gcf-merge-on-green · Oct 9, 2026 · Oct 9, 2026
@@ -22,7 +22,7 @@ Add the following lines to your `pom.xml` file:
     <dependency>
       <groupId>com.google.apis</groupId>
       <artifactId>google-api-services-integrations</artifactId>
-      <version>v1-rev20260927-2.0.0</version>
+      <version>v1-rev20261004-2.0.0</version>
     </dependency>
   </dependencies>
 </project>
@@ -35,7 +35,7 @@ repositories {
   mavenCentral()
 }
 dependencies {
-  implementation 'com.google.apis:google-api-services-integrations:v1-rev20260927-2.0.0'
+  implementation 'com.google.apis:google-api-services-integrations:v1-rev20261004-2.0.0'
 }
 ```
 

@@ -93,6 +93,15 @@ public final class GoogleCloudIntegrationsV1alphaIntegrationVersion extends com.
     com.google.api.client.util.Data.nullOf(GoogleCloudIntegrationsV1alphaErrorCatcherConfig.class);
   }
 
+  /**
+   * Output only. The EUC hardening disposition of this version. Set by the service when the
+   * integration is first created and inherited unchanged by every later version, so all versions of
+   * an integration report the same value.
+   * The value may be {@code null}.
+   */
+  @com.google.api.client.util.Key
+  private java.lang.String eucHardeningDisposition;
+
   /**
    * Optional. Config Parameters that are expected to be passed to the integration when an
    * integration is published. This consists of all the parameters that are expected to provide
@@ -410,6 +419,27 @@ public GoogleCloudIntegrationsV1alphaIntegrationVersion setErrorCatcherConfigs(j
     return this;
   }
 
+  /**
+   * Output only. The EUC hardening disposition of this version. Set by the service when the
+   * integration is first created and inherited unchanged by every later version, so all versions of
+   * an integration report the same value.
+   * @return value or {@code null} for none
+   */
+  public java.lang.String getEucHardeningDisposition() {
+    return eucHardeningDisposition;
+  }
+
+  /**
+   * Output only. The EUC hardening disposition of this version. Set by the service when the
+   * integration is first created and inherited unchanged by every later version, so all versions of
+   * an integration report the same value.
+   * @param eucHardeningDisposition eucHardeningDisposition or {@code null} for none
+   */
+  public GoogleCloudIntegrationsV1alphaIntegrationVersion setEucHardeningDisposition(java.lang.String eucHardeningDisposition) {
+    this.eucHardeningDisposition = eucHardeningDisposition;
+    return this;
+  }
+
   /**
    * Optional. Config Parameters that are expected to be passed to the integration when an
    * integration is published. This consists of all the parameters that are expected to provide

@@ -37,16 +37,19 @@ public final class GoogleCloudIntegrationsV1alphaTestIntegrationsRequest extends
    * drained under the integration's run-as service account, exactly as a real Cloud Scheduler,
    * cron, Pub/Sub, Salesforce or connector fire would be. That is the only way to verify the
    * credential path an asynchronous trigger actually takes; a synchronous test always carries the
-   * caller's own credential and so exercises the opposite branch. When `true`: * Only the
-   * **published** (`ACTIVE`) version runs. The asynchronous path resolves the integration from
-   * storage by `trigger_id`, so a draft cannot be tested this way. `integration_version` must
-   * therefore carry only `name`; supplying any other field is rejected, rather than silently
-   * running something other than what was passed. * The response carries `execution_id` only.
-   * `execution_failed`, `event_parameters`, `parameters` and `parameter_entries` describe a
-   * finished run and are left unset, because nothing has run yet. In particular, do not read
-   * `execution_failed` as a pass signal. * The run is real, with real side effects, quota and
-   * concurrency. No actual Pub/Sub push or Cloud Scheduler tick occurs; only the enqueue is
-   * simulated, which does not change the credential path.
+   * caller's own credential and so exercises the opposite branch. When `true`: * The version named
+   * by `integration_version.name` runs. A name ending in `/versions/{version}` runs that exact
+   * version, published or draft; a name without one runs the published (`ACTIVE`) version on the
+   * trigger. Either way the integration is resolved from storage, so `integration_version` must
+   * carry only `name`; supplying any other field is rejected, rather than silently running
+   * something other than what was passed. * A draft is validated before it is enqueued, including
+   * the check that the caller may act as the integration's run-as service account. Testing a draft
+   * therefore fails fast on a configuration a publish would reject. * The response carries
+   * `execution_id` only. `execution_failed`, `event_parameters`, `parameters` and
+   * `parameter_entries` describe a finished run and are left unset, because nothing has run yet. In
+   * particular, do not read `execution_failed` as a pass signal. * The run is real, with real side
+   * effects, quota and concurrency. No actual Pub/Sub push or Cloud Scheduler tick occurs; only the
+   * enqueue is simulated, which does not change the credential path.
