From 386ba5bd33426db7c55c3f98e8d66c783ec74960 Mon Sep 17 00:00:00 2001
From: "gcf-owl-bot[bot]" <78513119+gcf-owl-bot[bot]@users.noreply.github.com>
Date: Thu, 22 Sep 2022 10:50:18 -0400
Subject: [PATCH] feat: replace java_outer_classname option with
 use_java_stubby_library, add DisableServiceAccountKey and
 EnableServiceAccountKey, and update comments (#170)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: replace java_outer_classname option with use_java_stubby_library, add DisableServiceAccountKey and EnableServiceAccountKey, and update comments

PiperOrigin-RevId: 474647927

Source-Link: https://github.com/googleapis/googleapis/commit/a0a740c6e20e30ba8ff9da40615a22a0866752e3

Source-Link: https://github.com/googleapis/googleapis-gen/commit/5849ad110f25eef1e08daf29bd5a81f11fb65424
Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiNTg0OWFkMTEwZjI1ZWVmMWUwOGRhZjI5YmQ1YTgxZjExZmI2NTQyNCJ9

* 🦉 Updates from OwlBot post-processor

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
---
 .../google/cloud/iam/admin/v1/IAMClient.java  | 338 ++++++++-
 .../cloud/iam/admin/v1/IAMSettings.java       |  26 +
 .../cloud/iam/admin/v1/gapic_metadata.json    |   6 +
 .../cloud/iam/admin/v1/package-info.java      |  16 +-
 .../cloud/iam/admin/v1/stub/GrpcIAMStub.java  |  68 ++
 .../cloud/iam/admin/v1/stub/IAMStub.java      |  10 +
 .../iam/admin/v1/stub/IAMStubSettings.java    |  54 ++
 .../cloud/iam/admin/v1/IAMClientTest.java     | 147 ++++
 .../cloud/iam/admin/v1/MockIAMImpl.java       |  44 ++
 .../java/com/google/iam/admin/v1/IAMGrpc.java | 407 +++++++++--
 .../iam/admin/v1/CreateRoleRequest.java       | 143 ++--
 .../admin/v1/CreateRoleRequestOrBuilder.java  |  38 +-
 .../v1/CreateServiceAccountKeyRequest.java    |  10 +-
 .../admin/v1/CreateServiceAccountRequest.java |  10 +-
 .../iam/admin/v1/DeleteRoleRequest.java       | 143 ++--
 .../admin/v1/DeleteRoleRequestOrBuilder.java  |  38 +-
 .../v1/DeleteServiceAccountKeyRequest.java    |  10 +-
 .../admin/v1/DeleteServiceAccountRequest.java |  10 +-
 .../v1/DisableServiceAccountKeyRequest.java   | 682 ++++++++++++++++++
 ...ableServiceAccountKeyRequestOrBuilder.java |  62 ++
 .../v1/DisableServiceAccountRequest.java      |  10 +-
 .../v1/EnableServiceAccountKeyRequest.java    | 682 ++++++++++++++++++
 ...ableServiceAccountKeyRequestOrBuilder.java |  62 ++
 .../admin/v1/EnableServiceAccountRequest.java |  10 +-
 .../google/iam/admin/v1/GetRoleRequest.java   | 206 +++---
 .../iam/admin/v1/GetRoleRequestOrBuilder.java |  56 +-
 .../admin/v1/GetServiceAccountKeyRequest.java |  66 +-
 .../GetServiceAccountKeyRequestOrBuilder.java |  16 +-
 .../admin/v1/GetServiceAccountRequest.java    |  10 +-
 .../iam/admin/v1/{IamProto.java => Iam.java}  | 594 ++++++++-------
 .../iam/admin/v1/LintPolicyRequest.java       |  10 +-
 .../iam/admin/v1/LintPolicyResponse.java      |  10 +-
 .../com/google/iam/admin/v1/LintResult.java   |  17 +-
 .../google/iam/admin/v1/ListRolesRequest.java | 199 ++---
 .../admin/v1/ListRolesRequestOrBuilder.java   |  54 +-
 .../iam/admin/v1/ListRolesResponse.java       |  10 +-
 .../v1/ListServiceAccountKeysRequest.java     |  10 +-
 .../v1/ListServiceAccountKeysResponse.java    |  10 +-
 .../admin/v1/ListServiceAccountsRequest.java  |  10 +-
 .../admin/v1/ListServiceAccountsResponse.java |  10 +-
 .../admin/v1/PatchServiceAccountRequest.java  |  16 +-
 .../com/google/iam/admin/v1/Permission.java   |  25 +-
 .../iam/admin/v1/PermissionOrBuilder.java     |   2 +-
 .../v1/QueryAuditableServicesRequest.java     |  10 +-
 .../v1/QueryAuditableServicesResponse.java    |  20 +-
 .../admin/v1/QueryGrantableRolesRequest.java  |  10 +-
 .../admin/v1/QueryGrantableRolesResponse.java |  10 +-
 .../v1/QueryTestablePermissionsRequest.java   |  10 +-
 .../v1/QueryTestablePermissionsResponse.java  |  10 +-
 .../java/com/google/iam/admin/v1/Role.java    |  20 +-
 .../com/google/iam/admin/v1/RoleView.java     |   2 +-
 .../google/iam/admin/v1/ServiceAccount.java   |  18 +-
 .../iam/admin/v1/ServiceAccountKey.java       | 100 ++-
 .../admin/v1/ServiceAccountKeyAlgorithm.java  |   2 +-
 .../admin/v1/ServiceAccountKeyOrBuilder.java  |  13 +
 .../iam/admin/v1/ServiceAccountKeyOrigin.java |   2 +-
 .../iam/admin/v1/ServiceAccountOrBuilder.java |   2 +-
 .../v1/ServiceAccountPrivateKeyType.java      |   2 +-
 .../admin/v1/ServiceAccountPublicKeyType.java |   6 +-
 .../google/iam/admin/v1/SignBlobRequest.java  |  32 +-
 .../admin/v1/SignBlobRequestOrBuilder.java    |   6 +-
 .../google/iam/admin/v1/SignBlobResponse.java |  32 +-
 .../admin/v1/SignBlobResponseOrBuilder.java   |   6 +-
 .../google/iam/admin/v1/SignJwtRequest.java   |  66 +-
 .../iam/admin/v1/SignJwtRequestOrBuilder.java |  16 +-
 .../google/iam/admin/v1/SignJwtResponse.java  |  38 +-
 .../admin/v1/SignJwtResponseOrBuilder.java    |   8 +-
 .../iam/admin/v1/UndeleteRoleRequest.java     | 143 ++--
 .../v1/UndeleteRoleRequestOrBuilder.java      |  38 +-
 .../v1/UndeleteServiceAccountRequest.java     |  10 +-
 .../v1/UndeleteServiceAccountResponse.java    |  10 +-
 .../iam/admin/v1/UpdateRoleRequest.java       | 143 ++--
 .../admin/v1/UpdateRoleRequestOrBuilder.java  |  38 +-
 .../v1/UploadServiceAccountKeyRequest.java    |  42 +-
 ...loadServiceAccountKeyRequestOrBuilder.java |   8 +-
 .../google/iam/admin/v1/audit_data.proto      |   2 +-
 .../main/proto/google/iam/admin/v1/iam.proto  | 399 ++++++----
 77 files changed, 4231 insertions(+), 1400 deletions(-)
 create mode 100644 java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountKeyRequest.java
 create mode 100644 java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountKeyRequestOrBuilder.java
 create mode 100644 java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountKeyRequest.java
 create mode 100644 java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountKeyRequestOrBuilder.java
 rename java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/{IamProto.java => Iam.java} (65%)

diff --git a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/IAMClient.java b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/IAMClient.java
index 92a8c9f97437..2fabff666d33 100644
--- a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/IAMClient.java
+++ b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/IAMClient.java
@@ -34,7 +34,9 @@
 import com.google.iam.admin.v1.DeleteRoleRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountRequest;
+import com.google.iam.admin.v1.DisableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DisableServiceAccountRequest;
+import com.google.iam.admin.v1.EnableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.EnableServiceAccountRequest;
 import com.google.iam.admin.v1.GetRoleRequest;
 import com.google.iam.admin.v1.GetServiceAccountKeyRequest;
@@ -97,9 +99,9 @@
  *   <li>&#42;&#42;Service account keys&#42;&#42;, which service accounts use to authenticate with
  *       Google APIs
  *   <li>&#42;&#42;IAM policies for service accounts&#42;&#42;, which specify the roles that a
- *       member has for the service account
+ *       principal has for the service account
  *   <li>&#42;&#42;IAM custom roles&#42;&#42;, which help you limit the number of permissions that
- *       you grant to members
+ *       you grant to principals
  * </ul>
  *
  * <p>In addition, you can use this service to complete the following tasks, among others:
@@ -110,6 +112,14 @@
  *   <li>Lint, or validate, condition expressions in an IAM policy
  * </ul>
  *
+ * <p>When you read data from the IAM API, each read is eventually consistent. In other words, if
+ * you write data with the IAM API, then immediately read that data, the read operation might return
+ * an older version of the data. To deal with this behavior, your application can retry the request
+ * with truncated exponential backoff.
+ *
+ * <p>In contrast, writing data to the IAM API is sequentially consistent. In other words, write
+ * operations are always processed in the order in which they were received.
+ *
  * <p>This class provides the ability to make remote calls to the backing service through method
  * calls that map to API methods. Sample code to get started:
  *
@@ -669,7 +679,7 @@ public final ServiceAccount createServiceAccount(CreateServiceAccountRequest req
    *
    * <p>Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
    *
-   * <p>You can update only the `display_name` and `description` fields.
+   * <p>You can update only the `display_name` field.
    *
    * <p>Sample code:
    *
@@ -710,7 +720,7 @@ public final ServiceAccount updateServiceAccount(ServiceAccount request) {
    *
    * <p>Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
    *
-   * <p>You can update only the `display_name` and `description` fields.
+   * <p>You can update only the `display_name` field.
    *
    * <p>Sample code:
    *
@@ -1336,8 +1346,8 @@ public final ListServiceAccountKeysResponse listServiceAccountKeys(
    *     `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
    *     <p>Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account.
    *     The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
-   * @param publicKeyType The output format of the public key requested. X509_PEM is the default
-   *     output format.
+   * @param publicKeyType Optional. The output format of the public key. The default is `TYPE_NONE`,
+   *     which means that the public key is not returned.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
    */
   public final ServiceAccountKey getServiceAccountKey(
@@ -1373,8 +1383,8 @@ public final ServiceAccountKey getServiceAccountKey(
    *     `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
    *     <p>Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account.
    *     The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
-   * @param publicKeyType The output format of the public key requested. X509_PEM is the default
-   *     output format.
+   * @param publicKeyType Optional. The output format of the public key. The default is `TYPE_NONE`,
+   *     which means that the public key is not returned.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
    */
   public final ServiceAccountKey getServiceAccountKey(
@@ -1597,8 +1607,11 @@ public final ServiceAccountKey createServiceAccountKey(CreateServiceAccountKeyRe
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey], using a public key that
-   * you provide.
+   * Uploads the public key portion of a key pair that you manage, and associates the public key
+   * with a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
+   *
+   * <p>After you upload the public key, you can use the private key from the key pair as a service
+   * account key.
    *
    * <p>Sample code:
    *
@@ -1627,8 +1640,11 @@ public final ServiceAccountKey uploadServiceAccountKey(UploadServiceAccountKeyRe
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey], using a public key that
-   * you provide.
+   * Uploads the public key portion of a key pair that you manage, and associates the public key
+   * with a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
+   *
+   * <p>After you upload the public key, you can use the private key from the key pair as a service
+   * account key.
    *
    * <p>Sample code:
    *
@@ -1782,6 +1798,250 @@ public final void deleteServiceAccountKey(DeleteServiceAccountKeyRequest request
     return stub.deleteServiceAccountKeyCallable();
   }
 
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service
+   * account key can be re-enabled with
+   * [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * // This snippet has been automatically generated and should be regarded as a code template only.
+   * // It will require modifications to work:
+   * // - It may require correct/in-range values for request initialization.
+   * // - It may require specifying regional endpoints when creating the service client as shown in
+   * // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
+   * try (IAMClient iAMClient = IAMClient.create()) {
+   *   KeyName name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]");
+   *   iAMClient.disableServiceAccountKey(name);
+   * }
+   * }</pre>
+   *
+   * @param name Required. The resource name of the service account key in the following format:
+   *     `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   *     <p>Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account.
+   *     The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final void disableServiceAccountKey(KeyName name) {
+    DisableServiceAccountKeyRequest request =
+        DisableServiceAccountKeyRequest.newBuilder()
+            .setName(name == null ? null : name.toString())
+            .build();
+    disableServiceAccountKey(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service
+   * account key can be re-enabled with
+   * [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * // This snippet has been automatically generated and should be regarded as a code template only.
+   * // It will require modifications to work:
+   * // - It may require correct/in-range values for request initialization.
+   * // - It may require specifying regional endpoints when creating the service client as shown in
+   * // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
+   * try (IAMClient iAMClient = IAMClient.create()) {
+   *   String name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString();
+   *   iAMClient.disableServiceAccountKey(name);
+   * }
+   * }</pre>
+   *
+   * @param name Required. The resource name of the service account key in the following format:
+   *     `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   *     <p>Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account.
+   *     The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final void disableServiceAccountKey(String name) {
+    DisableServiceAccountKeyRequest request =
+        DisableServiceAccountKeyRequest.newBuilder().setName(name).build();
+    disableServiceAccountKey(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service
+   * account key can be re-enabled with
+   * [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * // This snippet has been automatically generated and should be regarded as a code template only.
+   * // It will require modifications to work:
+   * // - It may require correct/in-range values for request initialization.
+   * // - It may require specifying regional endpoints when creating the service client as shown in
+   * // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
+   * try (IAMClient iAMClient = IAMClient.create()) {
+   *   DisableServiceAccountKeyRequest request =
+   *       DisableServiceAccountKeyRequest.newBuilder()
+   *           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
+   *           .build();
+   *   iAMClient.disableServiceAccountKey(request);
+   * }
+   * }</pre>
+   *
+   * @param request The request object containing all of the parameters for the API call.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final void disableServiceAccountKey(DisableServiceAccountKeyRequest request) {
+    disableServiceAccountKeyCallable().call(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service
+   * account key can be re-enabled with
+   * [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * // This snippet has been automatically generated and should be regarded as a code template only.
+   * // It will require modifications to work:
+   * // - It may require correct/in-range values for request initialization.
+   * // - It may require specifying regional endpoints when creating the service client as shown in
+   * // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
+   * try (IAMClient iAMClient = IAMClient.create()) {
+   *   DisableServiceAccountKeyRequest request =
+   *       DisableServiceAccountKeyRequest.newBuilder()
+   *           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
+   *           .build();
+   *   ApiFuture<Empty> future = iAMClient.disableServiceAccountKeyCallable().futureCall(request);
+   *   // Do something.
+   *   future.get();
+   * }
+   * }</pre>
+   */
+  public final UnaryCallable<DisableServiceAccountKeyRequest, Empty>
+      disableServiceAccountKeyCallable() {
+    return stub.disableServiceAccountKeyCallable();
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * // This snippet has been automatically generated and should be regarded as a code template only.
+   * // It will require modifications to work:
+   * // - It may require correct/in-range values for request initialization.
+   * // - It may require specifying regional endpoints when creating the service client as shown in
+   * // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
+   * try (IAMClient iAMClient = IAMClient.create()) {
+   *   KeyName name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]");
+   *   iAMClient.enableServiceAccountKey(name);
+   * }
+   * }</pre>
+   *
+   * @param name Required. The resource name of the service account key in the following format:
+   *     `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   *     <p>Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account.
+   *     The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final void enableServiceAccountKey(KeyName name) {
+    EnableServiceAccountKeyRequest request =
+        EnableServiceAccountKeyRequest.newBuilder()
+            .setName(name == null ? null : name.toString())
+            .build();
+    enableServiceAccountKey(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * // This snippet has been automatically generated and should be regarded as a code template only.
+   * // It will require modifications to work:
+   * // - It may require correct/in-range values for request initialization.
+   * // - It may require specifying regional endpoints when creating the service client as shown in
+   * // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
+   * try (IAMClient iAMClient = IAMClient.create()) {
+   *   String name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString();
+   *   iAMClient.enableServiceAccountKey(name);
+   * }
+   * }</pre>
+   *
+   * @param name Required. The resource name of the service account key in the following format:
+   *     `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   *     <p>Using `-` as a wildcard for the `PROJECT_ID` will infer the project from the account.
+   *     The `ACCOUNT` value can be the `email` address or the `unique_id` of the service account.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final void enableServiceAccountKey(String name) {
+    EnableServiceAccountKeyRequest request =
+        EnableServiceAccountKeyRequest.newBuilder().setName(name).build();
+    enableServiceAccountKey(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * // This snippet has been automatically generated and should be regarded as a code template only.
+   * // It will require modifications to work:
+   * // - It may require correct/in-range values for request initialization.
+   * // - It may require specifying regional endpoints when creating the service client as shown in
+   * // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
+   * try (IAMClient iAMClient = IAMClient.create()) {
+   *   EnableServiceAccountKeyRequest request =
+   *       EnableServiceAccountKeyRequest.newBuilder()
+   *           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
+   *           .build();
+   *   iAMClient.enableServiceAccountKey(request);
+   * }
+   * }</pre>
+   *
+   * @param request The request object containing all of the parameters for the API call.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final void enableServiceAccountKey(EnableServiceAccountKeyRequest request) {
+    enableServiceAccountKeyCallable().call(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * // This snippet has been automatically generated and should be regarded as a code template only.
+   * // It will require modifications to work:
+   * // - It may require correct/in-range values for request initialization.
+   * // - It may require specifying regional endpoints when creating the service client as shown in
+   * // https://cloud.google.com/java/docs/setup#configure_endpoints_for_the_client_library
+   * try (IAMClient iAMClient = IAMClient.create()) {
+   *   EnableServiceAccountKeyRequest request =
+   *       EnableServiceAccountKeyRequest.newBuilder()
+   *           .setName(KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]").toString())
+   *           .build();
+   *   ApiFuture<Empty> future = iAMClient.enableServiceAccountKeyCallable().futureCall(request);
+   *   // Do something.
+   *   future.get();
+   * }
+   * }</pre>
+   */
+  public final UnaryCallable<EnableServiceAccountKeyRequest, Empty>
+      enableServiceAccountKeyCallable() {
+    return stub.enableServiceAccountKeyCallable();
+  }
+
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
    * &#42;&#42;Note:&#42;&#42; This method is deprecated. Use the
@@ -1988,7 +2248,7 @@ public final UnaryCallable<SignBlobRequest, SignBlobResponse> signBlobCallable()
    *     <p>The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims
    *     Set. For example: `{"sub": "user{@literal @}example.com", "iat": 313435}`
    *     <p>If the JWT Claims Set contains an expiration time (`exp`) claim, it must be an integer
-   *     timestamp that is not in the past and no more than 1 hour in the future.
+   *     timestamp that is not in the past and no more than 12 hours in the future.
    *     <p>If the JWT Claims Set does not contain an expiration time (`exp`) claim, this claim is
    *     added automatically, with a timestamp that is 1 hour in the future.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
@@ -2041,7 +2301,7 @@ public final SignJwtResponse signJwt(ServiceAccountName name, String payload) {
    *     <p>The JWT payload to sign. Must be a serialized JSON object that contains a JWT Claims
    *     Set. For example: `{"sub": "user{@literal @}example.com", "iat": 313435}`
    *     <p>If the JWT Claims Set contains an expiration time (`exp`) claim, it must be an integer
-   *     timestamp that is not in the past and no more than 1 hour in the future.
+   *     timestamp that is not in the past and no more than 12 hours in the future.
    *     <p>If the JWT Claims Set does not contain an expiration time (`exp`) claim, this claim is
    *     added automatically, with a timestamp that is 1 hour in the future.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
@@ -2132,7 +2392,7 @@ public final UnaryCallable<SignJwtRequest, SignJwtResponse> signJwtCallable() {
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
    * Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
-   * This IAM policy specifies which members have access to the service account.
+   * This IAM policy specifies which principals have access to the service account.
    *
    * <p>This method does not tell you whether the service account has been granted any roles on
    * other resources. To check whether a service account has role grants on a resource, use the
@@ -2170,7 +2430,7 @@ public final Policy getIamPolicy(ResourceName resource) {
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
    * Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
-   * This IAM policy specifies which members have access to the service account.
+   * This IAM policy specifies which principals have access to the service account.
    *
    * <p>This method does not tell you whether the service account has been granted any roles on
    * other resources. To check whether a service account has role grants on a resource, use the
@@ -2205,7 +2465,7 @@ public final Policy getIamPolicy(String resource) {
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
    * Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
-   * This IAM policy specifies which members have access to the service account.
+   * This IAM policy specifies which principals have access to the service account.
    *
    * <p>This method does not tell you whether the service account has been granted any roles on
    * other resources. To check whether a service account has role grants on a resource, use the
@@ -2242,7 +2502,7 @@ public final Policy getIamPolicy(GetIamPolicyRequest request) {
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
    * Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
-   * This IAM policy specifies which members have access to the service account.
+   * This IAM policy specifies which principals have access to the service account.
    *
    * <p>This method does not tell you whether the service account has been granted any roles on
    * other resources. To check whether a service account has role grants on a resource, use the
@@ -2280,7 +2540,7 @@ public final UnaryCallable<GetIamPolicyRequest, Policy> getIamPolicyCallable() {
    * Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
    *
    * <p>Use this method to grant or revoke access to the service account. For example, you could
-   * grant a member the ability to impersonate the service account.
+   * grant a principal the ability to impersonate the service account.
    *
    * <p>This method does not enable the service account to access other resources. To grant roles to
    * a service account on a resource, follow these steps:
@@ -2289,8 +2549,10 @@ public final UnaryCallable<GetIamPolicyRequest, Policy> getIamPolicyCallable() {
    * policy so that it binds the service account to an IAM role for the resource. 3. Call the
    * resource's `setIamPolicy` method to update its IAM policy.
    *
-   * <p>For detailed instructions, see [Granting roles to a service account for specific
-   * resources](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts).
+   * <p>For detailed instructions, see [Manage access to project, folders, and
+   * organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts)
+   * or [Manage access to other
+   * resources](https://cloud.google.com/iam/help/access/manage-other-resources).
    *
    * <p>Sample code:
    *
@@ -2328,7 +2590,7 @@ public final Policy setIamPolicy(ResourceName resource, Policy policy) {
    * Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
    *
    * <p>Use this method to grant or revoke access to the service account. For example, you could
-   * grant a member the ability to impersonate the service account.
+   * grant a principal the ability to impersonate the service account.
    *
    * <p>This method does not enable the service account to access other resources. To grant roles to
    * a service account on a resource, follow these steps:
@@ -2337,8 +2599,10 @@ public final Policy setIamPolicy(ResourceName resource, Policy policy) {
    * policy so that it binds the service account to an IAM role for the resource. 3. Call the
    * resource's `setIamPolicy` method to update its IAM policy.
    *
-   * <p>For detailed instructions, see [Granting roles to a service account for specific
-   * resources](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts).
+   * <p>For detailed instructions, see [Manage access to project, folders, and
+   * organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts)
+   * or [Manage access to other
+   * resources](https://cloud.google.com/iam/help/access/manage-other-resources).
    *
    * <p>Sample code:
    *
@@ -2373,7 +2637,7 @@ public final Policy setIamPolicy(String resource, Policy policy) {
    * Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
    *
    * <p>Use this method to grant or revoke access to the service account. For example, you could
-   * grant a member the ability to impersonate the service account.
+   * grant a principal the ability to impersonate the service account.
    *
    * <p>This method does not enable the service account to access other resources. To grant roles to
    * a service account on a resource, follow these steps:
@@ -2382,8 +2646,10 @@ public final Policy setIamPolicy(String resource, Policy policy) {
    * policy so that it binds the service account to an IAM role for the resource. 3. Call the
    * resource's `setIamPolicy` method to update its IAM policy.
    *
-   * <p>For detailed instructions, see [Granting roles to a service account for specific
-   * resources](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts).
+   * <p>For detailed instructions, see [Manage access to project, folders, and
+   * organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts)
+   * or [Manage access to other
+   * resources](https://cloud.google.com/iam/help/access/manage-other-resources).
    *
    * <p>Sample code:
    *
@@ -2416,7 +2682,7 @@ public final Policy setIamPolicy(SetIamPolicyRequest request) {
    * Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
    *
    * <p>Use this method to grant or revoke access to the service account. For example, you could
-   * grant a member the ability to impersonate the service account.
+   * grant a principal the ability to impersonate the service account.
    *
    * <p>This method does not enable the service account to access other resources. To grant roles to
    * a service account on a resource, follow these steps:
@@ -2425,8 +2691,10 @@ public final Policy setIamPolicy(SetIamPolicyRequest request) {
    * policy so that it binds the service account to an IAM role for the resource. 3. Call the
    * resource's `setIamPolicy` method to update its IAM policy.
    *
-   * <p>For detailed instructions, see [Granting roles to a service account for specific
-   * resources](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts).
+   * <p>For detailed instructions, see [Manage access to project, folders, and
+   * organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts)
+   * or [Manage access to other
+   * resources](https://cloud.google.com/iam/help/access/manage-other-resources).
    *
    * <p>Sample code:
    *
@@ -3019,7 +3287,7 @@ public final UnaryCallable<UpdateRoleRequest, Role> updateRoleCallable() {
    * <p>When you delete a custom role, the following changes occur immediately:
    *
    * <ul>
-   *   <li>You cannot bind a member to the custom role in an IAM [Policy][google.iam.v1.Policy].
+   *   <li>You cannot bind a principal to the custom role in an IAM [Policy][google.iam.v1.Policy].
    *   <li>Existing bindings to the custom role are not changed, but they have no effect.
    *   <li>By default, the response from [ListRoles][google.iam.admin.v1.IAM.ListRoles] does not
    *       include the custom role.
@@ -3065,7 +3333,7 @@ public final Role deleteRole(DeleteRoleRequest request) {
    * <p>When you delete a custom role, the following changes occur immediately:
    *
    * <ul>
-   *   <li>You cannot bind a member to the custom role in an IAM [Policy][google.iam.v1.Policy].
+   *   <li>You cannot bind a principal to the custom role in an IAM [Policy][google.iam.v1.Policy].
    *   <li>Existing bindings to the custom role are not changed, but they have no effect.
    *   <li>By default, the response from [ListRoles][google.iam.admin.v1.IAM.ListRoles] does not
    *       include the custom role.
@@ -3163,7 +3431,7 @@ public final UnaryCallable<UndeleteRoleRequest, Role> undeleteRoleCallable() {
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
    * Lists every permission that you can test on a resource. A permission is testable if you can
-   * check whether a member has that permission on the resource.
+   * check whether a principal has that permission on the resource.
    *
    * <p>Sample code:
    *
@@ -3197,7 +3465,7 @@ public final QueryTestablePermissionsPagedResponse queryTestablePermissions(
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
    * Lists every permission that you can test on a resource. A permission is testable if you can
-   * check whether a member has that permission on the resource.
+   * check whether a principal has that permission on the resource.
    *
    * <p>Sample code:
    *
@@ -3231,7 +3499,7 @@ public final QueryTestablePermissionsPagedResponse queryTestablePermissions(
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
    * Lists every permission that you can test on a resource. A permission is testable if you can
-   * check whether a member has that permission on the resource.
+   * check whether a principal has that permission on the resource.
    *
    * <p>Sample code:
    *
diff --git a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/IAMSettings.java b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/IAMSettings.java
index ac1da86d1ac8..9023882ad6aa 100644
--- a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/IAMSettings.java
+++ b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/IAMSettings.java
@@ -39,7 +39,9 @@
 import com.google.iam.admin.v1.DeleteRoleRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountRequest;
+import com.google.iam.admin.v1.DisableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DisableServiceAccountRequest;
+import com.google.iam.admin.v1.EnableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.EnableServiceAccountRequest;
 import com.google.iam.admin.v1.GetRoleRequest;
 import com.google.iam.admin.v1.GetServiceAccountKeyRequest;
@@ -197,6 +199,18 @@ public UnaryCallSettings<DisableServiceAccountRequest, Empty> disableServiceAcco
     return ((IAMStubSettings) getStubSettings()).deleteServiceAccountKeySettings();
   }
 
+  /** Returns the object with the settings used for calls to disableServiceAccountKey. */
+  public UnaryCallSettings<DisableServiceAccountKeyRequest, Empty>
+      disableServiceAccountKeySettings() {
+    return ((IAMStubSettings) getStubSettings()).disableServiceAccountKeySettings();
+  }
+
+  /** Returns the object with the settings used for calls to enableServiceAccountKey. */
+  public UnaryCallSettings<EnableServiceAccountKeyRequest, Empty>
+      enableServiceAccountKeySettings() {
+    return ((IAMStubSettings) getStubSettings()).enableServiceAccountKeySettings();
+  }
+
   /**
    * Returns the object with the settings used for calls to signBlob.
    *
@@ -474,6 +488,18 @@ public Builder applyToAllUnaryMethods(
       return getStubSettingsBuilder().deleteServiceAccountKeySettings();
     }
 
+    /** Returns the builder for the settings used for calls to disableServiceAccountKey. */
+    public UnaryCallSettings.Builder<DisableServiceAccountKeyRequest, Empty>
+        disableServiceAccountKeySettings() {
+      return getStubSettingsBuilder().disableServiceAccountKeySettings();
+    }
+
+    /** Returns the builder for the settings used for calls to enableServiceAccountKey. */
+    public UnaryCallSettings.Builder<EnableServiceAccountKeyRequest, Empty>
+        enableServiceAccountKeySettings() {
+      return getStubSettingsBuilder().enableServiceAccountKeySettings();
+    }
+
     /**
      * Returns the builder for the settings used for calls to signBlob.
      *
diff --git a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/gapic_metadata.json b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/gapic_metadata.json
index 83fe9cbfbd8c..b721693a4a72 100644
--- a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/gapic_metadata.json
+++ b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/gapic_metadata.json
@@ -31,9 +31,15 @@
             "DisableServiceAccount": {
               "methods": ["disableServiceAccount", "disableServiceAccountCallable"]
             },
+            "DisableServiceAccountKey": {
+              "methods": ["disableServiceAccountKey", "disableServiceAccountKey", "disableServiceAccountKey", "disableServiceAccountKeyCallable"]
+            },
             "EnableServiceAccount": {
               "methods": ["enableServiceAccount", "enableServiceAccountCallable"]
             },
+            "EnableServiceAccountKey": {
+              "methods": ["enableServiceAccountKey", "enableServiceAccountKey", "enableServiceAccountKey", "enableServiceAccountKeyCallable"]
+            },
             "GetIamPolicy": {
               "methods": ["getIamPolicy", "getIamPolicy", "getIamPolicy", "getIamPolicyCallable"]
             },
diff --git a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/package-info.java b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/package-info.java
index b5e32fb3052f..579be0c0ed17 100644
--- a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/package-info.java
+++ b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/package-info.java
@@ -15,7 +15,9 @@
  */
 
 /**
- * The interfaces provided are listed below, along with usage samples.
+ * A client to Identity and Access Management (IAM) API
+ *
+ * <p>The interfaces provided are listed below, along with usage samples.
  *
  * <p>======================= IAMClient =======================
  *
@@ -29,9 +31,9 @@
  *   <li>&#42;&#42;Service account keys&#42;&#42;, which service accounts use to authenticate with
  *       Google APIs
  *   <li>&#42;&#42;IAM policies for service accounts&#42;&#42;, which specify the roles that a
- *       member has for the service account
+ *       principal has for the service account
  *   <li>&#42;&#42;IAM custom roles&#42;&#42;, which help you limit the number of permissions that
- *       you grant to members
+ *       you grant to principals
  * </ul>
  *
  * <p>In addition, you can use this service to complete the following tasks, among others:
@@ -42,6 +44,14 @@
  *   <li>Lint, or validate, condition expressions in an IAM policy
  * </ul>
  *
+ * <p>When you read data from the IAM API, each read is eventually consistent. In other words, if
+ * you write data with the IAM API, then immediately read that data, the read operation might return
+ * an older version of the data. To deal with this behavior, your application can retry the request
+ * with truncated exponential backoff.
+ *
+ * <p>In contrast, writing data to the IAM API is sequentially consistent. In other words, write
+ * operations are always processed in the order in which they were received.
+ *
  * <p>Sample for IAMClient:
  *
  * <pre>{@code
diff --git a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/GrpcIAMStub.java b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/GrpcIAMStub.java
index 8d4ca5eca3f3..bb92cc3149d0 100644
--- a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/GrpcIAMStub.java
+++ b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/GrpcIAMStub.java
@@ -34,7 +34,9 @@
 import com.google.iam.admin.v1.DeleteRoleRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountRequest;
+import com.google.iam.admin.v1.DisableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DisableServiceAccountRequest;
+import com.google.iam.admin.v1.EnableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.EnableServiceAccountRequest;
 import com.google.iam.admin.v1.GetRoleRequest;
 import com.google.iam.admin.v1.GetServiceAccountKeyRequest;
@@ -233,6 +235,26 @@ public class GrpcIAMStub extends IAMStub {
               .setResponseMarshaller(ProtoUtils.marshaller(Empty.getDefaultInstance()))
               .build();
 
+  private static final MethodDescriptor<DisableServiceAccountKeyRequest, Empty>
+      disableServiceAccountKeyMethodDescriptor =
+          MethodDescriptor.<DisableServiceAccountKeyRequest, Empty>newBuilder()
+              .setType(MethodDescriptor.MethodType.UNARY)
+              .setFullMethodName("google.iam.admin.v1.IAM/DisableServiceAccountKey")
+              .setRequestMarshaller(
+                  ProtoUtils.marshaller(DisableServiceAccountKeyRequest.getDefaultInstance()))
+              .setResponseMarshaller(ProtoUtils.marshaller(Empty.getDefaultInstance()))
+              .build();
+
+  private static final MethodDescriptor<EnableServiceAccountKeyRequest, Empty>
+      enableServiceAccountKeyMethodDescriptor =
+          MethodDescriptor.<EnableServiceAccountKeyRequest, Empty>newBuilder()
+              .setType(MethodDescriptor.MethodType.UNARY)
+              .setFullMethodName("google.iam.admin.v1.IAM/EnableServiceAccountKey")
+              .setRequestMarshaller(
+                  ProtoUtils.marshaller(EnableServiceAccountKeyRequest.getDefaultInstance()))
+              .setResponseMarshaller(ProtoUtils.marshaller(Empty.getDefaultInstance()))
+              .build();
+
   private static final MethodDescriptor<SignBlobRequest, SignBlobResponse>
       signBlobMethodDescriptor =
           MethodDescriptor.<SignBlobRequest, SignBlobResponse>newBuilder()
@@ -397,6 +419,10 @@ public class GrpcIAMStub extends IAMStub {
       uploadServiceAccountKeyCallable;
   private final UnaryCallable<DeleteServiceAccountKeyRequest, Empty>
       deleteServiceAccountKeyCallable;
+  private final UnaryCallable<DisableServiceAccountKeyRequest, Empty>
+      disableServiceAccountKeyCallable;
+  private final UnaryCallable<EnableServiceAccountKeyRequest, Empty>
+      enableServiceAccountKeyCallable;
   private final UnaryCallable<SignBlobRequest, SignBlobResponse> signBlobCallable;
   private final UnaryCallable<SignJwtRequest, SignJwtResponse> signJwtCallable;
   private final UnaryCallable<GetIamPolicyRequest, Policy> getIamPolicyCallable;
@@ -613,6 +639,28 @@ protected GrpcIAMStub(
                       return params.build();
                     })
                 .build();
+    GrpcCallSettings<DisableServiceAccountKeyRequest, Empty>
+        disableServiceAccountKeyTransportSettings =
+            GrpcCallSettings.<DisableServiceAccountKeyRequest, Empty>newBuilder()
+                .setMethodDescriptor(disableServiceAccountKeyMethodDescriptor)
+                .setParamsExtractor(
+                    request -> {
+                      ImmutableMap.Builder<String, String> params = ImmutableMap.builder();
+                      params.put("name", String.valueOf(request.getName()));
+                      return params.build();
+                    })
+                .build();
+    GrpcCallSettings<EnableServiceAccountKeyRequest, Empty>
+        enableServiceAccountKeyTransportSettings =
+            GrpcCallSettings.<EnableServiceAccountKeyRequest, Empty>newBuilder()
+                .setMethodDescriptor(enableServiceAccountKeyMethodDescriptor)
+                .setParamsExtractor(
+                    request -> {
+                      ImmutableMap.Builder<String, String> params = ImmutableMap.builder();
+                      params.put("name", String.valueOf(request.getName()));
+                      return params.build();
+                    })
+                .build();
     GrpcCallSettings<SignBlobRequest, SignBlobResponse> signBlobTransportSettings =
         GrpcCallSettings.<SignBlobRequest, SignBlobResponse>newBuilder()
             .setMethodDescriptor(signBlobMethodDescriptor)
@@ -821,6 +869,16 @@ protected GrpcIAMStub(
             deleteServiceAccountKeyTransportSettings,
             settings.deleteServiceAccountKeySettings(),
             clientContext);
+    this.disableServiceAccountKeyCallable =
+        callableFactory.createUnaryCallable(
+            disableServiceAccountKeyTransportSettings,
+            settings.disableServiceAccountKeySettings(),
+            clientContext);
+    this.enableServiceAccountKeyCallable =
+        callableFactory.createUnaryCallable(
+            enableServiceAccountKeyTransportSettings,
+            settings.enableServiceAccountKeySettings(),
+            clientContext);
     this.signBlobCallable =
         callableFactory.createUnaryCallable(
             signBlobTransportSettings, settings.signBlobSettings(), clientContext);
@@ -978,6 +1036,16 @@ public UnaryCallable<DeleteServiceAccountKeyRequest, Empty> deleteServiceAccount
     return deleteServiceAccountKeyCallable;
   }
 
+  @Override
+  public UnaryCallable<DisableServiceAccountKeyRequest, Empty> disableServiceAccountKeyCallable() {
+    return disableServiceAccountKeyCallable;
+  }
+
+  @Override
+  public UnaryCallable<EnableServiceAccountKeyRequest, Empty> enableServiceAccountKeyCallable() {
+    return enableServiceAccountKeyCallable;
+  }
+
   @Override
   public UnaryCallable<SignBlobRequest, SignBlobResponse> signBlobCallable() {
     return signBlobCallable;
diff --git a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/IAMStub.java b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/IAMStub.java
index d010ff76855d..32e94da43e72 100644
--- a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/IAMStub.java
+++ b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/IAMStub.java
@@ -29,7 +29,9 @@
 import com.google.iam.admin.v1.DeleteRoleRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountRequest;
+import com.google.iam.admin.v1.DisableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DisableServiceAccountRequest;
+import com.google.iam.admin.v1.EnableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.EnableServiceAccountRequest;
 import com.google.iam.admin.v1.GetRoleRequest;
 import com.google.iam.admin.v1.GetServiceAccountKeyRequest;
@@ -145,6 +147,14 @@ public UnaryCallable<DeleteServiceAccountKeyRequest, Empty> deleteServiceAccount
     throw new UnsupportedOperationException("Not implemented: deleteServiceAccountKeyCallable()");
   }
 
