by this policy, that is, if has been called for . Otherwise, for instance, if the bucket name was specified as part of the element, this will return null.

Collection of fields as defined by this policy. Post requests enforced by this policy should set, for each pair in this sequence, the given element to the exact given value.

Sets a required field value for . If any condition existed on this instance for it will be overriden with this required field value.

The type of the value to set the element to. The element for which to set a required field value. The value to set the element to.

Sets a starts-with condition for . If any condition existed on this instance for it will be overriden with this starts-with condition.

The element for which to set an starts-with condition. The prefix to validate against.

Sets a range condition for . If any condition existed on this instance for it will be overriden with this range condition.

The type of the values defining the range. The element for which to set a range condition. The range lower bound. The range upper bound.

Sets a required field value for of name . If any condition existed on this instance for of name it will be overriden with this required field value.

The type of the value to set the element to. The element for which to set a required field value. The custom element name. The value to set the element to. The function to convert to the representation which with it should be included in the policy. May be null in which case ToString() will be used.

Sets a starts-with condition for of name . If any condition existed on this instance for of name it will be overriden with this starts-with condition.

The element for which to set an starts-with condition. The custom element name. The prefix to validate against.

Represents a matching condition that is used to include in a .

Writes this condition to the given .

The element name / value pair that this condition defines.

Represents the exact match condition for included in a .

The type of the element this condition acts upon. The type of the values allowed by .

The element this condition applies to.

The exact value to match.

Represents the starts with condition for included in a . The type of the element this condition acts upon.

The element this condition applies to.

The prefix to match against.

Represents the range condition for included in a .

The type of the element this condition acts upon. The type of the values allowed by .

The element this condition applies to.

The min range value.

The max range value.

Represents an element that can be included on a .

The name with which the element is included on a .

Represents a that supports the exact match condition operation.

A way to convert the values of to the representation with which to include them on the .

The value for which to return the corresponding representation. The representation of the given value.

Represents a that supports the range match condition operation.

A way to convert the values of to the representation with which to include them on the .

The value for which to return the corresponding representation. The representation of the given value.

Represents a that supports the starts with condition operation.

The ACL that you want to allow for the objects that will be uploaded.

The default acl element.

The name of the bucket that you want to allow uploads to. Alternatively, you can include the bucket name in the element.

The default bucket element.

The cache control you want to allow for the objects that will be uploaded.

The default cache-control element.

The content disposition you want to allow for the objects that will be uploaded.

The default content-disposition element.

The content encoding you want to allow for the objects that will be uploaded.

The default content-encoding element.

The content length you want to allow for the objects that will be uploaded.

The default content-length element.

The content type you want to allow for the objects that will be uploaded.

The default content-type element.

The date and time you want to allow before objects that will be uploaded are considered stale by the browser. The value for this element will be included in the in ISO8601 basic format. When using this element as a you should specify the part of the ISO8601 basic format representation that you want values on upload to start with.

The default expires element.

The acceptable key name or a prefix for the uploaded objects. This element should always be present in a post policy.

The default key element.

The allowed URL to which the client is redirected upon successful upload.

The default success-action-redirect element.

The status code returned to the client upon successful upload if is not specified. Allowed values are 200, 201 and 204.

The default success-action-status element.

Custom element used for requiering extra Google metadata to be included in the post request.

The type for the values of the element.

Creates a new element with the given name.

The name for this element that must start with x-goog-meta-. Must not be null. The function to use to convert values to the representation with which they will be included in a . May be null in which case ToString() will be used.

The default x-goog-meta- element factory.

Custom element used for requiering extra fields to be included in the post request.

The type for the values of the element.

Creates a new element with the given name.

The name for this element. It will be lowercased to obtain the element name. The function to use to convert values to the representation with which they'll be included in a . May be null in wich case ToString() will be used.

The default custom element factory.

The default x-goog-algorithm element.

The default x-goog-credential element.

The default x-goog-date element.

Represents the request template to be signed.