    * The value may be {@code null}.
    */
   @com.google.api.client.util.Key
@@ -66,6 +69,18 @@ public final class GoogleCloudIntegrationsV1alphaTestIntegrationsRequest extends
   @com.google.api.client.util.Key
   private java.util.Map<String, java.lang.Object> configParameters;
 
+  /**
+   * Optional. The credential flow to run the test under. Applies to synchronous tests only. When
+   * unset, the default depends on when the test runs: before the EUC hardening cutover it is
+   * `CREDENTIAL_MODE_CURRENT`; from the cutover on it is `CREDENTIAL_MODE_HARDENED`, whatever the
+   * integration's stored disposition. Where the hardened flow cannot be evaluated, an unset mode
+   * runs `CREDENTIAL_MODE_CURRENT` instead of failing. The response's `credential_mode` reports the
+   * mode that ran.
+   * The value may be {@code null}.
+   */
+  @com.google.api.client.util.Key
+  private java.lang.String credentialMode;
+
   /**
    * Optional. custom deadline of the rpc
    * The value may be {@code null}.
@@ -119,16 +134,19 @@ public final class GoogleCloudIntegrationsV1alphaTestIntegrationsRequest extends
    * drained under the integration's run-as service account, exactly as a real Cloud Scheduler,
    * cron, Pub/Sub, Salesforce or connector fire would be. That is the only way to verify the
    * credential path an asynchronous trigger actually takes; a synchronous test always carries the
-   * caller's own credential and so exercises the opposite branch. When `true`: * Only the
-   * **published** (`ACTIVE`) version runs. The asynchronous path resolves the integration from
-   * storage by `trigger_id`, so a draft cannot be tested this way. `integration_version` must
-   * therefore carry only `name`; supplying any other field is rejected, rather than silently
-   * running something other than what was passed. * The response carries `execution_id` only.
-   * `execution_failed`, `event_parameters`, `parameters` and `parameter_entries` describe a
-   * finished run and are left unset, because nothing has run yet. In particular, do not read
-   * `execution_failed` as a pass signal. * The run is real, with real side effects, quota and
-   * concurrency. No actual Pub/Sub push or Cloud Scheduler tick occurs; only the enqueue is
-   * simulated, which does not change the credential path.
+   * caller's own credential and so exercises the opposite branch. When `true`: * The version named
+   * by `integration_version.name` runs. A name ending in `/versions/{version}` runs that exact
+   * version, published or draft; a name without one runs the published (`ACTIVE`) version on the
+   * trigger. Either way the integration is resolved from storage, so `integration_version` must
+   * carry only `name`; supplying any other field is rejected, rather than silently running
+   * something other than what was passed. * A draft is validated before it is enqueued, including
+   * the check that the caller may act as the integration's run-as service account. Testing a draft
+   * therefore fails fast on a configuration a publish would reject. * The response carries
+   * `execution_id` only. `execution_failed`, `event_parameters`, `parameters` and
+   * `parameter_entries` describe a finished run and are left unset, because nothing has run yet. In
+   * particular, do not read `execution_failed` as a pass signal. * The run is real, with real side
+   * effects, quota and concurrency. No actual Pub/Sub push or Cloud Scheduler tick occurs; only the
+   * enqueue is simulated, which does not change the credential path.
    * @return value or {@code null} for none
    */
   public java.lang.Boolean getAsyncExecution() {
@@ -142,16 +160,19 @@ public java.lang.Boolean getAsyncExecution() {
    * drained under the integration's run-as service account, exactly as a real Cloud Scheduler,
    * cron, Pub/Sub, Salesforce or connector fire would be. That is the only way to verify the
    * credential path an asynchronous trigger actually takes; a synchronous test always carries the
-   * caller's own credential and so exercises the opposite branch. When `true`: * Only the
-   * **published** (`ACTIVE`) version runs. The asynchronous path resolves the integration from
-   * storage by `trigger_id`, so a draft cannot be tested this way. `integration_version` must
-   * therefore carry only `name`; supplying any other field is rejected, rather than silently
-   * running something other than what was passed. * The response carries `execution_id` only.
-   * `execution_failed`, `event_parameters`, `parameters` and `parameter_entries` describe a
-   * finished run and are left unset, because nothing has run yet. In particular, do not read
-   * `execution_failed` as a pass signal. * The run is real, with real side effects, quota and
-   * concurrency. No actual Pub/Sub push or Cloud Scheduler tick occurs; only the enqueue is
-   * simulated, which does not change the credential path.