+  public UnaryCallable<DisableServiceAccountKeyRequest, Empty> disableServiceAccountKeyCallable() {
+    throw new UnsupportedOperationException("Not implemented: disableServiceAccountKeyCallable()");
+  }
+
+  public UnaryCallable<EnableServiceAccountKeyRequest, Empty> enableServiceAccountKeyCallable() {
+    throw new UnsupportedOperationException("Not implemented: enableServiceAccountKeyCallable()");
+  }
+
   @Deprecated
   public UnaryCallable<SignBlobRequest, SignBlobResponse> signBlobCallable() {
     throw new UnsupportedOperationException("Not implemented: signBlobCallable()");
diff --git a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/IAMStubSettings.java b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/IAMStubSettings.java
index d4b2d0aeb569..bfb79c3cbcb1 100644
--- a/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/IAMStubSettings.java
+++ b/java-iam-admin/google-iam-admin/src/main/java/com/google/cloud/iam/admin/v1/stub/IAMStubSettings.java
@@ -53,7 +53,9 @@
 import com.google.iam.admin.v1.DeleteRoleRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountRequest;
+import com.google.iam.admin.v1.DisableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DisableServiceAccountRequest;
+import com.google.iam.admin.v1.EnableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.EnableServiceAccountRequest;
 import com.google.iam.admin.v1.GetRoleRequest;
 import com.google.iam.admin.v1.GetServiceAccountKeyRequest;
@@ -162,6 +164,10 @@ public class IAMStubSettings extends StubSettings<IAMStubSettings> {
       uploadServiceAccountKeySettings;
   private final UnaryCallSettings<DeleteServiceAccountKeyRequest, Empty>
       deleteServiceAccountKeySettings;
+  private final UnaryCallSettings<DisableServiceAccountKeyRequest, Empty>
+      disableServiceAccountKeySettings;
+  private final UnaryCallSettings<EnableServiceAccountKeyRequest, Empty>
+      enableServiceAccountKeySettings;
   private final UnaryCallSettings<SignBlobRequest, SignBlobResponse> signBlobSettings;
   private final UnaryCallSettings<SignJwtRequest, SignJwtResponse> signJwtSettings;
   private final UnaryCallSettings<GetIamPolicyRequest, Policy> getIamPolicySettings;
@@ -510,6 +516,18 @@ public UnaryCallSettings<DisableServiceAccountRequest, Empty> disableServiceAcco
     return deleteServiceAccountKeySettings;
   }
 
+  /** Returns the object with the settings used for calls to disableServiceAccountKey. */
+  public UnaryCallSettings<DisableServiceAccountKeyRequest, Empty>
+      disableServiceAccountKeySettings() {
+    return disableServiceAccountKeySettings;
+  }
+
+  /** Returns the object with the settings used for calls to enableServiceAccountKey. */
+  public UnaryCallSettings<EnableServiceAccountKeyRequest, Empty>
+      enableServiceAccountKeySettings() {
+    return enableServiceAccountKeySettings;
+  }
+
   /**
    * Returns the object with the settings used for calls to signBlob.
    *
@@ -692,6 +710,8 @@ protected IAMStubSettings(Builder settingsBuilder) throws IOException {
     createServiceAccountKeySettings = settingsBuilder.createServiceAccountKeySettings().build();
     uploadServiceAccountKeySettings = settingsBuilder.uploadServiceAccountKeySettings().build();
     deleteServiceAccountKeySettings = settingsBuilder.deleteServiceAccountKeySettings().build();
+    disableServiceAccountKeySettings = settingsBuilder.disableServiceAccountKeySettings().build();
+    enableServiceAccountKeySettings = settingsBuilder.enableServiceAccountKeySettings().build();
     signBlobSettings = settingsBuilder.signBlobSettings().build();
     signJwtSettings = settingsBuilder.signJwtSettings().build();
     getIamPolicySettings = settingsBuilder.getIamPolicySettings().build();
@@ -745,6 +765,10 @@ public static class Builder extends StubSettings.Builder<IAMStubSettings, Builde
         uploadServiceAccountKeySettings;
     private final UnaryCallSettings.Builder<DeleteServiceAccountKeyRequest, Empty>
         deleteServiceAccountKeySettings;
+    private final UnaryCallSettings.Builder<DisableServiceAccountKeyRequest, Empty>
+        disableServiceAccountKeySettings;
+    private final UnaryCallSettings.Builder<EnableServiceAccountKeyRequest, Empty>
+        enableServiceAccountKeySettings;
     private final UnaryCallSettings.Builder<SignBlobRequest, SignBlobResponse> signBlobSettings;
     private final UnaryCallSettings.Builder<SignJwtRequest, SignJwtResponse> signJwtSettings;
     private final UnaryCallSettings.Builder<GetIamPolicyRequest, Policy> getIamPolicySettings;
@@ -842,6 +866,8 @@ protected Builder(ClientContext clientContext) {
       createServiceAccountKeySettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       uploadServiceAccountKeySettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       deleteServiceAccountKeySettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
+      disableServiceAccountKeySettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
+      enableServiceAccountKeySettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       signBlobSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       signJwtSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       getIamPolicySettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
@@ -876,6 +902,8 @@ protected Builder(ClientContext clientContext) {
               createServiceAccountKeySettings,
               uploadServiceAccountKeySettings,
               deleteServiceAccountKeySettings,
+              disableServiceAccountKeySettings,
+              enableServiceAccountKeySettings,
               signBlobSettings,
               signJwtSettings,
               getIamPolicySettings,
@@ -911,6 +939,8 @@ protected Builder(IAMStubSettings settings) {
       createServiceAccountKeySettings = settings.createServiceAccountKeySettings.toBuilder();
       uploadServiceAccountKeySettings = settings.uploadServiceAccountKeySettings.toBuilder();
       deleteServiceAccountKeySettings = settings.deleteServiceAccountKeySettings.toBuilder();
+      disableServiceAccountKeySettings = settings.disableServiceAccountKeySettings.toBuilder();
+      enableServiceAccountKeySettings = settings.enableServiceAccountKeySettings.toBuilder();
       signBlobSettings = settings.signBlobSettings.toBuilder();
       signJwtSettings = settings.signJwtSettings.toBuilder();
       getIamPolicySettings = settings.getIamPolicySettings.toBuilder();
@@ -943,6 +973,8 @@ protected Builder(IAMStubSettings settings) {
               createServiceAccountKeySettings,
               uploadServiceAccountKeySettings,
               deleteServiceAccountKeySettings,
+              disableServiceAccountKeySettings,
+              enableServiceAccountKeySettings,
               signBlobSettings,
               signJwtSettings,
               getIamPolicySettings,
@@ -1044,6 +1076,16 @@ private static Builder initDefaults(Builder builder) {
           .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("retry_policy_0_codes"))
           .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("retry_policy_0_params"));
 
+      builder
+          .disableServiceAccountKeySettings()
+          .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("no_retry_codes"))
+          .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("no_retry_params"));
+
+      builder
+          .enableServiceAccountKeySettings()
+          .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("no_retry_codes"))
+          .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("no_retry_params"));
+
       builder
           .signBlobSettings()
           .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("no_retry_1_codes"))
@@ -1224,6 +1266,18 @@ public Builder applyToAllUnaryMethods(
       return deleteServiceAccountKeySettings;
     }
 
+    /** Returns the builder for the settings used for calls to disableServiceAccountKey. */
+    public UnaryCallSettings.Builder<DisableServiceAccountKeyRequest, Empty>
+        disableServiceAccountKeySettings() {
+      return disableServiceAccountKeySettings;
+    }
+
+    /** Returns the builder for the settings used for calls to enableServiceAccountKey. */
+    public UnaryCallSettings.Builder<EnableServiceAccountKeyRequest, Empty>
+        enableServiceAccountKeySettings() {
+      return enableServiceAccountKeySettings;
+    }
+
     /**
      * Returns the builder for the settings used for calls to signBlob.
      *
diff --git a/java-iam-admin/google-iam-admin/src/test/java/com/google/cloud/iam/admin/v1/IAMClientTest.java b/java-iam-admin/google-iam-admin/src/test/java/com/google/cloud/iam/admin/v1/IAMClientTest.java
index 5e2ef9c869fd..b7f5f0d4f58f 100644
--- a/java-iam-admin/google-iam-admin/src/test/java/com/google/cloud/iam/admin/v1/IAMClientTest.java
+++ b/java-iam-admin/google-iam-admin/src/test/java/com/google/cloud/iam/admin/v1/IAMClientTest.java
@@ -36,7 +36,9 @@
 import com.google.iam.admin.v1.DeleteRoleRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountRequest;
+import com.google.iam.admin.v1.DisableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DisableServiceAccountRequest;
+import com.google.iam.admin.v1.EnableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.EnableServiceAccountRequest;
 import com.google.iam.admin.v1.GetRoleRequest;
 import com.google.iam.admin.v1.GetServiceAccountKeyRequest;
@@ -840,6 +842,7 @@ public void getServiceAccountKeyTest() throws Exception {
             .setValidAfterTime(Timestamp.newBuilder().build())
             .setValidBeforeTime(Timestamp.newBuilder().build())
             .setKeyOrigin(ServiceAccountKeyOrigin.forNumber(0))
+            .setDisabled(true)
             .build();
     mockIAM.addResponse(expectedResponse);
 
@@ -889,6 +892,7 @@ public void getServiceAccountKeyTest2() throws Exception {
             .setValidAfterTime(Timestamp.newBuilder().build())
             .setValidBeforeTime(Timestamp.newBuilder().build())
             .setKeyOrigin(ServiceAccountKeyOrigin.forNumber(0))
+            .setDisabled(true)
             .build();
     mockIAM.addResponse(expectedResponse);
 
@@ -938,6 +942,7 @@ public void createServiceAccountKeyTest() throws Exception {
             .setValidAfterTime(Timestamp.newBuilder().build())
             .setValidBeforeTime(Timestamp.newBuilder().build())
             .setKeyOrigin(ServiceAccountKeyOrigin.forNumber(0))
+            .setDisabled(true)
             .build();
     mockIAM.addResponse(expectedResponse);
 
@@ -991,6 +996,7 @@ public void createServiceAccountKeyTest2() throws Exception {
             .setValidAfterTime(Timestamp.newBuilder().build())
             .setValidBeforeTime(Timestamp.newBuilder().build())
             .setKeyOrigin(ServiceAccountKeyOrigin.forNumber(0))
+            .setDisabled(true)
             .build();
     mockIAM.addResponse(expectedResponse);
 
@@ -1044,6 +1050,7 @@ public void uploadServiceAccountKeyTest() throws Exception {
             .setValidAfterTime(Timestamp.newBuilder().build())
             .setValidBeforeTime(Timestamp.newBuilder().build())
             .setKeyOrigin(ServiceAccountKeyOrigin.forNumber(0))
+            .setDisabled(true)
             .build();
     mockIAM.addResponse(expectedResponse);
 
@@ -1157,6 +1164,146 @@ public void deleteServiceAccountKeyExceptionTest2() throws Exception {
     }
   }
 
+  @Test
+  public void disableServiceAccountKeyTest() throws Exception {
+    Empty expectedResponse = Empty.newBuilder().build();
+    mockIAM.addResponse(expectedResponse);
+
+    KeyName name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]");
+
+    client.disableServiceAccountKey(name);
+
+    List<AbstractMessage> actualRequests = mockIAM.getRequests();
+    Assert.assertEquals(1, actualRequests.size());
+    DisableServiceAccountKeyRequest actualRequest =
+        ((DisableServiceAccountKeyRequest) actualRequests.get(0));
+
+    Assert.assertEquals(name.toString(), actualRequest.getName());
+    Assert.assertTrue(
+        channelProvider.isHeaderSent(
+            ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
+            GaxGrpcProperties.getDefaultApiClientHeaderPattern()));
+  }
+
+  @Test
+  public void disableServiceAccountKeyExceptionTest() throws Exception {
+    StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
+    mockIAM.addException(exception);
+
+    try {
+      KeyName name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]");
+      client.disableServiceAccountKey(name);
+      Assert.fail("No exception raised");
+    } catch (InvalidArgumentException e) {
+      // Expected exception.
+    }
+  }
+
+  @Test
+  public void disableServiceAccountKeyTest2() throws Exception {
+    Empty expectedResponse = Empty.newBuilder().build();
+    mockIAM.addResponse(expectedResponse);
+
+    String name = "name3373707";
+
+    client.disableServiceAccountKey(name);
+
+    List<AbstractMessage> actualRequests = mockIAM.getRequests();
+    Assert.assertEquals(1, actualRequests.size());
+    DisableServiceAccountKeyRequest actualRequest =
+        ((DisableServiceAccountKeyRequest) actualRequests.get(0));
+
+    Assert.assertEquals(name, actualRequest.getName());
+    Assert.assertTrue(
+        channelProvider.isHeaderSent(
+            ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
+            GaxGrpcProperties.getDefaultApiClientHeaderPattern()));
+  }
+
+  @Test
+  public void disableServiceAccountKeyExceptionTest2() throws Exception {
+    StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
+    mockIAM.addException(exception);
+
+    try {
+      String name = "name3373707";
+      client.disableServiceAccountKey(name);
+      Assert.fail("No exception raised");
+    } catch (InvalidArgumentException e) {
+      // Expected exception.
+    }
+  }
+
+  @Test
+  public void enableServiceAccountKeyTest() throws Exception {
+    Empty expectedResponse = Empty.newBuilder().build();
+    mockIAM.addResponse(expectedResponse);
+
+    KeyName name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]");
+
+    client.enableServiceAccountKey(name);
+
+    List<AbstractMessage> actualRequests = mockIAM.getRequests();
+    Assert.assertEquals(1, actualRequests.size());
+    EnableServiceAccountKeyRequest actualRequest =
+        ((EnableServiceAccountKeyRequest) actualRequests.get(0));
+
+    Assert.assertEquals(name.toString(), actualRequest.getName());
+    Assert.assertTrue(
+        channelProvider.isHeaderSent(
+            ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
+            GaxGrpcProperties.getDefaultApiClientHeaderPattern()));
+  }
+
+  @Test
+  public void enableServiceAccountKeyExceptionTest() throws Exception {
+    StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
+    mockIAM.addException(exception);
+
+    try {
+      KeyName name = KeyName.of("[PROJECT]", "[SERVICE_ACCOUNT]", "[KEY]");
+      client.enableServiceAccountKey(name);
+      Assert.fail("No exception raised");
+    } catch (InvalidArgumentException e) {
+      // Expected exception.
+    }
+  }
+
+  @Test
+  public void enableServiceAccountKeyTest2() throws Exception {
+    Empty expectedResponse = Empty.newBuilder().build();
+    mockIAM.addResponse(expectedResponse);
+
+    String name = "name3373707";
+
+    client.enableServiceAccountKey(name);
+
+    List<AbstractMessage> actualRequests = mockIAM.getRequests();
+    Assert.assertEquals(1, actualRequests.size());
+    EnableServiceAccountKeyRequest actualRequest =
+        ((EnableServiceAccountKeyRequest) actualRequests.get(0));
+
+    Assert.assertEquals(name, actualRequest.getName());
+    Assert.assertTrue(
+        channelProvider.isHeaderSent(
+            ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
+            GaxGrpcProperties.getDefaultApiClientHeaderPattern()));
+  }
+
+  @Test
+  public void enableServiceAccountKeyExceptionTest2() throws Exception {
+    StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
+    mockIAM.addException(exception);
+
+    try {
+      String name = "name3373707";
+      client.enableServiceAccountKey(name);
+      Assert.fail("No exception raised");
+    } catch (InvalidArgumentException e) {
+      // Expected exception.
+    }
+  }
+
   @Test
   public void signBlobTest() throws Exception {
     SignBlobResponse expectedResponse =
diff --git a/java-iam-admin/google-iam-admin/src/test/java/com/google/cloud/iam/admin/v1/MockIAMImpl.java b/java-iam-admin/google-iam-admin/src/test/java/com/google/cloud/iam/admin/v1/MockIAMImpl.java
index 41377d1408b3..5cf0bc5ee6e9 100644
--- a/java-iam-admin/google-iam-admin/src/test/java/com/google/cloud/iam/admin/v1/MockIAMImpl.java
+++ b/java-iam-admin/google-iam-admin/src/test/java/com/google/cloud/iam/admin/v1/MockIAMImpl.java
@@ -23,7 +23,9 @@
 import com.google.iam.admin.v1.DeleteRoleRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DeleteServiceAccountRequest;
+import com.google.iam.admin.v1.DisableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.DisableServiceAccountRequest;
+import com.google.iam.admin.v1.EnableServiceAccountKeyRequest;
 import com.google.iam.admin.v1.EnableServiceAccountRequest;
 import com.google.iam.admin.v1.GetRoleRequest;
 import com.google.iam.admin.v1.GetServiceAccountKeyRequest;
@@ -399,6 +401,48 @@ public void deleteServiceAccountKey(
     }
   }
 
+  @Override
+  public void disableServiceAccountKey(
+      DisableServiceAccountKeyRequest request, StreamObserver<Empty> responseObserver) {
+    Object response = responses.poll();
+    if (response instanceof Empty) {
+      requests.add(request);
+      responseObserver.onNext(((Empty) response));
+      responseObserver.onCompleted();
+    } else if (response instanceof Exception) {
+      responseObserver.onError(((Exception) response));
+    } else {
+      responseObserver.onError(
+          new IllegalArgumentException(
+              String.format(
+                  "Unrecognized response type %s for method DisableServiceAccountKey, expected %s or %s",
+                  response == null ? "null" : response.getClass().getName(),
+                  Empty.class.getName(),
+                  Exception.class.getName())));
+    }
+  }
+
+  @Override
+  public void enableServiceAccountKey(
+      EnableServiceAccountKeyRequest request, StreamObserver<Empty> responseObserver) {
+    Object response = responses.poll();
+    if (response instanceof Empty) {
+      requests.add(request);
+      responseObserver.onNext(((Empty) response));
+      responseObserver.onCompleted();
+    } else if (response instanceof Exception) {
+      responseObserver.onError(((Exception) response));
+    } else {
+      responseObserver.onError(
+          new IllegalArgumentException(
+              String.format(
+                  "Unrecognized response type %s for method EnableServiceAccountKey, expected %s or %s",
+                  response == null ? "null" : response.getClass().getName(),
+                  Empty.class.getName(),
+                  Exception.class.getName())));
+    }
+  }
+
   @Override
   public void signBlob(SignBlobRequest request, StreamObserver<SignBlobResponse> responseObserver) {
     Object response = responses.poll();
diff --git a/java-iam-admin/grpc-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/IAMGrpc.java b/java-iam-admin/grpc-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/IAMGrpc.java
index 8a34ea11a0da..61f5d423f1a3 100644
--- a/java-iam-admin/grpc-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/IAMGrpc.java
+++ b/java-iam-admin/grpc-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/IAMGrpc.java
@@ -28,14 +28,22 @@
  * * **Service account keys**, which service accounts use to authenticate with
  *   Google APIs
  * * **IAM policies for service accounts**, which specify the roles that a
- *   member has for the service account
+ *   principal has for the service account
  * * **IAM custom roles**, which help you limit the number of permissions that
- *   you grant to members
+ *   you grant to principals
  * In addition, you can use this service to complete the following tasks, among
  * others:
  * * Test whether a service account can use specific permissions
  * * Check which roles you can grant for a specific resource
  * * Lint, or validate, condition expressions in an IAM policy
+ * When you read data from the IAM API, each read is eventually consistent. In
+ * other words, if you write data with the IAM API, then immediately read that
+ * data, the read operation might return an older version of the data. To deal
+ * with this behavior, your application can retry the request with truncated
+ * exponential backoff.
+ * In contrast, writing data to the IAM API is sequentially consistent. In other
+ * words, write operations are always processed in the order in which they were
+ * received.
  * </pre>
  */
 @javax.annotation.Generated(
@@ -682,6 +690,95 @@ private IAMGrpc() {}
     return getDeleteServiceAccountKeyMethod;
   }
 
+  private static volatile io.grpc.MethodDescriptor<
+          com.google.iam.admin.v1.DisableServiceAccountKeyRequest, com.google.protobuf.Empty>
+      getDisableServiceAccountKeyMethod;
+
+  @io.grpc.stub.annotations.RpcMethod(
+      fullMethodName = SERVICE_NAME + '/' + "DisableServiceAccountKey",
+      requestType = com.google.iam.admin.v1.DisableServiceAccountKeyRequest.class,
+      responseType = com.google.protobuf.Empty.class,
+      methodType = io.grpc.MethodDescriptor.MethodType.UNARY)
+  public static io.grpc.MethodDescriptor<
+          com.google.iam.admin.v1.DisableServiceAccountKeyRequest, com.google.protobuf.Empty>
+      getDisableServiceAccountKeyMethod() {
+    io.grpc.MethodDescriptor<
+            com.google.iam.admin.v1.DisableServiceAccountKeyRequest, com.google.protobuf.Empty>
+        getDisableServiceAccountKeyMethod;
+    if ((getDisableServiceAccountKeyMethod = IAMGrpc.getDisableServiceAccountKeyMethod) == null) {
+      synchronized (IAMGrpc.class) {
+        if ((getDisableServiceAccountKeyMethod = IAMGrpc.getDisableServiceAccountKeyMethod)
+            == null) {
+          IAMGrpc.getDisableServiceAccountKeyMethod =
+              getDisableServiceAccountKeyMethod =
+                  io.grpc.MethodDescriptor
+                      .<com.google.iam.admin.v1.DisableServiceAccountKeyRequest,
+                          com.google.protobuf.Empty>
+                          newBuilder()
+                      .setType(io.grpc.MethodDescriptor.MethodType.UNARY)
+                      .setFullMethodName(
+                          generateFullMethodName(SERVICE_NAME, "DisableServiceAccountKey"))
+                      .setSampledToLocalTracing(true)
+                      .setRequestMarshaller(
+                          io.grpc.protobuf.ProtoUtils.marshaller(
+                              com.google.iam.admin.v1.DisableServiceAccountKeyRequest
+                                  .getDefaultInstance()))
+                      .setResponseMarshaller(
+                          io.grpc.protobuf.ProtoUtils.marshaller(
+                              com.google.protobuf.Empty.getDefaultInstance()))
+                      .setSchemaDescriptor(
+                          new IAMMethodDescriptorSupplier("DisableServiceAccountKey"))
+                      .build();
+        }
+      }
+    }
+    return getDisableServiceAccountKeyMethod;
+  }
+
+  private static volatile io.grpc.MethodDescriptor<
+          com.google.iam.admin.v1.EnableServiceAccountKeyRequest, com.google.protobuf.Empty>
+      getEnableServiceAccountKeyMethod;
+
+  @io.grpc.stub.annotations.RpcMethod(
+      fullMethodName = SERVICE_NAME + '/' + "EnableServiceAccountKey",
+      requestType = com.google.iam.admin.v1.EnableServiceAccountKeyRequest.class,
+      responseType = com.google.protobuf.Empty.class,
+      methodType = io.grpc.MethodDescriptor.MethodType.UNARY)
+  public static io.grpc.MethodDescriptor<
+          com.google.iam.admin.v1.EnableServiceAccountKeyRequest, com.google.protobuf.Empty>
+      getEnableServiceAccountKeyMethod() {
+    io.grpc.MethodDescriptor<
+            com.google.iam.admin.v1.EnableServiceAccountKeyRequest, com.google.protobuf.Empty>
+        getEnableServiceAccountKeyMethod;
+    if ((getEnableServiceAccountKeyMethod = IAMGrpc.getEnableServiceAccountKeyMethod) == null) {
+      synchronized (IAMGrpc.class) {
+        if ((getEnableServiceAccountKeyMethod = IAMGrpc.getEnableServiceAccountKeyMethod) == null) {
+          IAMGrpc.getEnableServiceAccountKeyMethod =
+              getEnableServiceAccountKeyMethod =
+                  io.grpc.MethodDescriptor
+                      .<com.google.iam.admin.v1.EnableServiceAccountKeyRequest,
+                          com.google.protobuf.Empty>
+                          newBuilder()
+                      .setType(io.grpc.MethodDescriptor.MethodType.UNARY)
+                      .setFullMethodName(
+                          generateFullMethodName(SERVICE_NAME, "EnableServiceAccountKey"))
+                      .setSampledToLocalTracing(true)
+                      .setRequestMarshaller(
+                          io.grpc.protobuf.ProtoUtils.marshaller(
+                              com.google.iam.admin.v1.EnableServiceAccountKeyRequest
+                                  .getDefaultInstance()))
+                      .setResponseMarshaller(
+                          io.grpc.protobuf.ProtoUtils.marshaller(
+                              com.google.protobuf.Empty.getDefaultInstance()))
+                      .setSchemaDescriptor(
+                          new IAMMethodDescriptorSupplier("EnableServiceAccountKey"))
+                      .build();
+        }
+      }
+    }
+    return getEnableServiceAccountKeyMethod;
+  }
+
   private static volatile io.grpc.MethodDescriptor<
           com.google.iam.admin.v1.SignBlobRequest, com.google.iam.admin.v1.SignBlobResponse>
       getSignBlobMethod;
@@ -1356,14 +1453,22 @@ public IAMFutureStub newStub(io.grpc.Channel channel, io.grpc.CallOptions callOp
    * * **Service account keys**, which service accounts use to authenticate with
    *   Google APIs
    * * **IAM policies for service accounts**, which specify the roles that a
-   *   member has for the service account
+   *   principal has for the service account
    * * **IAM custom roles**, which help you limit the number of permissions that
-   *   you grant to members
+   *   you grant to principals
    * In addition, you can use this service to complete the following tasks, among
    * others:
    * * Test whether a service account can use specific permissions
    * * Check which roles you can grant for a specific resource
    * * Lint, or validate, condition expressions in an IAM policy
+   * When you read data from the IAM API, each read is eventually consistent. In
+   * other words, if you write data with the IAM API, then immediately read that
+   * data, the read operation might return an older version of the data. To deal
+   * with this behavior, your application can retry the request with truncated
+   * exponential backoff.
+   * In contrast, writing data to the IAM API is sequentially consistent. In other
+   * words, write operations are always processed in the order in which they were
+   * received.
    * </pre>
    */
   public abstract static class IAMImplBase implements io.grpc.BindableService {
@@ -1418,7 +1523,7 @@ public void createServiceAccount(
      * **Note:** We are in the process of deprecating this method. Use
      * [PatchServiceAccount][google.iam.admin.v1.IAM.PatchServiceAccount] instead.
      * Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
-     * You can update only the `display_name` and `description` fields.
+     * You can update only the `display_name` field.
      * </pre>
      */
     public void updateServiceAccount(
@@ -1579,7 +1684,10 @@ public void createServiceAccountKey(
      *
      *
      * <pre>
-     * Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey], using a public key that you provide.
+     * Uploads the public key portion of a key pair that you manage, and
+     * associates the public key with a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
+     * After you upload the public key, you can use the private key from the key
+     * pair as a service account key.
      * </pre>
      */
     public void uploadServiceAccountKey(
@@ -1605,6 +1713,35 @@ public void deleteServiceAccountKey(
           getDeleteServiceAccountKeyMethod(), responseObserver);
     }
 
+    /**
+     *
+     *
+     * <pre>
+     * Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service account key can be
+     * re-enabled with [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].
+     * </pre>
+     */
+    public void disableServiceAccountKey(
+        com.google.iam.admin.v1.DisableServiceAccountKeyRequest request,
+        io.grpc.stub.StreamObserver<com.google.protobuf.Empty> responseObserver) {
+      io.grpc.stub.ServerCalls.asyncUnimplementedUnaryCall(
+          getDisableServiceAccountKeyMethod(), responseObserver);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
+     * </pre>
+     */
+    public void enableServiceAccountKey(
+        com.google.iam.admin.v1.EnableServiceAccountKeyRequest request,
+        io.grpc.stub.StreamObserver<com.google.protobuf.Empty> responseObserver) {
+      io.grpc.stub.ServerCalls.asyncUnimplementedUnaryCall(
+          getEnableServiceAccountKeyMethod(), responseObserver);
+    }
+
     /**
      *
      *
@@ -1651,7 +1788,7 @@ public void signJwt(
      *
      * <pre>
      * Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount]. This IAM
-     * policy specifies which members have access to the service account.
+     * policy specifies which principals have access to the service account.
      * This method does not tell you whether the service account has been granted
      * any roles on other resources. To check whether a service account has role
      * grants on a resource, use the `getIamPolicy` method for that resource. For
@@ -1674,7 +1811,7 @@ public void getIamPolicy(
      * <pre>
      * Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
      * Use this method to grant or revoke access to the service account. For
-     * example, you could grant a member the ability to impersonate the service
+     * example, you could grant a principal the ability to impersonate the service
      * account.
      * This method does not enable the service account to access other resources.
      * To grant roles to a service account on a resource, follow these steps:
@@ -1683,8 +1820,10 @@ public void getIamPolicy(
      * the resource.
      * 3. Call the resource's `setIamPolicy` method to update its IAM policy.
      * For detailed instructions, see
-     * [Granting roles to a service account for specific
-     * resources](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts).
+     * [Manage access to project, folders, and
+     * organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts)
+     * or [Manage access to other
+     * resources](https://cloud.google.com/iam/help/access/manage-other-resources).
      * </pre>
      */
     public void setIamPolicy(
@@ -1786,7 +1925,7 @@ public void updateRole(
      * <pre>
      * Deletes a custom [Role][google.iam.admin.v1.Role].
      * When you delete a custom role, the following changes occur immediately:
-     * * You cannot bind a member to the custom role in an IAM
+     * * You cannot bind a principal to the custom role in an IAM
      * [Policy][google.iam.v1.Policy].
      * * Existing bindings to the custom role are not changed, but they have no
      * effect.
@@ -1824,7 +1963,7 @@ public void undeleteRole(
      *
      * <pre>
      * Lists every permission that you can test on a resource. A permission is
-     * testable if you can check whether a member has that permission on the
+     * testable if you can check whether a principal has that permission on the
      * resource.
      * </pre>
      */
@@ -1967,6 +2106,18 @@ public final io.grpc.ServerServiceDefinition bindService() {
                   new MethodHandlers<
                       com.google.iam.admin.v1.DeleteServiceAccountKeyRequest,
                       com.google.protobuf.Empty>(this, METHODID_DELETE_SERVICE_ACCOUNT_KEY)))
+          .addMethod(
+              getDisableServiceAccountKeyMethod(),
+              io.grpc.stub.ServerCalls.asyncUnaryCall(
+                  new MethodHandlers<
+                      com.google.iam.admin.v1.DisableServiceAccountKeyRequest,
+                      com.google.protobuf.Empty>(this, METHODID_DISABLE_SERVICE_ACCOUNT_KEY)))
+          .addMethod(
+              getEnableServiceAccountKeyMethod(),
+              io.grpc.stub.ServerCalls.asyncUnaryCall(
+                  new MethodHandlers<
+                      com.google.iam.admin.v1.EnableServiceAccountKeyRequest,
+                      com.google.protobuf.Empty>(this, METHODID_ENABLE_SERVICE_ACCOUNT_KEY)))
           .addMethod(
               getSignBlobMethod(),
               io.grpc.stub.ServerCalls.asyncUnaryCall(
@@ -2076,14 +2227,22 @@ public final io.grpc.ServerServiceDefinition bindService() {
    * * **Service account keys**, which service accounts use to authenticate with
    *   Google APIs
    * * **IAM policies for service accounts**, which specify the roles that a
-   *   member has for the service account
+   *   principal has for the service account
    * * **IAM custom roles**, which help you limit the number of permissions that
-   *   you grant to members
+   *   you grant to principals
    * In addition, you can use this service to complete the following tasks, among
    * others:
    * * Test whether a service account can use specific permissions
    * * Check which roles you can grant for a specific resource
    * * Lint, or validate, condition expressions in an IAM policy
+   * When you read data from the IAM API, each read is eventually consistent. In
+   * other words, if you write data with the IAM API, then immediately read that
+   * data, the read operation might return an older version of the data. To deal
+   * with this behavior, your application can retry the request with truncated
+   * exponential backoff.
+   * In contrast, writing data to the IAM API is sequentially consistent. In other
+   * words, write operations are always processed in the order in which they were
+   * received.
    * </pre>
    */
   public static final class IAMStub extends io.grpc.stub.AbstractAsyncStub<IAMStub> {
@@ -2152,7 +2311,7 @@ public void createServiceAccount(
      * **Note:** We are in the process of deprecating this method. Use
      * [PatchServiceAccount][google.iam.admin.v1.IAM.PatchServiceAccount] instead.
      * Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
-     * You can update only the `display_name` and `description` fields.
+     * You can update only the `display_name` field.
      * </pre>
      */
     public void updateServiceAccount(
@@ -2331,7 +2490,10 @@ public void createServiceAccountKey(
      *
      *
      * <pre>
-     * Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey], using a public key that you provide.
+     * Uploads the public key portion of a key pair that you manage, and
+     * associates the public key with a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
+     * After you upload the public key, you can use the private key from the key
+     * pair as a service account key.
      * </pre>
      */
     public void uploadServiceAccountKey(
@@ -2361,6 +2523,39 @@ public void deleteServiceAccountKey(
           responseObserver);
     }
 
+    /**
+     *
+     *
+     * <pre>
+     * Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service account key can be
+     * re-enabled with [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].
+     * </pre>
+     */
+    public void disableServiceAccountKey(
+        com.google.iam.admin.v1.DisableServiceAccountKeyRequest request,
+        io.grpc.stub.StreamObserver<com.google.protobuf.Empty> responseObserver) {
+      io.grpc.stub.ClientCalls.asyncUnaryCall(
+          getChannel().newCall(getDisableServiceAccountKeyMethod(), getCallOptions()),
+          request,
+          responseObserver);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
+     * </pre>
+     */
+    public void enableServiceAccountKey(
+        com.google.iam.admin.v1.EnableServiceAccountKeyRequest request,
+        io.grpc.stub.StreamObserver<com.google.protobuf.Empty> responseObserver) {
+      io.grpc.stub.ClientCalls.asyncUnaryCall(
+          getChannel().newCall(getEnableServiceAccountKeyMethod(), getCallOptions()),
+          request,
+          responseObserver);
+    }
+
     /**
      *
      *
@@ -2409,7 +2604,7 @@ public void signJwt(
      *
      * <pre>
      * Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount]. This IAM
-     * policy specifies which members have access to the service account.
+     * policy specifies which principals have access to the service account.
      * This method does not tell you whether the service account has been granted
      * any roles on other resources. To check whether a service account has role
      * grants on a resource, use the `getIamPolicy` method for that resource. For
@@ -2434,7 +2629,7 @@ public void getIamPolicy(
      * <pre>
      * Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
      * Use this method to grant or revoke access to the service account. For
-     * example, you could grant a member the ability to impersonate the service
+     * example, you could grant a principal the ability to impersonate the service
      * account.
      * This method does not enable the service account to access other resources.
      * To grant roles to a service account on a resource, follow these steps:
@@ -2443,8 +2638,10 @@ public void getIamPolicy(
      * the resource.
      * 3. Call the resource's `setIamPolicy` method to update its IAM policy.
      * For detailed instructions, see
-     * [Granting roles to a service account for specific
-     * resources](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts).
+     * [Manage access to project, folders, and
+     * organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts)
+     * or [Manage access to other
+     * resources](https://cloud.google.com/iam/help/access/manage-other-resources).
      * </pre>
      */
     public void setIamPolicy(
@@ -2556,7 +2753,7 @@ public void updateRole(
      * <pre>
      * Deletes a custom [Role][google.iam.admin.v1.Role].
      * When you delete a custom role, the following changes occur immediately:
-     * * You cannot bind a member to the custom role in an IAM
+     * * You cannot bind a principal to the custom role in an IAM
      * [Policy][google.iam.v1.Policy].
      * * Existing bindings to the custom role are not changed, but they have no
      * effect.
@@ -2597,7 +2794,7 @@ public void undeleteRole(
      *
      * <pre>
      * Lists every permission that you can test on a resource. A permission is
-     * testable if you can check whether a member has that permission on the
+     * testable if you can check whether a principal has that permission on the
      * resource.
      * </pre>
      */
@@ -2661,14 +2858,22 @@ public void lintPolicy(
    * * **Service account keys**, which service accounts use to authenticate with
    *   Google APIs
    * * **IAM policies for service accounts**, which specify the roles that a
-   *   member has for the service account
+   *   principal has for the service account
    * * **IAM custom roles**, which help you limit the number of permissions that
-   *   you grant to members
+   *   you grant to principals
    * In addition, you can use this service to complete the following tasks, among
    * others:
    * * Test whether a service account can use specific permissions
    * * Check which roles you can grant for a specific resource
    * * Lint, or validate, condition expressions in an IAM policy
+   * When you read data from the IAM API, each read is eventually consistent. In
+   * other words, if you write data with the IAM API, then immediately read that
+   * data, the read operation might return an older version of the data. To deal
+   * with this behavior, your application can retry the request with truncated
+   * exponential backoff.
+   * In contrast, writing data to the IAM API is sequentially consistent. In other
+   * words, write operations are always processed in the order in which they were
+   * received.
    * </pre>
    */
   public static final class IAMBlockingStub
@@ -2728,7 +2933,7 @@ public com.google.iam.admin.v1.ServiceAccount createServiceAccount(
      * **Note:** We are in the process of deprecating this method. Use
      * [PatchServiceAccount][google.iam.admin.v1.IAM.PatchServiceAccount] instead.
      * Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
-     * You can update only the `display_name` and `description` fields.
+     * You can update only the `display_name` field.
      * </pre>
      */
     public com.google.iam.admin.v1.ServiceAccount updateServiceAccount(
@@ -2878,7 +3083,10 @@ public com.google.iam.admin.v1.ServiceAccountKey createServiceAccountKey(
      *
      *
      * <pre>
-     * Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey], using a public key that you provide.
+     * Uploads the public key portion of a key pair that you manage, and
+     * associates the public key with a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
+     * After you upload the public key, you can use the private key from the key
+     * pair as a service account key.
      * </pre>
      */
     public com.google.iam.admin.v1.ServiceAccountKey uploadServiceAccountKey(
@@ -2902,6 +3110,33 @@ public com.google.protobuf.Empty deleteServiceAccountKey(
           getChannel(), getDeleteServiceAccountKeyMethod(), getCallOptions(), request);
     }
 
