{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Organization",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "asset_feeds": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^[a-z0-9-]+$": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "billing_project",
            "feed_output_config"
          ],
          "properties": {
            "billing_project": {
              "type": "string"
            },
            "content_type": {
              "type": "string",
              "enum": [
                "RESOURCE",
                "IAM_POLICY",
                "ORG_POLICY",
                "ACCESS_POLICY",
                "OS_INVENTORY",
                "RELATIONSHIP"
              ]
            },
            "asset_types": {
              "type": "array",
              "items": {
                "type": "string"
              }
            },
            "asset_names": {
              "type": "array",
              "items": {
                "type": "string"
              }
            },
            "feed_output_config": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "pubsub_destination"
              ],
              "properties": {
                "pubsub_destination": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "topic"
                  ],
                  "properties": {
                    "topic": {
                      "type": "string"
                    }
                  }
                }
              }
            },
            "condition": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "expression"
              ],
              "properties": {
                "expression": {
                  "type": "string"
                },
                "title": {
                  "type": "string"
                },
                "description": {
                  "type": "string"
                },
                "location": {
                  "type": "string"
                }
              }
            }
          }
        }
      }
    },
    "id": {
      "type": "string"
    },
    "contacts": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^(\\S+@\\S+\\.\\S+|\\$email_addresses:\\S+)$": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "ALL",
              "BILLING",
              "LEGAL",
              "SECURITY",
              "PRODUCT_UPDATES",
              "SUSPENSION",
              "TECHNICAL"
            ]
          }
        }
      }
    },
    "data_access_logs": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^([a-z][a-z-]+\\.googleapis\\.com|allServices)$": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "ADMIN_READ": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "exempted_members": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                }
              }
            },
            "DATA_READ": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "exempted_members": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                }
              }
            },
            "DATA_WRITE": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "exempted_members": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                }
              }
            }
          }
        }
      }
    },
    "iam": {
      "$ref": "#/$defs/iam"
    },
    "iam_bindings": {
      "$ref": "#/$defs/iam_bindings"
    },
    "iam_bindings_additive": {
      "$ref": "#/$defs/iam_bindings_additive"
    },
    "iam_by_principals": {
      "$ref": "#/$defs/iam_by_principals"
    },
    "iam_by_principals_conditional": {
      "$ref": "#/$defs/iam_by_principals_conditional"
    },
    "iam_by_principals_additive": {
      "$ref": "#/$defs/iam_by_principals"
    },
    "logging": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "kms_key_name": {
          "type": "string"
        },
        "storage_location": {
          "type": "string"
        },
        "sinks": {
          "type": "object",
          "additionalProperties": false,
          "patternProperties": {
            "^[a-z][a-z0-9-_]+$": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "description": {
                  "type": "string"
                },
                "destination": {
                  "type": "string"
                },
                "exclusions": {
                  "type": "object"
                },
                "filter": {
                  "type": "string"
                },
                "type": {
                  "type": "string",
                  "default": "logging",
                  "enum": [
                    "bigquery",
                    "logging",
                    "project",
                    "pubsub",
                    "storage"
                  ]
                }
              }
            }
          }
        }
      }
    },
    "org_policies": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^[a-z]+\\.": {
          "type": "object",
          "properties": {
            "inherit_from_parent": {
              "type": "boolean"
            },
            "reset": {
              "type": "boolean"
            },
            "rules": {
              "type": "array",
              "items": {
                "type": "object",
                "additionalProperties": false,
                "properties": {
                  "allow": {
                    "type": "object",
                    "additionalProperties": false,
                    "properties": {
                      "all": {
                        "type": "boolean"
                      },
                      "values": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      }
                    }
                  },
                  "deny": {
                    "type": "object",
                    "additionalProperties": false,
                    "properties": {
                      "all": {
                        "type": "boolean"
                      },
                      "values": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      }
                    }
                  },
                  "enforce": {
                    "type": "boolean"
                  },
                  "condition": {
                    "type": "object",
                    "additionalProperties": false,
                    "properties": {
                      "description": {
                        "type": "string"
                      },
                      "expression": {
                        "type": "string"
                      },
                      "location": {
                        "type": "string"
                      },
                      "title": {
                        "type": "string"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "pam_entitlements": {
      "$ref": "#/$defs/pam_entitlements"
    },
    "service_agents_config": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "create_agents": {
          "type": "boolean"
        },
        "services": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "tags": {
      "type": "object",
      "additionalProperties": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "description": {
            "type": "string"
          },
          "iam": {
            "$ref": "#/$defs/iam"
          },
          "iam_bindings": {
            "$ref": "#/$defs/iam_bindings"
          },
          "iam_bindings_additive": {
            "$ref": "#/$defs/iam_bindings_additive"
          },
          "id": {
            "type": "string"
          },
          "values": {
            "type": "object",
            "additionalProperties": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "description": {
                  "type": "string"
                },
                "iam": {
                  "$ref": "#/$defs/iam"
                },
                "iam_bindings": {
                  "$ref": "#/$defs/iam_bindings"
                },
                "iam_bindings_additive": {
                  "$ref": "#/$defs/iam_bindings_additive"
                },
                "id": {
                  "type": "string"
