diff --git a/packages/google-cloud-iap/.OwlBot.yaml b/packages/google-cloud-iap/.OwlBot.yaml
new file mode 100644
index 000000000000..727d1c4052bb
--- /dev/null
+++ b/packages/google-cloud-iap/.OwlBot.yaml
@@ -0,0 +1,26 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+deep-remove-regex:
+  - /owl-bot-staging
+
+deep-preserve-regex:
+  - /owl-bot-staging/google-cloud-iap/v1beta1
+
+deep-copy-regex:
+  - source: /google/cloud/iap/(v.*)/.*-py
+    dest: /owl-bot-staging/google-cloud-iap/$1
+
+begin-after-commit-hash: 70f7f0525414fe4dfeb2fc2e81546b073f83a621
diff --git a/packages/google-cloud-iap/.coveragerc b/packages/google-cloud-iap/.coveragerc
new file mode 100644
index 000000000000..46e950e71ee3
--- /dev/null
+++ b/packages/google-cloud-iap/.coveragerc
@@ -0,0 +1,13 @@
+[run]
+branch = True
+
+[report]
+show_missing = True
+omit =
+    google/cloud/iap/__init__.py
+    google/cloud/iap/gapic_version.py
+exclude_lines =
+    # Re-enable the standard pragma
+    pragma: NO COVER
+    # Ignore debug-only repr
+    def __repr__
diff --git a/packages/google-cloud-iap/.flake8 b/packages/google-cloud-iap/.flake8
new file mode 100644
index 000000000000..2e438749863d
--- /dev/null
+++ b/packages/google-cloud-iap/.flake8
@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Generated by synthtool. DO NOT EDIT!
+[flake8]
+ignore = E203, E231, E266, E501, W503
+exclude =
+  # Exclude generated code.
+  **/proto/**
+  **/gapic/**
+  **/services/**
+  **/types/**
+  *_pb2.py
+
+  # Standard linting exemptions.
+  **/.nox/**
+  __pycache__,
+  .git,
+  *.pyc,
+  conf.py
diff --git a/packages/google-cloud-iap/.gitignore b/packages/google-cloud-iap/.gitignore
new file mode 100644
index 000000000000..b4243ced74e4
--- /dev/null
+++ b/packages/google-cloud-iap/.gitignore
@@ -0,0 +1,63 @@
+*.py[cod]
+*.sw[op]
+
+# C extensions
+*.so
+
+# Packages
+*.egg
+*.egg-info
+dist
+build
+eggs
+.eggs
+parts
+bin
+var
+sdist
+develop-eggs
+.installed.cfg
+lib
+lib64
+__pycache__
+
+# Installer logs
+pip-log.txt
+
+# Unit test / coverage reports
+.coverage
+.nox
+.cache
+.pytest_cache
+
+
+# Mac
+.DS_Store
+
+# JetBrains
+.idea
+
+# VS Code
+.vscode
+
+# emacs
+*~
+
+# Built documentation
+docs/_build
+bigquery/docs/generated
+docs.metadata
+
+# Virtual environment
+env/
+
+# Test logs
+coverage.xml
+*sponge_log.xml
+
+# System test environment variables.
+system_tests/local_test_setup
+
+# Make sure a generated file isn't accidentally committed.