+    /**
+     *
+     *
+     * <pre>
+     * Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service account key can be
+     * re-enabled with [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].
+     * </pre>
+     */
+    public com.google.protobuf.Empty disableServiceAccountKey(
+        com.google.iam.admin.v1.DisableServiceAccountKeyRequest request) {
+      return io.grpc.stub.ClientCalls.blockingUnaryCall(
+          getChannel(), getDisableServiceAccountKeyMethod(), getCallOptions(), request);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
+     * </pre>
+     */
+    public com.google.protobuf.Empty enableServiceAccountKey(
+        com.google.iam.admin.v1.EnableServiceAccountKeyRequest request) {
+      return io.grpc.stub.ClientCalls.blockingUnaryCall(
+          getChannel(), getEnableServiceAccountKeyMethod(), getCallOptions(), request);
+    }
+
     /**
      *
      *
@@ -2948,7 +3183,7 @@ public com.google.iam.admin.v1.SignJwtResponse signJwt(
      *
      * <pre>
      * Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount]. This IAM
-     * policy specifies which members have access to the service account.
+     * policy specifies which principals have access to the service account.
      * This method does not tell you whether the service account has been granted
      * any roles on other resources. To check whether a service account has role
      * grants on a resource, use the `getIamPolicy` method for that resource. For
@@ -2969,7 +3204,7 @@ public com.google.iam.v1.Policy getIamPolicy(com.google.iam.v1.GetIamPolicyReque
      * <pre>
      * Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
      * Use this method to grant or revoke access to the service account. For
-     * example, you could grant a member the ability to impersonate the service
+     * example, you could grant a principal the ability to impersonate the service
      * account.
      * This method does not enable the service account to access other resources.
      * To grant roles to a service account on a resource, follow these steps:
@@ -2978,8 +3213,10 @@ public com.google.iam.v1.Policy getIamPolicy(com.google.iam.v1.GetIamPolicyReque
      * the resource.
      * 3. Call the resource's `setIamPolicy` method to update its IAM policy.
      * For detailed instructions, see
-     * [Granting roles to a service account for specific
-     * resources](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts).
+     * [Manage access to project, folders, and
+     * organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts)
+     * or [Manage access to other
+     * resources](https://cloud.google.com/iam/help/access/manage-other-resources).
      * </pre>
      */
     public com.google.iam.v1.Policy setIamPolicy(com.google.iam.v1.SetIamPolicyRequest request) {
@@ -3074,7 +3311,7 @@ public com.google.iam.admin.v1.Role updateRole(
      * <pre>
      * Deletes a custom [Role][google.iam.admin.v1.Role].
      * When you delete a custom role, the following changes occur immediately:
-     * * You cannot bind a member to the custom role in an IAM
+     * * You cannot bind a principal to the custom role in an IAM
      * [Policy][google.iam.v1.Policy].
      * * Existing bindings to the custom role are not changed, but they have no
      * effect.
@@ -3111,7 +3348,7 @@ public com.google.iam.admin.v1.Role undeleteRole(
      *
      * <pre>
      * Lists every permission that you can test on a resource. A permission is
-     * testable if you can check whether a member has that permission on the
+     * testable if you can check whether a principal has that permission on the
      * resource.
      * </pre>
      */
@@ -3166,14 +3403,22 @@ public com.google.iam.admin.v1.LintPolicyResponse lintPolicy(
    * * **Service account keys**, which service accounts use to authenticate with
    *   Google APIs
    * * **IAM policies for service accounts**, which specify the roles that a
-   *   member has for the service account
+   *   principal has for the service account
    * * **IAM custom roles**, which help you limit the number of permissions that
-   *   you grant to members
+   *   you grant to principals
    * In addition, you can use this service to complete the following tasks, among
    * others:
    * * Test whether a service account can use specific permissions
    * * Check which roles you can grant for a specific resource
    * * Lint, or validate, condition expressions in an IAM policy
+   * When you read data from the IAM API, each read is eventually consistent. In
+   * other words, if you write data with the IAM API, then immediately read that
+   * data, the read operation might return an older version of the data. To deal
+   * with this behavior, your application can retry the request with truncated
+   * exponential backoff.
+   * In contrast, writing data to the IAM API is sequentially consistent. In other
+   * words, write operations are always processed in the order in which they were
+   * received.
    * </pre>
    */
   public static final class IAMFutureStub extends io.grpc.stub.AbstractFutureStub<IAMFutureStub> {
@@ -3235,7 +3480,7 @@ protected IAMFutureStub build(io.grpc.Channel channel, io.grpc.CallOptions callO
      * **Note:** We are in the process of deprecating this method. Use
      * [PatchServiceAccount][google.iam.admin.v1.IAM.PatchServiceAccount] instead.
      * Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
-     * You can update only the `display_name` and `description` fields.
+     * You can update only the `display_name` field.
      * </pre>
      */
     public com.google.common.util.concurrent.ListenableFuture<
@@ -3391,7 +3636,10 @@ protected IAMFutureStub build(io.grpc.Channel channel, io.grpc.CallOptions callO
      *
      *
      * <pre>
-     * Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey], using a public key that you provide.
+     * Uploads the public key portion of a key pair that you manage, and
+     * associates the public key with a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
+     * After you upload the public key, you can use the private key from the key
+     * pair as a service account key.
      * </pre>
      */
     public com.google.common.util.concurrent.ListenableFuture<
@@ -3416,6 +3664,33 @@ protected IAMFutureStub build(io.grpc.Channel channel, io.grpc.CallOptions callO
           getChannel().newCall(getDeleteServiceAccountKeyMethod(), getCallOptions()), request);
     }
 
+    /**
+     *
+     *
+     * <pre>
+     * Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service account key can be
+     * re-enabled with [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].
+     * </pre>
+     */
+    public com.google.common.util.concurrent.ListenableFuture<com.google.protobuf.Empty>
+        disableServiceAccountKey(com.google.iam.admin.v1.DisableServiceAccountKeyRequest request) {
+      return io.grpc.stub.ClientCalls.futureUnaryCall(
+          getChannel().newCall(getDisableServiceAccountKeyMethod(), getCallOptions()), request);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
+     * </pre>
+     */
+    public com.google.common.util.concurrent.ListenableFuture<com.google.protobuf.Empty>
+        enableServiceAccountKey(com.google.iam.admin.v1.EnableServiceAccountKeyRequest request) {
+      return io.grpc.stub.ClientCalls.futureUnaryCall(
+          getChannel().newCall(getEnableServiceAccountKeyMethod(), getCallOptions()), request);
+    }
+
     /**
      *
      *
@@ -3464,7 +3739,7 @@ protected IAMFutureStub build(io.grpc.Channel channel, io.grpc.CallOptions callO
      *
      * <pre>
      * Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount]. This IAM
-     * policy specifies which members have access to the service account.
+     * policy specifies which principals have access to the service account.
      * This method does not tell you whether the service account has been granted
      * any roles on other resources. To check whether a service account has role
      * grants on a resource, use the `getIamPolicy` method for that resource. For
@@ -3486,7 +3761,7 @@ protected IAMFutureStub build(io.grpc.Channel channel, io.grpc.CallOptions callO
      * <pre>
      * Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
      * Use this method to grant or revoke access to the service account. For
-     * example, you could grant a member the ability to impersonate the service
+     * example, you could grant a principal the ability to impersonate the service
      * account.
      * This method does not enable the service account to access other resources.
      * To grant roles to a service account on a resource, follow these steps:
@@ -3495,8 +3770,10 @@ protected IAMFutureStub build(io.grpc.Channel channel, io.grpc.CallOptions callO
      * the resource.
      * 3. Call the resource's `setIamPolicy` method to update its IAM policy.
      * For detailed instructions, see
-     * [Granting roles to a service account for specific
-     * resources](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts).
+     * [Manage access to project, folders, and
+     * organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts)
+     * or [Manage access to other
+     * resources](https://cloud.google.com/iam/help/access/manage-other-resources).
      * </pre>
      */
     public com.google.common.util.concurrent.ListenableFuture<com.google.iam.v1.Policy>
@@ -3596,7 +3873,7 @@ public com.google.common.util.concurrent.ListenableFuture<com.google.iam.admin.v
      * <pre>
      * Deletes a custom [Role][google.iam.admin.v1.Role].
      * When you delete a custom role, the following changes occur immediately:
-     * * You cannot bind a member to the custom role in an IAM
+     * * You cannot bind a principal to the custom role in an IAM
      * [Policy][google.iam.v1.Policy].
      * * Existing bindings to the custom role are not changed, but they have no
      * effect.
@@ -3633,7 +3910,7 @@ public com.google.common.util.concurrent.ListenableFuture<com.google.iam.admin.v
      *
      * <pre>
      * Lists every permission that you can test on a resource. A permission is
-     * testable if you can check whether a member has that permission on the
+     * testable if you can check whether a principal has that permission on the
      * resource.
      * </pre>
      */
@@ -3694,21 +3971,23 @@ public com.google.common.util.concurrent.ListenableFuture<com.google.iam.admin.v
   private static final int METHODID_CREATE_SERVICE_ACCOUNT_KEY = 11;
   private static final int METHODID_UPLOAD_SERVICE_ACCOUNT_KEY = 12;
   private static final int METHODID_DELETE_SERVICE_ACCOUNT_KEY = 13;
-  private static final int METHODID_SIGN_BLOB = 14;
-  private static final int METHODID_SIGN_JWT = 15;
-  private static final int METHODID_GET_IAM_POLICY = 16;
-  private static final int METHODID_SET_IAM_POLICY = 17;
-  private static final int METHODID_TEST_IAM_PERMISSIONS = 18;
-  private static final int METHODID_QUERY_GRANTABLE_ROLES = 19;
-  private static final int METHODID_LIST_ROLES = 20;
-  private static final int METHODID_GET_ROLE = 21;
-  private static final int METHODID_CREATE_ROLE = 22;
-  private static final int METHODID_UPDATE_ROLE = 23;
-  private static final int METHODID_DELETE_ROLE = 24;
-  private static final int METHODID_UNDELETE_ROLE = 25;
-  private static final int METHODID_QUERY_TESTABLE_PERMISSIONS = 26;
-  private static final int METHODID_QUERY_AUDITABLE_SERVICES = 27;
-  private static final int METHODID_LINT_POLICY = 28;
+  private static final int METHODID_DISABLE_SERVICE_ACCOUNT_KEY = 14;
+  private static final int METHODID_ENABLE_SERVICE_ACCOUNT_KEY = 15;
+  private static final int METHODID_SIGN_BLOB = 16;
+  private static final int METHODID_SIGN_JWT = 17;
+  private static final int METHODID_GET_IAM_POLICY = 18;
+  private static final int METHODID_SET_IAM_POLICY = 19;
+  private static final int METHODID_TEST_IAM_PERMISSIONS = 20;
+  private static final int METHODID_QUERY_GRANTABLE_ROLES = 21;
+  private static final int METHODID_LIST_ROLES = 22;
+  private static final int METHODID_GET_ROLE = 23;
+  private static final int METHODID_CREATE_ROLE = 24;
+  private static final int METHODID_UPDATE_ROLE = 25;
+  private static final int METHODID_DELETE_ROLE = 26;
+  private static final int METHODID_UNDELETE_ROLE = 27;
+  private static final int METHODID_QUERY_TESTABLE_PERMISSIONS = 28;
+  private static final int METHODID_QUERY_AUDITABLE_SERVICES = 29;
+  private static final int METHODID_LINT_POLICY = 30;
 
   private static final class MethodHandlers<Req, Resp>
       implements io.grpc.stub.ServerCalls.UnaryMethod<Req, Resp>,
@@ -3807,6 +4086,16 @@ public void invoke(Req request, io.grpc.stub.StreamObserver<Resp> responseObserv
               (com.google.iam.admin.v1.DeleteServiceAccountKeyRequest) request,
               (io.grpc.stub.StreamObserver<com.google.protobuf.Empty>) responseObserver);
           break;
+        case METHODID_DISABLE_SERVICE_ACCOUNT_KEY:
+          serviceImpl.disableServiceAccountKey(
+              (com.google.iam.admin.v1.DisableServiceAccountKeyRequest) request,
+              (io.grpc.stub.StreamObserver<com.google.protobuf.Empty>) responseObserver);
+          break;
+        case METHODID_ENABLE_SERVICE_ACCOUNT_KEY:
+          serviceImpl.enableServiceAccountKey(
+              (com.google.iam.admin.v1.EnableServiceAccountKeyRequest) request,
+              (io.grpc.stub.StreamObserver<com.google.protobuf.Empty>) responseObserver);
+          break;
         case METHODID_SIGN_BLOB:
           serviceImpl.signBlob(
               (com.google.iam.admin.v1.SignBlobRequest) request,
@@ -3914,7 +4203,7 @@ private abstract static class IAMBaseDescriptorSupplier
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.FileDescriptor getFileDescriptor() {
-      return com.google.iam.admin.v1.IamProto.getDescriptor();
+      return com.google.iam.admin.v1.Iam.getDescriptor();
     }
 
     @java.lang.Override
@@ -3967,6 +4256,8 @@ public static io.grpc.ServiceDescriptor getServiceDescriptor() {
                       .addMethod(getCreateServiceAccountKeyMethod())
                       .addMethod(getUploadServiceAccountKeyMethod())
                       .addMethod(getDeleteServiceAccountKeyMethod())
+                      .addMethod(getDisableServiceAccountKeyMethod())
+                      .addMethod(getEnableServiceAccountKeyMethod())
                       .addMethod(getSignBlobMethod())
                       .addMethod(getSignJwtMethod())
                       .addMethod(getGetIamPolicyMethod())
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateRoleRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateRoleRequest.java
index f6a737e0d366..1d0a81349656 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateRoleRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateRoleRequest.java
@@ -121,14 +121,14 @@ private CreateRoleRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_CreateRoleRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_CreateRoleRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.CreateRoleRequest.class,
@@ -143,18 +143,21 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * The `parent` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `parent` value format is described below:
-   * * [`projects.roles.create()`](/iam/reference/rest/v1/projects.roles/create):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `parent` value format is described below:
+   * * [`projects.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/create):
    *   `projects/{PROJECT_ID}`. This method creates project-level
-   *   [custom roles](/iam/docs/understanding-custom-roles).
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-   * * [`organizations.roles.create()`](/iam/reference/rest/v1/organizations.roles/create):
+   * * [`organizations.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/create):
    *   `organizations/{ORGANIZATION_ID}`. This method creates organization-level
-   *   [custom roles](/iam/docs/understanding-custom-roles). Example request
-   *   URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
+   *   Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
    * ID or organization ID.
@@ -182,18 +185,21 @@ public java.lang.String getParent() {
    * <pre>
    * The `parent` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `parent` value format is described below:
-   * * [`projects.roles.create()`](/iam/reference/rest/v1/projects.roles/create):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `parent` value format is described below:
+   * * [`projects.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/create):
    *   `projects/{PROJECT_ID}`. This method creates project-level
-   *   [custom roles](/iam/docs/understanding-custom-roles).
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-   * * [`organizations.roles.create()`](/iam/reference/rest/v1/organizations.roles/create):
+   * * [`organizations.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/create):
    *   `organizations/{ORGANIZATION_ID}`. This method creates organization-level
-   *   [custom roles](/iam/docs/understanding-custom-roles). Example request
-   *   URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
+   *   Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
    * ID or organization ID.
@@ -513,14 +519,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.CreateRoleRequest)
       com.google.iam.admin.v1.CreateRoleRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_CreateRoleRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_CreateRoleRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.CreateRoleRequest.class,
@@ -559,7 +565,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_CreateRoleRequest_descriptor;
     }
 
@@ -684,18 +690,21 @@ public Builder mergeFrom(
      * <pre>
      * The `parent` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `parent` value format is described below:
-     * * [`projects.roles.create()`](/iam/reference/rest/v1/projects.roles/create):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `parent` value format is described below:
+     * * [`projects.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/create):
      *   `projects/{PROJECT_ID}`. This method creates project-level
-     *   [custom roles](/iam/docs/understanding-custom-roles).
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-     * * [`organizations.roles.create()`](/iam/reference/rest/v1/organizations.roles/create):
+     * * [`organizations.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/create):
      *   `organizations/{ORGANIZATION_ID}`. This method creates organization-level
-     *   [custom roles](/iam/docs/understanding-custom-roles). Example request
-     *   URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
+     *   Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
      * ID or organization ID.
@@ -722,18 +731,21 @@ public java.lang.String getParent() {
      * <pre>
      * The `parent` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `parent` value format is described below:
-     * * [`projects.roles.create()`](/iam/reference/rest/v1/projects.roles/create):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `parent` value format is described below:
+     * * [`projects.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/create):
      *   `projects/{PROJECT_ID}`. This method creates project-level
-     *   [custom roles](/iam/docs/understanding-custom-roles).
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-     * * [`organizations.roles.create()`](/iam/reference/rest/v1/organizations.roles/create):
+     * * [`organizations.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/create):
      *   `organizations/{ORGANIZATION_ID}`. This method creates organization-level
-     *   [custom roles](/iam/docs/understanding-custom-roles). Example request
-     *   URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
+     *   Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
      * ID or organization ID.
@@ -760,18 +772,21 @@ public com.google.protobuf.ByteString getParentBytes() {
      * <pre>
      * The `parent` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `parent` value format is described below:
-     * * [`projects.roles.create()`](/iam/reference/rest/v1/projects.roles/create):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `parent` value format is described below:
+     * * [`projects.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/create):
      *   `projects/{PROJECT_ID}`. This method creates project-level
-     *   [custom roles](/iam/docs/understanding-custom-roles).
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-     * * [`organizations.roles.create()`](/iam/reference/rest/v1/organizations.roles/create):
+     * * [`organizations.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/create):
      *   `organizations/{ORGANIZATION_ID}`. This method creates organization-level
-     *   [custom roles](/iam/docs/understanding-custom-roles). Example request
-     *   URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
+     *   Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
      * ID or organization ID.
@@ -797,18 +812,21 @@ public Builder setParent(java.lang.String value) {
      * <pre>
      * The `parent` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `parent` value format is described below:
-     * * [`projects.roles.create()`](/iam/reference/rest/v1/projects.roles/create):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `parent` value format is described below:
+     * * [`projects.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/create):
      *   `projects/{PROJECT_ID}`. This method creates project-level
-     *   [custom roles](/iam/docs/understanding-custom-roles).
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-     * * [`organizations.roles.create()`](/iam/reference/rest/v1/organizations.roles/create):
+     * * [`organizations.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/create):
      *   `organizations/{ORGANIZATION_ID}`. This method creates organization-level
-     *   [custom roles](/iam/docs/understanding-custom-roles). Example request
-     *   URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
+     *   Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
      * ID or organization ID.
@@ -830,18 +848,21 @@ public Builder clearParent() {
      * <pre>
      * The `parent` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `parent` value format is described below:
-     * * [`projects.roles.create()`](/iam/reference/rest/v1/projects.roles/create):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `parent` value format is described below:
+     * * [`projects.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/create):
      *   `projects/{PROJECT_ID}`. This method creates project-level
-     *   [custom roles](/iam/docs/understanding-custom-roles).
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-     * * [`organizations.roles.create()`](/iam/reference/rest/v1/organizations.roles/create):
+     * * [`organizations.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/create):
      *   `organizations/{ORGANIZATION_ID}`. This method creates organization-level
-     *   [custom roles](/iam/docs/understanding-custom-roles). Example request
-     *   URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
+     *   Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
      * ID or organization ID.
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateRoleRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateRoleRequestOrBuilder.java
index f2dc74ae0b9c..1674f71581f3 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateRoleRequestOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateRoleRequestOrBuilder.java
@@ -29,18 +29,21 @@ public interface CreateRoleRequestOrBuilder
    * <pre>
    * The `parent` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `parent` value format is described below:
-   * * [`projects.roles.create()`](/iam/reference/rest/v1/projects.roles/create):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `parent` value format is described below:
+   * * [`projects.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/create):
    *   `projects/{PROJECT_ID}`. This method creates project-level
-   *   [custom roles](/iam/docs/understanding-custom-roles).
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-   * * [`organizations.roles.create()`](/iam/reference/rest/v1/organizations.roles/create):
+   * * [`organizations.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/create):
    *   `organizations/{ORGANIZATION_ID}`. This method creates organization-level
-   *   [custom roles](/iam/docs/understanding-custom-roles). Example request
-   *   URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
+   *   Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
    * ID or organization ID.
@@ -57,18 +60,21 @@ public interface CreateRoleRequestOrBuilder
    * <pre>
    * The `parent` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `parent` value format is described below:
-   * * [`projects.roles.create()`](/iam/reference/rest/v1/projects.roles/create):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `parent` value format is described below:
+   * * [`projects.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/create):
    *   `projects/{PROJECT_ID}`. This method creates project-level
-   *   [custom roles](/iam/docs/understanding-custom-roles).
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-   * * [`organizations.roles.create()`](/iam/reference/rest/v1/organizations.roles/create):
+   * * [`organizations.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/create):
    *   `organizations/{ORGANIZATION_ID}`. This method creates organization-level
-   *   [custom roles](/iam/docs/understanding-custom-roles). Example request
-   *   URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
+   *   Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
    * ID or organization ID.
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateServiceAccountKeyRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateServiceAccountKeyRequest.java
index 2309a6bcd115..b80a958d9e75 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateServiceAccountKeyRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateServiceAccountKeyRequest.java
@@ -116,14 +116,14 @@ private CreateServiceAccountKeyRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_CreateServiceAccountKeyRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_CreateServiceAccountKeyRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.CreateServiceAccountKeyRequest.class,
@@ -471,14 +471,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.CreateServiceAccountKeyRequest)
       com.google.iam.admin.v1.CreateServiceAccountKeyRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_CreateServiceAccountKeyRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_CreateServiceAccountKeyRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.CreateServiceAccountKeyRequest.class,
@@ -513,7 +513,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_CreateServiceAccountKeyRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateServiceAccountRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateServiceAccountRequest.java
index 9f412e904bdf..45ac175b2c11 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateServiceAccountRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/CreateServiceAccountRequest.java
@@ -123,14 +123,14 @@ private CreateServiceAccountRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_CreateServiceAccountRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_CreateServiceAccountRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.CreateServiceAccountRequest.class,
@@ -497,14 +497,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.CreateServiceAccountRequest)
       com.google.iam.admin.v1.CreateServiceAccountRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_CreateServiceAccountRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_CreateServiceAccountRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.CreateServiceAccountRequest.class,
@@ -543,7 +543,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_CreateServiceAccountRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteRoleRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteRoleRequest.java
index 0fba35a9a971..6c34b467ae08 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteRoleRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteRoleRequest.java
@@ -105,14 +105,14 @@ private DeleteRoleRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_DeleteRoleRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_DeleteRoleRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.DeleteRoleRequest.class,
@@ -127,17 +127,20 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.delete()`](/iam/reference/rest/v1/projects.roles/delete):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/delete):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method deletes only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.delete()`](/iam/reference/rest/v1/organizations.roles/delete):
+   * * [`organizations.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/delete):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   deletes only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   deletes only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -166,17 +169,20 @@ public java.lang.String getName() {
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.delete()`](/iam/reference/rest/v1/projects.roles/delete):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/delete):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method deletes only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.delete()`](/iam/reference/rest/v1/organizations.roles/delete):
+   * * [`organizations.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/delete):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   deletes only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   deletes only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -400,14 +406,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.DeleteRoleRequest)
       com.google.iam.admin.v1.DeleteRoleRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DeleteRoleRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DeleteRoleRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.DeleteRoleRequest.class,
@@ -440,7 +446,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DeleteRoleRequest_descriptor;
     }
 
