// Copyright 2026 Google LLC.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// Code generated file. DO NOT EDIT.

// Package agentidentitycredentials provides access to the Agent Identity Credentials API.
//
// For product documentation, see: https://cloud.google.com/iam/docs/
//
// # Library status
//
// These client libraries are officially supported by Google. However, this
// library is considered complete and is in maintenance mode. This means
// that we will address critical bugs and security issues but will not add
// any new features.
//
// When possible, we recommend using our newer
// [Cloud Client Libraries for Go](https://pkg.go.dev/cloud.google.com/go)
// that are still actively being worked and iterated on.
//
// # Creating a client
//
// Usage example:
//
//	import "google.golang.org/api/agentidentitycredentials/v1beta"
//	...
//	ctx := context.Background()
//	agentidentitycredentialsService, err := agentidentitycredentials.NewService(ctx)
//
// In this example, Google Application Default Credentials are used for
// authentication. For information on how to create and obtain Application
// Default Credentials, see https://developers.google.com/identity/protocols/application-default-credentials.
//
// # Other authentication options
//
// To use an API key for authentication (note: some APIs do not support API
// keys), use [google.golang.org/api/option.WithAPIKey]:
//
//	agentidentitycredentialsService, err := agentidentitycredentials.NewService(ctx, option.WithAPIKey("AIza..."))
//
// To use an OAuth token (e.g., a user token obtained via a three-legged OAuth
// flow, use [google.golang.org/api/option.WithTokenSource]:
//
//	config := &oauth2.Config{...}
//	// ...
//	token, err := config.Exchange(ctx, ...)
//	agentidentitycredentialsService, err := agentidentitycredentials.NewService(ctx, option.WithTokenSource(config.TokenSource(ctx, token)))
//
// See [google.golang.org/api/option.ClientOption] for details on options.
package agentidentitycredentials // import "google.golang.org/api/agentidentitycredentials/v1beta"

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"log/slog"
	"net/http"
	"net/url"
	"strconv"
	"strings"

	"github.com/googleapis/gax-go/v2/internallog"
	googleapi "google.golang.org/api/googleapi"
	internal "google.golang.org/api/internal"
	gensupport "google.golang.org/api/internal/gensupport"
	option "google.golang.org/api/option"
	internaloption "google.golang.org/api/option/internaloption"
	htransport "google.golang.org/api/transport/http"
)

// Always reference these packages, just in case the auto-generated code
// below doesn't.
var _ = bytes.NewBuffer
var _ = strconv.Itoa
var _ = fmt.Sprintf
var _ = json.NewDecoder
var _ = io.Copy
var _ = url.Parse
var _ = gensupport.MarshalJSON
var _ = googleapi.Version
var _ = errors.New
var _ = strings.Replace
var _ = context.Canceled
var _ = internaloption.WithDefaultEndpoint
var _ = internal.Version
var _ = internallog.New

const apiId = "agentidentitycredentials:v1beta"
const apiName = "agentidentitycredentials"
const apiVersion = "v1beta"
const basePath = "https://agentidentitycredentials.googleapis.com/"
const basePathTemplate = "https://agentidentitycredentials.UNIVERSE_DOMAIN/"
const mtlsBasePath = "https://agentidentitycredentials.mtls.googleapis.com/"

// OAuth2 scopes used by this API.
const (
	// See, edit, configure, and delete your Google Cloud data and see the email
	// address for your Google Account.
	CloudPlatformScope = "https://www.googleapis.com/auth/cloud-platform"
)

// NewService creates a new Service.
func NewService(ctx context.Context, opts ...option.ClientOption) (*Service, error) {
	scopesOption := internaloption.WithDefaultScopes(
		"https://www.googleapis.com/auth/cloud-platform",
	)
	// NOTE: prepend, so we don't override user-specified scopes.
	opts = append([]option.ClientOption{scopesOption}, opts...)
	opts = append(opts, internaloption.WithDefaultEndpoint(basePath))
	opts = append(opts, internaloption.WithDefaultEndpointTemplate(basePathTemplate))
	opts = append(opts, internaloption.WithDefaultMTLSEndpoint(mtlsBasePath))
	opts = append(opts, internaloption.EnableNewAuthLibrary())
	client, endpoint, err := htransport.NewClient(ctx, opts...)
	if err != nil {
		return nil, err
	}
	s := &Service{client: client, BasePath: basePath, logger: internaloption.GetLogger(opts)}
	s.Projects = NewProjectsService(s)
	if endpoint != "" {
		s.BasePath = endpoint
	}
	return s, nil
}

