Class: Google::Iam::V1beta::WorkloadIdentityPoolProvider

Inherits:

Object

• Object
• Google::Iam::V1beta::WorkloadIdentityPoolProvider

Extended by:

Protobuf::MessageExts::ClassMethods

Includes:

Protobuf::MessageExts

Defined in:

proto_docs/google/iam/v1beta/workload_identity_pool.rb

Overview

A configuration for an external identity provider.

Defined Under Namespace

Modules: State Classes: AttributeMappingEntry, Aws, Oidc

Instance Attribute Summary

• #attribute_condition ⇒ ::String

  A Common Expression Language expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted.

• #attribute_mapping ⇒ ::Google::Protobuf::Map{::String => ::String}

  Maps attributes from authentication credentials issued by an external identity provider to Google Cloud attributes, such as subject and segment.

• #aws ⇒ ::Google::Iam::V1beta::WorkloadIdentityPoolProvider::Aws

  An Amazon Web Services identity provider.

• #description ⇒ ::String

  A description for the provider.

• #disabled ⇒ ::Boolean

  Whether the provider is disabled.

• #display_name ⇒ ::String

  A display name for the provider.

• #name ⇒ ::String readonly

  Output only.

• #oidc ⇒ ::Google::Iam::V1beta::WorkloadIdentityPoolProvider::Oidc

  An OpenId Connect 1.0 identity provider.

• #state ⇒ ::Google::Iam::V1beta::WorkloadIdentityPoolProvider::State readonly

  Output only.

Instance Attribute Details

#attribute_condition ⇒ ::String

# File 'proto_docs/google/iam/v1beta/workload_identity_pool.rb', line 204

class WorkloadIdentityPoolProvider
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Represents an Amazon Web Services identity provider.
  # @!attribute [rw] account_id
  #   @return [::String]
  #     Required. The AWS account ID.
  class Aws
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Represents an OpenId Connect 1.0 identity provider.
  # @!attribute [rw] issuer_uri
  #   @return [::String]
  #     Required. The OIDC issuer URL.
  # @!attribute [rw] allowed_audiences
  #   @return [::Array<::String>]
  #     Acceptable values for the `aud` field (audience) in the OIDC token. Token
  #     exchange requests are rejected if the token audience does not match one
  #     of the configured values. Each audience may be at most 256 characters. A
  #     maximum of 10 audiences may be configured.
  #
  #     If this list is empty, the OIDC token audience must be equal to
  #     the full canonical resource name of the WorkloadIdentityPoolProvider,
  #     with or without the HTTPS prefix. For example:
  #
  #     ```
  #     //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     ```
  class Oidc
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::String]
  class AttributeMappingEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The current state of the provider.
  module State
    # State unspecified.
    STATE_UNSPECIFIED = 0

    # The provider is active, and may be used to validate authentication
    # credentials.
    ACTIVE = 1

    # The provider is soft-deleted. Soft-deleted providers are permanently
    # deleted after approximately 30 days. You can restore a soft-deleted
    # provider using
    # {::Google::Iam::V1beta::WorkloadIdentityPools::Client#undelete_workload_identity_pool_provider UndeleteWorkloadIdentityPoolProvider}.
    #
    # You cannot reuse the ID of a soft-deleted provider until it is
    # permanently deleted.
    DELETED = 2
  end
end

#attribute_mapping ⇒ ::Google::Protobuf::Map{::String => ::String}

# File 'proto_docs/google/iam/v1beta/workload_identity_pool.rb', line 204

class WorkloadIdentityPoolProvider
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Represents an Amazon Web Services identity provider.
  # @!attribute [rw] account_id
  #   @return [::String]
  #     Required. The AWS account ID.
  class Aws
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Represents an OpenId Connect 1.0 identity provider.
  # @!attribute [rw] issuer_uri
  #   @return [::String]
  #     Required. The OIDC issuer URL.
  # @!attribute [rw] allowed_audiences
  #   @return [::Array<::String>]
  #     Acceptable values for the `aud` field (audience) in the OIDC token. Token
  #     exchange requests are rejected if the token audience does not match one
  #     of the configured values. Each audience may be at most 256 characters. A
  #     maximum of 10 audiences may be configured.
  #
  #     If this list is empty, the OIDC token audience must be equal to
  #     the full canonical resource name of the WorkloadIdentityPoolProvider,
  #     with or without the HTTPS prefix. For example:
  #
  #     ```
  #     //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     ```
  class Oidc
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::String]
  class AttributeMappingEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The current state of the provider.
  module State
    # State unspecified.
    STATE_UNSPECIFIED = 0

