- [Resource: User](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#User)
  - [JSON representation](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#User.SCHEMA_REPRESENTATION)
- [SqlUserType](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#SqlUserType)
- [UserPasswordValidationPolicy](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#UserPasswordValidationPolicy)
  - [JSON representation](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#UserPasswordValidationPolicy.SCHEMA_REPRESENTATION)
- [PasswordStatus](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#PasswordStatus)
  - [JSON representation](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#PasswordStatus.SCHEMA_REPRESENTATION)
- [DualPasswordType](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#DualPasswordType)
- [IamStatus](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#IamStatus)
- [Methods](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#METHODS_SUMMARY)

## Resource: User

A Cloud SQL user resource.

| JSON representation |
|---|
| ``` { "kind": string, "password": string, "etag": string, "name": string, "host": string, "instance": string, "project": string, "type": enum (`https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#SqlUserType`), "iamEmail": string, "passwordPolicy": { object (`https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#UserPasswordValidationPolicy`) }, "databaseRoles": [ string ], "dualPasswordType": enum (`https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#DualPasswordType`), "iamStatus": enum (`https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#IamStatus`) } ``` |

| Fields ||
|---|---|
| `kind` | `string` This is always `sql#user`. |
| `password` | `string` The password for the user. |
| `etag` | `string` This field is deprecated and will be removed from a future version of the API. |
| `name` | `string` The name of the user in the Cloud SQL instance. Can be omitted for `update` because it is already specified in the URL. |
| `host` | `string` Optional. The host from which the user can connect. For `insert` operations, host defaults to an empty string. For `update` operations, host is specified as part of the request URL. The host name cannot be updated after insertion. For a MySQL instance, it's required; for a PostgreSQL or SQL Server instance, it's optional. |
| `instance` | `string` The name of the Cloud SQL instance. This does not include the project ID. Can be omitted for `update` because it is already specified on the URL. |
| `project` | `string` The project ID of the project containing the Cloud SQL database. The Google apps domain is prefixed if applicable. Can be omitted for `update` because it is already specified on the URL. |
| `type` | ``enum (`https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#SqlUserType`)`` The user type. It determines the method to authenticate the user during login. The default is the database's built-in user type. |
| `iamEmail` | `string` Optional. The full email for an IAM user. For normal database users, this will not be filled. Only applicable to MySQL database users. |
| `passwordPolicy` | ``object (`https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#UserPasswordValidationPolicy`)`` User level password validation policy. |
| `databaseRoles[]` | `string` Optional. Role memberships of the user |
| `dualPasswordType` | ``enum (`https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#DualPasswordType`)`` Dual password status for the user. |
| `iamStatus` | ``enum (`https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#IamStatus`)`` Indicates if a group is active or inactive for IAM database authentication. |

## SqlUserType

The user type.

| Enums ||
|---|---|
| `BUILT_IN` | The database's built-in user type. |
| `CLOUD_IAM_USER` | Cloud IAM user. |
| `CLOUD_IAM_SERVICE_ACCOUNT` | Cloud IAM service account. |
| `CLOUD_IAM_GROUP` | Cloud IAM group. Not used for login. |
| `CLOUD_IAM_GROUP_USER` | Read-only. Login for a user that belongs to the Cloud IAM group. |
| `CLOUD_IAM_GROUP_SERVICE_ACCOUNT` | Read-only. Login for a service account that belongs to the Cloud IAM group. |
| `CLOUD_IAM_WORKFORCE_IDENTITY` | Cloud IAM workforce identity managed by Workforce Identity Federation. |

## UserPasswordValidationPolicy

User level password validation policy.

| JSON representation |
|---|
| ``` { "allowedFailedAttempts": integer, "passwordExpirationDuration": string, "enableFailedAttemptsCheck": boolean, "status": { object (`https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#PasswordStatus`) }, "enablePasswordVerification": boolean } ``` |

| Fields ||
|---|---|
| `allowedFailedAttempts` | `integer` Number of failed login attempts allowed before user get locked. |
| `passwordExpirationDuration` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#duration` format)`` Expiration duration after password is updated. A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: `"3.5s"`. |
| `enableFailedAttemptsCheck` | `boolean` If true, failed login attempts check will be enabled. |
| `status` | ``object (`https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users#PasswordStatus`)`` Output only. Read-only password status. |
| `enablePasswordVerification` | `boolean` If true, the user must specify the current password before changing the password. This flag is supported only for MySQL. |

## PasswordStatus

Read-only password status.

| JSON representation |
|---|
| ``` { "locked": boolean, "passwordExpirationTime": string } ``` |

| Fields ||
|---|---|
| `locked` | `boolean` If true, user does not have login privileges. |
| `passwordExpirationTime` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#timestamp` format)`` The expiration time of the current password. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`. |

## DualPasswordType

The type of retained password.

| Enums ||
|---|---|
| `DUAL_PASSWORD_TYPE_UNSPECIFIED` | The default value. |
| `NO_MODIFY_DUAL_PASSWORD` | Do not update the user's dual password status. |
| `NO_DUAL_PASSWORD` | No dual password usable for connecting using this user. |
| `DUAL_PASSWORD` | Dual password usable for connecting using this user. |

## IamStatus

Indicates if a group is available for IAM database authentication.

| Enums ||
|---|---|
| `IAM_STATUS_UNSPECIFIED` | The default value for users that are not of type CLOUD_IAM_GROUP. Only CLOUD_IAM_GROUP users will be inactive or active. Users with an IamStatus of IAM_STATUS_UNSPECIFIED will not display whether they are active or inactive as that is not applicable to them. |
| `INACTIVE` | INACTIVE indicates a group is not available for IAM database authentication. |
| `ACTIVE` | ACTIVE indicates a group is available for IAM database authentication. |

| ## Methods ||
|---|---|
| ### `https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users/delete` | Deletes a user from a Cloud SQL instance. |
| ### `https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users/get` | Retrieves a resource containing information about a user. |
| ### `https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users/insert` | Creates a new user in a Cloud SQL instance. |
| ### `https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users/list` | Lists users in the specified Cloud SQL instance. |
| ### `https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/users/update` | Updates an existing user in a Cloud SQL instance. |