When either of the headers collections are specified, there are certain headers which will be included in the signed URL's signature, and therefore must be included in requests made with the created URL. These are the Content-MD5 and Content-Type content headers as well as any content or request header with a name starting with "x-goog-". If the headers collections are null or empty, no headers are included in the signed URL's signature, so any requests made with the created URL must not contain Content-MD5, Content-Type, or any header starting with "x-goog-". Note that when GET is specified as the (or it is null, in which case GET is used), both GET and HEAD requests can be made with the created signed URL.

The name of the bucket. This will never be null.

The name of the object within the bucket. May be null, in which case the signed URL will refer to the bucket instead of an object.

The HTTP request method for which the signed URL is allowed to be used. This will never be null. If null is specified in then this value will be set to . Will default to .

Note that when GET is specified as the , both GET and HEAD requests can be made with the created signed URL.

The headers which will be included with the request. This will never be null. If null is specified in then an empty dictionary will be used.

When using , from all the headers supplied in , only the ones starting with "x-goog-" will be included in the signed URL's signature and therefor must be included in requests made with the created URL. All other headers supplied in will be ignored when creating the signed URL so they shouldn't be included in requests made with the created URL. When using all headers supplied in will be included in the signed URL's signature and therefor must be included in requests made with the created URL. Note that if the entity is encrypted with customer-supplied encryption keys (see https://cloud.google.com/storage/docs/encryption for more information), the x-goog-encryption-algorithm, x-goog-encryption-key, and x-goog-encryption-key-sha256 headers will be required when making the request. However, only the x-goog-encryption-algorithm header is included in the signature for the signed URL. So the specified only need to have the x-goog-encryption-algorithm header.

The headers for the content which will be included with the request. This will never be null. If null is specified in then an empty dictionary will be used.

When using , from all the headers supplied in , only the ones starting with "x-goog-", the Content-MD5 and the Content-Type headers will be included in the signed URL's signature and therefor must be included in requests made with the created URL. All other headers supplied in will be ignored when creating the signed URL so they shouldn't be included in requests made with the created URL. When using all headers supplied in will be included in the signed URL's signature and therefor must be included in requests made with the created URL.

The query parameters which will be included with the request. This will never be null. If null is specified in then an empty dictionary will be used.

When using custom query parameters are not supported by the signing process and and will throw if is not an empty dictionary, that is, if one or more custom query parameters have been specified.

Creates a new request template to sign from the given bucket name.

The name of the bucket for which the signed URL will be created. Must not be null. A new request template.

Returns a new request template with all the same settings as this one except for the bucket name.

The new bucket name. Must not be null. A new request template.

Returns a new request template with all the same settings as this one except for the object name.

The new object name. May be null, in which case the signed URL will refer to the bucket instead of an object. A new request template.

Returns a new request template with all the same settings as this one except for the HTTP method.

The new HTTP method. May be null, in which case will be used. A new request template.

Returns a new request template with all the same settings as this one except for the request headers.

The new request headers. May be null, in which case an empty collection will be used. A new request template.

Returns a new request template with all the same settings as this one except for the content headers.

The new content headers. May be null, in which case an empty collection will be used. A new request template.

Returns a new request template with all the same settings as this one except for the query parameters.

The new query parameters. May be null, in which case an empty collection will be used. A new request template.

Returns a new request template with all the same settings as this one except for all the information that can be obtained from , that is the HTTP method, the request headers and the content headers.

The new request message. May be null, in which case the default values for all the affected properties will be used.. A new request template.

The result of signing a containing the fields that should be including when making the post request.

The URL where the post request enforced by this signed policy should be made.

Collection of fields as defined by this policy. Post requests enforced by this policy should set, for each pair in this sequence, the given element to the exact given value.

Specifies the style of the signed URL to be generated.

The signed URL will be generated using the Path style: https://storage.googleapis.com/mybucket/myobject.

The signed URL will be generated using the Virtual-Hosted style: https://mybucket.storage.googleapis.com/myobject.

The signed URL will be generated using a client code provided host that is associated to the given bucket: https://mydomain.tld/my-object.

State which needs to be carried between the "pre-signing" stage and "post-signing" stages of the implementation.