+pylintrc
+pylintrc.test
diff --git a/packages/google-cloud-iap/.pre-commit-config.yaml b/packages/google-cloud-iap/.pre-commit-config.yaml
new file mode 100644
index 000000000000..5405cc8ff1f3
--- /dev/null
+++ b/packages/google-cloud-iap/.pre-commit-config.yaml
@@ -0,0 +1,31 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# See https://pre-commit.com for more information
+# See https://pre-commit.com/hooks.html for more hooks
+repos:
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.0.1
+    hooks:
+    -   id: trailing-whitespace
+    -   id: end-of-file-fixer
+    -   id: check-yaml
+-   repo: https://github.com/psf/black
+    rev: 22.3.0
+    hooks:
+    - id: black
+-   repo: https://github.com/pycqa/flake8
+    rev: 3.9.2
+    hooks:
+    - id: flake8
diff --git a/packages/google-cloud-iap/.release-please-manifest.json b/packages/google-cloud-iap/.release-please-manifest.json
new file mode 100644
index 000000000000..211ac9a5064b
--- /dev/null
+++ b/packages/google-cloud-iap/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "1.10.1"
+}
diff --git a/packages/google-cloud-iap/.repo-metadata.json b/packages/google-cloud-iap/.repo-metadata.json
new file mode 100644
index 000000000000..22b899fce5ec
--- /dev/null
+++ b/packages/google-cloud-iap/.repo-metadata.json
@@ -0,0 +1,17 @@
+{
+    "name": "iap",
+    "name_pretty": "Identity-Aware Proxy",
+    "product_documentation": "https://cloud.google.com/iap",
+    "client_documentation": "https://cloud.google.com/python/docs/reference/iap/latest",
+    "issue_tracker": "",
+    "release_level": "stable",
+    "language": "python",
+    "library_type": "GAPIC_AUTO",
+    "repo": "googleapis/python-iap",
+    "distribution_name": "google-cloud-iap",
+    "api_id": "iap.googleapis.com",
+    "default_version": "v1",
+    "codeowner_team": "",
+    "api_shortname": "iap",
+    "api_description": "Identity-Aware Proxy includes a number of features that can be used to protect access to Google Cloud hosted resources and applications hosted on Google Cloud."
+}
diff --git a/packages/google-cloud-iap/CHANGELOG.md b/packages/google-cloud-iap/CHANGELOG.md
new file mode 100644
index 000000000000..2ce71f1169fb
--- /dev/null
+++ b/packages/google-cloud-iap/CHANGELOG.md
@@ -0,0 +1,249 @@
+# Changelog
+
+## [1.10.1](https://github.com/googleapis/python-iap/compare/v1.10.0...v1.10.1) (2023-04-01)
+
+
+### Documentation
+
+* Minor changes in AttributePropagationSettings ([#168](https://github.com/googleapis/python-iap/issues/168)) ([2c61c43](https://github.com/googleapis/python-iap/commit/2c61c438f6e254fea0662589f7047d2c8464d9f2))
+
+## [1.10.0](https://github.com/googleapis/python-iap/compare/v1.9.0...v1.10.0) (2023-03-23)
+
+
+### Features
+
+* Add an enum ENROLLED_SECOND_FACTORS under IapSettings ([8890e9e](https://github.com/googleapis/python-iap/commit/8890e9eceb2cfc41c3fee269d2e084052e783c5e))
+
+
+### Documentation
+
+* Fix formatting of request arg in docstring ([#167](https://github.com/googleapis/python-iap/issues/167)) ([a95d454](https://github.com/googleapis/python-iap/commit/a95d4548860e8bf8f3a6e269c9b3882cda42d364))
+* Update doc description for field_mask ([8890e9e](https://github.com/googleapis/python-iap/commit/8890e9eceb2cfc41c3fee269d2e084052e783c5e))
+