@@ -556,17 +562,20 @@ public Builder mergeFrom(
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.delete()`](/iam/reference/rest/v1/projects.roles/delete):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/delete):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method deletes only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.delete()`](/iam/reference/rest/v1/organizations.roles/delete):
+     * * [`organizations.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/delete):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   deletes only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   deletes only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -594,17 +603,20 @@ public java.lang.String getName() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.delete()`](/iam/reference/rest/v1/projects.roles/delete):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/delete):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method deletes only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.delete()`](/iam/reference/rest/v1/organizations.roles/delete):
+     * * [`organizations.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/delete):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   deletes only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   deletes only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -632,17 +644,20 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.delete()`](/iam/reference/rest/v1/projects.roles/delete):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/delete):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method deletes only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.delete()`](/iam/reference/rest/v1/organizations.roles/delete):
+     * * [`organizations.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/delete):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   deletes only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   deletes only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -669,17 +684,20 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.delete()`](/iam/reference/rest/v1/projects.roles/delete):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/delete):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method deletes only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.delete()`](/iam/reference/rest/v1/organizations.roles/delete):
+     * * [`organizations.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/delete):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   deletes only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   deletes only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -702,17 +720,20 @@ public Builder clearName() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.delete()`](/iam/reference/rest/v1/projects.roles/delete):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/delete):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method deletes only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.delete()`](/iam/reference/rest/v1/organizations.roles/delete):
+     * * [`organizations.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/delete):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   deletes only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   deletes only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteRoleRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteRoleRequestOrBuilder.java
index 4f755bfd42ce..232f648e6f42 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteRoleRequestOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteRoleRequestOrBuilder.java
@@ -29,17 +29,20 @@ public interface DeleteRoleRequestOrBuilder
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.delete()`](/iam/reference/rest/v1/projects.roles/delete):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/delete):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method deletes only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.delete()`](/iam/reference/rest/v1/organizations.roles/delete):
+   * * [`organizations.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/delete):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   deletes only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   deletes only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -57,17 +60,20 @@ public interface DeleteRoleRequestOrBuilder
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.delete()`](/iam/reference/rest/v1/projects.roles/delete):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/delete):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method deletes only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.delete()`](/iam/reference/rest/v1/organizations.roles/delete):
+   * * [`organizations.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/delete):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   deletes only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   deletes only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteServiceAccountKeyRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteServiceAccountKeyRequest.java
index ae370baa62cc..1a8dd8d7051b 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteServiceAccountKeyRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteServiceAccountKeyRequest.java
@@ -100,14 +100,14 @@ private DeleteServiceAccountKeyRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_DeleteServiceAccountKeyRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_DeleteServiceAccountKeyRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.DeleteServiceAccountKeyRequest.class,
@@ -349,14 +349,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.DeleteServiceAccountKeyRequest)
       com.google.iam.admin.v1.DeleteServiceAccountKeyRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DeleteServiceAccountKeyRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DeleteServiceAccountKeyRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.DeleteServiceAccountKeyRequest.class,
@@ -387,7 +387,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DeleteServiceAccountKeyRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteServiceAccountRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteServiceAccountRequest.java
index 5953b612be03..2952df0288c6 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteServiceAccountRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DeleteServiceAccountRequest.java
@@ -99,14 +99,14 @@ private DeleteServiceAccountRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_DeleteServiceAccountRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_DeleteServiceAccountRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.DeleteServiceAccountRequest.class,
@@ -347,14 +347,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.DeleteServiceAccountRequest)
       com.google.iam.admin.v1.DeleteServiceAccountRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DeleteServiceAccountRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DeleteServiceAccountRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.DeleteServiceAccountRequest.class,
@@ -385,7 +385,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DeleteServiceAccountRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountKeyRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountKeyRequest.java
new file mode 100644
index 000000000000..47f1791f16f5
--- /dev/null
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountKeyRequest.java
@@ -0,0 +1,682 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/iam/admin/v1/iam.proto
+
+package com.google.iam.admin.v1;
+
+/**
+ *
+ *
+ * <pre>
+ * The service account key disable request.
+ * </pre>
+ *
+ * Protobuf type {@code google.iam.admin.v1.DisableServiceAccountKeyRequest}
+ */
+public final class DisableServiceAccountKeyRequest extends com.google.protobuf.GeneratedMessageV3
+    implements
+    // @@protoc_insertion_point(message_implements:google.iam.admin.v1.DisableServiceAccountKeyRequest)
+    DisableServiceAccountKeyRequestOrBuilder {
+  private static final long serialVersionUID = 0L;
+  // Use DisableServiceAccountKeyRequest.newBuilder() to construct.
+  private DisableServiceAccountKeyRequest(
+      com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+    super(builder);
+  }
+
+  private DisableServiceAccountKeyRequest() {
+    name_ = "";
+  }
+
+  @java.lang.Override
+  @SuppressWarnings({"unused"})
+  protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
+    return new DisableServiceAccountKeyRequest();
+  }
+
+  @java.lang.Override
+  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
+    return this.unknownFields;
+  }
+
+  private DisableServiceAccountKeyRequest(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    this();
+    if (extensionRegistry == null) {
+      throw new java.lang.NullPointerException();
+    }
+    com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+        com.google.protobuf.UnknownFieldSet.newBuilder();
+    try {
+      boolean done = false;
+      while (!done) {
+        int tag = input.readTag();
+        switch (tag) {
+          case 0:
+            done = true;
+            break;
+          case 10:
+            {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              name_ = s;
+              break;
+            }
+          default:
+            {
+              if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
+                done = true;
+              }
+              break;
+            }
+        }
+      }
+    } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+      throw e.setUnfinishedMessage(this);
+    } catch (com.google.protobuf.UninitializedMessageException e) {
+      throw e.asInvalidProtocolBufferException().setUnfinishedMessage(this);
+    } catch (java.io.IOException e) {
+      throw new com.google.protobuf.InvalidProtocolBufferException(e).setUnfinishedMessage(this);
+    } finally {
+      this.unknownFields = unknownFields.build();
+      makeExtensionsImmutable();
+    }
+  }
+
+  public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+    return com.google.iam.admin.v1.Iam
+        .internal_static_google_iam_admin_v1_DisableServiceAccountKeyRequest_descriptor;
+  }
+
+  @java.lang.Override
+  protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internalGetFieldAccessorTable() {
+    return com.google.iam.admin.v1.Iam
+        .internal_static_google_iam_admin_v1_DisableServiceAccountKeyRequest_fieldAccessorTable
+        .ensureFieldAccessorsInitialized(
+            com.google.iam.admin.v1.DisableServiceAccountKeyRequest.class,
+            com.google.iam.admin.v1.DisableServiceAccountKeyRequest.Builder.class);
+  }
+
+  public static final int NAME_FIELD_NUMBER = 1;
+  private volatile java.lang.Object name_;
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the service account key in the following format:
+   * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+   * the account. The `ACCOUNT` value can be the `email` address or the
+   * `unique_id` of the service account.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The name.
+   */
+  @java.lang.Override
+  public java.lang.String getName() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      return (java.lang.String) ref;
+    } else {
+      com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+      java.lang.String s = bs.toStringUtf8();
+      name_ = s;
+      return s;
+    }
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the service account key in the following format:
+   * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+   * the account. The `ACCOUNT` value can be the `email` address or the
+   * `unique_id` of the service account.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The bytes for name.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getNameBytes() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      com.google.protobuf.ByteString b =
+          com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+      name_ = b;
+      return b;
+    } else {
+      return (com.google.protobuf.ByteString) ref;
+    }
+  }
+
+  private byte memoizedIsInitialized = -1;
+
+  @java.lang.Override
+  public final boolean isInitialized() {
+    byte isInitialized = memoizedIsInitialized;
+    if (isInitialized == 1) return true;
+    if (isInitialized == 0) return false;
+
+    memoizedIsInitialized = 1;
+    return true;
+  }
+
+  @java.lang.Override
+  public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io.IOException {
+    if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(name_)) {
+      com.google.protobuf.GeneratedMessageV3.writeString(output, 1, name_);
+    }
+    unknownFields.writeTo(output);
+  }
+
+  @java.lang.Override
+  public int getSerializedSize() {
+    int size = memoizedSize;
+    if (size != -1) return size;
+
+    size = 0;
+    if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(name_)) {
+      size += com.google.protobuf.GeneratedMessageV3.computeStringSize(1, name_);
+    }
+    size += unknownFields.getSerializedSize();
+    memoizedSize = size;
+    return size;
+  }
+
+  @java.lang.Override
+  public boolean equals(final java.lang.Object obj) {
+    if (obj == this) {
+      return true;
+    }
+    if (!(obj instanceof com.google.iam.admin.v1.DisableServiceAccountKeyRequest)) {
+      return super.equals(obj);
+    }
+    com.google.iam.admin.v1.DisableServiceAccountKeyRequest other =
+        (com.google.iam.admin.v1.DisableServiceAccountKeyRequest) obj;
+
+    if (!getName().equals(other.getName())) return false;
+    if (!unknownFields.equals(other.unknownFields)) return false;
+    return true;
+  }
+
+  @java.lang.Override
+  public int hashCode() {
+    if (memoizedHashCode != 0) {
+      return memoizedHashCode;
+    }
+    int hash = 41;
+    hash = (19 * hash) + getDescriptor().hashCode();
+    hash = (37 * hash) + NAME_FIELD_NUMBER;
+    hash = (53 * hash) + getName().hashCode();
+    hash = (29 * hash) + unknownFields.hashCode();
+    memoizedHashCode = hash;
+    return hash;
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseFrom(
+      java.nio.ByteBuffer data) throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseFrom(
+      java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseFrom(
+      com.google.protobuf.ByteString data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseFrom(
+      com.google.protobuf.ByteString data,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseFrom(byte[] data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseFrom(
+      byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseDelimitedFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(PARSER, input);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseDelimitedFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseFrom(
+      com.google.protobuf.CodedInputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest parseFrom(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  @java.lang.Override
+  public Builder newBuilderForType() {
+    return newBuilder();
+  }
+
+  public static Builder newBuilder() {
+    return DEFAULT_INSTANCE.toBuilder();
+  }
+
+  public static Builder newBuilder(
+      com.google.iam.admin.v1.DisableServiceAccountKeyRequest prototype) {
+    return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
+  }
+
+  @java.lang.Override
+  public Builder toBuilder() {
+    return this == DEFAULT_INSTANCE ? new Builder() : new Builder().mergeFrom(this);
+  }
+
+  @java.lang.Override
+  protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+    Builder builder = new Builder(parent);
+    return builder;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The service account key disable request.
+   * </pre>
+   *
+   * Protobuf type {@code google.iam.admin.v1.DisableServiceAccountKeyRequest}
+   */
+  public static final class Builder extends com.google.protobuf.GeneratedMessageV3.Builder<Builder>
+      implements
+      // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.DisableServiceAccountKeyRequest)
+      com.google.iam.admin.v1.DisableServiceAccountKeyRequestOrBuilder {
+    public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+      return com.google.iam.admin.v1.Iam
+          .internal_static_google_iam_admin_v1_DisableServiceAccountKeyRequest_descriptor;
+    }
+
+    @java.lang.Override
+    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return com.google.iam.admin.v1.Iam
+          .internal_static_google_iam_admin_v1_DisableServiceAccountKeyRequest_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              com.google.iam.admin.v1.DisableServiceAccountKeyRequest.class,
+              com.google.iam.admin.v1.DisableServiceAccountKeyRequest.Builder.class);
+    }
+
+    // Construct using com.google.iam.admin.v1.DisableServiceAccountKeyRequest.newBuilder()
+    private Builder() {
+      maybeForceBuilderInitialization();
+    }
+
+    private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+      super(parent);
+      maybeForceBuilderInitialization();
+    }
+
+    private void maybeForceBuilderInitialization() {
+      if (com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders) {}
+    }
+
+    @java.lang.Override
+    public Builder clear() {
+      super.clear();
+      name_ = "";
+
+      return this;
+    }
+
+    @java.lang.Override
+    public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
+      return com.google.iam.admin.v1.Iam
+          .internal_static_google_iam_admin_v1_DisableServiceAccountKeyRequest_descriptor;
+    }
+
+    @java.lang.Override
+    public com.google.iam.admin.v1.DisableServiceAccountKeyRequest getDefaultInstanceForType() {
+      return com.google.iam.admin.v1.DisableServiceAccountKeyRequest.getDefaultInstance();
+    }
+
+    @java.lang.Override
+    public com.google.iam.admin.v1.DisableServiceAccountKeyRequest build() {
+      com.google.iam.admin.v1.DisableServiceAccountKeyRequest result = buildPartial();
+      if (!result.isInitialized()) {
+        throw newUninitializedMessageException(result);
+      }
+      return result;
+    }
+
+    @java.lang.Override
+    public com.google.iam.admin.v1.DisableServiceAccountKeyRequest buildPartial() {
+      com.google.iam.admin.v1.DisableServiceAccountKeyRequest result =
+          new com.google.iam.admin.v1.DisableServiceAccountKeyRequest(this);
+      result.name_ = name_;
+      onBuilt();
+      return result;
+    }
+
+    @java.lang.Override
+    public Builder clone() {
+      return super.clone();
+    }
+
+    @java.lang.Override
+    public Builder setField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.setField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
+      return super.clearField(field);
+    }
+
+    @java.lang.Override
+    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
+      return super.clearOneof(oneof);
+    }
+
+    @java.lang.Override
+    public Builder setRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
+      return super.setRepeatedField(field, index, value);
+    }
+
+    @java.lang.Override
+    public Builder addRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.addRepeatedField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(com.google.protobuf.Message other) {
+      if (other instanceof com.google.iam.admin.v1.DisableServiceAccountKeyRequest) {
+        return mergeFrom((com.google.iam.admin.v1.DisableServiceAccountKeyRequest) other);
+      } else {
+        super.mergeFrom(other);
+        return this;
+      }
+    }
+
+    public Builder mergeFrom(com.google.iam.admin.v1.DisableServiceAccountKeyRequest other) {
+      if (other == com.google.iam.admin.v1.DisableServiceAccountKeyRequest.getDefaultInstance())
+        return this;
+      if (!other.getName().isEmpty()) {
+        name_ = other.name_;
+        onChanged();
+      }
+      this.mergeUnknownFields(other.unknownFields);
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final boolean isInitialized() {
+      return true;
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      com.google.iam.admin.v1.DisableServiceAccountKeyRequest parsedMessage = null;
+      try {
+        parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        parsedMessage =
+            (com.google.iam.admin.v1.DisableServiceAccountKeyRequest) e.getUnfinishedMessage();
+        throw e.unwrapIOException();
+      } finally {
+        if (parsedMessage != null) {
+          mergeFrom(parsedMessage);
+        }
+      }
+      return this;
+    }
+
+    private java.lang.Object name_ = "";
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the service account key in the following format:
+     * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+     * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+     * the account. The `ACCOUNT` value can be the `email` address or the
+     * `unique_id` of the service account.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return The name.
+     */
+    public java.lang.String getName() {
+      java.lang.Object ref = name_;
+      if (!(ref instanceof java.lang.String)) {
+        com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        name_ = s;
+        return s;
+      } else {
+        return (java.lang.String) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the service account key in the following format:
+     * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+     * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+     * the account. The `ACCOUNT` value can be the `email` address or the
+     * `unique_id` of the service account.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return The bytes for name.
+     */
+    public com.google.protobuf.ByteString getNameBytes() {
+      java.lang.Object ref = name_;
+      if (ref instanceof String) {
+        com.google.protobuf.ByteString b =
+            com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+        name_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the service account key in the following format:
+     * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+     * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+     * the account. The `ACCOUNT` value can be the `email` address or the
+     * `unique_id` of the service account.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @param value The name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setName(java.lang.String value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the service account key in the following format:
+     * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+     * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+     * the account. The `ACCOUNT` value can be the `email` address or the
+     * `unique_id` of the service account.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearName() {
+
+      name_ = getDefaultInstance().getName();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the service account key in the following format:
+     * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+     * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+     * the account. The `ACCOUNT` value can be the `email` address or the
+     * `unique_id` of the service account.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @param value The bytes for name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setNameBytes(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+      checkByteStringIsUtf8(value);
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.setUnknownFields(unknownFields);
+    }
+
+    @java.lang.Override
+    public final Builder mergeUnknownFields(
+        final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.mergeUnknownFields(unknownFields);
+    }
+
+    // @@protoc_insertion_point(builder_scope:google.iam.admin.v1.DisableServiceAccountKeyRequest)
+  }
+
+  // @@protoc_insertion_point(class_scope:google.iam.admin.v1.DisableServiceAccountKeyRequest)
+  private static final com.google.iam.admin.v1.DisableServiceAccountKeyRequest DEFAULT_INSTANCE;
+
+  static {
+    DEFAULT_INSTANCE = new com.google.iam.admin.v1.DisableServiceAccountKeyRequest();
+  }
+
+  public static com.google.iam.admin.v1.DisableServiceAccountKeyRequest getDefaultInstance() {
+    return DEFAULT_INSTANCE;
+  }
+
+  private static final com.google.protobuf.Parser<DisableServiceAccountKeyRequest> PARSER =
+      new com.google.protobuf.AbstractParser<DisableServiceAccountKeyRequest>() {
+        @java.lang.Override
+        public DisableServiceAccountKeyRequest parsePartialFrom(
+            com.google.protobuf.CodedInputStream input,
+            com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+            throws com.google.protobuf.InvalidProtocolBufferException {
+          return new DisableServiceAccountKeyRequest(input, extensionRegistry);
+        }
+      };
+
+  public static com.google.protobuf.Parser<DisableServiceAccountKeyRequest> parser() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.protobuf.Parser<DisableServiceAccountKeyRequest> getParserForType() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.iam.admin.v1.DisableServiceAccountKeyRequest getDefaultInstanceForType() {
+    return DEFAULT_INSTANCE;
+  }
+}
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountKeyRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountKeyRequestOrBuilder.java
new file mode 100644
index 000000000000..29d21895f82c
--- /dev/null
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountKeyRequestOrBuilder.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/iam/admin/v1/iam.proto
+
+package com.google.iam.admin.v1;
+
+public interface DisableServiceAccountKeyRequestOrBuilder
+    extends
+    // @@protoc_insertion_point(interface_extends:google.iam.admin.v1.DisableServiceAccountKeyRequest)
+    com.google.protobuf.MessageOrBuilder {
+
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the service account key in the following format:
+   * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+   * the account. The `ACCOUNT` value can be the `email` address or the
+   * `unique_id` of the service account.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The name.
+   */
+  java.lang.String getName();
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the service account key in the following format:
+   * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+   * the account. The `ACCOUNT` value can be the `email` address or the
+   * `unique_id` of the service account.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The bytes for name.
+   */
+  com.google.protobuf.ByteString getNameBytes();
+}
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountRequest.java
index 51d753f7d2d4..5e49be02dbd9 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/DisableServiceAccountRequest.java
@@ -99,14 +99,14 @@ private DisableServiceAccountRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_DisableServiceAccountRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_DisableServiceAccountRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.DisableServiceAccountRequest.class,
@@ -343,14 +343,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.DisableServiceAccountRequest)
       com.google.iam.admin.v1.DisableServiceAccountRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DisableServiceAccountRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DisableServiceAccountRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.DisableServiceAccountRequest.class,
@@ -381,7 +381,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_DisableServiceAccountRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountKeyRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountKeyRequest.java
new file mode 100644
index 000000000000..fc0f9aef505a
--- /dev/null
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountKeyRequest.java
@@ -0,0 +1,682 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/iam/admin/v1/iam.proto
+
+package com.google.iam.admin.v1;
+
+/**
+ *
+ *
+ * <pre>
+ * The service account key enable request.
+ * </pre>
+ *
+ * Protobuf type {@code google.iam.admin.v1.EnableServiceAccountKeyRequest}
+ */
+public final class EnableServiceAccountKeyRequest extends com.google.protobuf.GeneratedMessageV3
+    implements
+    // @@protoc_insertion_point(message_implements:google.iam.admin.v1.EnableServiceAccountKeyRequest)
+    EnableServiceAccountKeyRequestOrBuilder {
+  private static final long serialVersionUID = 0L;
+  // Use EnableServiceAccountKeyRequest.newBuilder() to construct.
+  private EnableServiceAccountKeyRequest(
+      com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+    super(builder);
+  }
+
+  private EnableServiceAccountKeyRequest() {
+    name_ = "";
+  }
+
+  @java.lang.Override
+  @SuppressWarnings({"unused"})
+  protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
+    return new EnableServiceAccountKeyRequest();
+  }
+
+  @java.lang.Override
+  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
+    return this.unknownFields;
+  }
+
+  private EnableServiceAccountKeyRequest(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    this();
+    if (extensionRegistry == null) {
+      throw new java.lang.NullPointerException();
+    }
+    com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+        com.google.protobuf.UnknownFieldSet.newBuilder();
+    try {
+      boolean done = false;
+      while (!done) {
+        int tag = input.readTag();
+        switch (tag) {
+          case 0:
+            done = true;
+            break;
+          case 10:
+            {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              name_ = s;
+              break;
+            }
+          default:
+            {
+              if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
+                done = true;
+              }
+              break;
+            }
+        }
+      }
+    } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+      throw e.setUnfinishedMessage(this);
+    } catch (com.google.protobuf.UninitializedMessageException e) {
+      throw e.asInvalidProtocolBufferException().setUnfinishedMessage(this);
+    } catch (java.io.IOException e) {
+      throw new com.google.protobuf.InvalidProtocolBufferException(e).setUnfinishedMessage(this);
+    } finally {
+      this.unknownFields = unknownFields.build();
+      makeExtensionsImmutable();
+    }
+  }
+
+  public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+    return com.google.iam.admin.v1.Iam
+        .internal_static_google_iam_admin_v1_EnableServiceAccountKeyRequest_descriptor;
+  }
+
+  @java.lang.Override
+  protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internalGetFieldAccessorTable() {
+    return com.google.iam.admin.v1.Iam
+        .internal_static_google_iam_admin_v1_EnableServiceAccountKeyRequest_fieldAccessorTable
+        .ensureFieldAccessorsInitialized(
+            com.google.iam.admin.v1.EnableServiceAccountKeyRequest.class,
+            com.google.iam.admin.v1.EnableServiceAccountKeyRequest.Builder.class);
+  }
+
+  public static final int NAME_FIELD_NUMBER = 1;
+  private volatile java.lang.Object name_;
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the service account key in the following format:
+   * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+   * the account. The `ACCOUNT` value can be the `email` address or the
+   * `unique_id` of the service account.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The name.
+   */
+  @java.lang.Override
+  public java.lang.String getName() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      return (java.lang.String) ref;
+    } else {
+      com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+      java.lang.String s = bs.toStringUtf8();
+      name_ = s;
+      return s;
+    }
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the service account key in the following format:
+   * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+   * the account. The `ACCOUNT` value can be the `email` address or the
+   * `unique_id` of the service account.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The bytes for name.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getNameBytes() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      com.google.protobuf.ByteString b =
+          com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+      name_ = b;
+      return b;
+    } else {
+      return (com.google.protobuf.ByteString) ref;
+    }
+  }
+
+  private byte memoizedIsInitialized = -1;
+
+  @java.lang.Override
+  public final boolean isInitialized() {
+    byte isInitialized = memoizedIsInitialized;
+    if (isInitialized == 1) return true;
+    if (isInitialized == 0) return false;
+
+    memoizedIsInitialized = 1;
+    return true;
+  }
+
+  @java.lang.Override
+  public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io.IOException {
+    if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(name_)) {
+      com.google.protobuf.GeneratedMessageV3.writeString(output, 1, name_);
+    }
+    unknownFields.writeTo(output);
+  }
+
+  @java.lang.Override
+  public int getSerializedSize() {
+    int size = memoizedSize;
+    if (size != -1) return size;
+
+    size = 0;
+    if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(name_)) {
+      size += com.google.protobuf.GeneratedMessageV3.computeStringSize(1, name_);
+    }
+    size += unknownFields.getSerializedSize();
+    memoizedSize = size;
+    return size;
+  }
+
+  @java.lang.Override
+  public boolean equals(final java.lang.Object obj) {
+    if (obj == this) {
+      return true;
+    }
+    if (!(obj instanceof com.google.iam.admin.v1.EnableServiceAccountKeyRequest)) {
+      return super.equals(obj);
+    }
+    com.google.iam.admin.v1.EnableServiceAccountKeyRequest other =
+        (com.google.iam.admin.v1.EnableServiceAccountKeyRequest) obj;
+
+    if (!getName().equals(other.getName())) return false;
+    if (!unknownFields.equals(other.unknownFields)) return false;
+    return true;
+  }
+
+  @java.lang.Override
+  public int hashCode() {
+    if (memoizedHashCode != 0) {
+      return memoizedHashCode;
+    }
+    int hash = 41;
+    hash = (19 * hash) + getDescriptor().hashCode();
+    hash = (37 * hash) + NAME_FIELD_NUMBER;
+    hash = (53 * hash) + getName().hashCode();
+    hash = (29 * hash) + unknownFields.hashCode();
+    memoizedHashCode = hash;
+    return hash;
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseFrom(
+      java.nio.ByteBuffer data) throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseFrom(
+      java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseFrom(
+      com.google.protobuf.ByteString data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseFrom(
+      com.google.protobuf.ByteString data,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseFrom(byte[] data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseFrom(
+      byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseDelimitedFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(PARSER, input);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseDelimitedFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseFrom(
+      com.google.protobuf.CodedInputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest parseFrom(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  @java.lang.Override
+  public Builder newBuilderForType() {
+    return newBuilder();
+  }
+
+  public static Builder newBuilder() {
+    return DEFAULT_INSTANCE.toBuilder();
+  }
+
+  public static Builder newBuilder(
+      com.google.iam.admin.v1.EnableServiceAccountKeyRequest prototype) {
+    return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
+  }
+
+  @java.lang.Override
+  public Builder toBuilder() {
+    return this == DEFAULT_INSTANCE ? new Builder() : new Builder().mergeFrom(this);
+  }
+
+  @java.lang.Override
+  protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+    Builder builder = new Builder(parent);
+    return builder;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The service account key enable request.
+   * </pre>
+   *
+   * Protobuf type {@code google.iam.admin.v1.EnableServiceAccountKeyRequest}
+   */
+  public static final class Builder extends com.google.protobuf.GeneratedMessageV3.Builder<Builder>
+      implements
+      // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.EnableServiceAccountKeyRequest)
+      com.google.iam.admin.v1.EnableServiceAccountKeyRequestOrBuilder {
+    public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+      return com.google.iam.admin.v1.Iam
+          .internal_static_google_iam_admin_v1_EnableServiceAccountKeyRequest_descriptor;
+    }
+
+    @java.lang.Override
+    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return com.google.iam.admin.v1.Iam
+          .internal_static_google_iam_admin_v1_EnableServiceAccountKeyRequest_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              com.google.iam.admin.v1.EnableServiceAccountKeyRequest.class,
+              com.google.iam.admin.v1.EnableServiceAccountKeyRequest.Builder.class);
+    }
+
+    // Construct using com.google.iam.admin.v1.EnableServiceAccountKeyRequest.newBuilder()
+    private Builder() {
+      maybeForceBuilderInitialization();
+    }
+
+    private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+      super(parent);
+      maybeForceBuilderInitialization();
+    }
+
+    private void maybeForceBuilderInitialization() {
+      if (com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders) {}
+    }
+
+    @java.lang.Override
+    public Builder clear() {
+      super.clear();
+      name_ = "";
+
+      return this;
+    }
+
+    @java.lang.Override
+    public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
+      return com.google.iam.admin.v1.Iam
+          .internal_static_google_iam_admin_v1_EnableServiceAccountKeyRequest_descriptor;
+    }
+
+    @java.lang.Override
+    public com.google.iam.admin.v1.EnableServiceAccountKeyRequest getDefaultInstanceForType() {
+      return com.google.iam.admin.v1.EnableServiceAccountKeyRequest.getDefaultInstance();
+    }
+
+    @java.lang.Override
+    public com.google.iam.admin.v1.EnableServiceAccountKeyRequest build() {
+      com.google.iam.admin.v1.EnableServiceAccountKeyRequest result = buildPartial();
+      if (!result.isInitialized()) {
+        throw newUninitializedMessageException(result);
+      }
+      return result;
+    }
+
+    @java.lang.Override
+    public com.google.iam.admin.v1.EnableServiceAccountKeyRequest buildPartial() {
+      com.google.iam.admin.v1.EnableServiceAccountKeyRequest result =
+          new com.google.iam.admin.v1.EnableServiceAccountKeyRequest(this);
+      result.name_ = name_;
+      onBuilt();
+      return result;
+    }
+
+    @java.lang.Override
+    public Builder clone() {
+      return super.clone();
+    }
+
+    @java.lang.Override
+    public Builder setField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.setField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
+      return super.clearField(field);
+    }
+
+    @java.lang.Override
+    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
+      return super.clearOneof(oneof);
+    }
+
+    @java.lang.Override
+    public Builder setRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
+      return super.setRepeatedField(field, index, value);
+    }
+
+    @java.lang.Override
+    public Builder addRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.addRepeatedField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(com.google.protobuf.Message other) {
+      if (other instanceof com.google.iam.admin.v1.EnableServiceAccountKeyRequest) {
+        return mergeFrom((com.google.iam.admin.v1.EnableServiceAccountKeyRequest) other);
+      } else {
+        super.mergeFrom(other);
+        return this;
+      }
+    }
+
+    public Builder mergeFrom(com.google.iam.admin.v1.EnableServiceAccountKeyRequest other) {
+      if (other == com.google.iam.admin.v1.EnableServiceAccountKeyRequest.getDefaultInstance())
+        return this;
+      if (!other.getName().isEmpty()) {
+        name_ = other.name_;
+        onChanged();
+      }
+      this.mergeUnknownFields(other.unknownFields);
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final boolean isInitialized() {
+      return true;
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      com.google.iam.admin.v1.EnableServiceAccountKeyRequest parsedMessage = null;
+      try {
+        parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        parsedMessage =
+            (com.google.iam.admin.v1.EnableServiceAccountKeyRequest) e.getUnfinishedMessage();
+        throw e.unwrapIOException();
+      } finally {
+        if (parsedMessage != null) {
+          mergeFrom(parsedMessage);
+        }
+      }
+      return this;
+    }
+
+    private java.lang.Object name_ = "";
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the service account key in the following format:
+     * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+     * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+     * the account. The `ACCOUNT` value can be the `email` address or the
+     * `unique_id` of the service account.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return The name.
+     */
+    public java.lang.String getName() {
+      java.lang.Object ref = name_;
+      if (!(ref instanceof java.lang.String)) {
+        com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        name_ = s;
+        return s;
+      } else {
+        return (java.lang.String) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the service account key in the following format:
+     * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+     * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+     * the account. The `ACCOUNT` value can be the `email` address or the
+     * `unique_id` of the service account.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return The bytes for name.
+     */
+    public com.google.protobuf.ByteString getNameBytes() {
+      java.lang.Object ref = name_;
+      if (ref instanceof String) {
+        com.google.protobuf.ByteString b =
+            com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+        name_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the service account key in the following format:
+     * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+     * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+     * the account. The `ACCOUNT` value can be the `email` address or the
+     * `unique_id` of the service account.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @param value The name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setName(java.lang.String value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the service account key in the following format:
+     * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+     * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+     * the account. The `ACCOUNT` value can be the `email` address or the
+     * `unique_id` of the service account.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearName() {
+
+      name_ = getDefaultInstance().getName();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the service account key in the following format:
+     * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+     * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+     * the account. The `ACCOUNT` value can be the `email` address or the
+     * `unique_id` of the service account.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @param value The bytes for name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setNameBytes(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+      checkByteStringIsUtf8(value);
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.setUnknownFields(unknownFields);
+    }
+
+    @java.lang.Override
+    public final Builder mergeUnknownFields(
+        final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.mergeUnknownFields(unknownFields);
+    }
+
+    // @@protoc_insertion_point(builder_scope:google.iam.admin.v1.EnableServiceAccountKeyRequest)
+  }
+
+  // @@protoc_insertion_point(class_scope:google.iam.admin.v1.EnableServiceAccountKeyRequest)
+  private static final com.google.iam.admin.v1.EnableServiceAccountKeyRequest DEFAULT_INSTANCE;
+
+  static {
+    DEFAULT_INSTANCE = new com.google.iam.admin.v1.EnableServiceAccountKeyRequest();
+  }
+
+  public static com.google.iam.admin.v1.EnableServiceAccountKeyRequest getDefaultInstance() {
+    return DEFAULT_INSTANCE;
+  }
+
+  private static final com.google.protobuf.Parser<EnableServiceAccountKeyRequest> PARSER =
+      new com.google.protobuf.AbstractParser<EnableServiceAccountKeyRequest>() {
+        @java.lang.Override
+        public EnableServiceAccountKeyRequest parsePartialFrom(
+            com.google.protobuf.CodedInputStream input,
+            com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+            throws com.google.protobuf.InvalidProtocolBufferException {
+          return new EnableServiceAccountKeyRequest(input, extensionRegistry);
+        }
+      };
+
+  public static com.google.protobuf.Parser<EnableServiceAccountKeyRequest> parser() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.protobuf.Parser<EnableServiceAccountKeyRequest> getParserForType() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.iam.admin.v1.EnableServiceAccountKeyRequest getDefaultInstanceForType() {
+    return DEFAULT_INSTANCE;
+  }
+}
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountKeyRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountKeyRequestOrBuilder.java
new file mode 100644
index 000000000000..04a0c513733f
--- /dev/null
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountKeyRequestOrBuilder.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/iam/admin/v1/iam.proto
+
+package com.google.iam.admin.v1;
+
+public interface EnableServiceAccountKeyRequestOrBuilder
+    extends
+    // @@protoc_insertion_point(interface_extends:google.iam.admin.v1.EnableServiceAccountKeyRequest)
+    com.google.protobuf.MessageOrBuilder {
+
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the service account key in the following format:
+   * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+   * the account. The `ACCOUNT` value can be the `email` address or the
+   * `unique_id` of the service account.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The name.
+   */
+  java.lang.String getName();
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the service account key in the following format:
+   * `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+   * Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+   * the account. The `ACCOUNT` value can be the `email` address or the
+   * `unique_id` of the service account.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The bytes for name.
+   */
+  com.google.protobuf.ByteString getNameBytes();
+}
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountRequest.java
index c88b74d06efc..6addbc7f948b 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/EnableServiceAccountRequest.java
@@ -99,14 +99,14 @@ private EnableServiceAccountRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_EnableServiceAccountRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_EnableServiceAccountRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.EnableServiceAccountRequest.class,
@@ -343,14 +343,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.EnableServiceAccountRequest)
       com.google.iam.admin.v1.EnableServiceAccountRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_EnableServiceAccountRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_EnableServiceAccountRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.EnableServiceAccountRequest.class,
@@ -381,7 +381,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_EnableServiceAccountRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetRoleRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetRoleRequest.java
index 578867583699..a58c7c0d2a50 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetRoleRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetRoleRequest.java
@@ -99,14 +99,14 @@ private GetRoleRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_GetRoleRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_GetRoleRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.GetRoleRequest.class,
@@ -121,23 +121,27 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`roles`](/iam/reference/rest/v1/roles),
-   * [`projects`](/iam/reference/rest/v1/projects.roles), or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`roles.get()`](/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
+   * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`roles.get()`](https://cloud.google.com/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
    *   This method returns results from all
-   *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-   *   Cloud IAM. Example request URL:
+   *   [predefined
+   *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+   *   in Cloud IAM. Example request URL:
    *   `https://iam.googleapis.com/v1/roles/{ROLE_NAME}`
-   * * [`projects.roles.get()`](/iam/reference/rest/v1/projects.roles/get):
+   * * [`projects.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/get):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method returns only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.get()`](/iam/reference/rest/v1/organizations.roles/get):
+   * * [`organizations.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/get):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   returns only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   returns only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -166,23 +170,27 @@ public java.lang.String getName() {
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`roles`](/iam/reference/rest/v1/roles),
-   * [`projects`](/iam/reference/rest/v1/projects.roles), or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`roles.get()`](/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
+   * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`roles.get()`](https://cloud.google.com/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
    *   This method returns results from all
-   *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-   *   Cloud IAM. Example request URL:
+   *   [predefined
+   *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+   *   in Cloud IAM. Example request URL:
    *   `https://iam.googleapis.com/v1/roles/{ROLE_NAME}`
-   * * [`projects.roles.get()`](/iam/reference/rest/v1/projects.roles/get):
+   * * [`projects.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/get):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method returns only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.get()`](/iam/reference/rest/v1/organizations.roles/get):
+   * * [`organizations.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/get):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   returns only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   returns only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -378,14 +386,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.GetRoleRequest)
       com.google.iam.admin.v1.GetRoleRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_GetRoleRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_GetRoleRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.GetRoleRequest.class,
@@ -416,7 +424,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_GetRoleRequest_descriptor;
     }
 
@@ -528,23 +536,27 @@ public Builder mergeFrom(
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`roles`](/iam/reference/rest/v1/roles),
-     * [`projects`](/iam/reference/rest/v1/projects.roles), or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`roles.get()`](/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
+     * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`roles.get()`](https://cloud.google.com/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
      *   This method returns results from all
-     *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-     *   Cloud IAM. Example request URL:
+     *   [predefined
+     *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+     *   in Cloud IAM. Example request URL:
      *   `https://iam.googleapis.com/v1/roles/{ROLE_NAME}`
-     * * [`projects.roles.get()`](/iam/reference/rest/v1/projects.roles/get):
+     * * [`projects.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/get):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method returns only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.get()`](/iam/reference/rest/v1/organizations.roles/get):
+     * * [`organizations.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/get):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   returns only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   returns only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -572,23 +584,27 @@ public java.lang.String getName() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`roles`](/iam/reference/rest/v1/roles),
-     * [`projects`](/iam/reference/rest/v1/projects.roles), or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`roles.get()`](/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
+     * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`roles.get()`](https://cloud.google.com/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
      *   This method returns results from all
-     *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-     *   Cloud IAM. Example request URL:
+     *   [predefined
+     *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+     *   in Cloud IAM. Example request URL:
      *   `https://iam.googleapis.com/v1/roles/{ROLE_NAME}`
-     * * [`projects.roles.get()`](/iam/reference/rest/v1/projects.roles/get):
+     * * [`projects.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/get):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method returns only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.get()`](/iam/reference/rest/v1/organizations.roles/get):
+     * * [`organizations.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/get):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   returns only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   returns only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -616,23 +632,27 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`roles`](/iam/reference/rest/v1/roles),
-     * [`projects`](/iam/reference/rest/v1/projects.roles), or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`roles.get()`](/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
+     * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`roles.get()`](https://cloud.google.com/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
      *   This method returns results from all
-     *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-     *   Cloud IAM. Example request URL:
+     *   [predefined
+     *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+     *   in Cloud IAM. Example request URL:
      *   `https://iam.googleapis.com/v1/roles/{ROLE_NAME}`
-     * * [`projects.roles.get()`](/iam/reference/rest/v1/projects.roles/get):
+     * * [`projects.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/get):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method returns only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.get()`](/iam/reference/rest/v1/organizations.roles/get):
+     * * [`organizations.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/get):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   returns only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   returns only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -659,23 +679,27 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`roles`](/iam/reference/rest/v1/roles),
-     * [`projects`](/iam/reference/rest/v1/projects.roles), or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`roles.get()`](/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
+     * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`roles.get()`](https://cloud.google.com/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
      *   This method returns results from all
-     *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-     *   Cloud IAM. Example request URL:
+     *   [predefined
+     *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+     *   in Cloud IAM. Example request URL:
      *   `https://iam.googleapis.com/v1/roles/{ROLE_NAME}`
-     * * [`projects.roles.get()`](/iam/reference/rest/v1/projects.roles/get):
+     * * [`projects.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/get):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method returns only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.get()`](/iam/reference/rest/v1/organizations.roles/get):
+     * * [`organizations.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/get):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   returns only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   returns only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -698,23 +722,27 @@ public Builder clearName() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`roles`](/iam/reference/rest/v1/roles),
-     * [`projects`](/iam/reference/rest/v1/projects.roles), or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`roles.get()`](/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
+     * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`roles.get()`](https://cloud.google.com/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
      *   This method returns results from all
-     *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-     *   Cloud IAM. Example request URL:
+     *   [predefined
+     *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+     *   in Cloud IAM. Example request URL:
      *   `https://iam.googleapis.com/v1/roles/{ROLE_NAME}`
-     * * [`projects.roles.get()`](/iam/reference/rest/v1/projects.roles/get):
+     * * [`projects.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/get):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method returns only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.get()`](/iam/reference/rest/v1/organizations.roles/get):
+     * * [`organizations.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/get):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   returns only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   returns only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetRoleRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetRoleRequestOrBuilder.java
index 65e4fa3757b8..9ba2b9e809ee 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetRoleRequestOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetRoleRequestOrBuilder.java
@@ -29,23 +29,27 @@ public interface GetRoleRequestOrBuilder
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`roles`](/iam/reference/rest/v1/roles),
-   * [`projects`](/iam/reference/rest/v1/projects.roles), or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`roles.get()`](/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
+   * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`roles.get()`](https://cloud.google.com/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
    *   This method returns results from all
-   *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-   *   Cloud IAM. Example request URL:
+   *   [predefined
+   *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+   *   in Cloud IAM. Example request URL:
    *   `https://iam.googleapis.com/v1/roles/{ROLE_NAME}`
-   * * [`projects.roles.get()`](/iam/reference/rest/v1/projects.roles/get):
+   * * [`projects.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/get):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method returns only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.get()`](/iam/reference/rest/v1/organizations.roles/get):
+   * * [`organizations.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/get):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   returns only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   returns only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -63,23 +67,27 @@ public interface GetRoleRequestOrBuilder
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`roles`](/iam/reference/rest/v1/roles),
-   * [`projects`](/iam/reference/rest/v1/projects.roles), or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`roles.get()`](/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
+   * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`roles.get()`](https://cloud.google.com/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
    *   This method returns results from all
-   *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-   *   Cloud IAM. Example request URL:
+   *   [predefined
+   *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+   *   in Cloud IAM. Example request URL:
    *   `https://iam.googleapis.com/v1/roles/{ROLE_NAME}`
-   * * [`projects.roles.get()`](/iam/reference/rest/v1/projects.roles/get):
+   * * [`projects.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/get):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method returns only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.get()`](/iam/reference/rest/v1/organizations.roles/get):
+   * * [`organizations.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/get):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   returns only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   returns only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountKeyRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountKeyRequest.java
index 863b59f613e0..2a434bd81e7f 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountKeyRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountKeyRequest.java
@@ -107,14 +107,14 @@ private GetServiceAccountKeyRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_GetServiceAccountKeyRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_GetServiceAccountKeyRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.GetServiceAccountKeyRequest.class,
@@ -188,11 +188,13 @@ public com.google.protobuf.ByteString getNameBytes() {
    *
    *
    * <pre>
-   * The output format of the public key requested.
-   * X509_PEM is the default output format.
+   * Optional. The output format of the public key. The default is `TYPE_NONE`, which
+   * means that the public key is not returned.
    * </pre>
    *
-   * <code>.google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2;</code>
+   * <code>
+   * .google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
    *
    * @return The enum numeric value on the wire for publicKeyType.
    */
@@ -204,11 +206,13 @@ public int getPublicKeyTypeValue() {
    *
    *
    * <pre>
-   * The output format of the public key requested.
-   * X509_PEM is the default output format.
+   * Optional. The output format of the public key. The default is `TYPE_NONE`, which
+   * means that the public key is not returned.
    * </pre>
    *
-   * <code>.google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2;</code>
+   * <code>
+   * .google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
    *
    * @return The publicKeyType.
    */
@@ -406,14 +410,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.GetServiceAccountKeyRequest)
       com.google.iam.admin.v1.GetServiceAccountKeyRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_GetServiceAccountKeyRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_GetServiceAccountKeyRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.GetServiceAccountKeyRequest.class,
@@ -446,7 +450,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_GetServiceAccountKeyRequest_descriptor;
     }
 
@@ -698,11 +702,13 @@ public Builder setNameBytes(com.google.protobuf.ByteString value) {
      *
      *
      * <pre>
-     * The output format of the public key requested.
-     * X509_PEM is the default output format.
+     * Optional. The output format of the public key. The default is `TYPE_NONE`, which
+     * means that the public key is not returned.
      * </pre>
      *
-     * <code>.google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2;</code>
+     * <code>
+     * .google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
      *
      * @return The enum numeric value on the wire for publicKeyType.
      */
@@ -714,11 +720,13 @@ public int getPublicKeyTypeValue() {
      *
      *
      * <pre>
-     * The output format of the public key requested.
-     * X509_PEM is the default output format.
+     * Optional. The output format of the public key. The default is `TYPE_NONE`, which
+     * means that the public key is not returned.
      * </pre>
      *
-     * <code>.google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2;</code>
+     * <code>
+     * .google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
      *
      * @param value The enum numeric value on the wire for publicKeyType to set.
      * @return This builder for chaining.
@@ -733,11 +741,13 @@ public Builder setPublicKeyTypeValue(int value) {
      *
      *
      * <pre>
-     * The output format of the public key requested.
-     * X509_PEM is the default output format.
+     * Optional. The output format of the public key. The default is `TYPE_NONE`, which
+     * means that the public key is not returned.
      * </pre>
      *
-     * <code>.google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2;</code>
+     * <code>
+     * .google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
      *
      * @return The publicKeyType.
      */
@@ -754,11 +764,13 @@ public com.google.iam.admin.v1.ServiceAccountPublicKeyType getPublicKeyType() {
      *
      *
      * <pre>
-     * The output format of the public key requested.
-     * X509_PEM is the default output format.
+     * Optional. The output format of the public key. The default is `TYPE_NONE`, which
+     * means that the public key is not returned.
      * </pre>
      *
-     * <code>.google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2;</code>
+     * <code>
+     * .google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
      *
      * @param value The publicKeyType to set.
      * @return This builder for chaining.
@@ -776,11 +788,13 @@ public Builder setPublicKeyType(com.google.iam.admin.v1.ServiceAccountPublicKeyT
      *
      *
      * <pre>
-     * The output format of the public key requested.
-     * X509_PEM is the default output format.
+     * Optional. The output format of the public key. The default is `TYPE_NONE`, which
+     * means that the public key is not returned.
      * </pre>
      *
-     * <code>.google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2;</code>
+     * <code>
+     * .google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
      *
      * @return This builder for chaining.
      */
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountKeyRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountKeyRequestOrBuilder.java
index 4ae4f7166b8f..eaa7d14fc0e8 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountKeyRequestOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountKeyRequestOrBuilder.java
@@ -64,11 +64,13 @@ public interface GetServiceAccountKeyRequestOrBuilder
    *
    *
    * <pre>
-   * The output format of the public key requested.
-   * X509_PEM is the default output format.
+   * Optional. The output format of the public key. The default is `TYPE_NONE`, which
+   * means that the public key is not returned.
    * </pre>
    *
-   * <code>.google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2;</code>
+   * <code>
+   * .google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
    *
    * @return The enum numeric value on the wire for publicKeyType.
    */
@@ -77,11 +79,13 @@ public interface GetServiceAccountKeyRequestOrBuilder
    *
    *
    * <pre>
-   * The output format of the public key requested.
-   * X509_PEM is the default output format.
+   * Optional. The output format of the public key. The default is `TYPE_NONE`, which
+   * means that the public key is not returned.
    * </pre>
    *
-   * <code>.google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2;</code>
+   * <code>
+   * .google.iam.admin.v1.ServiceAccountPublicKeyType public_key_type = 2 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
    *
    * @return The publicKeyType.
    */
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountRequest.java
index e561414799b4..c95de9f3c537 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/GetServiceAccountRequest.java
@@ -99,14 +99,14 @@ private GetServiceAccountRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_GetServiceAccountRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_GetServiceAccountRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.GetServiceAccountRequest.class,
@@ -347,14 +347,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.GetServiceAccountRequest)
       com.google.iam.admin.v1.GetServiceAccountRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_GetServiceAccountRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_GetServiceAccountRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.GetServiceAccountRequest.class,
@@ -385,7 +385,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_GetServiceAccountRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/IamProto.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Iam.java
similarity index 65%
rename from java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/IamProto.java
rename to java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Iam.java
index aeb9f0853709..d350c467cf8f 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/IamProto.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Iam.java
@@ -18,8 +18,8 @@
 
 package com.google.iam.admin.v1;
 
-public final class IamProto {
-  private IamProto() {}
+public final class Iam {
+  private Iam() {}
 
   public static void registerAllExtensions(com.google.protobuf.ExtensionRegistryLite registry) {}
 