                }
              }
            }
          }
        }
      }
    },
    "workforce_identity_pools": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^[a-z][a-z0-9-]+[a-z0-9]$": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "display_name": {
              "type": "string"
            },
            "description": {
              "type": "string"
            },
            "disabled": {
              "type": "boolean"
            },
            "session_duration": {
              "type": "string"
            },
            "access_restrictions": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "allowed_services": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "additionalProperties": false,
                    "properties": {
                      "domain": {
                        "type": "string"
                      }
                    }
                  }
                },
                "disable_programmatic_signin": {
                  "type": "boolean"
                }
              }
            },
            "providers": {
              "type": "object",
              "additionalProperties": false,
              "patternProperties": {
                "^[a-z][a-z0-9-]+[a-z0-9]$": {
                  "type": "object",
                  "additionalProperties": false,
                  "properties": {
                    "description": {
                      "type": "string"
                    },
                    "display_name": {
                      "type": "string"
                    },
                    "attribute_condition": {
                      "type": "string"
                    },
                    "attribute_mapping": {
                      "type": "object"
                    },
                    "attribute_mapping_template": {
                      "type": "string",
                      "enum": [
                        "azuread",
                        "okta"
                      ]
                    },
                    "disabled": {
                      "type": "boolean"
                    },
                    "detailed_audit_logging": {
                      "type": "boolean",
                      "default": false
                    },
                    "identity_provider": {
                      "type": "object",
                      "oneOf": [
                        {
                          "properties": {
                            "oidc": {
                              "type": "object",
                              "description": "OpenID Connect configuration.",
                              "properties": {
                                "issuer_uri": {
                                  "type": "string",
                                  "description": "The URI of the OIDC issuer."
                                },
                                "client_id": {
                                  "type": "string",
                                  "description": "The client ID."
                                },
                                "client_secret": {
                                  "type": "string",
                                  "description": "The client secret (optional)."
                                },
                                "jwks_json": {
                                  "type": "string",
                                  "description": "JSON Web Key Set as a JSON string (optional)."
                                },
                                "web_sso_config": {
                                  "type": "object",
                                  "description": "Optional Web SSO configuration for OIDC.",
                                  "properties": {
                                    "response_type": {
                                      "type": "string",
                                      "default": "CODE",
                                      "enum": [
                                        "CODE",
                                        "ID_TOKEN"
                                      ]
                                    },
                                    "assertion_claims_behavior": {
                                      "type": "string",
                                      "default": "ONLY_ID_TOKEN_CLAIMS",
                                      "enum": [
                                        "MERGE_USER_INFO_OVER_ID_TOKEN_CLAIMS",
                                        "ONLY_ID_TOKEN_CLAIMS"
                                      ]
                                    },
                                    "additional_scopes": {
                                      "type": "array",
                                      "items": {
                                        "type": "string"
                                      }
                                    }
                                  },
                                  "required": [],
                                  "additionalProperties": false
                                }
                              },
                              "required": [
                                "issuer_uri",
                                "client_id"
                              ],
                              "additionalProperties": false
                            }
                          },
                          "required": [
                            "oidc"
                          ],
                          "additionalProperties": false
                        },
                        {
                          "properties": {
                            "saml": {
                              "type": "object",
                              "description": "SAML configuration.",
                              "properties": {
                                "idp_metadata_xml": {
                                  "type": "string",
                                  "description": "SAML IdP metadata XML."
                                }
                              },
                              "required": [
                                "idp_metadata_xml"
                              ],
                              "additionalProperties": false
                            }
                          },
                          "required": [
                            "saml"
                          ],
                          "additionalProperties": false
                        }
                      ]
                    },
                    "oauth2_client_config": {
                      "type": "object",
                      "additionalProperties": false,
                      "properties": {
                        "extended_attributes": {
                          "$ref": "#/$defs/wfif_oauth2_client_attrs"
                        },
                        "extra_attributes": {
                          "$ref": "#/$defs/wfif_oauth2_client_attrs"
                        }
                      }
                    },
                    "scim_tenant": {
                      "type": "object",
                      "additionalProperties": false,
                      "required": [
                        "id",
                        "claim_mapping"
                      ],
                      "properties": {
                        "id": {
                          "type": "string"
                        },
                        "claim_mapping": {
                          "type": "object",
                          "additionalProperties": {
                            "type": "string"
                          }
                        },
                        "location": {
                          "type": "string",
                          "default": "global"
                        },
                        "display_name": {
                          "type": "string"
                        },
                        "description": {
                          "type": "string"