+## [1.9.0](https://github.com/googleapis/python-iap/compare/v1.8.1...v1.9.0) (2023-02-19)
+
+
+### Features
+
+* Enable "rest" transport in Python for services supporting numeric enums ([#157](https://github.com/googleapis/python-iap/issues/157)) ([15be642](https://github.com/googleapis/python-iap/commit/15be6424ef580e8f02855a7f939a331a42236cd1))
+
+## [1.8.1](https://github.com/googleapis/python-iap/compare/v1.8.0...v1.8.1) (2023-01-20)
+
+
+### Bug Fixes
+
+* Add context manager return types ([6d93973](https://github.com/googleapis/python-iap/commit/6d9397372916d91bb156f8995f3741c98729aa84))
+
+
+### Documentation
+
+* Add documentation for enums ([6d93973](https://github.com/googleapis/python-iap/commit/6d9397372916d91bb156f8995f3741c98729aa84))
+
+## [1.8.0](https://github.com/googleapis/python-iap/compare/v1.7.0...v1.8.0) (2023-01-10)
+
+
+### Features
+
+* Add support for python 3.11 ([#149](https://github.com/googleapis/python-iap/issues/149)) ([e136d2f](https://github.com/googleapis/python-iap/commit/e136d2fcd7e12c811972a2ff0fe819154e9cfca2))
+
+## [1.7.0](https://github.com/googleapis/python-iap/compare/v1.6.0...v1.7.0) (2023-01-04)
+
+
+### Features
+
+* Add AllowedDomainSettings to the UpdateIapSettingsRequest ([1be4844](https://github.com/googleapis/python-iap/commit/1be48441b21823dbc1ac53f7da7290da7bb66352))
+* Add AttributePropagationSettings to the UpdateIapSettingsRequest ([1be4844](https://github.com/googleapis/python-iap/commit/1be48441b21823dbc1ac53f7da7290da7bb66352))
+* Add remediation_token_generation_enabled to the CsmSettings ([1be4844](https://github.com/googleapis/python-iap/commit/1be48441b21823dbc1ac53f7da7290da7bb66352))
+
+## [1.6.0](https://github.com/googleapis/python-iap/compare/v1.5.4...v1.6.0) (2022-12-14)
+
+
+### Features
+
+* Add support for `google.cloud.iap.__version__` ([828e0bd](https://github.com/googleapis/python-iap/commit/828e0bdc68c1f1c0f8986dec6bd0d99b0bd8f561))
+* Add typing to proto.Message based class attributes ([828e0bd](https://github.com/googleapis/python-iap/commit/828e0bdc68c1f1c0f8986dec6bd0d99b0bd8f561))
+
+
+### Bug Fixes
+
+* Add dict typing for client_options ([828e0bd](https://github.com/googleapis/python-iap/commit/828e0bdc68c1f1c0f8986dec6bd0d99b0bd8f561))
+* **deps:** Require google-api-core >=1.34.0, >=2.11.0  ([2c0f3e5](https://github.com/googleapis/python-iap/commit/2c0f3e5f044b956b02e1389741adeaa0ee2bc259))
+* Drop usage of pkg_resources ([2c0f3e5](https://github.com/googleapis/python-iap/commit/2c0f3e5f044b956b02e1389741adeaa0ee2bc259))
+* Fix timeout default values ([2c0f3e5](https://github.com/googleapis/python-iap/commit/2c0f3e5f044b956b02e1389741adeaa0ee2bc259))
+
+
+### Documentation
+
+* **samples:** Snippetgen handling of repeated enum field ([828e0bd](https://github.com/googleapis/python-iap/commit/828e0bdc68c1f1c0f8986dec6bd0d99b0bd8f561))
+* **samples:** Snippetgen should call await on the operation coroutine before calling result ([2c0f3e5](https://github.com/googleapis/python-iap/commit/2c0f3e5f044b956b02e1389741adeaa0ee2bc259))
+
+## [1.5.4](https://github.com/googleapis/python-iap/compare/v1.5.3...v1.5.4) (2022-10-07)
+
+
+### Bug Fixes
+
+* **deps:** Allow protobuf 3.19.5 ([#137](https://github.com/googleapis/python-iap/issues/137)) ([c5fd70f](https://github.com/googleapis/python-iap/commit/c5fd70f7168a5a87a52afb25a399a6990ab2c9e0))
