gcp-cloudidentity-inbound-oidc-client-secret-input
An inbound OIDC SSO profile carries its relying-party client secret only in create or patch input; the official methods document OAuth scopes but no IAM permission action.
Where it sits
| location | cloudidentity.inboundOidcSsoProfiles.create/cloudidentity.inboundOidcSsoProfiles.patch.request.rpConfig.clientSecret |
|---|
| location kind | secret_value |
|---|
| data kinds | oauth_token secret_key credential |
|---|
| emits edge | ContainsCredential |
|---|
| service | Cloud Identity / Workspace (gcp:cloudidentity) |
|---|
Collection recipe
| access mode | write_only_input |
|---|
| operation | cloudidentity.inboundOidcSsoProfiles.create/cloudidentity.inboundOidcSsoProfiles.patch |
|---|
| response path | request.rpConfig.clientSecret |
|---|
| encoding | string |
|---|
| params | {"name": "\u003cresource-name\u003e"} |
|---|
References