@@ -99,6 +99,14 @@ public static void registerAllExtensions(com.google.protobuf.ExtensionRegistry r
       internal_static_google_iam_admin_v1_DeleteServiceAccountKeyRequest_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internal_static_google_iam_admin_v1_DeleteServiceAccountKeyRequest_fieldAccessorTable;
+  static final com.google.protobuf.Descriptors.Descriptor
+      internal_static_google_iam_admin_v1_DisableServiceAccountKeyRequest_descriptor;
+  static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internal_static_google_iam_admin_v1_DisableServiceAccountKeyRequest_fieldAccessorTable;
+  static final com.google.protobuf.Descriptors.Descriptor
+      internal_static_google_iam_admin_v1_EnableServiceAccountKeyRequest_descriptor;
+  static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internal_static_google_iam_admin_v1_EnableServiceAccountKeyRequest_fieldAccessorTable;
   static final com.google.protobuf.Descriptors.Descriptor
       internal_static_google_iam_admin_v1_SignBlobRequest_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
@@ -201,14 +209,14 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
   static {
     java.lang.String[] descriptorData = {
       "\n\035google/iam/admin/v1/iam.proto\022\023google."
-          + "iam.admin.v1\032\027google/api/client.proto\032\037g"
-          + "oogle/api/field_behavior.proto\032\031google/a"
-          + "pi/resource.proto\032\036google/iam/v1/iam_pol"
-          + "icy.proto\032\032google/iam/v1/policy.proto\032\033g"
-          + "oogle/protobuf/empty.proto\032 google/proto"
-          + "buf/field_mask.proto\032\037google/protobuf/ti"
-          + "mestamp.proto\032\026google/type/expr.proto\032\034g"
-          + "oogle/api/annotations.proto\"\276\002\n\016ServiceA"
+          + "iam.admin.v1\032\034google/api/annotations.pro"
+          + "to\032\027google/api/client.proto\032\037google/api/"
+          + "field_behavior.proto\032\031google/api/resourc"
+          + "e.proto\032\036google/iam/v1/iam_policy.proto\032"
+          + "\032google/iam/v1/policy.proto\032\033google/prot"
+          + "obuf/empty.proto\032 google/protobuf/field_"
+          + "mask.proto\032\037google/protobuf/timestamp.pr"
+          + "oto\032\026google/type/expr.proto\"\276\002\n\016ServiceA"
           + "ccount\022\014\n\004name\030\001 \001(\t\022\027\n\nproject_id\030\002 \001(\t"
           + "B\003\340A\003\022\026\n\tunique_id\030\004 \001(\tB\003\340A\003\022\022\n\005email\030\005"
           + " \001(\tB\003\340A\003\022\031\n\014display_name\030\006 \001(\tB\003\340A\001\022\020\n\004"
@@ -249,258 +257,272 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "_TYPE_UNSPECIFIED\020\000\022\020\n\014USER_MANAGED\020\001\022\022\n"
           + "\016SYSTEM_MANAGED\020\002\"V\n\036ListServiceAccountK"
           + "eysResponse\0224\n\004keys\030\001 \003(\0132&.google.iam.a"
-          + "dmin.v1.ServiceAccountKey\"\226\001\n\033GetService"
+          + "dmin.v1.ServiceAccountKey\"\233\001\n\033GetService"
           + "AccountKeyRequest\022,\n\004name\030\001 \001(\tB\036\340A\002\372A\030\n"
-          + "\026iam.googleapis.com/Key\022I\n\017public_key_ty"
+          + "\026iam.googleapis.com/Key\022N\n\017public_key_ty"
           + "pe\030\002 \001(\01620.google.iam.admin.v1.ServiceAc"
-          + "countPublicKeyType\"\304\004\n\021ServiceAccountKey"
-          + "\022\014\n\004name\030\001 \001(\t\022K\n\020private_key_type\030\002 \001(\016"
-          + "21.google.iam.admin.v1.ServiceAccountPri"
-          + "vateKeyType\022F\n\rkey_algorithm\030\010 \001(\0162/.goo"
-          + "gle.iam.admin.v1.ServiceAccountKeyAlgori"
-          + "thm\022\030\n\020private_key_data\030\003 \001(\014\022\027\n\017public_"
-          + "key_data\030\007 \001(\014\0224\n\020valid_after_time\030\004 \001(\013"
-          + "2\032.google.protobuf.Timestamp\0225\n\021valid_be"
-          + "fore_time\030\005 \001(\0132\032.google.protobuf.Timest"
-          + "amp\022@\n\nkey_origin\030\t \001(\0162,.google.iam.adm"
-          + "in.v1.ServiceAccountKeyOrigin\022L\n\010key_typ"
-          + "e\030\n \001(\0162:.google.iam.admin.v1.ListServic"
-          + "eAccountKeysRequest.KeyType:\\\352AY\n\026iam.go"
-          + "ogleapis.com/Key\022?projects/{project}/ser"
-          + "viceAccounts/{service_account}/keys/{key"
-          + "}\"\356\001\n\036CreateServiceAccountKeyRequest\0227\n\004"
-          + "name\030\001 \001(\tB)\340A\002\372A#\n!iam.googleapis.com/S"
-          + "erviceAccount\022K\n\020private_key_type\030\002 \001(\0162"
-          + "1.google.iam.admin.v1.ServiceAccountPriv"
-          + "ateKeyType\022F\n\rkey_algorithm\030\003 \001(\0162/.goog"
-          + "le.iam.admin.v1.ServiceAccountKeyAlgorit"
-          + "hm\"G\n\036UploadServiceAccountKeyRequest\022\014\n\004"
-          + "name\030\001 \001(\t\022\027\n\017public_key_data\030\002 \001(\014\"N\n\036D"
-          + "eleteServiceAccountKeyRequest\022,\n\004name\030\001 "
-          + "\001(\tB\036\340A\002\372A\030\n\026iam.googleapis.com/Key\"j\n\017S"
-          + "ignBlobRequest\0229\n\004name\030\001 \001(\tB+\030\001\340A\002\372A#\n!"
-          + "iam.googleapis.com/ServiceAccount\022\034\n\rbyt"
-          + "es_to_sign\030\002 \001(\014B\005\030\001\340A\002\"=\n\020SignBlobRespo"
-          + "nse\022\022\n\006key_id\030\001 \001(\tB\002\030\001\022\025\n\tsignature\030\002 \001"
-          + "(\014B\002\030\001\"c\n\016SignJwtRequest\0229\n\004name\030\001 \001(\tB+"
-          + "\030\001\340A\002\372A#\n!iam.googleapis.com/ServiceAcco"
-          + "unt\022\026\n\007payload\030\002 \001(\tB\005\030\001\340A\002\"=\n\017SignJwtRe"
-          + "sponse\022\022\n\006key_id\030\001 \001(\tB\002\030\001\022\026\n\nsigned_jwt"
-          + "\030\002 \001(\tB\002\030\001\"\206\002\n\004Role\022\014\n\004name\030\001 \001(\t\022\r\n\005tit"
-          + "le\030\002 \001(\t\022\023\n\013description\030\003 \001(\t\022\034\n\024include"
-          + "d_permissions\030\007 \003(\t\0228\n\005stage\030\010 \001(\0162).goo"
-          + "gle.iam.admin.v1.Role.RoleLaunchStage\022\014\n"
-          + "\004etag\030\t \001(\014\022\017\n\007deleted\030\013 \001(\010\"U\n\017RoleLaun"
-          + "chStage\022\t\n\005ALPHA\020\000\022\010\n\004BETA\020\001\022\006\n\002GA\020\002\022\016\n\n"
-          + "DEPRECATED\020\004\022\014\n\010DISABLED\020\005\022\007\n\003EAP\020\006\"\221\001\n\032"
-          + "QueryGrantableRolesRequest\022\037\n\022full_resou"
-          + "rce_name\030\001 \001(\tB\003\340A\002\022+\n\004view\030\002 \001(\0162\035.goog"
-          + "le.iam.admin.v1.RoleView\022\021\n\tpage_size\030\003 "
-          + "\001(\005\022\022\n\npage_token\030\004 \001(\t\"`\n\033QueryGrantabl"
-          + "eRolesResponse\022(\n\005roles\030\001 \003(\0132\031.google.i"
-          + "am.admin.v1.Role\022\027\n\017next_page_token\030\002 \001("
-          + "\t\"\224\001\n\020ListRolesRequest\022\026\n\006parent\030\001 \001(\tB\006"
-          + "\372A\003\n\001*\022\021\n\tpage_size\030\002 \001(\005\022\022\n\npage_token\030"
-          + "\003 \001(\t\022+\n\004view\030\004 \001(\0162\035.google.iam.admin.v"
-          + "1.RoleView\022\024\n\014show_deleted\030\006 \001(\010\"V\n\021List"
-          + "RolesResponse\022(\n\005roles\030\001 \003(\0132\031.google.ia"
-          + "m.admin.v1.Role\022\027\n\017next_page_token\030\002 \001(\t"
-          + "\"&\n\016GetRoleRequest\022\024\n\004name\030\001 \001(\tB\006\372A\003\n\001*"
-          + "\"e\n\021CreateRoleRequest\022\026\n\006parent\030\001 \001(\tB\006\372"
-          + "A\003\n\001*\022\017\n\007role_id\030\002 \001(\t\022\'\n\004role\030\003 \001(\0132\031.g"
-          + "oogle.iam.admin.v1.Role\"\203\001\n\021UpdateRoleRe"
-          + "quest\022\024\n\004name\030\001 \001(\tB\006\372A\003\n\001*\022\'\n\004role\030\002 \001("
-          + "\0132\031.google.iam.admin.v1.Role\022/\n\013update_m"
-          + "ask\030\003 \001(\0132\032.google.protobuf.FieldMask\"7\n"
-          + "\021DeleteRoleRequest\022\024\n\004name\030\001 \001(\tB\006\372A\003\n\001*"
-          + "\022\014\n\004etag\030\002 \001(\014\"9\n\023UndeleteRoleRequest\022\024\n"
-          + "\004name\030\001 \001(\tB\006\372A\003\n\001*\022\014\n\004etag\030\002 \001(\014\"\311\003\n\nPe"
-          + "rmission\022\014\n\004name\030\001 \001(\t\022\r\n\005title\030\002 \001(\t\022\023\n"
-          + "\013description\030\003 \001(\t\022$\n\030only_in_predefined"
-          + "_roles\030\004 \001(\010B\002\030\001\022D\n\005stage\030\005 \001(\01625.google"
-          + ".iam.admin.v1.Permission.PermissionLaunc"
-          + "hStage\022[\n\032custom_roles_support_level\030\006 \001"
-          + "(\01627.google.iam.admin.v1.Permission.Cust"
-          + "omRolesSupportLevel\022\024\n\014api_disabled\030\007 \001("
-          + "\010\022\032\n\022primary_permission\030\010 \001(\t\"D\n\025Permiss"
-          + "ionLaunchStage\022\t\n\005ALPHA\020\000\022\010\n\004BETA\020\001\022\006\n\002G"
-          + "A\020\002\022\016\n\nDEPRECATED\020\003\"H\n\027CustomRolesSuppor"
-          + "tLevel\022\r\n\tSUPPORTED\020\000\022\013\n\007TESTING\020\001\022\021\n\rNO"
-          + "T_SUPPORTED\020\002\"d\n\037QueryTestablePermission"
-          + "sRequest\022\032\n\022full_resource_name\030\001 \001(\t\022\021\n\t"
-          + "page_size\030\002 \001(\005\022\022\n\npage_token\030\003 \001(\t\"q\n Q"
-          + "ueryTestablePermissionsResponse\0224\n\013permi"
-          + "ssions\030\001 \003(\0132\037.google.iam.admin.v1.Permi"
-          + "ssion\022\027\n\017next_page_token\030\002 \001(\t\";\n\035QueryA"
-          + "uditableServicesRequest\022\032\n\022full_resource"
-          + "_name\030\001 \001(\t\"\232\001\n\036QueryAuditableServicesRe"
-          + "sponse\022V\n\010services\030\001 \003(\0132D.google.iam.ad"
-          + "min.v1.QueryAuditableServicesResponse.Au"
-          + "ditableService\032 \n\020AuditableService\022\014\n\004na"
-          + "me\030\001 \001(\t\"f\n\021LintPolicyRequest\022\032\n\022full_re"
-          + "source_name\030\001 \001(\t\022&\n\tcondition\030\005 \001(\0132\021.g"
-          + "oogle.type.ExprH\000B\r\n\013lint_object\"\363\002\n\nLin"
-          + "tResult\0224\n\005level\030\001 \001(\0162%.google.iam.admi"
-          + "n.v1.LintResult.Level\022\034\n\024validation_unit"
-          + "_name\030\002 \001(\t\022:\n\010severity\030\003 \001(\0162(.google.i"
-          + "am.admin.v1.LintResult.Severity\022\022\n\nfield"
-          + "_name\030\005 \001(\t\022\027\n\017location_offset\030\006 \001(\005\022\025\n\r"
-          + "debug_message\030\007 \001(\t\"-\n\005Level\022\025\n\021LEVEL_UN"
-          + "SPECIFIED\020\000\022\r\n\tCONDITION\020\003\"b\n\010Severity\022\030"
-          + "\n\024SEVERITY_UNSPECIFIED\020\000\022\t\n\005ERROR\020\001\022\013\n\007W"
-          + "ARNING\020\002\022\n\n\006NOTICE\020\003\022\010\n\004INFO\020\004\022\016\n\nDEPREC"
-          + "ATED\020\005\"K\n\022LintPolicyResponse\0225\n\014lint_res"
-          + "ults\030\001 \003(\0132\037.google.iam.admin.v1.LintRes"
-          + "ult*a\n\032ServiceAccountKeyAlgorithm\022\027\n\023KEY"
-          + "_ALG_UNSPECIFIED\020\000\022\024\n\020KEY_ALG_RSA_1024\020\001"
-          + "\022\024\n\020KEY_ALG_RSA_2048\020\002*l\n\034ServiceAccount"
-          + "PrivateKeyType\022\024\n\020TYPE_UNSPECIFIED\020\000\022\024\n\020"
-          + "TYPE_PKCS12_FILE\020\001\022 \n\034TYPE_GOOGLE_CREDEN"
-          + "TIALS_FILE\020\002*]\n\033ServiceAccountPublicKeyT"
-          + "ype\022\r\n\tTYPE_NONE\020\000\022\026\n\022TYPE_X509_PEM_FILE"
-          + "\020\001\022\027\n\023TYPE_RAW_PUBLIC_KEY\020\002*Y\n\027ServiceAc"
-          + "countKeyOrigin\022\026\n\022ORIGIN_UNSPECIFIED\020\000\022\021"
-          + "\n\rUSER_PROVIDED\020\001\022\023\n\017GOOGLE_PROVIDED\020\002*\037"
-          + "\n\010RoleView\022\t\n\005BASIC\020\000\022\010\n\004FULL\020\0012\263(\n\003IAM\022"
-          + "\256\001\n\023ListServiceAccounts\022/.google.iam.adm"
-          + "in.v1.ListServiceAccountsRequest\0320.googl"
-          + "e.iam.admin.v1.ListServiceAccountsRespon"
-          + "se\"4\202\323\344\223\002\'\022%/v1/{name=projects/*}/servic"
-          + "eAccounts\332A\004name\022\237\001\n\021GetServiceAccount\022-"
-          + ".google.iam.admin.v1.GetServiceAccountRe"
-          + "quest\032#.google.iam.admin.v1.ServiceAccou"
-          + "nt\"6\202\323\344\223\002)\022\'/v1/{name=projects/*/service"
-          + "Accounts/*}\332A\004name\022\301\001\n\024CreateServiceAcco"
-          + "unt\0220.google.iam.admin.v1.CreateServiceA"
-          + "ccountRequest\032#.google.iam.admin.v1.Serv"
-          + "iceAccount\"R\202\323\344\223\002*\"%/v1/{name=projects/*"
-          + "}/serviceAccounts:\001*\332A\037name,account_id,s"
-          + "ervice_account\022\224\001\n\024UpdateServiceAccount\022"
-          + "#.google.iam.admin.v1.ServiceAccount\032#.g"
-          + "oogle.iam.admin.v1.ServiceAccount\"2\202\323\344\223\002"
-          + ",\032\'/v1/{name=projects/*/serviceAccounts/"
-          + "*}:\001*\022\257\001\n\023PatchServiceAccount\022/.google.i"
-          + "am.admin.v1.PatchServiceAccountRequest\032#"
-          + ".google.iam.admin.v1.ServiceAccount\"B\202\323\344"
-          + "\223\002<27/v1/{service_account.name=projects/"
-          + "*/serviceAccounts/*}:\001*\022\230\001\n\024DeleteServic"
-          + "eAccount\0220.google.iam.admin.v1.DeleteSer"
-          + "viceAccountRequest\032\026.google.protobuf.Emp"
-          + "ty\"6\202\323\344\223\002)*\'/v1/{name=projects/*/service"
-          + "Accounts/*}\332A\004name\022\276\001\n\026UndeleteServiceAc"
-          + "count\0222.google.iam.admin.v1.UndeleteServ"
-          + "iceAccountRequest\0323.google.iam.admin.v1."
-          + "UndeleteServiceAccountResponse\";\202\323\344\223\0025\"0"
-          + "/v1/{name=projects/*/serviceAccounts/*}:"
-          + "undelete:\001*\022\233\001\n\024EnableServiceAccount\0220.g"
-          + "oogle.iam.admin.v1.EnableServiceAccountR"
-          + "equest\032\026.google.protobuf.Empty\"9\202\323\344\223\0023\"."
-          + "/v1/{name=projects/*/serviceAccounts/*}:"
-          + "enable:\001*\022\236\001\n\025DisableServiceAccount\0221.go"
-          + "ogle.iam.admin.v1.DisableServiceAccountR"
-          + "equest\032\026.google.protobuf.Empty\":\202\323\344\223\0024\"/"
-          + "/v1/{name=projects/*/serviceAccounts/*}:"
-          + "disable:\001*\022\310\001\n\026ListServiceAccountKeys\0222."
-          + "google.iam.admin.v1.ListServiceAccountKe"
-          + "ysRequest\0323.google.iam.admin.v1.ListServ"
-          + "iceAccountKeysResponse\"E\202\323\344\223\002.\022,/v1/{nam"
-          + "e=projects/*/serviceAccounts/*}/keys\332A\016n"
-          + "ame,key_types\022\277\001\n\024GetServiceAccountKey\0220"
-          + ".google.iam.admin.v1.GetServiceAccountKe"
+          + "countPublicKeyTypeB\003\340A\001\"\326\004\n\021ServiceAccou"
+          + "ntKey\022\014\n\004name\030\001 \001(\t\022K\n\020private_key_type\030"
+          + "\002 \001(\01621.google.iam.admin.v1.ServiceAccou"
+          + "ntPrivateKeyType\022F\n\rkey_algorithm\030\010 \001(\0162"
+          + "/.google.iam.admin.v1.ServiceAccountKeyA"
+          + "lgorithm\022\030\n\020private_key_data\030\003 \001(\014\022\027\n\017pu"
+          + "blic_key_data\030\007 \001(\014\0224\n\020valid_after_time\030"
+          + "\004 \001(\0132\032.google.protobuf.Timestamp\0225\n\021val"
+          + "id_before_time\030\005 \001(\0132\032.google.protobuf.T"
+          + "imestamp\022@\n\nkey_origin\030\t \001(\0162,.google.ia"
+          + "m.admin.v1.ServiceAccountKeyOrigin\022L\n\010ke"
+          + "y_type\030\n \001(\0162:.google.iam.admin.v1.ListS"
+          + "erviceAccountKeysRequest.KeyType\022\020\n\010disa"
+          + "bled\030\013 \001(\010:\\\352AY\n\026iam.googleapis.com/Key\022"
+          + "?projects/{project}/serviceAccounts/{ser"
+          + "vice_account}/keys/{key}\"\356\001\n\036CreateServi"
+          + "ceAccountKeyRequest\0227\n\004name\030\001 \001(\tB)\340A\002\372A"
+          + "#\n!iam.googleapis.com/ServiceAccount\022K\n\020"
+          + "private_key_type\030\002 \001(\01621.google.iam.admi"
+          + "n.v1.ServiceAccountPrivateKeyType\022F\n\rkey"
+          + "_algorithm\030\003 \001(\0162/.google.iam.admin.v1.S"
+          + "erviceAccountKeyAlgorithm\"G\n\036UploadServi"
+          + "ceAccountKeyRequest\022\014\n\004name\030\001 \001(\t\022\027\n\017pub"
+          + "lic_key_data\030\002 \001(\014\"N\n\036DeleteServiceAccou"
+          + "ntKeyRequest\022,\n\004name\030\001 \001(\tB\036\340A\002\372A\030\n\026iam."
+          + "googleapis.com/Key\"O\n\037DisableServiceAcco"
+          + "untKeyRequest\022,\n\004name\030\001 \001(\tB\036\340A\002\372A\030\n\026iam"
+          + ".googleapis.com/Key\"N\n\036EnableServiceAcco"
+          + "untKeyRequest\022,\n\004name\030\001 \001(\tB\036\340A\002\372A\030\n\026iam"
+          + ".googleapis.com/Key\"j\n\017SignBlobRequest\0229"
+          + "\n\004name\030\001 \001(\tB+\030\001\340A\002\372A#\n!iam.googleapis.c"
+          + "om/ServiceAccount\022\034\n\rbytes_to_sign\030\002 \001(\014"
+          + "B\005\030\001\340A\002\"=\n\020SignBlobResponse\022\022\n\006key_id\030\001 "
+          + "\001(\tB\002\030\001\022\025\n\tsignature\030\002 \001(\014B\002\030\001\"c\n\016SignJw"
+          + "tRequest\0229\n\004name\030\001 \001(\tB+\030\001\340A\002\372A#\n!iam.go"
+          + "ogleapis.com/ServiceAccount\022\026\n\007payload\030\002"
+          + " \001(\tB\005\030\001\340A\002\"=\n\017SignJwtResponse\022\022\n\006key_id"
+          + "\030\001 \001(\tB\002\030\001\022\026\n\nsigned_jwt\030\002 \001(\tB\002\030\001\"\206\002\n\004R"
+          + "ole\022\014\n\004name\030\001 \001(\t\022\r\n\005title\030\002 \001(\t\022\023\n\013desc"
+          + "ription\030\003 \001(\t\022\034\n\024included_permissions\030\007 "
+          + "\003(\t\0228\n\005stage\030\010 \001(\0162).google.iam.admin.v1"
+          + ".Role.RoleLaunchStage\022\014\n\004etag\030\t \001(\014\022\017\n\007d"
+          + "eleted\030\013 \001(\010\"U\n\017RoleLaunchStage\022\t\n\005ALPHA"
+          + "\020\000\022\010\n\004BETA\020\001\022\006\n\002GA\020\002\022\016\n\nDEPRECATED\020\004\022\014\n\010"
+          + "DISABLED\020\005\022\007\n\003EAP\020\006\"\221\001\n\032QueryGrantableRo"
+          + "lesRequest\022\037\n\022full_resource_name\030\001 \001(\tB\003"
+          + "\340A\002\022+\n\004view\030\002 \001(\0162\035.google.iam.admin.v1."
+          + "RoleView\022\021\n\tpage_size\030\003 \001(\005\022\022\n\npage_toke"
+          + "n\030\004 \001(\t\"`\n\033QueryGrantableRolesResponse\022("
+          + "\n\005roles\030\001 \003(\0132\031.google.iam.admin.v1.Role"
+          + "\022\027\n\017next_page_token\030\002 \001(\t\"\224\001\n\020ListRolesR"
+          + "equest\022\026\n\006parent\030\001 \001(\tB\006\372A\003\n\001*\022\021\n\tpage_s"
+          + "ize\030\002 \001(\005\022\022\n\npage_token\030\003 \001(\t\022+\n\004view\030\004 "
+          + "\001(\0162\035.google.iam.admin.v1.RoleView\022\024\n\014sh"
+          + "ow_deleted\030\006 \001(\010\"V\n\021ListRolesResponse\022(\n"
+          + "\005roles\030\001 \003(\0132\031.google.iam.admin.v1.Role\022"
+          + "\027\n\017next_page_token\030\002 \001(\t\"&\n\016GetRoleReque"
+          + "st\022\024\n\004name\030\001 \001(\tB\006\372A\003\n\001*\"e\n\021CreateRoleRe"
+          + "quest\022\026\n\006parent\030\001 \001(\tB\006\372A\003\n\001*\022\017\n\007role_id"
+          + "\030\002 \001(\t\022\'\n\004role\030\003 \001(\0132\031.google.iam.admin."
+          + "v1.Role\"\203\001\n\021UpdateRoleRequest\022\024\n\004name\030\001 "
+          + "\001(\tB\006\372A\003\n\001*\022\'\n\004role\030\002 \001(\0132\031.google.iam.a"
+          + "dmin.v1.Role\022/\n\013update_mask\030\003 \001(\0132\032.goog"
+          + "le.protobuf.FieldMask\"7\n\021DeleteRoleReque"
+          + "st\022\024\n\004name\030\001 \001(\tB\006\372A\003\n\001*\022\014\n\004etag\030\002 \001(\014\"9"
+          + "\n\023UndeleteRoleRequest\022\024\n\004name\030\001 \001(\tB\006\372A\003"
+          + "\n\001*\022\014\n\004etag\030\002 \001(\014\"\311\003\n\nPermission\022\014\n\004name"
+          + "\030\001 \001(\t\022\r\n\005title\030\002 \001(\t\022\023\n\013description\030\003 \001"
+          + "(\t\022$\n\030only_in_predefined_roles\030\004 \001(\010B\002\030\001"
+          + "\022D\n\005stage\030\005 \001(\01625.google.iam.admin.v1.Pe"
+          + "rmission.PermissionLaunchStage\022[\n\032custom"
+          + "_roles_support_level\030\006 \001(\01627.google.iam."
+          + "admin.v1.Permission.CustomRolesSupportLe"
+          + "vel\022\024\n\014api_disabled\030\007 \001(\010\022\032\n\022primary_per"
+          + "mission\030\010 \001(\t\"D\n\025PermissionLaunchStage\022\t"
+          + "\n\005ALPHA\020\000\022\010\n\004BETA\020\001\022\006\n\002GA\020\002\022\016\n\nDEPRECATE"
+          + "D\020\003\"H\n\027CustomRolesSupportLevel\022\r\n\tSUPPOR"
+          + "TED\020\000\022\013\n\007TESTING\020\001\022\021\n\rNOT_SUPPORTED\020\002\"d\n"
+          + "\037QueryTestablePermissionsRequest\022\032\n\022full"
+          + "_resource_name\030\001 \001(\t\022\021\n\tpage_size\030\002 \001(\005\022"
+          + "\022\n\npage_token\030\003 \001(\t\"q\n QueryTestablePerm"
+          + "issionsResponse\0224\n\013permissions\030\001 \003(\0132\037.g"
+          + "oogle.iam.admin.v1.Permission\022\027\n\017next_pa"
+          + "ge_token\030\002 \001(\t\";\n\035QueryAuditableServices"
+          + "Request\022\032\n\022full_resource_name\030\001 \001(\t\"\232\001\n\036"
+          + "QueryAuditableServicesResponse\022V\n\010servic"
+          + "es\030\001 \003(\0132D.google.iam.admin.v1.QueryAudi"
+          + "tableServicesResponse.AuditableService\032 "
+          + "\n\020AuditableService\022\014\n\004name\030\001 \001(\t\"f\n\021Lint"
+          + "PolicyRequest\022\032\n\022full_resource_name\030\001 \001("
+          + "\t\022&\n\tcondition\030\005 \001(\0132\021.google.type.ExprH"
+          + "\000B\r\n\013lint_object\"\363\002\n\nLintResult\0224\n\005level"
+          + "\030\001 \001(\0162%.google.iam.admin.v1.LintResult."
+          + "Level\022\034\n\024validation_unit_name\030\002 \001(\t\022:\n\010s"
+          + "everity\030\003 \001(\0162(.google.iam.admin.v1.Lint"
+          + "Result.Severity\022\022\n\nfield_name\030\005 \001(\t\022\027\n\017l"
+          + "ocation_offset\030\006 \001(\005\022\025\n\rdebug_message\030\007 "
+          + "\001(\t\"-\n\005Level\022\025\n\021LEVEL_UNSPECIFIED\020\000\022\r\n\tC"
+          + "ONDITION\020\003\"b\n\010Severity\022\030\n\024SEVERITY_UNSPE"
+          + "CIFIED\020\000\022\t\n\005ERROR\020\001\022\013\n\007WARNING\020\002\022\n\n\006NOTI"
+          + "CE\020\003\022\010\n\004INFO\020\004\022\016\n\nDEPRECATED\020\005\"K\n\022LintPo"
+          + "licyResponse\0225\n\014lint_results\030\001 \003(\0132\037.goo"
+          + "gle.iam.admin.v1.LintResult*a\n\032ServiceAc"
+          + "countKeyAlgorithm\022\027\n\023KEY_ALG_UNSPECIFIED"
+          + "\020\000\022\024\n\020KEY_ALG_RSA_1024\020\001\022\024\n\020KEY_ALG_RSA_"
+          + "2048\020\002*l\n\034ServiceAccountPrivateKeyType\022\024"
+          + "\n\020TYPE_UNSPECIFIED\020\000\022\024\n\020TYPE_PKCS12_FILE"
+          + "\020\001\022 \n\034TYPE_GOOGLE_CREDENTIALS_FILE\020\002*]\n\033"
+          + "ServiceAccountPublicKeyType\022\r\n\tTYPE_NONE"
+          + "\020\000\022\026\n\022TYPE_X509_PEM_FILE\020\001\022\027\n\023TYPE_RAW_P"
+          + "UBLIC_KEY\020\002*Y\n\027ServiceAccountKeyOrigin\022\026"
+          + "\n\022ORIGIN_UNSPECIFIED\020\000\022\021\n\rUSER_PROVIDED\020"
+          + "\001\022\023\n\017GOOGLE_PROVIDED\020\002*\037\n\010RoleView\022\t\n\005BA"
+          + "SIC\020\000\022\010\n\004FULL\020\0012\232+\n\003IAM\022\256\001\n\023ListServiceA"
+          + "ccounts\022/.google.iam.admin.v1.ListServic"
+          + "eAccountsRequest\0320.google.iam.admin.v1.L"
+          + "istServiceAccountsResponse\"4\202\323\344\223\002\'\022%/v1/"
+          + "{name=projects/*}/serviceAccounts\332A\004name"
+          + "\022\237\001\n\021GetServiceAccount\022-.google.iam.admi"
+          + "n.v1.GetServiceAccountRequest\032#.google.i"
+          + "am.admin.v1.ServiceAccount\"6\202\323\344\223\002)\022\'/v1/"
+          + "{name=projects/*/serviceAccounts/*}\332A\004na"
+          + "me\022\301\001\n\024CreateServiceAccount\0220.google.iam"
+          + ".admin.v1.CreateServiceAccountRequest\032#."
+          + "google.iam.admin.v1.ServiceAccount\"R\202\323\344\223"
+          + "\002*\"%/v1/{name=projects/*}/serviceAccount"
+          + "s:\001*\332A\037name,account_id,service_account\022\224"
+          + "\001\n\024UpdateServiceAccount\022#.google.iam.adm"
+          + "in.v1.ServiceAccount\032#.google.iam.admin."
+          + "v1.ServiceAccount\"2\202\323\344\223\002,\032\'/v1/{name=pro"
+          + "jects/*/serviceAccounts/*}:\001*\022\257\001\n\023PatchS"
+          + "erviceAccount\022/.google.iam.admin.v1.Patc"
+          + "hServiceAccountRequest\032#.google.iam.admi"
+          + "n.v1.ServiceAccount\"B\202\323\344\223\002<27/v1/{servic"
+          + "e_account.name=projects/*/serviceAccount"
+          + "s/*}:\001*\022\230\001\n\024DeleteServiceAccount\0220.googl"
+          + "e.iam.admin.v1.DeleteServiceAccountReque"
+          + "st\032\026.google.protobuf.Empty\"6\202\323\344\223\002)*\'/v1/"
+          + "{name=projects/*/serviceAccounts/*}\332A\004na"
+          + "me\022\276\001\n\026UndeleteServiceAccount\0222.google.i"
+          + "am.admin.v1.UndeleteServiceAccountReques"
+          + "t\0323.google.iam.admin.v1.UndeleteServiceA"
+          + "ccountResponse\";\202\323\344\223\0025\"0/v1/{name=projec"
+          + "ts/*/serviceAccounts/*}:undelete:\001*\022\233\001\n\024"
+          + "EnableServiceAccount\0220.google.iam.admin."
+          + "v1.EnableServiceAccountRequest\032\026.google."
+          + "protobuf.Empty\"9\202\323\344\223\0023\"./v1/{name=projec"
+          + "ts/*/serviceAccounts/*}:enable:\001*\022\236\001\n\025Di"
+          + "sableServiceAccount\0221.google.iam.admin.v"
+          + "1.DisableServiceAccountRequest\032\026.google."
+          + "protobuf.Empty\":\202\323\344\223\0024\"//v1/{name=projec"
+          + "ts/*/serviceAccounts/*}:disable:\001*\022\310\001\n\026L"
+          + "istServiceAccountKeys\0222.google.iam.admin"
+          + ".v1.ListServiceAccountKeysRequest\0323.goog"
+          + "le.iam.admin.v1.ListServiceAccountKeysRe"
+          + "sponse\"E\202\323\344\223\002.\022,/v1/{name=projects/*/ser"
+          + "viceAccounts/*}/keys\332A\016name,key_types\022\277\001"
+          + "\n\024GetServiceAccountKey\0220.google.iam.admi"
+          + "n.v1.GetServiceAccountKeyRequest\032&.googl"
+          + "e.iam.admin.v1.ServiceAccountKey\"M\202\323\344\223\0020"
+          + "\022./v1/{name=projects/*/serviceAccounts/*"
+          + "/keys/*}\332A\024name,public_key_type\022\325\001\n\027Crea"
+          + "teServiceAccountKey\0223.google.iam.admin.v"
+          + "1.CreateServiceAccountKeyRequest\032&.googl"
+          + "e.iam.admin.v1.ServiceAccountKey\"]\202\323\344\223\0021"
+          + "\",/v1/{name=projects/*/serviceAccounts/*"
+          + "}/keys:\001*\332A#name,private_key_type,key_al"
+          + "gorithm\022\266\001\n\027UploadServiceAccountKey\0223.go"
+          + "ogle.iam.admin.v1.UploadServiceAccountKe"
           + "yRequest\032&.google.iam.admin.v1.ServiceAc"
-          + "countKey\"M\202\323\344\223\0020\022./v1/{name=projects/*/s"
-          + "erviceAccounts/*/keys/*}\332A\024name,public_k"
-          + "ey_type\022\325\001\n\027CreateServiceAccountKey\0223.go"
-          + "ogle.iam.admin.v1.CreateServiceAccountKe"
-          + "yRequest\032&.google.iam.admin.v1.ServiceAc"
-          + "countKey\"]\202\323\344\223\0021\",/v1/{name=projects/*/s"
-          + "erviceAccounts/*}/keys:\001*\332A#name,private"
-          + "_key_type,key_algorithm\022\266\001\n\027UploadServic"
-          + "eAccountKey\0223.google.iam.admin.v1.Upload"
-          + "ServiceAccountKeyRequest\032&.google.iam.ad"
-          + "min.v1.ServiceAccountKey\">\202\323\344\223\0028\"3/v1/{n"
-          + "ame=projects/*/serviceAccounts/*}/keys:u"
-          + "pload:\001*\022\245\001\n\027DeleteServiceAccountKey\0223.g"
-          + "oogle.iam.admin.v1.DeleteServiceAccountK"
-          + "eyRequest\032\026.google.protobuf.Empty\"=\202\323\344\223\002"
-          + "0*./v1/{name=projects/*/serviceAccounts/"
-          + "*/keys/*}\332A\004name\022\254\001\n\010SignBlob\022$.google.i"
-          + "am.admin.v1.SignBlobRequest\032%.google.iam"
-          + ".admin.v1.SignBlobResponse\"S\210\002\001\202\323\344\223\0025\"0/"
-          + "v1/{name=projects/*/serviceAccounts/*}:s"
-          + "ignBlob:\001*\332A\022name,bytes_to_sign\022\242\001\n\007Sign"
-          + "Jwt\022#.google.iam.admin.v1.SignJwtRequest"
-          + "\032$.google.iam.admin.v1.SignJwtResponse\"L"
-          + "\210\002\001\202\323\344\223\0024\"//v1/{name=projects/*/serviceA"
-          + "ccounts/*}:signJwt:\001*\332A\014name,payload\022\226\001\n"
-          + "\014GetIamPolicy\022\".google.iam.v1.GetIamPoli"
-          + "cyRequest\032\025.google.iam.v1.Policy\"K\202\323\344\223\002:"
-          + "\"8/v1/{resource=projects/*/serviceAccoun"
-          + "ts/*}:getIamPolicy\332A\010resource\022\240\001\n\014SetIam"
-          + "Policy\022\".google.iam.v1.SetIamPolicyReque"
-          + "st\032\025.google.iam.v1.Policy\"U\202\323\344\223\002=\"8/v1/{"
-          + "resource=projects/*/serviceAccounts/*}:s"
-          + "etIamPolicy:\001*\332A\017resource,policy\022\313\001\n\022Tes"
-          + "tIamPermissions\022(.google.iam.v1.TestIamP"
-          + "ermissionsRequest\032).google.iam.v1.TestIa"
-          + "mPermissionsResponse\"`\202\323\344\223\002C\">/v1/{resou"
-          + "rce=projects/*/serviceAccounts/*}:testIa"
-          + "mPermissions:\001*\332A\024resource,permissions\022\267"
-          + "\001\n\023QueryGrantableRoles\022/.google.iam.admi"
-          + "n.v1.QueryGrantableRolesRequest\0320.google"
-          + ".iam.admin.v1.QueryGrantableRolesRespons"
-          + "e\"=\202\323\344\223\002\"\"\035/v1/roles:queryGrantableRoles"
-          + ":\001*\332A\022full_resource_name\022\264\001\n\tListRoles\022%"
-          + ".google.iam.admin.v1.ListRolesRequest\032&."
-          + "google.iam.admin.v1.ListRolesResponse\"X\202"
-          + "\323\344\223\002R\022\t/v1/rolesZ$\022\"/v1/{parent=organiza"
-          + "tions/*}/rolesZ\037\022\035/v1/{parent=projects/*"
-          + "}/roles\022\254\001\n\007GetRole\022#.google.iam.admin.v"
-          + "1.GetRoleRequest\032\031.google.iam.admin.v1.R"
-          + "ole\"a\202\323\344\223\002[\022\022/v1/{name=roles/*}Z$\022\"/v1/{"
-          + "name=organizations/*/roles/*}Z\037\022\035/v1/{na"
-          + "me=projects/*/roles/*}\022\242\001\n\nCreateRole\022&."
-          + "google.iam.admin.v1.CreateRoleRequest\032\031."
-          + "google.iam.admin.v1.Role\"Q\202\323\344\223\002K\"\"/v1/{p"
-          + "arent=organizations/*}/roles:\001*Z\"\"\035/v1/{"
-          + "parent=projects/*}/roles:\001*\022\250\001\n\nUpdateRo"
-          + "le\022&.google.iam.admin.v1.UpdateRoleReque"
-          + "st\032\031.google.iam.admin.v1.Role\"W\202\323\344\223\002Q2\"/"
-          + "v1/{name=organizations/*/roles/*}:\004roleZ"
-          + "%2\035/v1/{name=projects/*/roles/*}:\004role\022\234"
-          + "\001\n\nDeleteRole\022&.google.iam.admin.v1.Dele"
-          + "teRoleRequest\032\031.google.iam.admin.v1.Role"
-          + "\"K\202\323\344\223\002E*\"/v1/{name=organizations/*/role"
-          + "s/*}Z\037*\035/v1/{name=projects/*/roles/*}\022\270\001"
-          + "\n\014UndeleteRole\022(.google.iam.admin.v1.Und"
-          + "eleteRoleRequest\032\031.google.iam.admin.v1.R"
-          + "ole\"c\202\323\344\223\002]\"+/v1/{name=organizations/*/r"
-          + "oles/*}:undelete:\001*Z+\"&/v1/{name=project"
-          + "s/*/roles/*}:undelete:\001*\022\274\001\n\030QueryTestab"
-          + "lePermissions\0224.google.iam.admin.v1.Quer"
-          + "yTestablePermissionsRequest\0325.google.iam"
-          + ".admin.v1.QueryTestablePermissionsRespon"
-          + "se\"3\202\323\344\223\002-\"(/v1/permissions:queryTestabl"
-          + "ePermissions:\001*\022\264\001\n\026QueryAuditableServic"
-          + "es\0222.google.iam.admin.v1.QueryAuditableS"
-          + "ervicesRequest\0323.google.iam.admin.v1.Que"
-          + "ryAuditableServicesResponse\"1\202\323\344\223\002+\"&/v1"
-          + "/iamPolicies:queryAuditableServices:\001*\022\204"
-          + "\001\n\nLintPolicy\022&.google.iam.admin.v1.Lint"
-          + "PolicyRequest\032\'.google.iam.admin.v1.Lint"
-          + "PolicyResponse\"%\202\323\344\223\002\037\"\032/v1/iamPolicies:"
-          + "lintPolicy:\001*\032F\312A\022iam.googleapis.com\322A.h"
-          + "ttps://www.googleapis.com/auth/cloud-pla"
-          + "tformB\232\001\n\027com.google.iam.admin.v1B\010IamPr"
-          + "otoP\001Z8google.golang.org/genproto/google"
-          + "apis/iam/admin/v1;admin\370\001\001\252\002\031Google.Clou"
-          + "d.Iam.Admin.V1\312\002\031Google\\Cloud\\Iam\\Admin\\"
-          + "V1b\006proto3"
+          + "countKey\">\202\323\344\223\0028\"3/v1/{name=projects/*/s"
+          + "erviceAccounts/*}/keys:upload:\001*\022\245\001\n\027Del"
+          + "eteServiceAccountKey\0223.google.iam.admin."
+          + "v1.DeleteServiceAccountKeyRequest\032\026.goog"
+          + "le.protobuf.Empty\"=\202\323\344\223\0020*./v1/{name=pro"
+          + "jects/*/serviceAccounts/*/keys/*}\332A\004name"
+          + "\022\262\001\n\030DisableServiceAccountKey\0224.google.i"
+          + "am.admin.v1.DisableServiceAccountKeyRequ"
+          + "est\032\026.google.protobuf.Empty\"H\202\323\344\223\002;\"6/v1"
+          + "/{name=projects/*/serviceAccounts/*/keys"
+          + "/*}:disable:\001*\332A\004name\022\257\001\n\027EnableServiceA"
+          + "ccountKey\0223.google.iam.admin.v1.EnableSe"
+          + "rviceAccountKeyRequest\032\026.google.protobuf"
+          + ".Empty\"G\202\323\344\223\002:\"5/v1/{name=projects/*/ser"
+          + "viceAccounts/*/keys/*}:enable:\001*\332A\004name\022"
+          + "\254\001\n\010SignBlob\022$.google.iam.admin.v1.SignB"
+          + "lobRequest\032%.google.iam.admin.v1.SignBlo"
+          + "bResponse\"S\210\002\001\202\323\344\223\0025\"0/v1/{name=projects"
+          + "/*/serviceAccounts/*}:signBlob:\001*\332A\022name"
+          + ",bytes_to_sign\022\242\001\n\007SignJwt\022#.google.iam."
+          + "admin.v1.SignJwtRequest\032$.google.iam.adm"
+          + "in.v1.SignJwtResponse\"L\210\002\001\202\323\344\223\0024\"//v1/{n"
+          + "ame=projects/*/serviceAccounts/*}:signJw"
+          + "t:\001*\332A\014name,payload\022\226\001\n\014GetIamPolicy\022\".g"
+          + "oogle.iam.v1.GetIamPolicyRequest\032\025.googl"
+          + "e.iam.v1.Policy\"K\202\323\344\223\002:\"8/v1/{resource=p"
+          + "rojects/*/serviceAccounts/*}:getIamPolic"
+          + "y\332A\010resource\022\240\001\n\014SetIamPolicy\022\".google.i"
+          + "am.v1.SetIamPolicyRequest\032\025.google.iam.v"
+          + "1.Policy\"U\202\323\344\223\002=\"8/v1/{resource=projects"
+          + "/*/serviceAccounts/*}:setIamPolicy:\001*\332A\017"
+          + "resource,policy\022\313\001\n\022TestIamPermissions\022("
+          + ".google.iam.v1.TestIamPermissionsRequest"
+          + "\032).google.iam.v1.TestIamPermissionsRespo"
+          + "nse\"`\202\323\344\223\002C\">/v1/{resource=projects/*/se"
+          + "rviceAccounts/*}:testIamPermissions:\001*\332A"
+          + "\024resource,permissions\022\267\001\n\023QueryGrantable"
+          + "Roles\022/.google.iam.admin.v1.QueryGrantab"
+          + "leRolesRequest\0320.google.iam.admin.v1.Que"
+          + "ryGrantableRolesResponse\"=\202\323\344\223\002\"\"\035/v1/ro"
+          + "les:queryGrantableRoles:\001*\332A\022full_resour"
+          + "ce_name\022\264\001\n\tListRoles\022%.google.iam.admin"
+          + ".v1.ListRolesRequest\032&.google.iam.admin."
+          + "v1.ListRolesResponse\"X\202\323\344\223\002R\022\t/v1/rolesZ"
+          + "$\022\"/v1/{parent=organizations/*}/rolesZ\037\022"
+          + "\035/v1/{parent=projects/*}/roles\022\254\001\n\007GetRo"
+          + "le\022#.google.iam.admin.v1.GetRoleRequest\032"
+          + "\031.google.iam.admin.v1.Role\"a\202\323\344\223\002[\022\022/v1/"
+          + "{name=roles/*}Z$\022\"/v1/{name=organization"
+          + "s/*/roles/*}Z\037\022\035/v1/{name=projects/*/rol"
+          + "es/*}\022\242\001\n\nCreateRole\022&.google.iam.admin."
+          + "v1.CreateRoleRequest\032\031.google.iam.admin."
+          + "v1.Role\"Q\202\323\344\223\002K\"\"/v1/{parent=organizatio"
+          + "ns/*}/roles:\001*Z\"\"\035/v1/{parent=projects/*"
+          + "}/roles:\001*\022\250\001\n\nUpdateRole\022&.google.iam.a"
+          + "dmin.v1.UpdateRoleRequest\032\031.google.iam.a"
+          + "dmin.v1.Role\"W\202\323\344\223\002Q2\"/v1/{name=organiza"
+          + "tions/*/roles/*}:\004roleZ%2\035/v1/{name=proj"
+          + "ects/*/roles/*}:\004role\022\234\001\n\nDeleteRole\022&.g"
+          + "oogle.iam.admin.v1.DeleteRoleRequest\032\031.g"
+          + "oogle.iam.admin.v1.Role\"K\202\323\344\223\002E*\"/v1/{na"
+          + "me=organizations/*/roles/*}Z\037*\035/v1/{name"
+          + "=projects/*/roles/*}\022\270\001\n\014UndeleteRole\022(."
+          + "google.iam.admin.v1.UndeleteRoleRequest\032"
+          + "\031.google.iam.admin.v1.Role\"c\202\323\344\223\002]\"+/v1/"
+          + "{name=organizations/*/roles/*}:undelete:"
+          + "\001*Z+\"&/v1/{name=projects/*/roles/*}:unde"
+          + "lete:\001*\022\274\001\n\030QueryTestablePermissions\0224.g"
+          + "oogle.iam.admin.v1.QueryTestablePermissi"
+          + "onsRequest\0325.google.iam.admin.v1.QueryTe"
+          + "stablePermissionsResponse\"3\202\323\344\223\002-\"(/v1/p"
+          + "ermissions:queryTestablePermissions:\001*\022\264"
+          + "\001\n\026QueryAuditableServices\0222.google.iam.a"
+          + "dmin.v1.QueryAuditableServicesRequest\0323."
+          + "google.iam.admin.v1.QueryAuditableServic"
+          + "esResponse\"1\202\323\344\223\002+\"&/v1/iamPolicies:quer"
+          + "yAuditableServices:\001*\022\204\001\n\nLintPolicy\022&.g"
+          + "oogle.iam.admin.v1.LintPolicyRequest\032\'.g"
+          + "oogle.iam.admin.v1.LintPolicyResponse\"%\202"
+          + "\323\344\223\002\037\"\032/v1/iamPolicies:lintPolicy:\001*\032F\312A"
+          + "\022iam.googleapis.com\322A.https://www.google"
+          + "apis.com/auth/cloud-platformB\220\001\n\027com.goo"
+          + "gle.iam.admin.v1P\001Z8google.golang.org/ge"
+          + "nproto/googleapis/iam/admin/v1;admin\370\001\001\252"
+          + "\002\031Google.Cloud.Iam.Admin.V1\312\002\031Google\\Clo"
+          + "ud\\Iam\\Admin\\V1b\006proto3"
     };
     descriptor =
         com.google.protobuf.Descriptors.FileDescriptor.internalBuildGeneratedFileFrom(
             descriptorData,
             new com.google.protobuf.Descriptors.FileDescriptor[] {
+              com.google.api.AnnotationsProto.getDescriptor(),
               com.google.api.ClientProto.getDescriptor(),
               com.google.api.FieldBehaviorProto.getDescriptor(),
               com.google.api.ResourceProto.getDescriptor(),
@@ -510,7 +532,6 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               com.google.protobuf.FieldMaskProto.getDescriptor(),
               com.google.protobuf.TimestampProto.getDescriptor(),
               com.google.type.ExprProto.getDescriptor(),
-              com.google.api.AnnotationsProto.getDescriptor(),
             });
     internal_static_google_iam_admin_v1_ServiceAccount_descriptor =
         getDescriptor().getMessageTypes().get(0);
@@ -647,6 +668,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "ValidBeforeTime",
               "KeyOrigin",
               "KeyType",
+              "Disabled",
             });
     internal_static_google_iam_admin_v1_CreateServiceAccountKeyRequest_descriptor =
         getDescriptor().getMessageTypes().get(15);
@@ -672,8 +694,24 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
             new java.lang.String[] {
               "Name",
             });
-    internal_static_google_iam_admin_v1_SignBlobRequest_descriptor =
+    internal_static_google_iam_admin_v1_DisableServiceAccountKeyRequest_descriptor =
         getDescriptor().getMessageTypes().get(18);
+    internal_static_google_iam_admin_v1_DisableServiceAccountKeyRequest_fieldAccessorTable =
+        new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
+            internal_static_google_iam_admin_v1_DisableServiceAccountKeyRequest_descriptor,
+            new java.lang.String[] {
+              "Name",
+            });
+    internal_static_google_iam_admin_v1_EnableServiceAccountKeyRequest_descriptor =
+        getDescriptor().getMessageTypes().get(19);
+    internal_static_google_iam_admin_v1_EnableServiceAccountKeyRequest_fieldAccessorTable =
+        new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
+            internal_static_google_iam_admin_v1_EnableServiceAccountKeyRequest_descriptor,
+            new java.lang.String[] {
+              "Name",
+            });
+    internal_static_google_iam_admin_v1_SignBlobRequest_descriptor =
+        getDescriptor().getMessageTypes().get(20);
     internal_static_google_iam_admin_v1_SignBlobRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_SignBlobRequest_descriptor,
@@ -681,7 +719,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Name", "BytesToSign",
             });
     internal_static_google_iam_admin_v1_SignBlobResponse_descriptor =
-        getDescriptor().getMessageTypes().get(19);
+        getDescriptor().getMessageTypes().get(21);
     internal_static_google_iam_admin_v1_SignBlobResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_SignBlobResponse_descriptor,
@@ -689,7 +727,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "KeyId", "Signature",
             });
     internal_static_google_iam_admin_v1_SignJwtRequest_descriptor =
-        getDescriptor().getMessageTypes().get(20);
+        getDescriptor().getMessageTypes().get(22);
     internal_static_google_iam_admin_v1_SignJwtRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_SignJwtRequest_descriptor,
@@ -697,14 +735,14 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Name", "Payload",
             });
     internal_static_google_iam_admin_v1_SignJwtResponse_descriptor =
-        getDescriptor().getMessageTypes().get(21);
+        getDescriptor().getMessageTypes().get(23);
     internal_static_google_iam_admin_v1_SignJwtResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_SignJwtResponse_descriptor,
             new java.lang.String[] {
               "KeyId", "SignedJwt",
             });
-    internal_static_google_iam_admin_v1_Role_descriptor = getDescriptor().getMessageTypes().get(22);
+    internal_static_google_iam_admin_v1_Role_descriptor = getDescriptor().getMessageTypes().get(24);
     internal_static_google_iam_admin_v1_Role_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_Role_descriptor,
@@ -712,7 +750,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Name", "Title", "Description", "IncludedPermissions", "Stage", "Etag", "Deleted",
             });
     internal_static_google_iam_admin_v1_QueryGrantableRolesRequest_descriptor =
-        getDescriptor().getMessageTypes().get(23);
+        getDescriptor().getMessageTypes().get(25);
     internal_static_google_iam_admin_v1_QueryGrantableRolesRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_QueryGrantableRolesRequest_descriptor,
@@ -720,7 +758,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "FullResourceName", "View", "PageSize", "PageToken",
             });
     internal_static_google_iam_admin_v1_QueryGrantableRolesResponse_descriptor =
-        getDescriptor().getMessageTypes().get(24);
+        getDescriptor().getMessageTypes().get(26);
     internal_static_google_iam_admin_v1_QueryGrantableRolesResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_QueryGrantableRolesResponse_descriptor,
@@ -728,7 +766,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Roles", "NextPageToken",
             });
     internal_static_google_iam_admin_v1_ListRolesRequest_descriptor =
-        getDescriptor().getMessageTypes().get(25);
+        getDescriptor().getMessageTypes().get(27);
     internal_static_google_iam_admin_v1_ListRolesRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_ListRolesRequest_descriptor,
@@ -736,7 +774,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Parent", "PageSize", "PageToken", "View", "ShowDeleted",
             });
     internal_static_google_iam_admin_v1_ListRolesResponse_descriptor =
-        getDescriptor().getMessageTypes().get(26);
+        getDescriptor().getMessageTypes().get(28);
     internal_static_google_iam_admin_v1_ListRolesResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_ListRolesResponse_descriptor,
@@ -744,7 +782,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Roles", "NextPageToken",
             });
     internal_static_google_iam_admin_v1_GetRoleRequest_descriptor =
-        getDescriptor().getMessageTypes().get(27);
+        getDescriptor().getMessageTypes().get(29);
     internal_static_google_iam_admin_v1_GetRoleRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_GetRoleRequest_descriptor,
@@ -752,7 +790,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Name",
             });
     internal_static_google_iam_admin_v1_CreateRoleRequest_descriptor =
-        getDescriptor().getMessageTypes().get(28);
+        getDescriptor().getMessageTypes().get(30);
     internal_static_google_iam_admin_v1_CreateRoleRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_CreateRoleRequest_descriptor,
@@ -760,7 +798,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Parent", "RoleId", "Role",
             });
     internal_static_google_iam_admin_v1_UpdateRoleRequest_descriptor =
-        getDescriptor().getMessageTypes().get(29);
+        getDescriptor().getMessageTypes().get(31);
     internal_static_google_iam_admin_v1_UpdateRoleRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_UpdateRoleRequest_descriptor,
@@ -768,7 +806,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Name", "Role", "UpdateMask",
             });
     internal_static_google_iam_admin_v1_DeleteRoleRequest_descriptor =
-        getDescriptor().getMessageTypes().get(30);
+        getDescriptor().getMessageTypes().get(32);
     internal_static_google_iam_admin_v1_DeleteRoleRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_DeleteRoleRequest_descriptor,
@@ -776,7 +814,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Name", "Etag",
             });
     internal_static_google_iam_admin_v1_UndeleteRoleRequest_descriptor =
-        getDescriptor().getMessageTypes().get(31);
+        getDescriptor().getMessageTypes().get(33);
     internal_static_google_iam_admin_v1_UndeleteRoleRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_UndeleteRoleRequest_descriptor,
@@ -784,7 +822,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Name", "Etag",
             });
     internal_static_google_iam_admin_v1_Permission_descriptor =
-        getDescriptor().getMessageTypes().get(32);
+        getDescriptor().getMessageTypes().get(34);
     internal_static_google_iam_admin_v1_Permission_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_Permission_descriptor,
@@ -799,7 +837,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "PrimaryPermission",
             });
     internal_static_google_iam_admin_v1_QueryTestablePermissionsRequest_descriptor =
-        getDescriptor().getMessageTypes().get(33);
+        getDescriptor().getMessageTypes().get(35);
     internal_static_google_iam_admin_v1_QueryTestablePermissionsRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_QueryTestablePermissionsRequest_descriptor,
@@ -807,7 +845,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "FullResourceName", "PageSize", "PageToken",
             });
     internal_static_google_iam_admin_v1_QueryTestablePermissionsResponse_descriptor =
-        getDescriptor().getMessageTypes().get(34);
+        getDescriptor().getMessageTypes().get(36);
     internal_static_google_iam_admin_v1_QueryTestablePermissionsResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_QueryTestablePermissionsResponse_descriptor,
@@ -815,7 +853,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Permissions", "NextPageToken",
             });
     internal_static_google_iam_admin_v1_QueryAuditableServicesRequest_descriptor =
-        getDescriptor().getMessageTypes().get(35);
+        getDescriptor().getMessageTypes().get(37);
     internal_static_google_iam_admin_v1_QueryAuditableServicesRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_QueryAuditableServicesRequest_descriptor,
@@ -823,7 +861,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "FullResourceName",
             });
     internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_descriptor =
-        getDescriptor().getMessageTypes().get(36);
+        getDescriptor().getMessageTypes().get(38);
     internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_descriptor,
@@ -841,7 +879,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Name",
             });
     internal_static_google_iam_admin_v1_LintPolicyRequest_descriptor =
-        getDescriptor().getMessageTypes().get(37);
+        getDescriptor().getMessageTypes().get(39);
     internal_static_google_iam_admin_v1_LintPolicyRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_LintPolicyRequest_descriptor,
@@ -849,7 +887,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "FullResourceName", "Condition", "LintObject",
             });
     internal_static_google_iam_admin_v1_LintResult_descriptor =
-        getDescriptor().getMessageTypes().get(38);
+        getDescriptor().getMessageTypes().get(40);
     internal_static_google_iam_admin_v1_LintResult_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_LintResult_descriptor,
@@ -862,7 +900,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "DebugMessage",
             });
     internal_static_google_iam_admin_v1_LintPolicyResponse_descriptor =
-        getDescriptor().getMessageTypes().get(39);
+        getDescriptor().getMessageTypes().get(41);
     internal_static_google_iam_admin_v1_LintPolicyResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_iam_admin_v1_LintPolicyResponse_descriptor,
@@ -880,6 +918,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
     registry.add(com.google.api.ResourceProto.resourceReference);
     com.google.protobuf.Descriptors.FileDescriptor.internalUpdateFileDescriptor(
         descriptor, registry);
+    com.google.api.AnnotationsProto.getDescriptor();
     com.google.api.ClientProto.getDescriptor();
     com.google.api.FieldBehaviorProto.getDescriptor();
     com.google.api.ResourceProto.getDescriptor();
@@ -889,7 +928,6 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
     com.google.protobuf.FieldMaskProto.getDescriptor();
     com.google.protobuf.TimestampProto.getDescriptor();
     com.google.type.ExprProto.getDescriptor();
-    com.google.api.AnnotationsProto.getDescriptor();
   }
 