// New creates a new Service. It uses the provided http.Client for requests.
//
// Deprecated: please use NewService instead.
// To provide a custom HTTP client, use option.WithHTTPClient.
// If you are using google.golang.org/api/googleapis/transport.APIKey, use option.WithAPIKey with NewService instead.
func New(client *http.Client) (*Service, error) {
	if client == nil {
		return nil, errors.New("client is nil")
	}
	return NewService(context.TODO(), option.WithHTTPClient(client))
}

type Service struct {
	client    *http.Client
	logger    *slog.Logger
	BasePath  string // API endpoint base URL
	UserAgent string // optional additional User-Agent fragment

	Projects *ProjectsService
}

func (s *Service) userAgent() string {
	if s.UserAgent == "" {
		return googleapi.UserAgent
	}
	return googleapi.UserAgent + " " + s.UserAgent
}

func NewProjectsService(s *Service) *ProjectsService {
	rs := &ProjectsService{s: s}
	rs.Locations = NewProjectsLocationsService(s)
	return rs
}

type ProjectsService struct {
	s *Service

	Locations *ProjectsLocationsService
}

func NewProjectsLocationsService(s *Service) *ProjectsLocationsService {
	rs := &ProjectsLocationsService{s: s}
	rs.AuthProviders = NewProjectsLocationsAuthProvidersService(s)
	return rs
}

type ProjectsLocationsService struct {
	s *Service

	AuthProviders *ProjectsLocationsAuthProvidersService
}

func NewProjectsLocationsAuthProvidersService(s *Service) *ProjectsLocationsAuthProvidersService {
	rs := &ProjectsLocationsAuthProvidersService{s: s}
	rs.Credentials = NewProjectsLocationsAuthProvidersCredentialsService(s)
	return rs
}

type ProjectsLocationsAuthProvidersService struct {
	s *Service

	Credentials *ProjectsLocationsAuthProvidersCredentialsService
}

func NewProjectsLocationsAuthProvidersCredentialsService(s *Service) *ProjectsLocationsAuthProvidersCredentialsService {
	rs := &ProjectsLocationsAuthProvidersCredentialsService{s: s}
	return rs
}

type ProjectsLocationsAuthProvidersCredentialsService struct {
	s *Service
}

// GoogleCloudAgentidentitycredentialsV1betaConsentRejected: Indicates the user
// has rejected the permission delegation or canceled the request.
type GoogleCloudAgentidentitycredentialsV1betaConsentRejected struct {
}

// GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsRequest: Request
// message for `FinalizeCredentials`.
type GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsRequest struct {
	// ConsentNonce: Required. The same `consent_nonce` value that was provided
	// during retrieval in the UriConsentRequired
	// (https://cloud.google.com/iam/docs/reference/agentidentitycredentials/rest/v1/projects.locations.authProviders.credentials/retrieve#UriConsentRequired)
	// metadata.
	ConsentNonce string `json:"consentNonce,omitempty"`
	// UserId: Required. The identity of the end user.
	UserId string `json:"userId,omitempty"`
	// UserIdValidationState: Required. The encrypted state passed back from the
	// consent flow.
	UserIdValidationState string `json:"userIdValidationState,omitempty"`
	// ForceSendFields is a list of field names (e.g. "ConsentNonce") to
	// unconditionally include in API requests. By default, fields with empty or
	// default values are omitted from API requests. See
	// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
	// details.
	ForceSendFields []string `json:"-"`
	// NullFields is a list of field names (e.g. "ConsentNonce") to include in API
	// requests with the JSON null value. By default, fields with empty values are
	// omitted from API requests. See
	// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
	NullFields []string `json:"-"`
}

func (s GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsRequest) MarshalJSON() ([]byte, error) {
	type NoMethod GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsRequest
	return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)
}

// GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsResponse:
// Response message for `FinalizeCredentials`. Intentionally empty.
type GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsResponse struct {
	// ServerResponse contains the HTTP response code and headers from the server.
	googleapi.ServerResponse `json:"-"`
}

// GoogleCloudAgentidentitycredentialsV1betaPending: Indicates that the
// credential retrieval is pending. The caller should retry the
// `RetrieveCredentials` request after some time.
type GoogleCloudAgentidentitycredentialsV1betaPending struct {
}

// GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsRequest: Request
// message for `RetrieveCredentials`.
type GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsRequest struct {
	// ContinueUri: Optional. The URI to redirect the user to after consent is
	// completed. This field is required for auth providers using the 3-legged
	// OAuth flow. For other auth provider types, this field is unused but not
	// rejected.
	ContinueUri string `json:"continueUri,omitempty"`
	// ForceRefreshToken: Optional. Input only. Set this field only if the previous
	// token was expired or invalid. This value must be the full, previously
	// returned token string. Setting this field triggers a refresh of the access
	// token with a stored refresh token, if possible, or a new consent flow.
	ForceRefreshToken string `json:"forceRefreshToken,omitempty"`
	// Scopes: Optional. The OAuth scopes required for this access.
	Scopes []string `json:"scopes,omitempty"`
	// UserId: Required. The identity of the end user.
	UserId string `json:"userId,omitempty"`
	// ForceSendFields is a list of field names (e.g. "ContinueUri") to
	// unconditionally include in API requests. By default, fields with empty or
	// default values are omitted from API requests. See
	// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
	// details.
	ForceSendFields []string `json:"-"`
	// NullFields is a list of field names (e.g. "ContinueUri") to include in API
	// requests with the JSON null value. By default, fields with empty values are
	// omitted from API requests. See
	// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
	NullFields []string `json:"-"`
}

func (s GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsRequest) MarshalJSON() ([]byte, error) {
	type NoMethod GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsRequest
	return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)
}

// GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsResponse:
// Response message for `RetrieveCredentials`. Contains the access tokens and
// related artifacts.
type GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsResponse struct {
	// ConsentRejected: Message indicating consent was rejected.
	ConsentRejected *GoogleCloudAgentidentitycredentialsV1betaConsentRejected `json:"consentRejected,omitempty"`
	// Pending: Message indicating credential retrieval is pending.
	Pending *GoogleCloudAgentidentitycredentialsV1betaPending `json:"pending,omitempty"`
	// Success: Message indicating credentials were successfully retrieved.
	Success *GoogleCloudAgentidentitycredentialsV1betaSuccess `json:"success,omitempty"`
	// UriConsentRequired: Message indicating URI-based consent is required.
	UriConsentRequired *GoogleCloudAgentidentitycredentialsV1betaUriConsentRequired `json:"uriConsentRequired,omitempty"`

	// ServerResponse contains the HTTP response code and headers from the server.
	googleapi.ServerResponse `json:"-"`
	// ForceSendFields is a list of field names (e.g. "ConsentRejected") to
	// unconditionally include in API requests. By default, fields with empty or
	// default values are omitted from API requests. See
	// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
	// details.
	ForceSendFields []string `json:"-"`
	// NullFields is a list of field names (e.g. "ConsentRejected") to include in
	// API requests with the JSON null value. By default, fields with empty values
	// are omitted from API requests. See
	// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
	NullFields []string `json:"-"`
}

func (s GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsResponse) MarshalJSON() ([]byte, error) {
	type NoMethod GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsResponse
	return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)
}

// GoogleCloudAgentidentitycredentialsV1betaSuccess: Message indicating
// successful retrieval of credentials.
type GoogleCloudAgentidentitycredentialsV1betaSuccess struct {
	// ExpireTime: The expiration time of the token. This does not guarantee that
	// the token will be valid until this time, since the token could be revoked
	// earlier. There could also be clock skew between the auth provider and the
	// client so it may expire slightly earlier. If not set, the token might be
	// permanent or it may be that the service does not (or cannot) know when it
	// will expire.
	ExpireTime string `json:"expireTime,omitempty"`
	// Header: The HTTP header name where the token should be placed.
	Header string `json:"header,omitempty"`
	// Scopes: The scopes actually associated with the retrieved token. End users
	// may have rejected some requested scopes, or the third-party authorization
	// servers can return a different set of scopes than what was asked for.
	// Callers should verify that all required scopes for their intended use are
	// included in this list.
	Scopes []string `json:"scopes,omitempty"`
	// Token: The retrieved access token or credential for the end user. On an MCP
	// tool call, for an invalid token the OAuth spec states that this should
	// return `401` or `403`, but MCP servers may implement this differently. If
	// you get any flavor of `PERMISSION_DENIED`, retry your original request to
	// `RetrieveCredentials` with force_refresh_token set to the expired/invalid
	// token string, which will fetch a new token or initiate a new consent flow.
	Token string `json:"token,omitempty"`
	// ForceSendFields is a list of field names (e.g. "ExpireTime") to
	// unconditionally include in API requests. By default, fields with empty or
	// default values are omitted from API requests. See
	// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
	// details.
	ForceSendFields []string `json:"-"`
	// NullFields is a list of field names (e.g. "ExpireTime") to include in API
	// requests with the JSON null value. By default, fields with empty values are
	// omitted from API requests. See
	// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
	NullFields []string `json:"-"`
}

func (s GoogleCloudAgentidentitycredentialsV1betaSuccess) MarshalJSON() ([]byte, error) {
	type NoMethod GoogleCloudAgentidentitycredentialsV1betaSuccess
	return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)
}

