{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/google-cloud-kms/json-schema/google-cloud-kms-key-access-justifications-policy-config-schema.json",
  "title": "KeyAccessJustificationsPolicyConfig",
  "description": "Represents a singleton configuration for Key Access Justifications policies.",
  "x-generated": "2026-11-11",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/google-cloud-kms-cloudkms-folders-api-openapi.yml#/components/schemas/KeyAccessJustificationsPolicyConfig",
  "properties": {
    "defaultKeyAccessJustificationPolicy": {
      "$ref": "#/$defs/KeyAccessJustificationsPolicy",
      "description": "Optional. Specifies the default key access justifications (KAJ) policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. This overrides any default policies in its ancestry. If this field is unset, or is set but contains an empty allowed_access_reasons list, no default Key Access Justifications (KAJ) policy configuration is active. In this scenario, all newly created keys will default to an \"allow-all\" policy."
    },
    "name": {
      "description": "Identifier. Represents the resource name for this KeyAccessJustificationsPolicyConfig in the format of \"{organizations|folders|projects}/*/kajPolicyConfig\".",
      "type": "string"
    },
    "defaultPolicyAvailable": {
      "type": "boolean",
      "readOnly": true,
      "description": "Output only. Indicates whether this parent resource is available to default policy feature. Please consult [the prerequisite of default policy feature](https://cloud.google.com/assured-workloads/key-access-justifications/docs/set-default-policy#before) for more details."
    }
  },
  "type": "object",
  "$defs": {
    "KeyAccessJustificationsPolicy": {
      "type": "object",
      "properties": {
        "allowedAccessReasons": {
          "items": {
            "type": "string",
            "enum": [
              "REASON_UNSPECIFIED",
              "CUSTOMER_INITIATED_SUPPORT",
              "GOOGLE_INITIATED_SERVICE",
              "THIRD_PARTY_DATA_REQUEST",
              "GOOGLE_INITIATED_REVIEW",
              "CUSTOMER_INITIATED_ACCESS",
              "GOOGLE_INITIATED_SYSTEM_OPERATION",
              "REASON_NOT_EXPECTED",
              "MODIFIED_CUSTOMER_INITIATED_ACCESS",
              "MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION",
              "GOOGLE_RESPONSE_TO_PRODUCTION_ALERT",
              "CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING"
            ]
          },
          "type": "array",
          "description": "The list of allowed reasons for access to a CryptoKey. Note that empty allowed_access_reasons has a different meaning depending on where this message appears. If this is under KeyAccessJustificationsPolicyConfig, it means allow-all. If this is under CryptoKey, it means deny-all."
        }
      },
      "description": "A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey or KeyAccessJustificationsPolicyConfig (the default Key Access Justifications policy)."
    }
  }
}