    # The provider is active, and may be used to validate authentication
    # credentials.
    ACTIVE = 1

    # The provider is soft-deleted. Soft-deleted providers are permanently
    # deleted after approximately 30 days. You can restore a soft-deleted
    # provider using
    # {::Google::Iam::V1beta::WorkloadIdentityPools::Client#undelete_workload_identity_pool_provider UndeleteWorkloadIdentityPoolProvider}.
    #
    # You cannot reuse the ID of a soft-deleted provider until it is
    # permanently deleted.
    DELETED = 2
  end
end

#aws ⇒ ::Google::Iam::V1beta::WorkloadIdentityPoolProvider::Aws

# File 'proto_docs/google/iam/v1beta/workload_identity_pool.rb', line 204

class WorkloadIdentityPoolProvider
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Represents an Amazon Web Services identity provider.
  # @!attribute [rw] account_id
  #   @return [::String]
  #     Required. The AWS account ID.
  class Aws
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Represents an OpenId Connect 1.0 identity provider.
  # @!attribute [rw] issuer_uri
  #   @return [::String]
  #     Required. The OIDC issuer URL.
  # @!attribute [rw] allowed_audiences
  #   @return [::Array<::String>]
  #     Acceptable values for the `aud` field (audience) in the OIDC token. Token
  #     exchange requests are rejected if the token audience does not match one
  #     of the configured values. Each audience may be at most 256 characters. A
  #     maximum of 10 audiences may be configured.
  #
  #     If this list is empty, the OIDC token audience must be equal to
  #     the full canonical resource name of the WorkloadIdentityPoolProvider,
  #     with or without the HTTPS prefix. For example:
  #
  #     ```
  #     //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     ```
  class Oidc
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::String]
  class AttributeMappingEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The current state of the provider.
  module State
    # State unspecified.
    STATE_UNSPECIFIED = 0

    # The provider is active, and may be used to validate authentication
    # credentials.
    ACTIVE = 1

    # The provider is soft-deleted. Soft-deleted providers are permanently
    # deleted after approximately 30 days. You can restore a soft-deleted
    # provider using
    # {::Google::Iam::V1beta::WorkloadIdentityPools::Client#undelete_workload_identity_pool_provider UndeleteWorkloadIdentityPoolProvider}.
    #
    # You cannot reuse the ID of a soft-deleted provider until it is
    # permanently deleted.
    DELETED = 2
  end
end

#description ⇒ ::String

# File 'proto_docs/google/iam/v1beta/workload_identity_pool.rb', line 204

class WorkloadIdentityPoolProvider
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Represents an Amazon Web Services identity provider.
  # @!attribute [rw] account_id
  #   @return [::String]
  #     Required. The AWS account ID.
  class Aws
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Represents an OpenId Connect 1.0 identity provider.
  # @!attribute [rw] issuer_uri
  #   @return [::String]
  #     Required. The OIDC issuer URL.
  # @!attribute [rw] allowed_audiences
  #   @return [::Array<::String>]
  #     Acceptable values for the `aud` field (audience) in the OIDC token. Token
  #     exchange requests are rejected if the token audience does not match one
  #     of the configured values. Each audience may be at most 256 characters. A
  #     maximum of 10 audiences may be configured.
  #
  #     If this list is empty, the OIDC token audience must be equal to
  #     the full canonical resource name of the WorkloadIdentityPoolProvider,
  #     with or without the HTTPS prefix. For example:
  #
  #     ```
  #     //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     ```
  class Oidc
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::String]
  class AttributeMappingEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The current state of the provider.
  module State
    # State unspecified.
    STATE_UNSPECIFIED = 0

    # The provider is active, and may be used to validate authentication
    # credentials.
    ACTIVE = 1

    # The provider is soft-deleted. Soft-deleted providers are permanently
    # deleted after approximately 30 days. You can restore a soft-deleted
    # provider using
    # {::Google::Iam::V1beta::WorkloadIdentityPools::Client#undelete_workload_identity_pool_provider UndeleteWorkloadIdentityPoolProvider}.
    #
    # You cannot reuse the ID of a soft-deleted provider until it is
    # permanently deleted.
    DELETED = 2
  end
end