// GoogleCloudAgentidentitycredentialsV1betaUriConsentRequired: Indicates that
// the user must visit the provided URI to consent to delegate permission to
// the agent to act on their behalf. The caller can either poll the
// `RetrieveCredentials` method, or await the /ValidateUserId callback.
type GoogleCloudAgentidentitycredentialsV1betaUriConsentRequired struct {
	// AuthorizationUri: Output only. The URL where the user should be redirected
	// to grant consent. This will always be present.
	AuthorizationUri string `json:"authorizationUri,omitempty"`
	// ConsentNonce: Output only. A one-time, randomly generated value that
	// validates the entire consent flow is handled by a single user, avoiding CSRF
	// attacks. It must be submitted with the `FinalizeCredentials` request to
	// complete the OAuth exchange. This will always be present. Implemented per
	// RFC 6819 Section 5.3.5
	// (https://www.rfc-editor.org/rfc/rfc6819#section-5.3.5).
	ConsentNonce string `json:"consentNonce,omitempty"`
	// Uid: Output only. The unique ID of the credentials retrieval operation.
	Uid string `json:"uid,omitempty"`
	// ForceSendFields is a list of field names (e.g. "AuthorizationUri") to
	// unconditionally include in API requests. By default, fields with empty or
	// default values are omitted from API requests. See
	// https://pkg.go.dev/google.golang.org/api#hdr-ForceSendFields for more
	// details.
	ForceSendFields []string `json:"-"`
	// NullFields is a list of field names (e.g. "AuthorizationUri") to include in
	// API requests with the JSON null value. By default, fields with empty values
	// are omitted from API requests. See
	// https://pkg.go.dev/google.golang.org/api#hdr-NullFields for more details.
	NullFields []string `json:"-"`
}

func (s GoogleCloudAgentidentitycredentialsV1betaUriConsentRequired) MarshalJSON() ([]byte, error) {
	type NoMethod GoogleCloudAgentidentitycredentialsV1betaUriConsentRequired
	return gensupport.MarshalJSON(NoMethod(s), s.ForceSendFields, s.NullFields)
}

type ProjectsLocationsAuthProvidersCredentialsFinalizeCall struct {
	s                                                                   *Service
	authProvider                                                        string
	googlecloudagentidentitycredentialsv1betaFinalizecredentialsrequest *GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsRequest
	urlParams_                                                          gensupport.URLParams
	ctx_                                                                context.Context
	header_                                                             http.Header
}

// Finalize: Finalizes the credentials after a successful consent flow.
//
//   - authProvider: The resource name of the auth provider. Format:
//     `projects/{project}/locations/{location}/authProviders/{auth_provider}`.
func (r *ProjectsLocationsAuthProvidersCredentialsService) Finalize(authProvider string, googlecloudagentidentitycredentialsv1betaFinalizecredentialsrequest *GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsRequest) *ProjectsLocationsAuthProvidersCredentialsFinalizeCall {
	c := &ProjectsLocationsAuthProvidersCredentialsFinalizeCall{s: r.s, urlParams_: make(gensupport.URLParams)}
	c.authProvider = authProvider
	c.googlecloudagentidentitycredentialsv1betaFinalizecredentialsrequest = googlecloudagentidentitycredentialsv1betaFinalizecredentialsrequest
	return c
}

// Fields allows partial responses to be retrieved. See
// https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more
// details.
func (c *ProjectsLocationsAuthProvidersCredentialsFinalizeCall) Fields(s ...googleapi.Field) *ProjectsLocationsAuthProvidersCredentialsFinalizeCall {
	c.urlParams_.Set("fields", googleapi.CombineFields(s))
	return c
}

// Context sets the context to be used in this call's Do method.
func (c *ProjectsLocationsAuthProvidersCredentialsFinalizeCall) Context(ctx context.Context) *ProjectsLocationsAuthProvidersCredentialsFinalizeCall {
	c.ctx_ = ctx
	return c
}