   // @@protoc_insertion_point(outer_class_scope)
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintPolicyRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintPolicyRequest.java
index 97946240bed1..18ece066e8dd 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintPolicyRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintPolicyRequest.java
@@ -113,14 +113,14 @@ private LintPolicyRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_LintPolicyRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_LintPolicyRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.LintPolicyRequest.class,
@@ -480,14 +480,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.LintPolicyRequest)
       com.google.iam.admin.v1.LintPolicyRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_LintPolicyRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_LintPolicyRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.LintPolicyRequest.class,
@@ -520,7 +520,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_LintPolicyRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintPolicyResponse.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintPolicyResponse.java
index 6d44137fe668..6aeec54c2ac4 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintPolicyResponse.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintPolicyResponse.java
@@ -108,14 +108,14 @@ private LintPolicyResponse(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_LintPolicyResponse_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_LintPolicyResponse_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.LintPolicyResponse.class,
@@ -367,14 +367,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.LintPolicyResponse)
       com.google.iam.admin.v1.LintPolicyResponseOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_LintPolicyResponse_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_LintPolicyResponse_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.LintPolicyResponse.class,
@@ -411,7 +411,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_LintPolicyResponse_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintResult.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintResult.java
index 8373ec18fc71..dd53eed9e6f3 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintResult.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/LintResult.java
@@ -136,14 +136,13 @@ private LintResult(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
-        .internal_static_google_iam_admin_v1_LintResult_descriptor;
+    return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_LintResult_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_LintResult_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.LintResult.class,
@@ -330,7 +329,7 @@ public enum Severity implements com.google.protobuf.ProtocolMessageEnum {
      * won't behave as expected during policy evaluation in `checkPolicy`.
      * This includes the following common scenarios:
      * - Unsatisfiable condition: Expired timestamp in date/time condition.
-     * - Ineffective condition: Condition on a &lt;member, role&gt; pair which is
+     * - Ineffective condition: Condition on a &lt;principal, role&gt; pair which is
      *   granted unconditionally in another binding of the same policy.
      * </pre>
      *
@@ -407,7 +406,7 @@ public enum Severity implements com.google.protobuf.ProtocolMessageEnum {
      * won't behave as expected during policy evaluation in `checkPolicy`.
      * This includes the following common scenarios:
      * - Unsatisfiable condition: Expired timestamp in date/time condition.
-     * - Ineffective condition: Condition on a &lt;member, role&gt; pair which is
+     * - Ineffective condition: Condition on a &lt;principal, role&gt; pair which is
      *   granted unconditionally in another binding of the same policy.
      * </pre>
      *
@@ -1006,14 +1005,13 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.LintResult)
       com.google.iam.admin.v1.LintResultOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
-          .internal_static_google_iam_admin_v1_LintResult_descriptor;
+      return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_LintResult_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_LintResult_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.LintResult.class,
@@ -1054,8 +1052,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
-          .internal_static_google_iam_admin_v1_LintResult_descriptor;
+      return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_LintResult_descriptor;
     }
 
     @java.lang.Override
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesRequest.java
index dab7f15475cc..3d9b34541125 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesRequest.java
@@ -125,14 +125,14 @@ private ListRolesRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListRolesRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListRolesRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.ListRolesRequest.class,
@@ -147,23 +147,26 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * The `parent` parameter's value depends on the target resource for the
    * request, namely
-   * [`roles`](/iam/reference/rest/v1/roles),
-   * [`projects`](/iam/reference/rest/v1/projects.roles), or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `parent` value format is described below:
-   * * [`roles.list()`](/iam/reference/rest/v1/roles/list): An empty string.
+   * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `parent` value format is described below:
+   * * [`roles.list()`](https://cloud.google.com/iam/reference/rest/v1/roles/list): An empty string.
    *   This method doesn't require a resource; it simply returns all
-   *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-   *   Cloud IAM. Example request URL:
-   *   `https://iam.googleapis.com/v1/roles`
-   * * [`projects.roles.list()`](/iam/reference/rest/v1/projects.roles/list):
+   *   [predefined
+   *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+   *   in Cloud IAM. Example request URL: `https://iam.googleapis.com/v1/roles`
+   * * [`projects.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/list):
    *   `projects/{PROJECT_ID}`. This method lists all project-level
-   *   [custom roles](/iam/docs/understanding-custom-roles).
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-   * * [`organizations.roles.list()`](/iam/reference/rest/v1/organizations.roles/list):
+   * * [`organizations.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/list):
    *   `organizations/{ORGANIZATION_ID}`. This method lists all
-   *   organization-level [custom roles](/iam/docs/understanding-custom-roles).
+   *   organization-level [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -192,23 +195,26 @@ public java.lang.String getParent() {
    * <pre>
    * The `parent` parameter's value depends on the target resource for the
    * request, namely
-   * [`roles`](/iam/reference/rest/v1/roles),
-   * [`projects`](/iam/reference/rest/v1/projects.roles), or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `parent` value format is described below:
-   * * [`roles.list()`](/iam/reference/rest/v1/roles/list): An empty string.
+   * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `parent` value format is described below:
+   * * [`roles.list()`](https://cloud.google.com/iam/reference/rest/v1/roles/list): An empty string.
    *   This method doesn't require a resource; it simply returns all
-   *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-   *   Cloud IAM. Example request URL:
-   *   `https://iam.googleapis.com/v1/roles`
-   * * [`projects.roles.list()`](/iam/reference/rest/v1/projects.roles/list):
+   *   [predefined
+   *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+   *   in Cloud IAM. Example request URL: `https://iam.googleapis.com/v1/roles`
+   * * [`projects.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/list):
    *   `projects/{PROJECT_ID}`. This method lists all project-level
-   *   [custom roles](/iam/docs/understanding-custom-roles).
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-   * * [`organizations.roles.list()`](/iam/reference/rest/v1/organizations.roles/list):
+   * * [`organizations.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/list):
    *   `organizations/{ORGANIZATION_ID}`. This method lists all
-   *   organization-level [custom roles](/iam/docs/understanding-custom-roles).
+   *   organization-level [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -567,14 +573,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.ListRolesRequest)
       com.google.iam.admin.v1.ListRolesRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListRolesRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListRolesRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.ListRolesRequest.class,
@@ -613,7 +619,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListRolesRequest_descriptor;
     }
 
@@ -742,23 +748,26 @@ public Builder mergeFrom(
      * <pre>
      * The `parent` parameter's value depends on the target resource for the
      * request, namely
-     * [`roles`](/iam/reference/rest/v1/roles),
-     * [`projects`](/iam/reference/rest/v1/projects.roles), or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `parent` value format is described below:
-     * * [`roles.list()`](/iam/reference/rest/v1/roles/list): An empty string.
+     * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `parent` value format is described below:
+     * * [`roles.list()`](https://cloud.google.com/iam/reference/rest/v1/roles/list): An empty string.
      *   This method doesn't require a resource; it simply returns all
-     *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-     *   Cloud IAM. Example request URL:
-     *   `https://iam.googleapis.com/v1/roles`
-     * * [`projects.roles.list()`](/iam/reference/rest/v1/projects.roles/list):
+     *   [predefined
+     *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+     *   in Cloud IAM. Example request URL: `https://iam.googleapis.com/v1/roles`
+     * * [`projects.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/list):
      *   `projects/{PROJECT_ID}`. This method lists all project-level
-     *   [custom roles](/iam/docs/understanding-custom-roles).
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-     * * [`organizations.roles.list()`](/iam/reference/rest/v1/organizations.roles/list):
+     * * [`organizations.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/list):
      *   `organizations/{ORGANIZATION_ID}`. This method lists all
-     *   organization-level [custom roles](/iam/docs/understanding-custom-roles).
+     *   organization-level [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -786,23 +795,26 @@ public java.lang.String getParent() {
      * <pre>
      * The `parent` parameter's value depends on the target resource for the
      * request, namely
-     * [`roles`](/iam/reference/rest/v1/roles),
-     * [`projects`](/iam/reference/rest/v1/projects.roles), or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `parent` value format is described below:
-     * * [`roles.list()`](/iam/reference/rest/v1/roles/list): An empty string.
+     * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `parent` value format is described below:
+     * * [`roles.list()`](https://cloud.google.com/iam/reference/rest/v1/roles/list): An empty string.
      *   This method doesn't require a resource; it simply returns all
-     *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-     *   Cloud IAM. Example request URL:
-     *   `https://iam.googleapis.com/v1/roles`
-     * * [`projects.roles.list()`](/iam/reference/rest/v1/projects.roles/list):
+     *   [predefined
+     *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+     *   in Cloud IAM. Example request URL: `https://iam.googleapis.com/v1/roles`
+     * * [`projects.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/list):
      *   `projects/{PROJECT_ID}`. This method lists all project-level
-     *   [custom roles](/iam/docs/understanding-custom-roles).
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-     * * [`organizations.roles.list()`](/iam/reference/rest/v1/organizations.roles/list):
+     * * [`organizations.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/list):
      *   `organizations/{ORGANIZATION_ID}`. This method lists all
-     *   organization-level [custom roles](/iam/docs/understanding-custom-roles).
+     *   organization-level [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -830,23 +842,26 @@ public com.google.protobuf.ByteString getParentBytes() {
      * <pre>
      * The `parent` parameter's value depends on the target resource for the
      * request, namely
-     * [`roles`](/iam/reference/rest/v1/roles),
-     * [`projects`](/iam/reference/rest/v1/projects.roles), or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `parent` value format is described below:
-     * * [`roles.list()`](/iam/reference/rest/v1/roles/list): An empty string.
+     * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `parent` value format is described below:
+     * * [`roles.list()`](https://cloud.google.com/iam/reference/rest/v1/roles/list): An empty string.
      *   This method doesn't require a resource; it simply returns all
-     *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-     *   Cloud IAM. Example request URL:
-     *   `https://iam.googleapis.com/v1/roles`
-     * * [`projects.roles.list()`](/iam/reference/rest/v1/projects.roles/list):
+     *   [predefined
+     *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+     *   in Cloud IAM. Example request URL: `https://iam.googleapis.com/v1/roles`
+     * * [`projects.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/list):
      *   `projects/{PROJECT_ID}`. This method lists all project-level
-     *   [custom roles](/iam/docs/understanding-custom-roles).
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-     * * [`organizations.roles.list()`](/iam/reference/rest/v1/organizations.roles/list):
+     * * [`organizations.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/list):
      *   `organizations/{ORGANIZATION_ID}`. This method lists all
-     *   organization-level [custom roles](/iam/docs/understanding-custom-roles).
+     *   organization-level [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -873,23 +888,26 @@ public Builder setParent(java.lang.String value) {
      * <pre>
      * The `parent` parameter's value depends on the target resource for the
      * request, namely
-     * [`roles`](/iam/reference/rest/v1/roles),
-     * [`projects`](/iam/reference/rest/v1/projects.roles), or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `parent` value format is described below:
-     * * [`roles.list()`](/iam/reference/rest/v1/roles/list): An empty string.
+     * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `parent` value format is described below:
+     * * [`roles.list()`](https://cloud.google.com/iam/reference/rest/v1/roles/list): An empty string.
      *   This method doesn't require a resource; it simply returns all
-     *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-     *   Cloud IAM. Example request URL:
-     *   `https://iam.googleapis.com/v1/roles`
-     * * [`projects.roles.list()`](/iam/reference/rest/v1/projects.roles/list):
+     *   [predefined
+     *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+     *   in Cloud IAM. Example request URL: `https://iam.googleapis.com/v1/roles`
+     * * [`projects.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/list):
      *   `projects/{PROJECT_ID}`. This method lists all project-level
-     *   [custom roles](/iam/docs/understanding-custom-roles).
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-     * * [`organizations.roles.list()`](/iam/reference/rest/v1/organizations.roles/list):
+     * * [`organizations.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/list):
      *   `organizations/{ORGANIZATION_ID}`. This method lists all
-     *   organization-level [custom roles](/iam/docs/understanding-custom-roles).
+     *   organization-level [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -912,23 +930,26 @@ public Builder clearParent() {
      * <pre>
      * The `parent` parameter's value depends on the target resource for the
      * request, namely
-     * [`roles`](/iam/reference/rest/v1/roles),
-     * [`projects`](/iam/reference/rest/v1/projects.roles), or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `parent` value format is described below:
-     * * [`roles.list()`](/iam/reference/rest/v1/roles/list): An empty string.
+     * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `parent` value format is described below:
+     * * [`roles.list()`](https://cloud.google.com/iam/reference/rest/v1/roles/list): An empty string.
      *   This method doesn't require a resource; it simply returns all
-     *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-     *   Cloud IAM. Example request URL:
-     *   `https://iam.googleapis.com/v1/roles`
-     * * [`projects.roles.list()`](/iam/reference/rest/v1/projects.roles/list):
+     *   [predefined
+     *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+     *   in Cloud IAM. Example request URL: `https://iam.googleapis.com/v1/roles`
+     * * [`projects.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/list):
      *   `projects/{PROJECT_ID}`. This method lists all project-level
-     *   [custom roles](/iam/docs/understanding-custom-roles).
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-     * * [`organizations.roles.list()`](/iam/reference/rest/v1/organizations.roles/list):
+     * * [`organizations.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/list):
      *   `organizations/{ORGANIZATION_ID}`. This method lists all
-     *   organization-level [custom roles](/iam/docs/understanding-custom-roles).
+     *   organization-level [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
      *   Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesRequestOrBuilder.java
index bd5ec88c1848..f78ba115ce67 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesRequestOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesRequestOrBuilder.java
@@ -29,23 +29,26 @@ public interface ListRolesRequestOrBuilder
    * <pre>
    * The `parent` parameter's value depends on the target resource for the
    * request, namely
-   * [`roles`](/iam/reference/rest/v1/roles),
-   * [`projects`](/iam/reference/rest/v1/projects.roles), or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `parent` value format is described below:
-   * * [`roles.list()`](/iam/reference/rest/v1/roles/list): An empty string.
+   * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `parent` value format is described below:
+   * * [`roles.list()`](https://cloud.google.com/iam/reference/rest/v1/roles/list): An empty string.
    *   This method doesn't require a resource; it simply returns all
-   *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-   *   Cloud IAM. Example request URL:
-   *   `https://iam.googleapis.com/v1/roles`
-   * * [`projects.roles.list()`](/iam/reference/rest/v1/projects.roles/list):
+   *   [predefined
+   *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+   *   in Cloud IAM. Example request URL: `https://iam.googleapis.com/v1/roles`
+   * * [`projects.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/list):
    *   `projects/{PROJECT_ID}`. This method lists all project-level
-   *   [custom roles](/iam/docs/understanding-custom-roles).
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-   * * [`organizations.roles.list()`](/iam/reference/rest/v1/organizations.roles/list):
+   * * [`organizations.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/list):
    *   `organizations/{ORGANIZATION_ID}`. This method lists all
-   *   organization-level [custom roles](/iam/docs/understanding-custom-roles).
+   *   organization-level [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -63,23 +66,26 @@ public interface ListRolesRequestOrBuilder
    * <pre>
    * The `parent` parameter's value depends on the target resource for the
    * request, namely
-   * [`roles`](/iam/reference/rest/v1/roles),
-   * [`projects`](/iam/reference/rest/v1/projects.roles), or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `parent` value format is described below:
-   * * [`roles.list()`](/iam/reference/rest/v1/roles/list): An empty string.
+   * [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `parent` value format is described below:
+   * * [`roles.list()`](https://cloud.google.com/iam/reference/rest/v1/roles/list): An empty string.
    *   This method doesn't require a resource; it simply returns all
-   *   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-   *   Cloud IAM. Example request URL:
-   *   `https://iam.googleapis.com/v1/roles`
-   * * [`projects.roles.list()`](/iam/reference/rest/v1/projects.roles/list):
+   *   [predefined
+   *   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+   *   in Cloud IAM. Example request URL: `https://iam.googleapis.com/v1/roles`
+   * * [`projects.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/list):
    *   `projects/{PROJECT_ID}`. This method lists all project-level
-   *   [custom roles](/iam/docs/understanding-custom-roles).
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
-   * * [`organizations.roles.list()`](/iam/reference/rest/v1/organizations.roles/list):
+   * * [`organizations.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/list):
    *   `organizations/{ORGANIZATION_ID}`. This method lists all
-   *   organization-level [custom roles](/iam/docs/understanding-custom-roles).
+   *   organization-level [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
    *   Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesResponse.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesResponse.java
index 6c0dd2001ce6..5b8c0a5b1b45 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesResponse.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListRolesResponse.java
@@ -114,14 +114,14 @@ private ListRolesResponse(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListRolesResponse_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListRolesResponse_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.ListRolesResponse.class,
@@ -431,14 +431,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.ListRolesResponse)
       com.google.iam.admin.v1.ListRolesResponseOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListRolesResponse_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListRolesResponse_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.ListRolesResponse.class,
@@ -477,7 +477,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListRolesResponse_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountKeysRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountKeysRequest.java
index 4a65bfd9270f..73fff3e0a05f 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountKeysRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountKeysRequest.java
@@ -129,14 +129,14 @@ private ListServiceAccountKeysRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListServiceAccountKeysRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListServiceAccountKeysRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.ListServiceAccountKeysRequest.class,
@@ -675,14 +675,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.ListServiceAccountKeysRequest)
       com.google.iam.admin.v1.ListServiceAccountKeysRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountKeysRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountKeysRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.ListServiceAccountKeysRequest.class,
@@ -715,7 +715,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountKeysRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountKeysResponse.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountKeysResponse.java
index 6cae76c3698d..77b4095172c8 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountKeysResponse.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountKeysResponse.java
@@ -108,14 +108,14 @@ private ListServiceAccountKeysResponse(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListServiceAccountKeysResponse_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListServiceAccountKeysResponse_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.ListServiceAccountKeysResponse.class,
@@ -367,14 +367,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.ListServiceAccountKeysResponse)
       com.google.iam.admin.v1.ListServiceAccountKeysResponseOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountKeysResponse_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountKeysResponse_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.ListServiceAccountKeysResponse.class,
@@ -411,7 +411,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountKeysResponse_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountsRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountsRequest.java
index e00cfccea10d..949073f6b452 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountsRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountsRequest.java
@@ -112,14 +112,14 @@ private ListServiceAccountsRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListServiceAccountsRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListServiceAccountsRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.ListServiceAccountsRequest.class,
@@ -445,14 +445,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.ListServiceAccountsRequest)
       com.google.iam.admin.v1.ListServiceAccountsRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountsRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountsRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.ListServiceAccountsRequest.class,
@@ -487,7 +487,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountsRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountsResponse.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountsResponse.java
index 0ed2f5b0be6e..ed125e2dd6f3 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountsResponse.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ListServiceAccountsResponse.java
@@ -115,14 +115,14 @@ private ListServiceAccountsResponse(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListServiceAccountsResponse_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ListServiceAccountsResponse_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.ListServiceAccountsResponse.class,
@@ -435,14 +435,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.ListServiceAccountsResponse)
       com.google.iam.admin.v1.ListServiceAccountsResponseOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountsResponse_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountsResponse_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.ListServiceAccountsResponse.class,
@@ -481,7 +481,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ListServiceAccountsResponse_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/PatchServiceAccountRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/PatchServiceAccountRequest.java
index 6d4cdd9a706d..cca7e76d3aa5 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/PatchServiceAccountRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/PatchServiceAccountRequest.java
@@ -22,8 +22,7 @@
  *
  *
  * <pre>
- * The request for
- * [PatchServiceAccount][google.iam.admin.v1.PatchServiceAccount].
+ * The service account patch request.
  * You can patch only the `display_name` and `description` fields. You must use
  * the `update_mask` field to specify which of these fields you want to patch.
  * Only the fields specified in the request are guaranteed to be returned in
@@ -126,14 +125,14 @@ private PatchServiceAccountRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_PatchServiceAccountRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_PatchServiceAccountRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.PatchServiceAccountRequest.class,
@@ -376,8 +375,7 @@ protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.Build
    *
    *
    * <pre>
-   * The request for
-   * [PatchServiceAccount][google.iam.admin.v1.PatchServiceAccount].
+   * The service account patch request.
    * You can patch only the `display_name` and `description` fields. You must use
    * the `update_mask` field to specify which of these fields you want to patch.
    * Only the fields specified in the request are guaranteed to be returned in
@@ -391,14 +389,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.PatchServiceAccountRequest)
       com.google.iam.admin.v1.PatchServiceAccountRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_PatchServiceAccountRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_PatchServiceAccountRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.PatchServiceAccountRequest.class,
@@ -439,7 +437,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_PatchServiceAccountRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Permission.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Permission.java
index c658c0f53b71..5e378f165f64 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Permission.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Permission.java
@@ -149,14 +149,13 @@ private Permission(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
-        .internal_static_google_iam_admin_v1_Permission_descriptor;
+    return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_Permission_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_Permission_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.Permission.class,
@@ -359,7 +358,7 @@ public enum CustomRolesSupportLevel implements com.google.protobuf.ProtocolMessa
      *
      *
      * <pre>
-     * Permission is fully supported for custom role use.
+     * Default state. Permission is fully supported for custom role use.
      * </pre>
      *
      * <code>SUPPORTED = 0;</code>
@@ -392,7 +391,7 @@ public enum CustomRolesSupportLevel implements com.google.protobuf.ProtocolMessa
      *
      *
      * <pre>
-     * Permission is fully supported for custom role use.
+     * Default state. Permission is fully supported for custom role use.
      * </pre>
      *
      * <code>SUPPORTED = 0;</code>
@@ -660,7 +659,7 @@ public com.google.protobuf.ByteString getDescriptionBytes() {
    * <code>bool only_in_predefined_roles = 4 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.Permission.only_in_predefined_roles is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=1341
+   *     google/iam/admin/v1/iam.proto;l=1450
    * @return The onlyInPredefinedRoles.
    */
   @java.lang.Override
@@ -1053,14 +1052,13 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.Permission)
       com.google.iam.admin.v1.PermissionOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
-          .internal_static_google_iam_admin_v1_Permission_descriptor;
+      return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_Permission_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_Permission_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.Permission.class,
@@ -1105,8 +1103,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
-          .internal_static_google_iam_admin_v1_Permission_descriptor;
+      return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_Permission_descriptor;
     }
 
     @java.lang.Override
@@ -1568,7 +1565,7 @@ public Builder setDescriptionBytes(com.google.protobuf.ByteString value) {
      * <code>bool only_in_predefined_roles = 4 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.Permission.only_in_predefined_roles is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=1341
+     *     google/iam/admin/v1/iam.proto;l=1450
      * @return The onlyInPredefinedRoles.
      */
     @java.lang.Override
@@ -1580,7 +1577,7 @@ public boolean getOnlyInPredefinedRoles() {
      * <code>bool only_in_predefined_roles = 4 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.Permission.only_in_predefined_roles is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=1341
+     *     google/iam/admin/v1/iam.proto;l=1450
      * @param value The onlyInPredefinedRoles to set.
      * @return This builder for chaining.
      */
@@ -1595,7 +1592,7 @@ public Builder setOnlyInPredefinedRoles(boolean value) {
      * <code>bool only_in_predefined_roles = 4 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.Permission.only_in_predefined_roles is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=1341
+     *     google/iam/admin/v1/iam.proto;l=1450
      * @return This builder for chaining.
      */
     @java.lang.Deprecated
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/PermissionOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/PermissionOrBuilder.java
index 7575bc9f42ea..0192a61435af 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/PermissionOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/PermissionOrBuilder.java
@@ -104,7 +104,7 @@ public interface PermissionOrBuilder
    * <code>bool only_in_predefined_roles = 4 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.Permission.only_in_predefined_roles is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=1341
+   *     google/iam/admin/v1/iam.proto;l=1450
    * @return The onlyInPredefinedRoles.
    */
   @java.lang.Deprecated
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryAuditableServicesRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryAuditableServicesRequest.java
index 6613246d2f47..35ffc41b122f 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryAuditableServicesRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryAuditableServicesRequest.java
@@ -99,14 +99,14 @@ private QueryAuditableServicesRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryAuditableServicesRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryAuditableServicesRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.QueryAuditableServicesRequest.class,
@@ -344,14 +344,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.QueryAuditableServicesRequest)
       com.google.iam.admin.v1.QueryAuditableServicesRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryAuditableServicesRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryAuditableServicesRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.QueryAuditableServicesRequest.class,
@@ -382,7 +382,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryAuditableServicesRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryAuditableServicesResponse.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryAuditableServicesResponse.java
index 060b6d5d3d6c..30938c983594 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryAuditableServicesResponse.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryAuditableServicesResponse.java
@@ -112,14 +112,14 @@ private QueryAuditableServicesResponse(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.QueryAuditableServicesResponse.class,
@@ -239,14 +239,14 @@ private AuditableService(
     }
 
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_AuditableService_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_AuditableService_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.QueryAuditableServicesResponse.AuditableService.class,
@@ -483,14 +483,14 @@ public static final class Builder
         // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.QueryAuditableServicesResponse.AuditableService)
         com.google.iam.admin.v1.QueryAuditableServicesResponse.AuditableServiceOrBuilder {
       public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-        return com.google.iam.admin.v1.IamProto
+        return com.google.iam.admin.v1.Iam
             .internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_AuditableService_descriptor;
       }
 
       @java.lang.Override
       protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
           internalGetFieldAccessorTable() {
-        return com.google.iam.admin.v1.IamProto
+        return com.google.iam.admin.v1.Iam
             .internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_AuditableService_fieldAccessorTable
             .ensureFieldAccessorsInitialized(
                 com.google.iam.admin.v1.QueryAuditableServicesResponse.AuditableService.class,
@@ -523,7 +523,7 @@ public Builder clear() {
 
       @java.lang.Override
       public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-        return com.google.iam.admin.v1.IamProto
+        return com.google.iam.admin.v1.Iam
             .internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_AuditableService_descriptor;
       }
 
@@ -1070,14 +1070,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.QueryAuditableServicesResponse)
       com.google.iam.admin.v1.QueryAuditableServicesResponseOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.QueryAuditableServicesResponse.class,
@@ -1114,7 +1114,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryAuditableServicesResponse_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryGrantableRolesRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryGrantableRolesRequest.java
index a08f530a494f..917dcae60848 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryGrantableRolesRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryGrantableRolesRequest.java
@@ -120,14 +120,14 @@ private QueryGrantableRolesRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryGrantableRolesRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryGrantableRolesRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.QueryGrantableRolesRequest.class,
@@ -482,14 +482,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.QueryGrantableRolesRequest)
       com.google.iam.admin.v1.QueryGrantableRolesRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryGrantableRolesRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryGrantableRolesRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.QueryGrantableRolesRequest.class,
@@ -526,7 +526,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryGrantableRolesRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryGrantableRolesResponse.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryGrantableRolesResponse.java
index 6512f7fd239d..333fed179950 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryGrantableRolesResponse.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryGrantableRolesResponse.java
@@ -114,14 +114,14 @@ private QueryGrantableRolesResponse(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryGrantableRolesResponse_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryGrantableRolesResponse_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.QueryGrantableRolesResponse.class,
@@ -431,14 +431,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.QueryGrantableRolesResponse)
       com.google.iam.admin.v1.QueryGrantableRolesResponseOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryGrantableRolesResponse_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryGrantableRolesResponse_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.QueryGrantableRolesResponse.class,
@@ -477,7 +477,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryGrantableRolesResponse_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryTestablePermissionsRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryTestablePermissionsRequest.java
index f221da57fc67..bcba7b3163c5 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryTestablePermissionsRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryTestablePermissionsRequest.java
@@ -113,14 +113,14 @@ private QueryTestablePermissionsRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryTestablePermissionsRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryTestablePermissionsRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.QueryTestablePermissionsRequest.class,
@@ -446,14 +446,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.QueryTestablePermissionsRequest)
       com.google.iam.admin.v1.QueryTestablePermissionsRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryTestablePermissionsRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryTestablePermissionsRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.QueryTestablePermissionsRequest.class,
@@ -488,7 +488,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryTestablePermissionsRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryTestablePermissionsResponse.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryTestablePermissionsResponse.java
index af8a948a187a..08a894d35f90 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryTestablePermissionsResponse.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/QueryTestablePermissionsResponse.java
@@ -116,14 +116,14 @@ private QueryTestablePermissionsResponse(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryTestablePermissionsResponse_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_QueryTestablePermissionsResponse_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.QueryTestablePermissionsResponse.class,
@@ -435,14 +435,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.QueryTestablePermissionsResponse)
       com.google.iam.admin.v1.QueryTestablePermissionsResponseOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryTestablePermissionsResponse_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryTestablePermissionsResponse_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.QueryTestablePermissionsResponse.class,
@@ -481,7 +481,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_QueryTestablePermissionsResponse_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Role.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Role.java
index 087eb828dc18..fc9edf7438fb 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Role.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/Role.java
@@ -149,14 +149,13 @@ private Role(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto.internal_static_google_iam_admin_v1_Role_descriptor;
+    return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_Role_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
-        .internal_static_google_iam_admin_v1_Role_fieldAccessorTable
+    return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_Role_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.Role.class, com.google.iam.admin.v1.Role.Builder.class);
   }
@@ -217,8 +216,8 @@ public enum RoleLaunchStage implements com.google.protobuf.ProtocolMessageEnum {
      *
      *
      * <pre>
-     * This role is disabled and will not contribute permissions to any members
-     * it is granted to in policies.
+     * This role is disabled and will not contribute permissions to any
+     * principals it is granted to in policies.
      * </pre>
      *
      * <code>DISABLED = 5;</code>
@@ -283,8 +282,8 @@ public enum RoleLaunchStage implements com.google.protobuf.ProtocolMessageEnum {
      *
      *
      * <pre>
-     * This role is disabled and will not contribute permissions to any members
-     * it is granted to in policies.
+     * This role is disabled and will not contribute permissions to any
+     * principals it is granted to in policies.
      * </pre>
      *
      * <code>DISABLED = 5;</code>
@@ -919,14 +918,13 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.Role)
       com.google.iam.admin.v1.RoleOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto.internal_static_google_iam_admin_v1_Role_descriptor;
+      return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_Role_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
-          .internal_static_google_iam_admin_v1_Role_fieldAccessorTable
+      return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_Role_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.Role.class, com.google.iam.admin.v1.Role.Builder.class);
     }
@@ -967,7 +965,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto.internal_static_google_iam_admin_v1_Role_descriptor;
+      return com.google.iam.admin.v1.Iam.internal_static_google_iam_admin_v1_Role_descriptor;
     }
 