#disabled ⇒ ::Boolean

# File 'proto_docs/google/iam/v1beta/workload_identity_pool.rb', line 204

class WorkloadIdentityPoolProvider
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Represents an Amazon Web Services identity provider.
  # @!attribute [rw] account_id
  #   @return [::String]
  #     Required. The AWS account ID.
  class Aws
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Represents an OpenId Connect 1.0 identity provider.
  # @!attribute [rw] issuer_uri
  #   @return [::String]
  #     Required. The OIDC issuer URL.
  # @!attribute [rw] allowed_audiences
  #   @return [::Array<::String>]
  #     Acceptable values for the `aud` field (audience) in the OIDC token. Token
  #     exchange requests are rejected if the token audience does not match one
  #     of the configured values. Each audience may be at most 256 characters. A
  #     maximum of 10 audiences may be configured.
  #
  #     If this list is empty, the OIDC token audience must be equal to
  #     the full canonical resource name of the WorkloadIdentityPoolProvider,
  #     with or without the HTTPS prefix. For example:
  #
  #     ```
  #     //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     ```
  class Oidc
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::String]
  class AttributeMappingEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The current state of the provider.
  module State
    # State unspecified.
    STATE_UNSPECIFIED = 0

    # The provider is active, and may be used to validate authentication
    # credentials.
    ACTIVE = 1

    # The provider is soft-deleted. Soft-deleted providers are permanently
    # deleted after approximately 30 days. You can restore a soft-deleted
    # provider using
    # {::Google::Iam::V1beta::WorkloadIdentityPools::Client#undelete_workload_identity_pool_provider UndeleteWorkloadIdentityPoolProvider}.
    #
    # You cannot reuse the ID of a soft-deleted provider until it is
    # permanently deleted.
    DELETED = 2
  end
end

#display_name ⇒ ::String

# File 'proto_docs/google/iam/v1beta/workload_identity_pool.rb', line 204

class WorkloadIdentityPoolProvider
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Represents an Amazon Web Services identity provider.
  # @!attribute [rw] account_id
  #   @return [::String]
  #     Required. The AWS account ID.
  class Aws
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Represents an OpenId Connect 1.0 identity provider.
  # @!attribute [rw] issuer_uri
  #   @return [::String]
  #     Required. The OIDC issuer URL.
  # @!attribute [rw] allowed_audiences
  #   @return [::Array<::String>]
  #     Acceptable values for the `aud` field (audience) in the OIDC token. Token
  #     exchange requests are rejected if the token audience does not match one
  #     of the configured values. Each audience may be at most 256 characters. A
  #     maximum of 10 audiences may be configured.
  #
  #     If this list is empty, the OIDC token audience must be equal to
  #     the full canonical resource name of the WorkloadIdentityPoolProvider,
  #     with or without the HTTPS prefix. For example:
  #
  #     ```
  #     //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     ```
  class Oidc
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::String]
  class AttributeMappingEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The current state of the provider.
  module State
    # State unspecified.
    STATE_UNSPECIFIED = 0

    # The provider is active, and may be used to validate authentication
    # credentials.
    ACTIVE = 1

    # The provider is soft-deleted. Soft-deleted providers are permanently
    # deleted after approximately 30 days. You can restore a soft-deleted
    # provider using
    # {::Google::Iam::V1beta::WorkloadIdentityPools::Client#undelete_workload_identity_pool_provider UndeleteWorkloadIdentityPoolProvider}.
    #
    # You cannot reuse the ID of a soft-deleted provider until it is
    # permanently deleted.
    DELETED = 2
  end
end

#name ⇒ ::String (readonly)

# File 'proto_docs/google/iam/v1beta/workload_identity_pool.rb', line 204

class WorkloadIdentityPoolProvider
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Represents an Amazon Web Services identity provider.
  # @!attribute [rw] account_id
  #   @return [::String]
  #     Required. The AWS account ID.
  class Aws
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Represents an OpenId Connect 1.0 identity provider.
  # @!attribute [rw] issuer_uri
  #   @return [::String]
  #     Required. The OIDC issuer URL.
  # @!attribute [rw] allowed_audiences
  #   @return [::Array<::String>]
  #     Acceptable values for the `aud` field (audience) in the OIDC token. Token
  #     exchange requests are rejected if the token audience does not match one
  #     of the configured values. Each audience may be at most 256 characters. A
  #     maximum of 10 audiences may be configured.
  #
  #     If this list is empty, the OIDC token audience must be equal to
  #     the full canonical resource name of the WorkloadIdentityPoolProvider,
  #     with or without the HTTPS prefix. For example:
  #
  #     ```
  #     //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     ```
  class Oidc
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::String]
  class AttributeMappingEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The current state of the provider.
  module State
    # State unspecified.
    STATE_UNSPECIFIED = 0