+
+## [1.5.3](https://github.com/googleapis/python-iap/compare/v1.5.2...v1.5.3) (2022-10-03)
+
+
+### Bug Fixes
+
+* **deps:** Require protobuf >= 3.20.2 ([#135](https://github.com/googleapis/python-iap/issues/135)) ([8ba970c](https://github.com/googleapis/python-iap/commit/8ba970cd3e7395e3c52cdf57b0af813f5d68e162))
+
+## [1.5.2](https://github.com/googleapis/python-iap/compare/v1.5.1...v1.5.2) (2022-08-11)
+
+
+### Bug Fixes
+
+* **deps:** allow protobuf < 5.0.0 ([#120](https://github.com/googleapis/python-iap/issues/120)) ([e5e67d0](https://github.com/googleapis/python-iap/commit/e5e67d0df1f26b1a786e23b26028de1406458b3f))
+* **deps:** require proto-plus >= 1.22.0 ([e5e67d0](https://github.com/googleapis/python-iap/commit/e5e67d0df1f26b1a786e23b26028de1406458b3f))
+
+## [1.5.1](https://github.com/googleapis/python-iap/compare/v1.5.0...v1.5.1) (2022-07-13)
+
+
+### Bug Fixes
+
+* **deps:** require google-api-core>=1.32.0,>=2.8.0 ([#114](https://github.com/googleapis/python-iap/issues/114)) ([ecf5c0e](https://github.com/googleapis/python-iap/commit/ecf5c0ef344578bc32474b1b6b13216faa2ebcbb))
+
+## [1.5.0](https://github.com/googleapis/python-iap/compare/v1.4.1...v1.5.0) (2022-07-12)
+
+
+### Features
+
+* add audience parameter ([01dc926](https://github.com/googleapis/python-iap/commit/01dc926fe83c7e774aefa7d5b859aa0c8a606e8e))
+
+
+### Bug Fixes
+
+* **deps:** require google-api-core >= 2.8.0 ([#110](https://github.com/googleapis/python-iap/issues/110)) ([01dc926](https://github.com/googleapis/python-iap/commit/01dc926fe83c7e774aefa7d5b859aa0c8a606e8e))
+* require python 3.7+ ([#112](https://github.com/googleapis/python-iap/issues/112)) ([7230d5f](https://github.com/googleapis/python-iap/commit/7230d5f2d9b15c970d56305a823886858b3d23c9))
+
+## [1.4.1](https://github.com/googleapis/python-iap/compare/v1.4.0...v1.4.1) (2022-06-03)
+
+
+### Bug Fixes
+
+* **deps:** require protobuf <4.0.0dev ([#103](https://github.com/googleapis/python-iap/issues/103)) ([c8b9cc5](https://github.com/googleapis/python-iap/commit/c8b9cc54d3734f62fd5bfaeb8f7f107427f3bae3))
+
+
+### Documentation
+
+* fix changelog header to consistent size ([#102](https://github.com/googleapis/python-iap/issues/102)) ([7c7a470](https://github.com/googleapis/python-iap/commit/7c7a4705af42124a616a193ebc4a665bfa9e69be))
+
+## [1.4.0](https://github.com/googleapis/python-iap/compare/v1.3.1...v1.4.0) (2022-05-19)
+
+
+### Features
+
+* add ReauthSettings to the UpdateIapSettingsRequest ([36c1866](https://github.com/googleapis/python-iap/commit/36c1866e605e4e880e65eb44a7d4dc49389f92f3))
+* add the TunnelDestGroup-related methods and types ([#93](https://github.com/googleapis/python-iap/issues/93)) ([36c1866](https://github.com/googleapis/python-iap/commit/36c1866e605e4e880e65eb44a7d4dc49389f92f3))
+* AuditConfig for IAM v1 ([49dc9c7](https://github.com/googleapis/python-iap/commit/49dc9c7162e956c684892bdf866f20b47e3b27d2))
+
+
+### Bug Fixes
+
+* **deps:** require grpc-google-iam-v1 >=0.12.4 ([49dc9c7](https://github.com/googleapis/python-iap/commit/49dc9c7162e956c684892bdf866f20b47e3b27d2))
+
+## [1.3.1](https://github.com/googleapis/python-iap/compare/v1.3.0...v1.3.1) (2022-03-05)
+
+
+### Bug Fixes
+