// Header returns a http.Header that can be modified by the caller to add
// headers to the request.
func (c *ProjectsLocationsAuthProvidersCredentialsFinalizeCall) Header() http.Header {
	if c.header_ == nil {
		c.header_ = make(http.Header)
	}
	return c.header_
}

func (c *ProjectsLocationsAuthProvidersCredentialsFinalizeCall) doRequest(alt string) (*http.Response, error) {
	reqHeaders := gensupport.SetHeaders(c.s.userAgent(), "application/json", c.header_)
	body, err := googleapi.WithoutDataWrapper.JSONBuffer(c.googlecloudagentidentitycredentialsv1betaFinalizecredentialsrequest)
	if err != nil {
		return nil, err
	}
	c.urlParams_.Set("alt", alt)
	c.urlParams_.Set("prettyPrint", "false")
	urls := googleapi.ResolveRelative(c.s.BasePath, "v1beta/{+authProvider}/credentials:finalize")
	urls += "?" + c.urlParams_.Encode()
	req, err := http.NewRequest("POST", urls, body)
	if err != nil {
		return nil, err
	}
	req.Header = reqHeaders
	googleapi.Expand(req.URL, map[string]string{
		"authProvider": c.authProvider,
	})
	c.s.logger.DebugContext(c.ctx_, "api request", "serviceName", apiName, "rpcName", "agentidentitycredentials.projects.locations.authProviders.credentials.finalize", "request", internallog.HTTPRequest(req, body.Bytes()))
	return gensupport.SendRequest(c.ctx_, c.s.client, req)
}

// Do executes the "agentidentitycredentials.projects.locations.authProviders.credentials.finalize" call.
// Any non-2xx status code is an error. Response headers are in either
// *GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsResponse.ServerR
// esponse.Header or (if a response was returned at all) in
// error.(*googleapi.Error).Header. Use googleapi.IsNotModified to check
// whether the returned error was because http.StatusNotModified was returned.
func (c *ProjectsLocationsAuthProvidersCredentialsFinalizeCall) Do(opts ...googleapi.CallOption) (*GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsResponse, error) {
	gensupport.SetOptions(c.urlParams_, opts...)
	res, err := c.doRequest("json")
	if res != nil && res.StatusCode == http.StatusNotModified {
		if res.Body != nil {
			res.Body.Close()
		}
		return nil, gensupport.WrapError(&googleapi.Error{
			Code:   res.StatusCode,
			Header: res.Header,
		})
	}
	if err != nil {
		return nil, err
	}
	defer googleapi.CloseBody(res)
	if err := googleapi.CheckResponse(res); err != nil {
		return nil, gensupport.WrapError(err)
	}
	ret := &GoogleCloudAgentidentitycredentialsV1betaFinalizeCredentialsResponse{
		ServerResponse: googleapi.ServerResponse{
			Header:         res.Header,
			HTTPStatusCode: res.StatusCode,
		},
	}
	target := &ret
	b, err := gensupport.DecodeResponseBytes(target, res)
	if err != nil {
		return nil, err
	}
	c.s.logger.DebugContext(c.ctx_, "api response", "serviceName", apiName, "rpcName", "agentidentitycredentials.projects.locations.authProviders.credentials.finalize", "response", internallog.HTTPResponse(res, b))
	return ret, nil
}

type ProjectsLocationsAuthProvidersCredentialsRetrieveCall struct {
	s                                                                   *Service
	authProvider                                                        string
	googlecloudagentidentitycredentialsv1betaRetrievecredentialsrequest *GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsRequest
	urlParams_                                                          gensupport.URLParams
	ctx_                                                                context.Context
	header_                                                             http.Header
}

// Retrieve: Retrieves authorization credentials for an auth provider, or
// indicates what action needs to be taken to obtain credentials. If the
// `token` field in the response is populated, credential retrieval was
// successful. If one of the fields in the `result` oneof is populated, further
// action is required to obtain credentials, such as redirecting the user for
// consent. View comments on `RetrieveCredentialsResponse` for more
// information.
//
//   - authProvider: The resource name of the auth provider. Format:
//     `projects/{project}/locations/{location}/authProviders/{auth_provider}`.
func (r *ProjectsLocationsAuthProvidersCredentialsService) Retrieve(authProvider string, googlecloudagentidentitycredentialsv1betaRetrievecredentialsrequest *GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsRequest) *ProjectsLocationsAuthProvidersCredentialsRetrieveCall {
	c := &ProjectsLocationsAuthProvidersCredentialsRetrieveCall{s: r.s, urlParams_: make(gensupport.URLParams)}
	c.authProvider = authProvider
	c.googlecloudagentidentitycredentialsv1betaRetrievecredentialsrequest = googlecloudagentidentitycredentialsv1betaRetrievecredentialsrequest
	return c
}