                        },
                        "hard_delete": {
                          "type": "boolean"
                        }
                      }
                    },
                    "scim_usage": {
                      "type": "string",
                      "enum": [
                        "ENABLED_FOR_GROUPS"
                      ]
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "$defs": {
    "iam": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^(?:roles/|\\$custom_roles:|organizations/[0-9]+/roles/|([a-z0-9.]+:)?projects/[a-z0-9-]+/roles/)": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^(?:\\$[a-z_-]+:|domain:|group:|mdb:|serviceAccount:|user:|principal:|principalSet:)"
          }
        }
      }
    },
    "iam_bindings": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^[a-z0-9_-]+$": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "members",
            "role"
          ],
          "properties": {
            "members": {
              "type": "array",
              "items": {
                "type": "string",
                "pattern": "^(?:\\$[a-z_-]+:|domain:|group:|mdb:|serviceAccount:|user:|principal:|principalSet:)"
              }
            },
            "role": {
              "type": "string",
              "pattern": "^(?:roles/|\\$custom_roles:|organizations/[0-9]+/roles/|([a-z0-9.]+:)?projects/[a-z0-9-]+/roles/)"
            },
            "condition": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "expression",
                "title"
              ],
              "properties": {
                "expression": {
                  "type": "string"
                },
                "title": {
                  "type": "string"
                },
                "description": {
                  "type": "string"
                }
              }
            }
          }
        }
      }
    },
    "iam_bindings_additive": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^[a-z0-9_-]+$": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "member",
            "role"
          ],
          "properties": {
            "member": {
              "type": "string",
              "pattern": "^(?:\\$[a-z_-]+:|domain:|group:|serviceAccount:|user:|principal:|principalSet:)"
            },
            "role": {
              "type": "string",
              "pattern": "^[a-zA-Z0-9_/\\.]+$"
            },
            "condition": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "expression",
                "title"
              ],
              "properties": {
                "expression": {
                  "type": "string"
                },
                "title": {
                  "type": "string"
                },
                "description": {
                  "type": "string"
                }
              }
            }
          }
        }
      }
    },
    "iam_by_principals": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^(?:\\$[a-z_-]+:|domain:|group:|serviceAccount:|user:|principal:|principalSet:)": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^(?:roles/|\\$custom_roles:|organizations/[0-9]+/roles/|([a-z0-9.]+:)?projects/[a-z0-9-]+/roles/)"
          }
        }
      }
    },
    "iam_by_principals_conditional": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^(?:\\$[a-z_-]+:|domain:|group:|serviceAccount:|user:|principal:|principalSet:)": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "condition",
            "roles"
          ],
          "properties": {
            "condition": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "expression",
                "title"
              ],
              "properties": {
                "expression": {
                  "type": "string"
                },
                "title": {
                  "type": "string"
                },
                "description": {
                  "type": "string"
                }
              }
            },
            "roles": {
              "type": "array",
              "items": {
                "type": "string",
                "pattern": "^(?:roles/|\\$custom_roles:|organizations/[0-9]+/roles/|([a-z0-9.]+:)?projects/[a-z0-9-]+/roles/)"
              }
            }
          }
        }
      }
    },
    "pam_entitlements": {
      "type": "object",
      "additionalProperties": false,
      "patternProperties": {
        "^[a-z][a-z0-9-]{0,61}[a-z0-9]$": {
          "type": "object",
          "properties": {
            "max_request_duration": {
              "type": "string"
            },
            "eligible_users": {
              "type": "array",
              "items": {
                "type": "string"
              }
            },
            "privileged_access": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "role": {
                    "type": "string"
                  },
                  "condition": {
                    "type": "string"
                  }
                },
                "required": [
                  "role"
                ],
                "additionalProperties": false
              }
            },
            "requester_justification_config": {
              "type": "object",
              "properties": {
                "not_mandatory": {
                  "type": "boolean"
                },
                "unstructured": {
                  "type": "boolean"
                }
              },
              "additionalProperties": false
            },
            "manual_approvals": {
              "type": "object",
              "properties": {
                "require_approver_justification": {
                  "type": "boolean"
                },
                "steps": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "approvers": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      },
                      "approvals_needed": {
                        "type": "number"
                      },
                      "approver_email_recipients": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      }
                    },
                    "required": [
                      "approvers"
                    ],
                    "additionalProperties": false
                  }
                }
              },
              "required": [
                "require_approver_justification",
                "steps"
              ],
              "additionalProperties": false
            },
            "additional_notification_targets": {
              "type": "object",
              "properties": {
                "admin_email_recipients": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "requester_email_recipients": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                }
              },
              "additionalProperties": false
            }
          },
          "required": [
            "max_request_duration",
            "eligible_users",
            "privileged_access"
          ],
          "additionalProperties": false
        }
      }
    },
    "wfif_oauth2_client_attrs": {
      "type": "object",
      "properties": {
        "issuer_uri": {
          "type": "string",
          "description": "The URI of the OpenID Connect issuer."
        },
        "client_id": {
          "type": "string",
          "description": "The client ID for the application."
        },
        "client_secret": {
          "type": "string",
          "description": "The client secret for the application."
        },
        "attributes_type": {
          "type": "string",
          "description": "The type of attributes to fetch (optional).",
          "enum": [
            "AZURE_AD_GROUPS_MAIL",
            "AZURE_AD_GROUPS_ID"
          ]
        },
        "query_filter": {
          "type": "string",
          "description": "A filter string to query specific data (optional)."
        }
      },
      "required": [
        "issuer_uri",
        "client_id",
        "client_secret"
      ],
      "additionalProperties": false
    }
  }
}
