{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/google-cloud-kms/json-schema/google-cloud-kms-autokey-config-schema.json",
  "title": "AutokeyConfig",
  "description": "Cloud KMS Autokey configuration for a project or folder.",
  "x-generated": "2026-11-11",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/google-cloud-kms-cloudkms-folders-api-openapi.yml#/components/schemas/AutokeyConfig",
  "type": "object",
  "properties": {
    "keyProject": {
      "type": "string",
      "description": "Optional. Name of the key project, e.g. `projects/{PROJECT_ID}` or `projects/{PROJECT_NUMBER}`, where Cloud KMS Autokey will provision a new CryptoKey when a KeyHandle is created. On UpdateAutokeyConfig, the caller will require `cloudkms.cryptoKeys.setIamPolicy` permission on this key project. Once configured, for Cloud KMS Autokey to function properly, this key project must have the Cloud KMS API activated and the Cloud KMS Service Agent for this key project must be granted the `cloudkms.admin` role (or pertinent permissions). A request with an empty key project field will clear the configuration."
    },
    "keyProjectResolutionMode": {
      "description": "Optional. KeyProjectResolutionMode for the AutokeyConfig. Valid values are `DEDICATED_KEY_PROJECT`, `RESOURCE_PROJECT`, or `DISABLED`.",
      "type": "string",
      "enum": [
        "KEY_PROJECT_RESOLUTION_MODE_UNSPECIFIED",
        "DEDICATED_KEY_PROJECT",
        "RESOURCE_PROJECT",
        "DISABLED"
      ]
    },
    "state": {
      "readOnly": true,
      "type": "string",
      "enum": [
        "STATE_UNSPECIFIED",
        "ACTIVE",
        "KEY_PROJECT_DELETED",
        "UNINITIALIZED",
        "KEY_PROJECT_PERMISSION_DENIED"
      ],
      "description": "Output only. The state for the AutokeyConfig."
    },
    "name": {
      "description": "Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`, `projects/{PROJECT_NUMBER}/autokeyConfig`, or `projects/{PROJECT_ID}/autokeyConfig`.",
      "type": "string"
    },
    "etag": {
      "description": "Optional. A checksum computed by the server based on the value of other fields. This may be sent on update requests to ensure that the client has an up-to-date value before proceeding. The request will be rejected with an ABORTED error on a mismatched etag.",
      "type": "string"
    }
  }
}