    # The provider is active, and may be used to validate authentication
    # credentials.
    ACTIVE = 1

    # The provider is soft-deleted. Soft-deleted providers are permanently
    # deleted after approximately 30 days. You can restore a soft-deleted
    # provider using
    # {::Google::Iam::V1beta::WorkloadIdentityPools::Client#undelete_workload_identity_pool_provider UndeleteWorkloadIdentityPoolProvider}.
    #
    # You cannot reuse the ID of a soft-deleted provider until it is
    # permanently deleted.
    DELETED = 2
  end
end

#oidc ⇒ ::Google::Iam::V1beta::WorkloadIdentityPoolProvider::Oidc

# File 'proto_docs/google/iam/v1beta/workload_identity_pool.rb', line 204

class WorkloadIdentityPoolProvider
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Represents an Amazon Web Services identity provider.
  # @!attribute [rw] account_id
  #   @return [::String]
  #     Required. The AWS account ID.
  class Aws
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Represents an OpenId Connect 1.0 identity provider.
  # @!attribute [rw] issuer_uri
  #   @return [::String]
  #     Required. The OIDC issuer URL.
  # @!attribute [rw] allowed_audiences
  #   @return [::Array<::String>]
  #     Acceptable values for the `aud` field (audience) in the OIDC token. Token
  #     exchange requests are rejected if the token audience does not match one
  #     of the configured values. Each audience may be at most 256 characters. A
  #     maximum of 10 audiences may be configured.
  #
  #     If this list is empty, the OIDC token audience must be equal to
  #     the full canonical resource name of the WorkloadIdentityPoolProvider,
  #     with or without the HTTPS prefix. For example:
  #
  #     ```
  #     //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     ```
  class Oidc
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::String]
  class AttributeMappingEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The current state of the provider.
  module State
    # State unspecified.
    STATE_UNSPECIFIED = 0

    # The provider is active, and may be used to validate authentication
    # credentials.
    ACTIVE = 1

    # The provider is soft-deleted. Soft-deleted providers are permanently
    # deleted after approximately 30 days. You can restore a soft-deleted
    # provider using
    # {::Google::Iam::V1beta::WorkloadIdentityPools::Client#undelete_workload_identity_pool_provider UndeleteWorkloadIdentityPoolProvider}.
    #
    # You cannot reuse the ID of a soft-deleted provider until it is
    # permanently deleted.
    DELETED = 2
  end
end

#state ⇒ ::Google::Iam::V1beta::WorkloadIdentityPoolProvider::State (readonly)

# File 'proto_docs/google/iam/v1beta/workload_identity_pool.rb', line 204

class WorkloadIdentityPoolProvider
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # Represents an Amazon Web Services identity provider.
  # @!attribute [rw] account_id
  #   @return [::String]
  #     Required. The AWS account ID.
  class Aws
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # Represents an OpenId Connect 1.0 identity provider.
  # @!attribute [rw] issuer_uri
  #   @return [::String]
  #     Required. The OIDC issuer URL.
  # @!attribute [rw] allowed_audiences
  #   @return [::Array<::String>]
  #     Acceptable values for the `aud` field (audience) in the OIDC token. Token
  #     exchange requests are rejected if the token audience does not match one
  #     of the configured values. Each audience may be at most 256 characters. A
  #     maximum of 10 audiences may be configured.
  #
  #     If this list is empty, the OIDC token audience must be equal to
  #     the full canonical resource name of the WorkloadIdentityPoolProvider,
  #     with or without the HTTPS prefix. For example:
  #
  #     ```
  #     //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
  #     ```
  class Oidc
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::String]
  class AttributeMappingEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # The current state of the provider.
  module State
    # State unspecified.
    STATE_UNSPECIFIED = 0

    # The provider is active, and may be used to validate authentication
    # credentials.
    ACTIVE = 1

    # The provider is soft-deleted. Soft-deleted providers are permanently
    # deleted after approximately 30 days. You can restore a soft-deleted
    # provider using
    # {::Google::Iam::V1beta::WorkloadIdentityPools::Client#undelete_workload_identity_pool_provider UndeleteWorkloadIdentityPoolProvider}.
    #
    # You cannot reuse the ID of a soft-deleted provider until it is
    # permanently deleted.
    DELETED = 2
  end
end