     @java.lang.Override
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/RoleView.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/RoleView.java
index 53888c2fffb7..9eb68d83a606 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/RoleView.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/RoleView.java
@@ -131,7 +131,7 @@ public final com.google.protobuf.Descriptors.EnumDescriptor getDescriptorForType
   }
 
   public static final com.google.protobuf.Descriptors.EnumDescriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto.getDescriptor().getEnumTypes().get(4);
+    return com.google.iam.admin.v1.Iam.getDescriptor().getEnumTypes().get(4);
   }
 
   private static final RoleView[] VALUES = values();
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccount.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccount.java
index d6bd48a146bb..ea0ac6bbf919 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccount.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccount.java
@@ -166,14 +166,14 @@ private ServiceAccount(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ServiceAccount_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ServiceAccount_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.ServiceAccount.class,
@@ -473,7 +473,7 @@ public com.google.protobuf.ByteString getDisplayNameBytes() {
    * <code>bytes etag = 7 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.ServiceAccount.etag is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=504
+   *     google/iam/admin/v1/iam.proto;l=538
    * @return The etag.
    */
   @java.lang.Override
@@ -852,14 +852,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.ServiceAccount)
       com.google.iam.admin.v1.ServiceAccountOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ServiceAccount_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ServiceAccount_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.ServiceAccount.class,
@@ -906,7 +906,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ServiceAccount_descriptor;
     }
 
@@ -1680,7 +1680,7 @@ public Builder setDisplayNameBytes(com.google.protobuf.ByteString value) {
      * <code>bytes etag = 7 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.ServiceAccount.etag is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=504
+     *     google/iam/admin/v1/iam.proto;l=538
      * @return The etag.
      */
     @java.lang.Override
@@ -1698,7 +1698,7 @@ public com.google.protobuf.ByteString getEtag() {
      * <code>bytes etag = 7 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.ServiceAccount.etag is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=504
+     *     google/iam/admin/v1/iam.proto;l=538
      * @param value The etag to set.
      * @return This builder for chaining.
      */
@@ -1722,7 +1722,7 @@ public Builder setEtag(com.google.protobuf.ByteString value) {
      * <code>bytes etag = 7 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.ServiceAccount.etag is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=504
+     *     google/iam/admin/v1/iam.proto;l=538
      * @return This builder for chaining.
      */
     @java.lang.Deprecated
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKey.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKey.java
index 2b33aeca72c4..a4d28fc26904 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKey.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKey.java
@@ -169,6 +169,11 @@ private ServiceAccountKey(
               keyType_ = rawValue;
               break;
             }
+          case 88:
+            {
+              disabled_ = input.readBool();
+              break;
+            }
           default:
             {
               if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
@@ -191,14 +196,14 @@ private ServiceAccountKey(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ServiceAccountKey_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_ServiceAccountKey_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.ServiceAccountKey.class,
@@ -561,6 +566,24 @@ public com.google.iam.admin.v1.ListServiceAccountKeysRequest.KeyType getKeyType(
         : result;
   }
 
+  public static final int DISABLED_FIELD_NUMBER = 11;
+  private boolean disabled_;
+  /**
+   *
+   *
+   * <pre>
+   * The key status.
+   * </pre>
+   *
+   * <code>bool disabled = 11;</code>
+   *
+   * @return The disabled.
+   */
+  @java.lang.Override
+  public boolean getDisabled() {
+    return disabled_;
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -607,6 +630,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
             .getNumber()) {
       output.writeEnum(10, keyType_);
     }
+    if (disabled_ != false) {
+      output.writeBool(11, disabled_);
+    }
     unknownFields.writeTo(output);
   }
 
@@ -648,6 +674,9 @@ public int getSerializedSize() {
             .getNumber()) {
       size += com.google.protobuf.CodedOutputStream.computeEnumSize(10, keyType_);
     }
+    if (disabled_ != false) {
+      size += com.google.protobuf.CodedOutputStream.computeBoolSize(11, disabled_);
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -679,6 +708,7 @@ public boolean equals(final java.lang.Object obj) {
     }
     if (keyOrigin_ != other.keyOrigin_) return false;
     if (keyType_ != other.keyType_) return false;
+    if (getDisabled() != other.getDisabled()) return false;
     if (!unknownFields.equals(other.unknownFields)) return false;
     return true;
   }
@@ -712,6 +742,8 @@ public int hashCode() {
     hash = (53 * hash) + keyOrigin_;
     hash = (37 * hash) + KEY_TYPE_FIELD_NUMBER;
     hash = (53 * hash) + keyType_;
+    hash = (37 * hash) + DISABLED_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getDisabled());
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -844,14 +876,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.ServiceAccountKey)
       com.google.iam.admin.v1.ServiceAccountKeyOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ServiceAccountKey_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ServiceAccountKey_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.ServiceAccountKey.class,
@@ -901,12 +933,14 @@ public Builder clear() {
 
       keyType_ = 0;
 
+      disabled_ = false;
+
       return this;
     }
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_ServiceAccountKey_descriptor;
     }
 
@@ -945,6 +979,7 @@ public com.google.iam.admin.v1.ServiceAccountKey buildPartial() {
       }
       result.keyOrigin_ = keyOrigin_;
       result.keyType_ = keyType_;
+      result.disabled_ = disabled_;
       onBuilt();
       return result;
     }
@@ -1022,6 +1057,9 @@ public Builder mergeFrom(com.google.iam.admin.v1.ServiceAccountKey other) {
       if (other.keyType_ != 0) {
         setKeyTypeValue(other.getKeyTypeValue());
       }
+      if (other.getDisabled() != false) {
+        setDisabled(other.getDisabled());
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -2077,6 +2115,58 @@ public Builder clearKeyType() {
       return this;
     }
 
+    private boolean disabled_;
+    /**
+     *
+     *
+     * <pre>
+     * The key status.
+     * </pre>
+     *
+     * <code>bool disabled = 11;</code>
+     *
+     * @return The disabled.
+     */
+    @java.lang.Override
+    public boolean getDisabled() {
+      return disabled_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The key status.
+     * </pre>
+     *
+     * <code>bool disabled = 11;</code>
+     *
+     * @param value The disabled to set.
+     * @return This builder for chaining.
+     */
+    public Builder setDisabled(boolean value) {
+
+      disabled_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The key status.
+     * </pre>
+     *
+     * <code>bool disabled = 11;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearDisabled() {
+
+      disabled_ = false;
+      onChanged();
+      return this;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyAlgorithm.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyAlgorithm.java
index 97118c487e2c..448e215c5752 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyAlgorithm.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyAlgorithm.java
@@ -153,7 +153,7 @@ public final com.google.protobuf.Descriptors.EnumDescriptor getDescriptorForType
   }
 
   public static final com.google.protobuf.Descriptors.EnumDescriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto.getDescriptor().getEnumTypes().get(0);
+    return com.google.iam.admin.v1.Iam.getDescriptor().getEnumTypes().get(0);
   }
 
   private static final ServiceAccountKeyAlgorithm[] VALUES = values();
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyOrBuilder.java
index 53dd2add8d93..76084efe9218 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyOrBuilder.java
@@ -268,4 +268,17 @@ public interface ServiceAccountKeyOrBuilder
    * @return The keyType.
    */
   com.google.iam.admin.v1.ListServiceAccountKeysRequest.KeyType getKeyType();
+
+  /**
+   *
+   *
+   * <pre>
+   * The key status.
+   * </pre>
+   *
+   * <code>bool disabled = 11;</code>
+   *
+   * @return The disabled.
+   */
+  boolean getDisabled();
 }
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyOrigin.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyOrigin.java
index c0f0b1239fb4..cd1ea17deda0 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyOrigin.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountKeyOrigin.java
@@ -153,7 +153,7 @@ public final com.google.protobuf.Descriptors.EnumDescriptor getDescriptorForType
   }
 
   public static final com.google.protobuf.Descriptors.EnumDescriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto.getDescriptor().getEnumTypes().get(3);
+    return com.google.iam.admin.v1.Iam.getDescriptor().getEnumTypes().get(3);
   }
 
   private static final ServiceAccountKeyOrigin[] VALUES = values();
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountOrBuilder.java
index 06761bfa1a20..3b4f12035b00 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountOrBuilder.java
@@ -194,7 +194,7 @@ public interface ServiceAccountOrBuilder
    * <code>bytes etag = 7 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.ServiceAccount.etag is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=504
+   *     google/iam/admin/v1/iam.proto;l=538
    * @return The etag.
    */
   @java.lang.Deprecated
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountPrivateKeyType.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountPrivateKeyType.java
index cd764455a1c5..fa6a877f88d6 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountPrivateKeyType.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountPrivateKeyType.java
@@ -157,7 +157,7 @@ public final com.google.protobuf.Descriptors.EnumDescriptor getDescriptorForType
   }
 
   public static final com.google.protobuf.Descriptors.EnumDescriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto.getDescriptor().getEnumTypes().get(1);
+    return com.google.iam.admin.v1.Iam.getDescriptor().getEnumTypes().get(1);
   }
 
   private static final ServiceAccountPrivateKeyType[] VALUES = values();
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountPublicKeyType.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountPublicKeyType.java
index 97912df3230a..be2e4c9b4813 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountPublicKeyType.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/ServiceAccountPublicKeyType.java
@@ -32,7 +32,7 @@ public enum ServiceAccountPublicKeyType implements com.google.protobuf.ProtocolM
    *
    *
    * <pre>
-   * Unspecified. Returns nothing here.
+   * Do not return the public key.
    * </pre>
    *
    * <code>TYPE_NONE = 0;</code>
@@ -65,7 +65,7 @@ public enum ServiceAccountPublicKeyType implements com.google.protobuf.ProtocolM
    *
    *
    * <pre>
-   * Unspecified. Returns nothing here.
+   * Do not return the public key.
    * </pre>
    *
    * <code>TYPE_NONE = 0;</code>
@@ -153,7 +153,7 @@ public final com.google.protobuf.Descriptors.EnumDescriptor getDescriptorForType
   }
 
   public static final com.google.protobuf.Descriptors.EnumDescriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto.getDescriptor().getEnumTypes().get(2);
+    return com.google.iam.admin.v1.Iam.getDescriptor().getEnumTypes().get(2);
   }
 
   private static final ServiceAccountPublicKeyType[] VALUES = values();
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobRequest.java
index dfbb638effd8..6b2b04cb588d 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobRequest.java
@@ -107,14 +107,14 @@ private SignBlobRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_SignBlobRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_SignBlobRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.SignBlobRequest.class,
@@ -141,7 +141,7 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * </code>
    *
    * @deprecated google.iam.admin.v1.SignBlobRequest.name is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=856
+   *     google/iam/admin/v1/iam.proto;l=974
    * @return The name.
    */
   @java.lang.Override
@@ -175,7 +175,7 @@ public java.lang.String getName() {
    * </code>
    *
    * @deprecated google.iam.admin.v1.SignBlobRequest.name is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=856
+   *     google/iam/admin/v1/iam.proto;l=974
    * @return The bytes for name.
    */
   @java.lang.Override
@@ -207,7 +207,7 @@ public com.google.protobuf.ByteString getNameBytes() {
    * </code>
    *
    * @deprecated google.iam.admin.v1.SignBlobRequest.bytes_to_sign is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=868
+   *     google/iam/admin/v1/iam.proto;l=986
    * @return The bytesToSign.
    */
   @java.lang.Override
@@ -399,14 +399,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.SignBlobRequest)
       com.google.iam.admin.v1.SignBlobRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignBlobRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignBlobRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.SignBlobRequest.class,
@@ -439,7 +439,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignBlobRequest_descriptor;
     }
 
@@ -567,7 +567,7 @@ public Builder mergeFrom(
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignBlobRequest.name is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=856
+     *     google/iam/admin/v1/iam.proto;l=974
      * @return The name.
      */
     @java.lang.Deprecated
@@ -600,7 +600,7 @@ public java.lang.String getName() {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignBlobRequest.name is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=856
+     *     google/iam/admin/v1/iam.proto;l=974
      * @return The bytes for name.
      */
     @java.lang.Deprecated
@@ -633,7 +633,7 @@ public com.google.protobuf.ByteString getNameBytes() {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignBlobRequest.name is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=856
+     *     google/iam/admin/v1/iam.proto;l=974
      * @param value The name to set.
      * @return This builder for chaining.
      */
@@ -665,7 +665,7 @@ public Builder setName(java.lang.String value) {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignBlobRequest.name is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=856
+     *     google/iam/admin/v1/iam.proto;l=974
      * @return This builder for chaining.
      */
     @java.lang.Deprecated
@@ -693,7 +693,7 @@ public Builder clearName() {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignBlobRequest.name is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=856
+     *     google/iam/admin/v1/iam.proto;l=974
      * @param value The bytes for name to set.
      * @return This builder for chaining.
      */
@@ -723,7 +723,7 @@ public Builder setNameBytes(com.google.protobuf.ByteString value) {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignBlobRequest.bytes_to_sign is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=868
+     *     google/iam/admin/v1/iam.proto;l=986
      * @return The bytesToSign.
      */
     @java.lang.Override
@@ -744,7 +744,7 @@ public com.google.protobuf.ByteString getBytesToSign() {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignBlobRequest.bytes_to_sign is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=868
+     *     google/iam/admin/v1/iam.proto;l=986
      * @param value The bytesToSign to set.
      * @return This builder for chaining.
      */
@@ -771,7 +771,7 @@ public Builder setBytesToSign(com.google.protobuf.ByteString value) {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignBlobRequest.bytes_to_sign is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=868
+     *     google/iam/admin/v1/iam.proto;l=986
      * @return This builder for chaining.
      */
     @java.lang.Deprecated
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobRequestOrBuilder.java
index 0e2941945f21..942b77f9dad4 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobRequestOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobRequestOrBuilder.java
@@ -41,7 +41,7 @@ public interface SignBlobRequestOrBuilder
    * </code>
    *
    * @deprecated google.iam.admin.v1.SignBlobRequest.name is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=856
+   *     google/iam/admin/v1/iam.proto;l=974
    * @return The name.
    */
   @java.lang.Deprecated
@@ -64,7 +64,7 @@ public interface SignBlobRequestOrBuilder
    * </code>
    *
    * @deprecated google.iam.admin.v1.SignBlobRequest.name is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=856
+   *     google/iam/admin/v1/iam.proto;l=974
    * @return The bytes for name.
    */
   @java.lang.Deprecated
@@ -83,7 +83,7 @@ public interface SignBlobRequestOrBuilder
    * </code>
    *
    * @deprecated google.iam.admin.v1.SignBlobRequest.bytes_to_sign is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=868
+   *     google/iam/admin/v1/iam.proto;l=986
    * @return The bytesToSign.
    */
   @java.lang.Deprecated
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobResponse.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobResponse.java
index bb865ad533b4..6ac6e0502092 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobResponse.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobResponse.java
@@ -107,14 +107,14 @@ private SignBlobResponse(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_SignBlobResponse_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_SignBlobResponse_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.SignBlobResponse.class,
@@ -135,7 +135,7 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <code>string key_id = 1 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignBlobResponse.key_id is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=883
+   *     google/iam/admin/v1/iam.proto;l=1001
    * @return The keyId.
    */
   @java.lang.Override
@@ -163,7 +163,7 @@ public java.lang.String getKeyId() {
    * <code>string key_id = 1 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignBlobResponse.key_id is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=883
+   *     google/iam/admin/v1/iam.proto;l=1001
    * @return The bytes for keyId.
    */
   @java.lang.Override
@@ -194,7 +194,7 @@ public com.google.protobuf.ByteString getKeyIdBytes() {
    * <code>bytes signature = 2 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignBlobResponse.signature is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=889
+   *     google/iam/admin/v1/iam.proto;l=1007
    * @return The signature.
    */
   @java.lang.Override
@@ -386,14 +386,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.SignBlobResponse)
       com.google.iam.admin.v1.SignBlobResponseOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignBlobResponse_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignBlobResponse_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.SignBlobResponse.class,
@@ -426,7 +426,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignBlobResponse_descriptor;
     }
 
@@ -548,7 +548,7 @@ public Builder mergeFrom(
      * <code>string key_id = 1 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignBlobResponse.key_id is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=883
+     *     google/iam/admin/v1/iam.proto;l=1001
      * @return The keyId.
      */
     @java.lang.Deprecated
@@ -575,7 +575,7 @@ public java.lang.String getKeyId() {
      * <code>string key_id = 1 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignBlobResponse.key_id is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=883
+     *     google/iam/admin/v1/iam.proto;l=1001
      * @return The bytes for keyId.
      */
     @java.lang.Deprecated
@@ -602,7 +602,7 @@ public com.google.protobuf.ByteString getKeyIdBytes() {
      * <code>string key_id = 1 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignBlobResponse.key_id is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=883
+     *     google/iam/admin/v1/iam.proto;l=1001
      * @param value The keyId to set.
      * @return This builder for chaining.
      */
@@ -628,7 +628,7 @@ public Builder setKeyId(java.lang.String value) {
      * <code>string key_id = 1 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignBlobResponse.key_id is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=883
+     *     google/iam/admin/v1/iam.proto;l=1001
      * @return This builder for chaining.
      */
     @java.lang.Deprecated
@@ -650,7 +650,7 @@ public Builder clearKeyId() {
      * <code>string key_id = 1 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignBlobResponse.key_id is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=883
+     *     google/iam/admin/v1/iam.proto;l=1001
      * @param value The bytes for keyId to set.
      * @return This builder for chaining.
      */
@@ -679,7 +679,7 @@ public Builder setKeyIdBytes(com.google.protobuf.ByteString value) {
      * <code>bytes signature = 2 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignBlobResponse.signature is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=889
+     *     google/iam/admin/v1/iam.proto;l=1007
      * @return The signature.
      */
     @java.lang.Override
@@ -699,7 +699,7 @@ public com.google.protobuf.ByteString getSignature() {
      * <code>bytes signature = 2 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignBlobResponse.signature is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=889
+     *     google/iam/admin/v1/iam.proto;l=1007
      * @param value The signature to set.
      * @return This builder for chaining.
      */
@@ -725,7 +725,7 @@ public Builder setSignature(com.google.protobuf.ByteString value) {
      * <code>bytes signature = 2 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignBlobResponse.signature is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=889
+     *     google/iam/admin/v1/iam.proto;l=1007
      * @return This builder for chaining.
      */
     @java.lang.Deprecated
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobResponseOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobResponseOrBuilder.java
index 2f5cbf2ff116..f9ca11b0a487 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobResponseOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignBlobResponseOrBuilder.java
@@ -35,7 +35,7 @@ public interface SignBlobResponseOrBuilder
    * <code>string key_id = 1 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignBlobResponse.key_id is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=883
+   *     google/iam/admin/v1/iam.proto;l=1001
    * @return The keyId.
    */
   @java.lang.Deprecated
@@ -52,7 +52,7 @@ public interface SignBlobResponseOrBuilder
    * <code>string key_id = 1 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignBlobResponse.key_id is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=883
+   *     google/iam/admin/v1/iam.proto;l=1001
    * @return The bytes for keyId.
    */
   @java.lang.Deprecated
@@ -70,7 +70,7 @@ public interface SignBlobResponseOrBuilder
    * <code>bytes signature = 2 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignBlobResponse.signature is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=889
+   *     google/iam/admin/v1/iam.proto;l=1007
    * @return The signature.
    */
   @java.lang.Deprecated
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtRequest.java
index 2f8b5557cf91..402149e5ca32 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtRequest.java
@@ -109,14 +109,14 @@ private SignJwtRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_SignJwtRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_SignJwtRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.SignJwtRequest.class,
@@ -143,7 +143,7 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * </code>
    *
    * @deprecated google.iam.admin.v1.SignJwtRequest.name is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=955
+   *     google/iam/admin/v1/iam.proto;l=1023
    * @return The name.
    */
   @java.lang.Override
@@ -177,7 +177,7 @@ public java.lang.String getName() {
    * </code>
    *
    * @deprecated google.iam.admin.v1.SignJwtRequest.name is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=955
+   *     google/iam/admin/v1/iam.proto;l=1023
    * @return The bytes for name.
    */
   @java.lang.Override
@@ -205,8 +205,8 @@ public com.google.protobuf.ByteString getNameBytes() {
    * The JWT payload to sign. Must be a serialized JSON object that contains a
    * JWT Claims Set. For example: `{"sub": "user&#64;example.com", "iat": 313435}`
    * If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
-   * an integer timestamp that is not in the past and no more than 1 hour in the
-   * future.
+   * an integer timestamp that is not in the past and no more than 12 hours in
+   * the future.
    * If the JWT Claims Set does not contain an expiration time (`exp`) claim,
    * this claim is added automatically, with a timestamp that is 1 hour in the
    * future.
@@ -215,7 +215,7 @@ public com.google.protobuf.ByteString getNameBytes() {
    * <code>string payload = 2 [deprecated = true, (.google.api.field_behavior) = REQUIRED];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtRequest.payload is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=976
+   *     google/iam/admin/v1/iam.proto;l=1044
    * @return The payload.
    */
   @java.lang.Override
@@ -240,8 +240,8 @@ public java.lang.String getPayload() {
    * The JWT payload to sign. Must be a serialized JSON object that contains a
    * JWT Claims Set. For example: `{"sub": "user&#64;example.com", "iat": 313435}`
    * If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
-   * an integer timestamp that is not in the past and no more than 1 hour in the
-   * future.
+   * an integer timestamp that is not in the past and no more than 12 hours in
+   * the future.
    * If the JWT Claims Set does not contain an expiration time (`exp`) claim,
    * this claim is added automatically, with a timestamp that is 1 hour in the
    * future.
@@ -250,7 +250,7 @@ public java.lang.String getPayload() {
    * <code>string payload = 2 [deprecated = true, (.google.api.field_behavior) = REQUIRED];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtRequest.payload is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=976
+   *     google/iam/admin/v1/iam.proto;l=1044
    * @return The bytes for payload.
    */
   @java.lang.Override
@@ -450,14 +450,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.SignJwtRequest)
       com.google.iam.admin.v1.SignJwtRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignJwtRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignJwtRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.SignJwtRequest.class,
@@ -490,7 +490,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignJwtRequest_descriptor;
     }
 
@@ -619,7 +619,7 @@ public Builder mergeFrom(
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignJwtRequest.name is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=955
+     *     google/iam/admin/v1/iam.proto;l=1023
      * @return The name.
      */
     @java.lang.Deprecated
@@ -652,7 +652,7 @@ public java.lang.String getName() {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignJwtRequest.name is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=955
+     *     google/iam/admin/v1/iam.proto;l=1023
      * @return The bytes for name.
      */
     @java.lang.Deprecated
@@ -685,7 +685,7 @@ public com.google.protobuf.ByteString getNameBytes() {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignJwtRequest.name is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=955
+     *     google/iam/admin/v1/iam.proto;l=1023
      * @param value The name to set.
      * @return This builder for chaining.
      */
@@ -717,7 +717,7 @@ public Builder setName(java.lang.String value) {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignJwtRequest.name is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=955
+     *     google/iam/admin/v1/iam.proto;l=1023
      * @return This builder for chaining.
      */
     @java.lang.Deprecated
@@ -745,7 +745,7 @@ public Builder clearName() {
      * </code>
      *
      * @deprecated google.iam.admin.v1.SignJwtRequest.name is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=955
+     *     google/iam/admin/v1/iam.proto;l=1023
      * @param value The bytes for name to set.
      * @return This builder for chaining.
      */
@@ -771,8 +771,8 @@ public Builder setNameBytes(com.google.protobuf.ByteString value) {
      * The JWT payload to sign. Must be a serialized JSON object that contains a
      * JWT Claims Set. For example: `{"sub": "user&#64;example.com", "iat": 313435}`
      * If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
-     * an integer timestamp that is not in the past and no more than 1 hour in the
-     * future.
+     * an integer timestamp that is not in the past and no more than 12 hours in
+     * the future.
      * If the JWT Claims Set does not contain an expiration time (`exp`) claim,
      * this claim is added automatically, with a timestamp that is 1 hour in the
      * future.
@@ -781,7 +781,7 @@ public Builder setNameBytes(com.google.protobuf.ByteString value) {
      * <code>string payload = 2 [deprecated = true, (.google.api.field_behavior) = REQUIRED];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtRequest.payload is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=976
+     *     google/iam/admin/v1/iam.proto;l=1044
      * @return The payload.
      */
     @java.lang.Deprecated
@@ -805,8 +805,8 @@ public java.lang.String getPayload() {
      * The JWT payload to sign. Must be a serialized JSON object that contains a
      * JWT Claims Set. For example: `{"sub": "user&#64;example.com", "iat": 313435}`
      * If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
-     * an integer timestamp that is not in the past and no more than 1 hour in the
-     * future.
+     * an integer timestamp that is not in the past and no more than 12 hours in
+     * the future.
      * If the JWT Claims Set does not contain an expiration time (`exp`) claim,
      * this claim is added automatically, with a timestamp that is 1 hour in the
      * future.
@@ -815,7 +815,7 @@ public java.lang.String getPayload() {
      * <code>string payload = 2 [deprecated = true, (.google.api.field_behavior) = REQUIRED];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtRequest.payload is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=976
+     *     google/iam/admin/v1/iam.proto;l=1044
      * @return The bytes for payload.
      */
     @java.lang.Deprecated
@@ -839,8 +839,8 @@ public com.google.protobuf.ByteString getPayloadBytes() {
      * The JWT payload to sign. Must be a serialized JSON object that contains a
      * JWT Claims Set. For example: `{"sub": "user&#64;example.com", "iat": 313435}`
      * If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
-     * an integer timestamp that is not in the past and no more than 1 hour in the
-     * future.
+     * an integer timestamp that is not in the past and no more than 12 hours in
+     * the future.
      * If the JWT Claims Set does not contain an expiration time (`exp`) claim,
      * this claim is added automatically, with a timestamp that is 1 hour in the
      * future.
@@ -849,7 +849,7 @@ public com.google.protobuf.ByteString getPayloadBytes() {
      * <code>string payload = 2 [deprecated = true, (.google.api.field_behavior) = REQUIRED];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtRequest.payload is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=976
+     *     google/iam/admin/v1/iam.proto;l=1044
      * @param value The payload to set.
      * @return This builder for chaining.
      */
@@ -872,8 +872,8 @@ public Builder setPayload(java.lang.String value) {
      * The JWT payload to sign. Must be a serialized JSON object that contains a
      * JWT Claims Set. For example: `{"sub": "user&#64;example.com", "iat": 313435}`
      * If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
-     * an integer timestamp that is not in the past and no more than 1 hour in the
-     * future.
+     * an integer timestamp that is not in the past and no more than 12 hours in
+     * the future.
      * If the JWT Claims Set does not contain an expiration time (`exp`) claim,
      * this claim is added automatically, with a timestamp that is 1 hour in the
      * future.
@@ -882,7 +882,7 @@ public Builder setPayload(java.lang.String value) {
      * <code>string payload = 2 [deprecated = true, (.google.api.field_behavior) = REQUIRED];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtRequest.payload is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=976
+     *     google/iam/admin/v1/iam.proto;l=1044
      * @return This builder for chaining.
      */
     @java.lang.Deprecated
@@ -901,8 +901,8 @@ public Builder clearPayload() {
      * The JWT payload to sign. Must be a serialized JSON object that contains a
      * JWT Claims Set. For example: `{"sub": "user&#64;example.com", "iat": 313435}`
      * If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
-     * an integer timestamp that is not in the past and no more than 1 hour in the
-     * future.
+     * an integer timestamp that is not in the past and no more than 12 hours in
+     * the future.
      * If the JWT Claims Set does not contain an expiration time (`exp`) claim,
      * this claim is added automatically, with a timestamp that is 1 hour in the
      * future.
@@ -911,7 +911,7 @@ public Builder clearPayload() {
      * <code>string payload = 2 [deprecated = true, (.google.api.field_behavior) = REQUIRED];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtRequest.payload is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=976
+     *     google/iam/admin/v1/iam.proto;l=1044
      * @param value The bytes for payload to set.
      * @return This builder for chaining.
      */
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtRequestOrBuilder.java
index 8e0ac15e7369..fccb35d9f874 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtRequestOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtRequestOrBuilder.java
@@ -41,7 +41,7 @@ public interface SignJwtRequestOrBuilder
    * </code>
    *
    * @deprecated google.iam.admin.v1.SignJwtRequest.name is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=955
+   *     google/iam/admin/v1/iam.proto;l=1023
    * @return The name.
    */
   @java.lang.Deprecated
@@ -64,7 +64,7 @@ public interface SignJwtRequestOrBuilder
    * </code>
    *
    * @deprecated google.iam.admin.v1.SignJwtRequest.name is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=955
+   *     google/iam/admin/v1/iam.proto;l=1023
    * @return The bytes for name.
    */
   @java.lang.Deprecated
@@ -79,8 +79,8 @@ public interface SignJwtRequestOrBuilder
    * The JWT payload to sign. Must be a serialized JSON object that contains a
    * JWT Claims Set. For example: `{"sub": "user&#64;example.com", "iat": 313435}`
    * If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
-   * an integer timestamp that is not in the past and no more than 1 hour in the
-   * future.
+   * an integer timestamp that is not in the past and no more than 12 hours in
+   * the future.
    * If the JWT Claims Set does not contain an expiration time (`exp`) claim,
    * this claim is added automatically, with a timestamp that is 1 hour in the
    * future.
@@ -89,7 +89,7 @@ public interface SignJwtRequestOrBuilder
    * <code>string payload = 2 [deprecated = true, (.google.api.field_behavior) = REQUIRED];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtRequest.payload is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=976
+   *     google/iam/admin/v1/iam.proto;l=1044
    * @return The payload.
    */
   @java.lang.Deprecated
@@ -103,8 +103,8 @@ public interface SignJwtRequestOrBuilder
    * The JWT payload to sign. Must be a serialized JSON object that contains a
    * JWT Claims Set. For example: `{"sub": "user&#64;example.com", "iat": 313435}`
    * If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
-   * an integer timestamp that is not in the past and no more than 1 hour in the
-   * future.
+   * an integer timestamp that is not in the past and no more than 12 hours in
+   * the future.
    * If the JWT Claims Set does not contain an expiration time (`exp`) claim,
    * this claim is added automatically, with a timestamp that is 1 hour in the
    * future.
@@ -113,7 +113,7 @@ public interface SignJwtRequestOrBuilder
    * <code>string payload = 2 [deprecated = true, (.google.api.field_behavior) = REQUIRED];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtRequest.payload is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=976
+   *     google/iam/admin/v1/iam.proto;l=1044
    * @return The bytes for payload.
    */
   @java.lang.Deprecated
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtResponse.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtResponse.java
index 1e32128371b2..92bc3151be6a 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtResponse.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtResponse.java
@@ -109,14 +109,14 @@ private SignJwtResponse(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_SignJwtResponse_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_SignJwtResponse_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.SignJwtResponse.class,
@@ -137,7 +137,7 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <code>string key_id = 1 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtResponse.key_id is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=991
+   *     google/iam/admin/v1/iam.proto;l=1059
    * @return The keyId.
    */
   @java.lang.Override
@@ -165,7 +165,7 @@ public java.lang.String getKeyId() {
    * <code>string key_id = 1 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtResponse.key_id is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=991
+   *     google/iam/admin/v1/iam.proto;l=1059
    * @return The bytes for keyId.
    */
   @java.lang.Override
@@ -196,7 +196,7 @@ public com.google.protobuf.ByteString getKeyIdBytes() {
    * <code>string signed_jwt = 2 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtResponse.signed_jwt is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=997
+   *     google/iam/admin/v1/iam.proto;l=1065
    * @return The signedJwt.
    */
   @java.lang.Override
@@ -224,7 +224,7 @@ public java.lang.String getSignedJwt() {
    * <code>string signed_jwt = 2 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtResponse.signed_jwt is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=997
+   *     google/iam/admin/v1/iam.proto;l=1065
    * @return The bytes for signedJwt.
    */
   @java.lang.Override
@@ -424,14 +424,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.SignJwtResponse)
       com.google.iam.admin.v1.SignJwtResponseOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignJwtResponse_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignJwtResponse_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.SignJwtResponse.class,
@@ -464,7 +464,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_SignJwtResponse_descriptor;
     }
 
@@ -587,7 +587,7 @@ public Builder mergeFrom(
      * <code>string key_id = 1 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtResponse.key_id is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=991
+     *     google/iam/admin/v1/iam.proto;l=1059
      * @return The keyId.
      */
     @java.lang.Deprecated
@@ -614,7 +614,7 @@ public java.lang.String getKeyId() {
      * <code>string key_id = 1 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtResponse.key_id is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=991
+     *     google/iam/admin/v1/iam.proto;l=1059
      * @return The bytes for keyId.
      */
     @java.lang.Deprecated
@@ -641,7 +641,7 @@ public com.google.protobuf.ByteString getKeyIdBytes() {
      * <code>string key_id = 1 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtResponse.key_id is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=991
+     *     google/iam/admin/v1/iam.proto;l=1059
      * @param value The keyId to set.
      * @return This builder for chaining.
      */
@@ -667,7 +667,7 @@ public Builder setKeyId(java.lang.String value) {
      * <code>string key_id = 1 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtResponse.key_id is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=991
+     *     google/iam/admin/v1/iam.proto;l=1059
      * @return This builder for chaining.
      */
     @java.lang.Deprecated
@@ -689,7 +689,7 @@ public Builder clearKeyId() {
      * <code>string key_id = 1 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtResponse.key_id is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=991
+     *     google/iam/admin/v1/iam.proto;l=1059
      * @param value The bytes for keyId to set.
      * @return This builder for chaining.
      */
@@ -718,7 +718,7 @@ public Builder setKeyIdBytes(com.google.protobuf.ByteString value) {
      * <code>string signed_jwt = 2 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtResponse.signed_jwt is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=997
+     *     google/iam/admin/v1/iam.proto;l=1065
      * @return The signedJwt.
      */
     @java.lang.Deprecated
@@ -745,7 +745,7 @@ public java.lang.String getSignedJwt() {
      * <code>string signed_jwt = 2 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtResponse.signed_jwt is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=997
+     *     google/iam/admin/v1/iam.proto;l=1065
      * @return The bytes for signedJwt.
      */
     @java.lang.Deprecated
@@ -772,7 +772,7 @@ public com.google.protobuf.ByteString getSignedJwtBytes() {
      * <code>string signed_jwt = 2 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtResponse.signed_jwt is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=997
+     *     google/iam/admin/v1/iam.proto;l=1065
      * @param value The signedJwt to set.
      * @return This builder for chaining.
      */
@@ -798,7 +798,7 @@ public Builder setSignedJwt(java.lang.String value) {
      * <code>string signed_jwt = 2 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtResponse.signed_jwt is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=997
+     *     google/iam/admin/v1/iam.proto;l=1065
      * @return This builder for chaining.
      */
     @java.lang.Deprecated
@@ -820,7 +820,7 @@ public Builder clearSignedJwt() {
      * <code>string signed_jwt = 2 [deprecated = true];</code>
      *
      * @deprecated google.iam.admin.v1.SignJwtResponse.signed_jwt is deprecated. See
-     *     google/iam/admin/v1/iam.proto;l=997
+     *     google/iam/admin/v1/iam.proto;l=1065
      * @param value The bytes for signedJwt to set.
      * @return This builder for chaining.
      */
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtResponseOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtResponseOrBuilder.java
index 4ea7a0579bd6..7e98ec1348a4 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtResponseOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/SignJwtResponseOrBuilder.java
@@ -35,7 +35,7 @@ public interface SignJwtResponseOrBuilder
    * <code>string key_id = 1 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtResponse.key_id is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=991
+   *     google/iam/admin/v1/iam.proto;l=1059
    * @return The keyId.
    */
   @java.lang.Deprecated
@@ -52,7 +52,7 @@ public interface SignJwtResponseOrBuilder
    * <code>string key_id = 1 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtResponse.key_id is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=991
+   *     google/iam/admin/v1/iam.proto;l=1059
    * @return The bytes for keyId.
    */
   @java.lang.Deprecated
@@ -70,7 +70,7 @@ public interface SignJwtResponseOrBuilder
    * <code>string signed_jwt = 2 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtResponse.signed_jwt is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=997
+   *     google/iam/admin/v1/iam.proto;l=1065
    * @return The signedJwt.
    */
   @java.lang.Deprecated
@@ -87,7 +87,7 @@ public interface SignJwtResponseOrBuilder
    * <code>string signed_jwt = 2 [deprecated = true];</code>
    *
    * @deprecated google.iam.admin.v1.SignJwtResponse.signed_jwt is deprecated. See
-   *     google/iam/admin/v1/iam.proto;l=997
+   *     google/iam/admin/v1/iam.proto;l=1065
    * @return The bytes for signedJwt.
    */
   @java.lang.Deprecated
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteRoleRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteRoleRequest.java
index 67f4d3d3fc3c..443d67489d4f 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteRoleRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteRoleRequest.java
@@ -105,14 +105,14 @@ private UndeleteRoleRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_UndeleteRoleRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_UndeleteRoleRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.UndeleteRoleRequest.class,
@@ -127,17 +127,20 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.undelete()`](/iam/reference/rest/v1/projects.roles/undelete):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/undelete):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method undeletes
-   *   only [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.undelete()`](/iam/reference/rest/v1/organizations.roles/undelete):
+   * * [`organizations.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/undelete):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   undeletes only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   undeletes only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -166,17 +169,20 @@ public java.lang.String getName() {
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.undelete()`](/iam/reference/rest/v1/projects.roles/undelete):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/undelete):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method undeletes
-   *   only [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.undelete()`](/iam/reference/rest/v1/organizations.roles/undelete):
+   * * [`organizations.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/undelete):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   undeletes only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   undeletes only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -400,14 +406,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.UndeleteRoleRequest)
       com.google.iam.admin.v1.UndeleteRoleRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UndeleteRoleRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UndeleteRoleRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.UndeleteRoleRequest.class,
@@ -440,7 +446,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UndeleteRoleRequest_descriptor;
     }
 