// Fields allows partial responses to be retrieved. See
// https://developers.google.com/gdata/docs/2.0/basics#PartialResponse for more
// details.
func (c *ProjectsLocationsAuthProvidersCredentialsRetrieveCall) Fields(s ...googleapi.Field) *ProjectsLocationsAuthProvidersCredentialsRetrieveCall {
	c.urlParams_.Set("fields", googleapi.CombineFields(s))
	return c
}

// Context sets the context to be used in this call's Do method.
func (c *ProjectsLocationsAuthProvidersCredentialsRetrieveCall) Context(ctx context.Context) *ProjectsLocationsAuthProvidersCredentialsRetrieveCall {
	c.ctx_ = ctx
	return c
}

// Header returns a http.Header that can be modified by the caller to add
// headers to the request.
func (c *ProjectsLocationsAuthProvidersCredentialsRetrieveCall) Header() http.Header {
	if c.header_ == nil {
		c.header_ = make(http.Header)
	}
	return c.header_
}

func (c *ProjectsLocationsAuthProvidersCredentialsRetrieveCall) doRequest(alt string) (*http.Response, error) {
	reqHeaders := gensupport.SetHeaders(c.s.userAgent(), "application/json", c.header_)
	body, err := googleapi.WithoutDataWrapper.JSONBuffer(c.googlecloudagentidentitycredentialsv1betaRetrievecredentialsrequest)
	if err != nil {
		return nil, err
	}
	c.urlParams_.Set("alt", alt)
	c.urlParams_.Set("prettyPrint", "false")
	urls := googleapi.ResolveRelative(c.s.BasePath, "v1beta/{+authProvider}/credentials:retrieve")
	urls += "?" + c.urlParams_.Encode()
	req, err := http.NewRequest("POST", urls, body)
	if err != nil {
		return nil, err
	}
	req.Header = reqHeaders
	googleapi.Expand(req.URL, map[string]string{
		"authProvider": c.authProvider,
	})
	c.s.logger.DebugContext(c.ctx_, "api request", "serviceName", apiName, "rpcName", "agentidentitycredentials.projects.locations.authProviders.credentials.retrieve", "request", internallog.HTTPRequest(req, body.Bytes()))
	return gensupport.SendRequest(c.ctx_, c.s.client, req)
}

// Do executes the "agentidentitycredentials.projects.locations.authProviders.credentials.retrieve" call.
// Any non-2xx status code is an error. Response headers are in either
// *GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsResponse.ServerR
// esponse.Header or (if a response was returned at all) in
// error.(*googleapi.Error).Header. Use googleapi.IsNotModified to check
// whether the returned error was because http.StatusNotModified was returned.
func (c *ProjectsLocationsAuthProvidersCredentialsRetrieveCall) Do(opts ...googleapi.CallOption) (*GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsResponse, error) {
	gensupport.SetOptions(c.urlParams_, opts...)
	res, err := c.doRequest("json")
	if res != nil && res.StatusCode == http.StatusNotModified {
		if res.Body != nil {
			res.Body.Close()
		}
		return nil, gensupport.WrapError(&googleapi.Error{
			Code:   res.StatusCode,
			Header: res.Header,
		})
	}
	if err != nil {
		return nil, err
	}
	defer googleapi.CloseBody(res)
	if err := googleapi.CheckResponse(res); err != nil {
		return nil, gensupport.WrapError(err)
	}
	ret := &GoogleCloudAgentidentitycredentialsV1betaRetrieveCredentialsResponse{
		ServerResponse: googleapi.ServerResponse{
			Header:         res.Header,
			HTTPStatusCode: res.StatusCode,
		},
	}
	target := &ret
	b, err := gensupport.DecodeResponseBytes(target, res)
	if err != nil {
		return nil, err
	}
	c.s.logger.DebugContext(c.ctx_, "api response", "serviceName", apiName, "rpcName", "agentidentitycredentials.projects.locations.authProviders.credentials.retrieve", "response", internallog.HTTPResponse(res, b))
	return ret, nil
}