+   * caller's own credential and so exercises the opposite branch. When `true`: * The version named
+   * by `integration_version.name` runs. A name ending in `/versions/{version}` runs that exact
+   * version, published or draft; a name without one runs the published (`ACTIVE`) version on the
+   * trigger. Either way the integration is resolved from storage, so `integration_version` must
+   * carry only `name`; supplying any other field is rejected, rather than silently running
+   * something other than what was passed. * A draft is validated before it is enqueued, including
+   * the check that the caller may act as the integration's run-as service account. Testing a draft
+   * therefore fails fast on a configuration a publish would reject. * The response carries
+   * `execution_id` only. `execution_failed`, `event_parameters`, `parameters` and
+   * `parameter_entries` describe a finished run and are left unset, because nothing has run yet. In
+   * particular, do not read `execution_failed` as a pass signal. * The run is real, with real side
+   * effects, quota and concurrency. No actual Pub/Sub push or Cloud Scheduler tick occurs; only the
+   * enqueue is simulated, which does not change the credential path.
    * @param asyncExecution asyncExecution or {@code null} for none
    */
   public GoogleCloudIntegrationsV1alphaTestIntegrationsRequest setAsyncExecution(java.lang.Boolean asyncExecution) {
@@ -193,6 +214,33 @@ public GoogleCloudIntegrationsV1alphaTestIntegrationsRequest setConfigParameters
     return this;
   }
 
+  /**
+   * Optional. The credential flow to run the test under. Applies to synchronous tests only. When
+   * unset, the default depends on when the test runs: before the EUC hardening cutover it is
+   * `CREDENTIAL_MODE_CURRENT`; from the cutover on it is `CREDENTIAL_MODE_HARDENED`, whatever the
+   * integration's stored disposition. Where the hardened flow cannot be evaluated, an unset mode
+   * runs `CREDENTIAL_MODE_CURRENT` instead of failing. The response's `credential_mode` reports the
+   * mode that ran.
+   * @return value or {@code null} for none
+   */
+  public java.lang.String getCredentialMode() {
+    return credentialMode;
+  }
+
+  /**
+   * Optional. The credential flow to run the test under. Applies to synchronous tests only. When
+   * unset, the default depends on when the test runs: before the EUC hardening cutover it is
+   * `CREDENTIAL_MODE_CURRENT`; from the cutover on it is `CREDENTIAL_MODE_HARDENED`, whatever the
+   * integration's stored disposition. Where the hardened flow cannot be evaluated, an unset mode
+   * runs `CREDENTIAL_MODE_CURRENT` instead of failing. The response's `credential_mode` reports the
+   * mode that ran.
+   * @param credentialMode credentialMode or {@code null} for none
+   */
+  public GoogleCloudIntegrationsV1alphaTestIntegrationsRequest setCredentialMode(java.lang.String credentialMode) {
+    this.credentialMode = credentialMode;
+    return this;
+  }
+
   /**
    * Optional. custom deadline of the rpc
    * @return value or {@code null} for none

@@ -30,6 +30,21 @@
 @SuppressWarnings("javadoc")
 public final class GoogleCloudIntegrationsV1alphaTestIntegrationsResponse extends com.google.api.client.json.GenericJson {
 
+  /**
+   * The credential flow the test ran under. Unset for asynchronous tests.
+   * The value may be {@code null}.
+   */
+  @com.google.api.client.util.Key
+  private java.lang.String credentialMode;
+
+  /**
+   * The EUC hardening disposition stored for the tested integration, read before the run. Unset for
+   * asynchronous tests.
+   * The value may be {@code null}.
+   */
+  @com.google.api.client.util.Key
+  private java.lang.String eucHardeningDisposition;
+
   /**
    * Details for the integration that were executed.
    * The value may be {@code null}.
@@ -51,6 +66,22 @@ public final class GoogleCloudIntegrationsV1alphaTestIntegrationsResponse extend
   @com.google.api.client.util.Key
   private java.lang.String executionId;
 
+  /**
+   * The credential paths the hardened flow covers for this test: each one that a task in the tested
+   * integration reaches and that the server running the test hardens, whatever the credential mode.
+   * A `CREDENTIAL_MODE_CURRENT` test of an integration not stored as hardened usually lists none,
+   * and a `CREDENTIAL_MODE_HARDENED` response with no paths means nothing in this integration was
+   * hardened. Empty where the hardened flow is switched off. Unset for asynchronous tests. Derived
+   * from the integration's task types before the run: it reports presence in the graph, not
+   * execution, so a task on a branch that did not run is still counted, as is a Call Integration
+   * task that runs as a configured service account. A sub-integration's own tasks are not included;
+   * each runs under its own stored disposition. Integration Connectors tasks and Cloud Scheduler
+   * triggers are never reported: the services they call do not yet accept the hardened credential.