@@ -556,17 +562,20 @@ public Builder mergeFrom(
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.undelete()`](/iam/reference/rest/v1/projects.roles/undelete):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/undelete):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method undeletes
-     *   only [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.undelete()`](/iam/reference/rest/v1/organizations.roles/undelete):
+     * * [`organizations.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/undelete):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   undeletes only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   undeletes only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -594,17 +603,20 @@ public java.lang.String getName() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.undelete()`](/iam/reference/rest/v1/projects.roles/undelete):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/undelete):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method undeletes
-     *   only [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.undelete()`](/iam/reference/rest/v1/organizations.roles/undelete):
+     * * [`organizations.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/undelete):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   undeletes only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   undeletes only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -632,17 +644,20 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.undelete()`](/iam/reference/rest/v1/projects.roles/undelete):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/undelete):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method undeletes
-     *   only [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.undelete()`](/iam/reference/rest/v1/organizations.roles/undelete):
+     * * [`organizations.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/undelete):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   undeletes only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   undeletes only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -669,17 +684,20 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.undelete()`](/iam/reference/rest/v1/projects.roles/undelete):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/undelete):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method undeletes
-     *   only [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.undelete()`](/iam/reference/rest/v1/organizations.roles/undelete):
+     * * [`organizations.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/undelete):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   undeletes only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   undeletes only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -702,17 +720,20 @@ public Builder clearName() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.undelete()`](/iam/reference/rest/v1/projects.roles/undelete):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/undelete):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method undeletes
-     *   only [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.undelete()`](/iam/reference/rest/v1/organizations.roles/undelete):
+     * * [`organizations.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/undelete):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   undeletes only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   undeletes only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteRoleRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteRoleRequestOrBuilder.java
index 97bd4dd56641..197f771cd4b6 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteRoleRequestOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteRoleRequestOrBuilder.java
@@ -29,17 +29,20 @@ public interface UndeleteRoleRequestOrBuilder
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.undelete()`](/iam/reference/rest/v1/projects.roles/undelete):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/undelete):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method undeletes
-   *   only [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.undelete()`](/iam/reference/rest/v1/organizations.roles/undelete):
+   * * [`organizations.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/undelete):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   undeletes only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   undeletes only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -57,17 +60,20 @@ public interface UndeleteRoleRequestOrBuilder
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.undelete()`](/iam/reference/rest/v1/projects.roles/undelete):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/undelete):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method undeletes
-   *   only [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.undelete()`](/iam/reference/rest/v1/organizations.roles/undelete):
+   * * [`organizations.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/undelete):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   undeletes only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   undeletes only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteServiceAccountRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteServiceAccountRequest.java
index 6abd4b5847c5..c848846be145 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteServiceAccountRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteServiceAccountRequest.java
@@ -99,14 +99,14 @@ private UndeleteServiceAccountRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_UndeleteServiceAccountRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_UndeleteServiceAccountRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.UndeleteServiceAccountRequest.class,
@@ -342,14 +342,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.UndeleteServiceAccountRequest)
       com.google.iam.admin.v1.UndeleteServiceAccountRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UndeleteServiceAccountRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UndeleteServiceAccountRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.UndeleteServiceAccountRequest.class,
@@ -380,7 +380,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UndeleteServiceAccountRequest_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteServiceAccountResponse.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteServiceAccountResponse.java
index f6aab0119441..d84dfb227fcb 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteServiceAccountResponse.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UndeleteServiceAccountResponse.java
@@ -99,14 +99,14 @@ private UndeleteServiceAccountResponse(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_UndeleteServiceAccountResponse_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_UndeleteServiceAccountResponse_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.UndeleteServiceAccountResponse.class,
@@ -332,14 +332,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.UndeleteServiceAccountResponse)
       com.google.iam.admin.v1.UndeleteServiceAccountResponseOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UndeleteServiceAccountResponse_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UndeleteServiceAccountResponse_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.UndeleteServiceAccountResponse.class,
@@ -374,7 +374,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UndeleteServiceAccountResponse_descriptor;
     }
 
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UpdateRoleRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UpdateRoleRequest.java
index 0ca0f2a341a0..82d2923a1523 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UpdateRoleRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UpdateRoleRequest.java
@@ -128,14 +128,14 @@ private UpdateRoleRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_UpdateRoleRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_UpdateRoleRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.UpdateRoleRequest.class,
@@ -150,17 +150,20 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.patch()`](/iam/reference/rest/v1/projects.roles/patch):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/patch):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method updates only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.patch()`](/iam/reference/rest/v1/organizations.roles/patch):
+   * * [`organizations.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/patch):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   updates only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   updates only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -189,17 +192,20 @@ public java.lang.String getName() {
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.patch()`](/iam/reference/rest/v1/projects.roles/patch):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/patch):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method updates only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.patch()`](/iam/reference/rest/v1/organizations.roles/patch):
+   * * [`organizations.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/patch):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   updates only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   updates only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -516,14 +522,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.UpdateRoleRequest)
       com.google.iam.admin.v1.UpdateRoleRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UpdateRoleRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UpdateRoleRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.UpdateRoleRequest.class,
@@ -566,7 +572,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UpdateRoleRequest_descriptor;
     }
 
@@ -694,17 +700,20 @@ public Builder mergeFrom(
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.patch()`](/iam/reference/rest/v1/projects.roles/patch):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/patch):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method updates only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.patch()`](/iam/reference/rest/v1/organizations.roles/patch):
+     * * [`organizations.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/patch):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   updates only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   updates only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -732,17 +741,20 @@ public java.lang.String getName() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.patch()`](/iam/reference/rest/v1/projects.roles/patch):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/patch):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method updates only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.patch()`](/iam/reference/rest/v1/organizations.roles/patch):
+     * * [`organizations.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/patch):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   updates only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   updates only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -770,17 +782,20 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.patch()`](/iam/reference/rest/v1/projects.roles/patch):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/patch):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method updates only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.patch()`](/iam/reference/rest/v1/organizations.roles/patch):
+     * * [`organizations.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/patch):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   updates only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   updates only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -807,17 +822,20 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.patch()`](/iam/reference/rest/v1/projects.roles/patch):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/patch):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method updates only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.patch()`](/iam/reference/rest/v1/organizations.roles/patch):
+     * * [`organizations.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/patch):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   updates only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   updates only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -840,17 +858,20 @@ public Builder clearName() {
      * <pre>
      * The `name` parameter's value depends on the target resource for the
      * request, namely
-     * [`projects`](/iam/reference/rest/v1/projects.roles) or
-     * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-     * resource type's `name` value format is described below:
-     * * [`projects.roles.patch()`](/iam/reference/rest/v1/projects.roles/patch):
+     * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+     * or
+     * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+     * Each resource type's `name` value format is described below:
+     * * [`projects.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/patch):
      *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method updates only
-     *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-     *   created at the project level. Example request URL:
+     *   [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+     *   have been created at the project level. Example request URL:
      *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-     * * [`organizations.roles.patch()`](/iam/reference/rest/v1/organizations.roles/patch):
+     * * [`organizations.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/patch):
      *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-     *   updates only [custom roles](/iam/docs/understanding-custom-roles) that
+     *   updates only [custom
+     *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
      *   have been created at the organization level. Example request URL:
      *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
      * Note: Wildcard (*) values are invalid; you must specify a complete project
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UpdateRoleRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UpdateRoleRequestOrBuilder.java
index 7083006651e3..003a8209bd78 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UpdateRoleRequestOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UpdateRoleRequestOrBuilder.java
@@ -29,17 +29,20 @@ public interface UpdateRoleRequestOrBuilder
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.patch()`](/iam/reference/rest/v1/projects.roles/patch):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/patch):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method updates only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.patch()`](/iam/reference/rest/v1/organizations.roles/patch):
+   * * [`organizations.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/patch):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   updates only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   updates only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
@@ -57,17 +60,20 @@ public interface UpdateRoleRequestOrBuilder
    * <pre>
    * The `name` parameter's value depends on the target resource for the
    * request, namely
-   * [`projects`](/iam/reference/rest/v1/projects.roles) or
-   * [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-   * resource type's `name` value format is described below:
-   * * [`projects.roles.patch()`](/iam/reference/rest/v1/projects.roles/patch):
+   * [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+   * or
+   * [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+   * Each resource type's `name` value format is described below:
+   * * [`projects.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/patch):
    *   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method updates only
-   *   [custom roles](/iam/docs/understanding-custom-roles) that have been
-   *   created at the project level. Example request URL:
+   *   [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+   *   have been created at the project level. Example request URL:
    *   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
-   * * [`organizations.roles.patch()`](/iam/reference/rest/v1/organizations.roles/patch):
+   * * [`organizations.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/patch):
    *   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-   *   updates only [custom roles](/iam/docs/understanding-custom-roles) that
+   *   updates only [custom
+   *   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
    *   have been created at the organization level. Example request URL:
    *   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
    * Note: Wildcard (*) values are invalid; you must specify a complete project
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UploadServiceAccountKeyRequest.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UploadServiceAccountKeyRequest.java
index 54c18246a93f..317b527067e2 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UploadServiceAccountKeyRequest.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UploadServiceAccountKeyRequest.java
@@ -106,14 +106,14 @@ private UploadServiceAccountKeyRequest(
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_UploadServiceAccountKeyRequest_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.iam.admin.v1.IamProto
+    return com.google.iam.admin.v1.Iam
         .internal_static_google_iam_admin_v1_UploadServiceAccountKeyRequest_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.iam.admin.v1.UploadServiceAccountKeyRequest.class,
@@ -183,10 +183,10 @@ public com.google.protobuf.ByteString getNameBytes() {
    *
    *
    * <pre>
-   * A field that allows clients to upload their own public key. If set,
-   * use this public key data to create a service account key for given
-   * service account.
-   * Please note, the expected format for this field is X509_PEM.
+   * The public key to associate with the service account. Must be an RSA public
+   * key that is wrapped in an X.509 v3 certificate. Include the first line,
+   * `-----BEGIN CERTIFICATE-----`, and the last line,
+   * `-----END CERTIFICATE-----`.
    * </pre>
    *
    * <code>bytes public_key_data = 2;</code>
@@ -381,14 +381,14 @@ public static final class Builder extends com.google.protobuf.GeneratedMessageV3
       // @@protoc_insertion_point(builder_implements:google.iam.admin.v1.UploadServiceAccountKeyRequest)
       com.google.iam.admin.v1.UploadServiceAccountKeyRequestOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UploadServiceAccountKeyRequest_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UploadServiceAccountKeyRequest_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.iam.admin.v1.UploadServiceAccountKeyRequest.class,
@@ -421,7 +421,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.iam.admin.v1.IamProto
+      return com.google.iam.admin.v1.Iam
           .internal_static_google_iam_admin_v1_UploadServiceAccountKeyRequest_descriptor;
     }
 
@@ -663,10 +663,10 @@ public Builder setNameBytes(com.google.protobuf.ByteString value) {
      *
      *
      * <pre>
-     * A field that allows clients to upload their own public key. If set,
-     * use this public key data to create a service account key for given
-     * service account.
-     * Please note, the expected format for this field is X509_PEM.
+     * The public key to associate with the service account. Must be an RSA public
+     * key that is wrapped in an X.509 v3 certificate. Include the first line,
+     * `-----BEGIN CERTIFICATE-----`, and the last line,
+     * `-----END CERTIFICATE-----`.
      * </pre>
      *
      * <code>bytes public_key_data = 2;</code>
@@ -681,10 +681,10 @@ public com.google.protobuf.ByteString getPublicKeyData() {
      *
      *
      * <pre>
-     * A field that allows clients to upload their own public key. If set,
-     * use this public key data to create a service account key for given
-     * service account.
-     * Please note, the expected format for this field is X509_PEM.
+     * The public key to associate with the service account. Must be an RSA public
+     * key that is wrapped in an X.509 v3 certificate. Include the first line,
+     * `-----BEGIN CERTIFICATE-----`, and the last line,
+     * `-----END CERTIFICATE-----`.
      * </pre>
      *
      * <code>bytes public_key_data = 2;</code>
@@ -705,10 +705,10 @@ public Builder setPublicKeyData(com.google.protobuf.ByteString value) {
      *
      *
      * <pre>
-     * A field that allows clients to upload their own public key. If set,
-     * use this public key data to create a service account key for given
-     * service account.
-     * Please note, the expected format for this field is X509_PEM.
+     * The public key to associate with the service account. Must be an RSA public
+     * key that is wrapped in an X.509 v3 certificate. Include the first line,
+     * `-----BEGIN CERTIFICATE-----`, and the last line,
+     * `-----END CERTIFICATE-----`.
      * </pre>
      *
      * <code>bytes public_key_data = 2;</code>
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UploadServiceAccountKeyRequestOrBuilder.java b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UploadServiceAccountKeyRequestOrBuilder.java
index 5c1636b669b0..0f4b51eaa747 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UploadServiceAccountKeyRequestOrBuilder.java
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/java/com/google/iam/admin/v1/UploadServiceAccountKeyRequestOrBuilder.java
@@ -60,10 +60,10 @@ public interface UploadServiceAccountKeyRequestOrBuilder
    *
    *
    * <pre>
-   * A field that allows clients to upload their own public key. If set,
-   * use this public key data to create a service account key for given
-   * service account.
-   * Please note, the expected format for this field is X509_PEM.
+   * The public key to associate with the service account. Must be an RSA public
+   * key that is wrapped in an X.509 v3 certificate. Include the first line,
+   * `-----BEGIN CERTIFICATE-----`, and the last line,
+   * `-----END CERTIFICATE-----`.
    * </pre>
    *
    * <code>bytes public_key_data = 2;</code>
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/proto/google/iam/admin/v1/audit_data.proto b/java-iam-admin/proto-google-iam-admin-v1/src/main/proto/google/iam/admin/v1/audit_data.proto
index 090ef6b3a24a..b5b6eec0c0c7 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/proto/google/iam/admin/v1/audit_data.proto
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/proto/google/iam/admin/v1/audit_data.proto
@@ -1,4 +1,4 @@
-// Copyright 2021 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/java-iam-admin/proto-google-iam-admin-v1/src/main/proto/google/iam/admin/v1/iam.proto b/java-iam-admin/proto-google-iam-admin-v1/src/main/proto/google/iam/admin/v1/iam.proto
index 9af085007fcd..a93382362aea 100644
--- a/java-iam-admin/proto-google-iam-admin-v1/src/main/proto/google/iam/admin/v1/iam.proto
+++ b/java-iam-admin/proto-google-iam-admin-v1/src/main/proto/google/iam/admin/v1/iam.proto
@@ -1,4 +1,4 @@
-// Copyright 2021 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@ syntax = "proto3";
 
 package google.iam.admin.v1;
 
+import "google/api/annotations.proto";
 import "google/api/client.proto";
 import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
@@ -25,13 +26,11 @@ import "google/protobuf/empty.proto";
 import "google/protobuf/field_mask.proto";
 import "google/protobuf/timestamp.proto";
 import "google/type/expr.proto";
-import "google/api/annotations.proto";
 
 option cc_enable_arenas = true;
 option csharp_namespace = "Google.Cloud.Iam.Admin.V1";
 option go_package = "google.golang.org/genproto/googleapis/iam/admin/v1;admin";
 option java_multiple_files = true;
-option java_outer_classname = "IamProto";
 option java_package = "com.google.iam.admin.v1";
 option php_namespace = "Google\\Cloud\\Iam\\Admin\\V1";
 
@@ -44,9 +43,9 @@ option php_namespace = "Google\\Cloud\\Iam\\Admin\\V1";
 // * **Service account keys**, which service accounts use to authenticate with
 //   Google APIs
 // * **IAM policies for service accounts**, which specify the roles that a
-//   member has for the service account
+//   principal has for the service account
 // * **IAM custom roles**, which help you limit the number of permissions that
-//   you grant to members
+//   you grant to principals
 //
 // In addition, you can use this service to complete the following tasks, among
 // others:
@@ -54,6 +53,16 @@ option php_namespace = "Google\\Cloud\\Iam\\Admin\\V1";
 // * Test whether a service account can use specific permissions
 // * Check which roles you can grant for a specific resource
 // * Lint, or validate, condition expressions in an IAM policy
+//
+// When you read data from the IAM API, each read is eventually consistent. In
+// other words, if you write data with the IAM API, then immediately read that
+// data, the read operation might return an older version of the data. To deal
+// with this behavior, your application can retry the request with truncated
+// exponential backoff.
+//
+// In contrast, writing data to the IAM API is sequentially consistent. In other
+// words, write operations are always processed in the order in which they were
+// received.
 service IAM {
   option (google.api.default_host) = "iam.googleapis.com";
   option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
@@ -88,7 +97,7 @@ service IAM {
   //
   // Updates a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
   //
-  // You can update only the `display_name` and `description` fields.
+  // You can update only the `display_name` field.
   rpc UpdateServiceAccount(ServiceAccount) returns (ServiceAccount) {
     option (google.api.http) = {
       put: "/v1/{name=projects/*/serviceAccounts/*}"
@@ -204,7 +213,11 @@ service IAM {
     option (google.api.method_signature) = "name,private_key_type,key_algorithm";
   }
 
-  // Creates a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey], using a public key that you provide.
+  // Uploads the public key portion of a key pair that you manage, and
+  // associates the public key with a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
+  //
+  // After you upload the public key, you can use the private key from the key
+  // pair as a service account key.
   rpc UploadServiceAccountKey(UploadServiceAccountKeyRequest) returns (ServiceAccountKey) {
     option (google.api.http) = {
       post: "/v1/{name=projects/*/serviceAccounts/*}/keys:upload"
@@ -222,6 +235,25 @@ service IAM {
     option (google.api.method_signature) = "name";
   }
 
+  // Disable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey]. A disabled service account key can be
+  // re-enabled with [EnableServiceAccountKey][google.iam.admin.v1.IAM.EnableServiceAccountKey].
+  rpc DisableServiceAccountKey(DisableServiceAccountKeyRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      post: "/v1/{name=projects/*/serviceAccounts/*/keys/*}:disable"
+      body: "*"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Enable a [ServiceAccountKey][google.iam.admin.v1.ServiceAccountKey].
+  rpc EnableServiceAccountKey(EnableServiceAccountKeyRequest) returns (google.protobuf.Empty) {
+    option (google.api.http) = {
+      post: "/v1/{name=projects/*/serviceAccounts/*/keys/*}:enable"
+      body: "*"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
   // **Note:** This method is deprecated. Use the
   // [`signBlob`](https://cloud.google.com/iam/help/rest-credentials/v1/projects.serviceAccounts/signBlob)
   // method in the IAM Service Account Credentials API instead. If you currently
@@ -258,7 +290,7 @@ service IAM {
   }
 
   // Gets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount]. This IAM
-  // policy specifies which members have access to the service account.
+  // policy specifies which principals have access to the service account.
   //
   // This method does not tell you whether the service account has been granted
   // any roles on other resources. To check whether a service account has role
@@ -277,7 +309,7 @@ service IAM {
   // Sets the IAM policy that is attached to a [ServiceAccount][google.iam.admin.v1.ServiceAccount].
   //
   // Use this method to grant or revoke access to the service account. For
-  // example, you could grant a member the ability to impersonate the service
+  // example, you could grant a principal the ability to impersonate the service
   // account.
   //
   // This method does not enable the service account to access other resources.
@@ -289,8 +321,10 @@ service IAM {
   // 3. Call the resource's `setIamPolicy` method to update its IAM policy.
   //
   // For detailed instructions, see
-  // [Granting roles to a service account for specific
-  // resources](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts).
+  // [Manage access to project, folders, and
+  // organizations](https://cloud.google.com/iam/help/service-accounts/granting-access-to-service-accounts)
+  // or [Manage access to other
+  // resources](https://cloud.google.com/iam/help/access/manage-other-resources).
   rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest) returns (google.iam.v1.Policy) {
     option (google.api.http) = {
       post: "/v1/{resource=projects/*/serviceAccounts/*}:setIamPolicy"
@@ -375,7 +409,7 @@ service IAM {
   //
   // When you delete a custom role, the following changes occur immediately:
   //
-  // * You cannot bind a member to the custom role in an IAM
+  // * You cannot bind a principal to the custom role in an IAM
   // [Policy][google.iam.v1.Policy].
   // * Existing bindings to the custom role are not changed, but they have no
   // effect.
@@ -410,7 +444,7 @@ service IAM {
   }
 
   // Lists every permission that you can test on a resource. A permission is
-  // testable if you can check whether a member has that permission on the
+  // testable if you can check whether a principal has that permission on the
   // resource.
   rpc QueryTestablePermissions(QueryTestablePermissionsRequest) returns (QueryTestablePermissionsResponse) {
     option (google.api.http) = {
@@ -603,8 +637,7 @@ message DeleteServiceAccountRequest {
   ];
 }
 
-// The request for
-// [PatchServiceAccount][google.iam.admin.v1.PatchServiceAccount].
+// The service account patch request.
 //
 // You can patch only the `display_name` and `description` fields. You must use
 // the `update_mask` field to specify which of these fields you want to patch.
@@ -707,9 +740,59 @@ message GetServiceAccountKeyRequest {
     }
   ];
 
-  // The output format of the public key requested.
-  // X509_PEM is the default output format.
-  ServiceAccountPublicKeyType public_key_type = 2;
+  // Optional. The output format of the public key. The default is `TYPE_NONE`, which
+  // means that the public key is not returned.
+  ServiceAccountPublicKeyType public_key_type = 2 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Supported key algorithms.
+enum ServiceAccountKeyAlgorithm {
+  // An unspecified key algorithm.
+  KEY_ALG_UNSPECIFIED = 0;
+
+  // 1k RSA Key.
+  KEY_ALG_RSA_1024 = 1;
+
+  // 2k RSA Key.
+  KEY_ALG_RSA_2048 = 2;
+}
+
+// Supported private key output formats.
+enum ServiceAccountPrivateKeyType {
+  // Unspecified. Equivalent to `TYPE_GOOGLE_CREDENTIALS_FILE`.
+  TYPE_UNSPECIFIED = 0;
+
+  // PKCS12 format.
+  // The password for the PKCS12 file is `notasecret`.
+  // For more information, see https://tools.ietf.org/html/rfc7292.
+  TYPE_PKCS12_FILE = 1;
+
+  // Google Credentials File format.
+  TYPE_GOOGLE_CREDENTIALS_FILE = 2;
+}
+
+// Supported public key output formats.
+enum ServiceAccountPublicKeyType {
+  // Do not return the public key.
+  TYPE_NONE = 0;
+
+  // X509 PEM format.
+  TYPE_X509_PEM_FILE = 1;
+
+  // Raw public key.
+  TYPE_RAW_PUBLIC_KEY = 2;
+}
+
+// Service Account Key Origin.
+enum ServiceAccountKeyOrigin {
+  // Unspecified key origin.
+  ORIGIN_UNSPECIFIED = 0;
+
+  // Key is provided by user.
+  USER_PROVIDED = 1;
+
+  // Key is provided by Google.
+  GOOGLE_PROVIDED = 2;
 }
 
 // Represents a service account key.
@@ -783,6 +866,9 @@ message ServiceAccountKey {
 
   // The key type.
   ListServiceAccountKeysRequest.KeyType key_type = 10;
+
+  // The key status.
+  bool disabled = 11;
 }
 
 // The service account key create request.
@@ -819,10 +905,10 @@ message UploadServiceAccountKeyRequest {
   // `unique_id` of the service account.
   string name = 1;
 
-  // A field that allows clients to upload their own public key. If set,
-  // use this public key data to create a service account key for given
-  // service account.
-  // Please note, the expected format for this field is X509_PEM.
+  // The public key to associate with the service account. Must be an RSA public
+  // key that is wrapped in an X.509 v3 certificate. Include the first line,
+  // `-----BEGIN CERTIFICATE-----`, and the last line,
+  // `-----END CERTIFICATE-----`.
   bytes public_key_data = 2;
 }
 
@@ -841,6 +927,38 @@ message DeleteServiceAccountKeyRequest {
   ];
 }
 
+// The service account key disable request.
+message DisableServiceAccountKeyRequest {
+  // Required. The resource name of the service account key in the following format:
+  // `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+  //
+  // Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+  // the account. The `ACCOUNT` value can be the `email` address or the
+  // `unique_id` of the service account.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "iam.googleapis.com/Key"
+    }
+  ];
+}
+
+// The service account key enable request.
+message EnableServiceAccountKeyRequest {
+  // Required. The resource name of the service account key in the following format:
+  // `projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}`.
+  //
+  // Using `-` as a wildcard for the `PROJECT_ID` will infer the project from
+  // the account. The `ACCOUNT` value can be the `email` address or the
+  // `unique_id` of the service account.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "iam.googleapis.com/Key"
+    }
+  ];
+}
+
 // Deprecated. [Migrate to Service Account Credentials
 // API](https://cloud.google.com/iam/help/credentials/migrate-api).
 //
@@ -890,56 +1008,6 @@ message SignBlobResponse {
   bytes signature = 2 [deprecated = true];
 }
 
-// Supported key algorithms.
-enum ServiceAccountKeyAlgorithm {
-  // An unspecified key algorithm.
-  KEY_ALG_UNSPECIFIED = 0;
-
-  // 1k RSA Key.
-  KEY_ALG_RSA_1024 = 1;
-
-  // 2k RSA Key.
-  KEY_ALG_RSA_2048 = 2;
-}
-
-// Supported private key output formats.
-enum ServiceAccountPrivateKeyType {
-  // Unspecified. Equivalent to `TYPE_GOOGLE_CREDENTIALS_FILE`.
-  TYPE_UNSPECIFIED = 0;
-
-  // PKCS12 format.
-  // The password for the PKCS12 file is `notasecret`.
-  // For more information, see https://tools.ietf.org/html/rfc7292.
-  TYPE_PKCS12_FILE = 1;
-
-  // Google Credentials File format.
-  TYPE_GOOGLE_CREDENTIALS_FILE = 2;
-}
-
-// Supported public key output formats.
-enum ServiceAccountPublicKeyType {
-  // Unspecified. Returns nothing here.
-  TYPE_NONE = 0;
-
-  // X509 PEM format.
-  TYPE_X509_PEM_FILE = 1;
-
-  // Raw public key.
-  TYPE_RAW_PUBLIC_KEY = 2;
-}
-
-// Service Account Key Origin.
-enum ServiceAccountKeyOrigin {
-  // Unspecified key origin.
-  ORIGIN_UNSPECIFIED = 0;
-
-  // Key is provided by user.
-  USER_PROVIDED = 1;
-
-  // Key is provided by Google.
-  GOOGLE_PROVIDED = 2;
-}
-
 // Deprecated. [Migrate to Service Account Credentials
 // API](https://cloud.google.com/iam/help/credentials/migrate-api).
 //
@@ -968,8 +1036,8 @@ message SignJwtRequest {
   // JWT Claims Set. For example: `{"sub": "user@example.com", "iat": 313435}`
   //
   // If the JWT Claims Set contains an expiration time (`exp`) claim, it must be
-  // an integer timestamp that is not in the past and no more than 1 hour in the
-  // future.
+  // an integer timestamp that is not in the past and no more than 12 hours in
+  // the future.
   //
   // If the JWT Claims Set does not contain an expiration time (`exp`) claim,
   // this claim is added automatically, with a timestamp that is 1 hour in the
@@ -1016,8 +1084,8 @@ message Role {
     // The user has indicated this role is being deprecated.
     DEPRECATED = 4;
 
-    // This role is disabled and will not contribute permissions to any members
-    // it is granted to in policies.
+    // This role is disabled and will not contribute permissions to any
+    // principals it is granted to in policies.
     DISABLED = 5;
 
     // The user has indicated this role is currently in an EAP phase.
@@ -1087,36 +1155,51 @@ message QueryGrantableRolesResponse {
   string next_page_token = 2;
 }
 
+// A view for Role objects.
+enum RoleView {
+  // Omits the `included_permissions` field.
+  // This is the default value.
+  BASIC = 0;
+
+  // Returns all fields.
+  FULL = 1;
+}
+
 // The request to get all roles defined under a resource.
 message ListRolesRequest {
   // The `parent` parameter's value depends on the target resource for the
   // request, namely
-  // [`roles`](/iam/reference/rest/v1/roles),
-  // [`projects`](/iam/reference/rest/v1/projects.roles), or
-  // [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-  // resource type's `parent` value format is described below:
+  // [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+  // [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+  // or
+  // [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+  // Each resource type's `parent` value format is described below:
   //
-  // * [`roles.list()`](/iam/reference/rest/v1/roles/list): An empty string.
+  // * [`roles.list()`](https://cloud.google.com/iam/reference/rest/v1/roles/list): An empty string.
   //   This method doesn't require a resource; it simply returns all
-  //   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-  //   Cloud IAM. Example request URL:
-  //   `https://iam.googleapis.com/v1/roles`
+  //   [predefined
+  //   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+  //   in Cloud IAM. Example request URL: `https://iam.googleapis.com/v1/roles`
   //
-  // * [`projects.roles.list()`](/iam/reference/rest/v1/projects.roles/list):
+  // * [`projects.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/list):
   //   `projects/{PROJECT_ID}`. This method lists all project-level
-  //   [custom roles](/iam/docs/understanding-custom-roles).
+  //   [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
   //   Example request URL:
   //   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
   //
-  // * [`organizations.roles.list()`](/iam/reference/rest/v1/organizations.roles/list):
+  // * [`organizations.roles.list()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/list):
   //   `organizations/{ORGANIZATION_ID}`. This method lists all
-  //   organization-level [custom roles](/iam/docs/understanding-custom-roles).
+  //   organization-level [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
   //   Example request URL:
   //   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
   //
   // Note: Wildcard (*) values are invalid; you must specify a complete project
   // ID or organization ID.
-  string parent = 1 [(google.api.resource_reference).type = "*"];
+  string parent = 1 [(google.api.resource_reference) = {
+                       type: "*"
+                     }];
 
   // Optional limit on the number of roles to include in the response.
   //
@@ -1150,57 +1233,68 @@ message ListRolesResponse {
 message GetRoleRequest {
   // The `name` parameter's value depends on the target resource for the
   // request, namely
-  // [`roles`](/iam/reference/rest/v1/roles),
-  // [`projects`](/iam/reference/rest/v1/projects.roles), or
-  // [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-  // resource type's `name` value format is described below:
+  // [`roles`](https://cloud.google.com/iam/reference/rest/v1/roles),
+  // [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles),
+  // or
+  // [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+  // Each resource type's `name` value format is described below:
   //
-  // * [`roles.get()`](/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
+  // * [`roles.get()`](https://cloud.google.com/iam/reference/rest/v1/roles/get): `roles/{ROLE_NAME}`.
   //   This method returns results from all
-  //   [predefined roles](/iam/docs/understanding-roles#predefined_roles) in
-  //   Cloud IAM. Example request URL:
+  //   [predefined
+  //   roles](https://cloud.google.com/iam/docs/understanding-roles#predefined_roles)
+  //   in Cloud IAM. Example request URL:
   //   `https://iam.googleapis.com/v1/roles/{ROLE_NAME}`
   //
-  // * [`projects.roles.get()`](/iam/reference/rest/v1/projects.roles/get):
+  // * [`projects.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/get):
   //   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method returns only
-  //   [custom roles](/iam/docs/understanding-custom-roles) that have been
-  //   created at the project level. Example request URL:
+  //   [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+  //   have been created at the project level. Example request URL:
   //   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
   //
-  // * [`organizations.roles.get()`](/iam/reference/rest/v1/organizations.roles/get):
+  // * [`organizations.roles.get()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/get):
   //   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-  //   returns only [custom roles](/iam/docs/understanding-custom-roles) that
+  //   returns only [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
   //   have been created at the organization level. Example request URL:
   //   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
   //
   // Note: Wildcard (*) values are invalid; you must specify a complete project
   // ID or organization ID.
-  string name = 1 [(google.api.resource_reference).type = "*"];
+  string name = 1 [(google.api.resource_reference) = {
+                     type: "*"
+                   }];
 }
 
 // The request to create a new role.
 message CreateRoleRequest {
   // The `parent` parameter's value depends on the target resource for the
   // request, namely
-  // [`projects`](/iam/reference/rest/v1/projects.roles) or
-  // [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-  // resource type's `parent` value format is described below:
+  // [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+  // or
+  // [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+  // Each resource type's `parent` value format is described below:
   //
-  // * [`projects.roles.create()`](/iam/reference/rest/v1/projects.roles/create):
+  // * [`projects.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/create):
   //   `projects/{PROJECT_ID}`. This method creates project-level
-  //   [custom roles](/iam/docs/understanding-custom-roles).
+  //   [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
   //   Example request URL:
   //   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles`
   //
-  // * [`organizations.roles.create()`](/iam/reference/rest/v1/organizations.roles/create):
+  // * [`organizations.roles.create()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/create):
   //   `organizations/{ORGANIZATION_ID}`. This method creates organization-level
-  //   [custom roles](/iam/docs/understanding-custom-roles). Example request
-  //   URL:
+  //   [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles).
+  //   Example request URL:
   //   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles`
   //
   // Note: Wildcard (*) values are invalid; you must specify a complete project
   // ID or organization ID.
-  string parent = 1 [(google.api.resource_reference).type = "*"];
+  string parent = 1 [(google.api.resource_reference) = {
+                       type: "*"
+                     }];
 
   // The role ID to use for this role.
   //
@@ -1217,25 +1311,30 @@ message CreateRoleRequest {
 message UpdateRoleRequest {
   // The `name` parameter's value depends on the target resource for the
   // request, namely
-  // [`projects`](/iam/reference/rest/v1/projects.roles) or
-  // [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-  // resource type's `name` value format is described below:
+  // [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+  // or
+  // [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+  // Each resource type's `name` value format is described below:
   //
-  // * [`projects.roles.patch()`](/iam/reference/rest/v1/projects.roles/patch):
+  // * [`projects.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/patch):
   //   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method updates only
-  //   [custom roles](/iam/docs/understanding-custom-roles) that have been
-  //   created at the project level. Example request URL:
+  //   [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+  //   have been created at the project level. Example request URL:
   //   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
   //
-  // * [`organizations.roles.patch()`](/iam/reference/rest/v1/organizations.roles/patch):
+  // * [`organizations.roles.patch()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/patch):
   //   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-  //   updates only [custom roles](/iam/docs/understanding-custom-roles) that
+  //   updates only [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
   //   have been created at the organization level. Example request URL:
   //   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
   //
   // Note: Wildcard (*) values are invalid; you must specify a complete project
   // ID or organization ID.
-  string name = 1 [(google.api.resource_reference).type = "*"];
+  string name = 1 [(google.api.resource_reference) = {
+                     type: "*"
+                   }];
 
   // The updated role.
   Role role = 2;
@@ -1248,25 +1347,30 @@ message UpdateRoleRequest {
 message DeleteRoleRequest {
   // The `name` parameter's value depends on the target resource for the
   // request, namely
-  // [`projects`](/iam/reference/rest/v1/projects.roles) or
-  // [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-  // resource type's `name` value format is described below:
+  // [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+  // or
+  // [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+  // Each resource type's `name` value format is described below:
   //
-  // * [`projects.roles.delete()`](/iam/reference/rest/v1/projects.roles/delete):
+  // * [`projects.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/delete):
   //   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method deletes only
-  //   [custom roles](/iam/docs/understanding-custom-roles) that have been
-  //   created at the project level. Example request URL:
+  //   [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+  //   have been created at the project level. Example request URL:
   //   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
   //
-  // * [`organizations.roles.delete()`](/iam/reference/rest/v1/organizations.roles/delete):
+  // * [`organizations.roles.delete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/delete):
   //   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-  //   deletes only [custom roles](/iam/docs/understanding-custom-roles) that
+  //   deletes only [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
   //   have been created at the organization level. Example request URL:
   //   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
   //
   // Note: Wildcard (*) values are invalid; you must specify a complete project
   // ID or organization ID.
-  string name = 1 [(google.api.resource_reference).type = "*"];
+  string name = 1 [(google.api.resource_reference) = {
+                     type: "*"
+                   }];
 
   // Used to perform a consistent read-modify-write.
   bytes etag = 2;
@@ -1276,25 +1380,30 @@ message DeleteRoleRequest {
 message UndeleteRoleRequest {
   // The `name` parameter's value depends on the target resource for the
   // request, namely
-  // [`projects`](/iam/reference/rest/v1/projects.roles) or
-  // [`organizations`](/iam/reference/rest/v1/organizations.roles). Each
-  // resource type's `name` value format is described below:
+  // [`projects`](https://cloud.google.com/iam/reference/rest/v1/projects.roles)
+  // or
+  // [`organizations`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles).
+  // Each resource type's `name` value format is described below:
   //
-  // * [`projects.roles.undelete()`](/iam/reference/rest/v1/projects.roles/undelete):
+  // * [`projects.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/projects.roles/undelete):
   //   `projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`. This method undeletes
-  //   only [custom roles](/iam/docs/understanding-custom-roles) that have been
-  //   created at the project level. Example request URL:
+  //   only [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
+  //   have been created at the project level. Example request URL:
   //   `https://iam.googleapis.com/v1/projects/{PROJECT_ID}/roles/{CUSTOM_ROLE_ID}`
   //
-  // * [`organizations.roles.undelete()`](/iam/reference/rest/v1/organizations.roles/undelete):
+  // * [`organizations.roles.undelete()`](https://cloud.google.com/iam/reference/rest/v1/organizations.roles/undelete):
   //   `organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`. This method
-  //   undeletes only [custom roles](/iam/docs/understanding-custom-roles) that
+  //   undeletes only [custom
+  //   roles](https://cloud.google.com/iam/docs/understanding-custom-roles) that
   //   have been created at the organization level. Example request URL:
   //   `https://iam.googleapis.com/v1/organizations/{ORGANIZATION_ID}/roles/{CUSTOM_ROLE_ID}`
   //
   // Note: Wildcard (*) values are invalid; you must specify a complete project
   // ID or organization ID.
-  string name = 1 [(google.api.resource_reference).type = "*"];
+  string name = 1 [(google.api.resource_reference) = {
+                     type: "*"
+                   }];
 
   // Used to perform a consistent read-modify-write.
   bytes etag = 2;
@@ -1319,7 +1428,7 @@ message Permission {
 
   // The state of the permission with regards to custom roles.
   enum CustomRolesSupportLevel {
-    // Permission is fully supported for custom role use.
+    // Default state. Permission is fully supported for custom role use.
     SUPPORTED = 0;
 
     // Permission is being tested to check custom role compatibility.
@@ -1459,7 +1568,7 @@ message LintResult {
     // This includes the following common scenarios:
     //
     // - Unsatisfiable condition: Expired timestamp in date/time condition.
-    // - Ineffective condition: Condition on a <member, role> pair which is
+    // - Ineffective condition: Condition on a <principal, role> pair which is
     //   granted unconditionally in another binding of the same policy.
     WARNING = 2;
 
@@ -1512,13 +1621,3 @@ message LintPolicyResponse {
   // List of lint results sorted by `severity` in descending order.
   repeated LintResult lint_results = 1;
 }
-
-// A view for Role objects.
-enum RoleView {
-  // Omits the `included_permissions` field.
-  // This is the default value.
-  BASIC = 0;
-
-  // Returns all fields.
-  FULL = 1;
-}