---
title: "POST /update-auth-method-gcp"
method: POST
path: "/update-auth-method-gcp"
tags: ["v2"]
---

# POST /update-auth-method-gcp

`POST /update-auth-method-gcp`

## Request body

- UpdateAuthMethodGCP — updateAuthMethodGCP is a command that updates a new auth method that will be able to authenticate using GCP IAM Service Account credentials or GCE instance credentials. [Deprecated: Use auth-method-update-gcp command]
  - `access-expires` integer — Access expiration date in Unix timestamp (select 0 for access without expiry date)
  - `allowed-client-type` string[] — limit the auth method usage for specific client types [cli,ui,gateway-admin,sdk,mobile,extension]
  - `audience` string, required — The audience to verify in the JWT received by the client
  - `audit-logs-claims` string[] — Subclaims to include in audit logs, e.g "--audit-logs-claims email --audit-logs-claims username"
  - `bound-ips` string[] — A CIDR whitelist with the IPs that the access is restricted to
  - `bound-labels` string[] — A comma-separated list of GCP labels formatted as "key:value" strings that must be set on authorized GCE instances. TODO: Because GCP labels are not currently ACL'd ....
  - `bound-projects` string[] — === Human and Machine authentication section === Array of GCP project IDs. Only entities belonging to any of the provided projects can authenticate.
  - `bound-regions` string[] — List of regions that a GCE instance must belong to in order to be authenticated. TODO: If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored.
  - `bound-service-accounts` string[] — List of service accounts the service account must be part of in order to be authenticated.
  - `bound-zones` string[] — === Machine authentication section === List of zones that a GCE instance must belong to in order to be authenticated. TODO: If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone.
  - `delete_protection` string — Protection from accidental deletion of this object [true/false]
  - `description` string — Auth Method description
  - `expiration-event-in` string[] — How many days before the expiration of the auth method would you like to be notified.
  - `force-sub-claims` boolean — if true: enforce role-association must include sub claims
  - `gw-bound-ips` string[] — A CIDR whitelist with the GW IPs that the access is restricted to
  - `json` boolean — Set output format to JSON
  - `jwt-ttl` integer — Jwt TTL
  - `name` string, required — Auth Method name
  - `new-name` string — Auth Method new name
  - `product-type` string[] — Choose the relevant product type for the auth method [sm, sra, pm, dp, ca]
  - `service-account-creds-data` string — ServiceAccount credentials data instead of giving a file path, base64 encoded
  - `token` string — Authentication token (see `/auth` and `/configure`)
  - `type` string, required — Type of the GCP Access Rules
  - `uid-token` string — The universal identity token, Required only for universal_identity authentication
  - `unique-identifier` string — A unique identifier (ID) value which is a "sub claim" name that contains details uniquely identifying that resource. This "sub claim" is used to distinguish between different identities.

## Response `200`

updateAuthMethodGCPResponse wraps response body.

- UpdateAuthMethodGCPOutput

## Other responses

- `default` — errorResponse wraps any error to return it as a JSON object with one "error" field.

---

[API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)