+   * The value may be {@code null}.
+   */
+  @com.google.api.client.util.Key
+  private java.util.List<java.lang.String> hardenedPaths;
+
   /**
    * Parameters are a part of Event and can be used to communicate between different tasks that are
    * part of the same integration execution.
@@ -73,6 +104,42 @@ public final class GoogleCloudIntegrationsV1alphaTestIntegrationsResponse extend
   @com.google.api.client.util.Key
   private java.util.Map<String, GoogleCloudIntegrationsV1alphaValueType> parameters;
 
+  /**
+   * The credential flow the test ran under. Unset for asynchronous tests.
+   * @return value or {@code null} for none
+   */
+  public java.lang.String getCredentialMode() {
+    return credentialMode;
+  }
+
+  /**
+   * The credential flow the test ran under. Unset for asynchronous tests.
+   * @param credentialMode credentialMode or {@code null} for none
+   */
+  public GoogleCloudIntegrationsV1alphaTestIntegrationsResponse setCredentialMode(java.lang.String credentialMode) {
+    this.credentialMode = credentialMode;
+    return this;
+  }
+
+  /**
+   * The EUC hardening disposition stored for the tested integration, read before the run. Unset for
+   * asynchronous tests.
+   * @return value or {@code null} for none
+   */
+  public java.lang.String getEucHardeningDisposition() {
+    return eucHardeningDisposition;
+  }
+
+  /**
+   * The EUC hardening disposition stored for the tested integration, read before the run. Unset for
+   * asynchronous tests.
+   * @param eucHardeningDisposition eucHardeningDisposition or {@code null} for none
+   */
+  public GoogleCloudIntegrationsV1alphaTestIntegrationsResponse setEucHardeningDisposition(java.lang.String eucHardeningDisposition) {
+    this.eucHardeningDisposition = eucHardeningDisposition;
+    return this;
+  }
+
   /**
    * Details for the integration that were executed.
    * @return value or {@code null} for none
@@ -124,6 +191,41 @@ public GoogleCloudIntegrationsV1alphaTestIntegrationsResponse setExecutionId(jav
     return this;
   }
 
+  /**
+   * The credential paths the hardened flow covers for this test: each one that a task in the tested
+   * integration reaches and that the server running the test hardens, whatever the credential mode.
+   * A `CREDENTIAL_MODE_CURRENT` test of an integration not stored as hardened usually lists none,
+   * and a `CREDENTIAL_MODE_HARDENED` response with no paths means nothing in this integration was
+   * hardened. Empty where the hardened flow is switched off. Unset for asynchronous tests. Derived
+   * from the integration's task types before the run: it reports presence in the graph, not
+   * execution, so a task on a branch that did not run is still counted, as is a Call Integration
+   * task that runs as a configured service account. A sub-integration's own tasks are not included;
+   * each runs under its own stored disposition. Integration Connectors tasks and Cloud Scheduler
+   * triggers are never reported: the services they call do not yet accept the hardened credential.
+   * @return value or {@code null} for none
+   */
+  public java.util.List<java.lang.String> getHardenedPaths() {
+    return hardenedPaths;
+  }
+
+  /**
+   * The credential paths the hardened flow covers for this test: each one that a task in the tested
+   * integration reaches and that the server running the test hardens, whatever the credential mode.
+   * A `CREDENTIAL_MODE_CURRENT` test of an integration not stored as hardened usually lists none,
+   * and a `CREDENTIAL_MODE_HARDENED` response with no paths means nothing in this integration was
+   * hardened. Empty where the hardened flow is switched off. Unset for asynchronous tests. Derived
+   * from the integration's task types before the run: it reports presence in the graph, not
+   * execution, so a task on a branch that did not run is still counted, as is a Call Integration
+   * task that runs as a configured service account. A sub-integration's own tasks are not included;
+   * each runs under its own stored disposition. Integration Connectors tasks and Cloud Scheduler
+   * triggers are never reported: the services they call do not yet accept the hardened credential.
+   * @param hardenedPaths hardenedPaths or {@code null} for none
+   */
+  public GoogleCloudIntegrationsV1alphaTestIntegrationsResponse setHardenedPaths(java.util.List<java.lang.String> hardenedPaths) {
+    this.hardenedPaths = hardenedPaths;
+    return this;
+  }
+
   /**
    * Parameters are a part of Event and can be used to communicate between different tasks that are
    * part of the same integration execution.