+* **deps:** require google-api-core>=1.31.5, >=2.3.2 ([#71](https://github.com/googleapis/python-iap/issues/71)) ([0e00d6a](https://github.com/googleapis/python-iap/commit/0e00d6a489ee97707bb733387a951e48e1f415dc))
+
+## [1.3.0](https://github.com/googleapis/python-iap/compare/v1.2.1...v1.3.0) (2022-02-26)
+
+
+### Features
+
+* add api key support ([#57](https://github.com/googleapis/python-iap/issues/57)) ([1787cb0](https://github.com/googleapis/python-iap/commit/1787cb00158f111915d0f9bb948abeceab75a6f4))
+
+
+### Bug Fixes
+
+* resolve DuplicateCredentialArgs error when using credentials_file ([18f725d](https://github.com/googleapis/python-iap/commit/18f725d81007e02d2054538087d7567029b2d179))
+
+
+### Documentation
+
+* add generated snippets ([#62](https://github.com/googleapis/python-iap/issues/62)) ([27c14d2](https://github.com/googleapis/python-iap/commit/27c14d24ce50d6bb80f09218bcf0ebc1db9ceabd))
+
+## [1.2.1](https://www.github.com/googleapis/python-iap/compare/v1.2.0...v1.2.1) (2021-11-01)
+
+
+### Bug Fixes
+
+* **deps:** drop packaging dependency ([30b353c](https://www.github.com/googleapis/python-iap/commit/30b353c9296d37f8792759a5ee997b3f50572f19))
+* **deps:** require google-api-core >= 1.28.0 ([30b353c](https://www.github.com/googleapis/python-iap/commit/30b353c9296d37f8792759a5ee997b3f50572f19))
+
+
+### Documentation
+
+* list oneofs in docstring ([30b353c](https://www.github.com/googleapis/python-iap/commit/30b353c9296d37f8792759a5ee997b3f50572f19))
+
+## [1.2.0](https://www.github.com/googleapis/python-iap/compare/v1.1.0...v1.2.0) (2021-10-18)
+
+
+### Features
+
+* add support for python 3.10 ([#37](https://www.github.com/googleapis/python-iap/issues/37)) ([7716426](https://www.github.com/googleapis/python-iap/commit/7716426b83a457a3206fae1dee66c46cf35bd7e7))
+
+## [1.1.0](https://www.github.com/googleapis/python-iap/compare/v1.0.2...v1.1.0) (2021-10-08)
+
+
+### Features
+
+* add context manager support in client ([#34](https://www.github.com/googleapis/python-iap/issues/34)) ([a985591](https://www.github.com/googleapis/python-iap/commit/a985591b016e768a5a172ab5f8de873319b1e7e0))
+
+## [1.0.2](https://www.github.com/googleapis/python-iap/compare/v1.0.1...v1.0.2) (2021-10-05)
+
+
+### Bug Fixes
+
+* improper types in pagers generation ([242d445](https://www.github.com/googleapis/python-iap/commit/242d44516fe55141a26024653158ea94fa93e525))
+
+## [1.0.1](https://www.github.com/googleapis/python-iap/compare/v1.0.0...v1.0.1) (2021-09-24)
+
+
+### Bug Fixes
+
+* add 'dict' annotation type to 'request' ([a5b27d2](https://www.github.com/googleapis/python-iap/commit/a5b27d26e4bc845aeede7281959a81f693ee52c2))
+
+## [1.0.0](https://www.github.com/googleapis/python-iap/compare/v0.1.2...v1.0.0) (2021-08-09)
+
+
+### Features
+
+* bump release level to production/stable ([#13](https://www.github.com/googleapis/python-iap/issues/13)) ([9d0a9f8](https://www.github.com/googleapis/python-iap/commit/9d0a9f84554b98fd2b1829532c9c13b16432b0af))
+
+## [0.1.2](https://www.github.com/googleapis/python-iap/compare/v0.1.1...v0.1.2) (2021-07-29)
+
+
+### Bug Fixes
+
+* enable self signed jwt for grpc ([#9](https://www.github.com/googleapis/python-iap/issues/9)) ([51304a3](https://www.github.com/googleapis/python-iap/commit/51304a327207a233e40308a8b49c9fdeda87c28b))
+
+
+### Documentation
+
+* add Samples section to CONTRIBUTING.rst ([#5](https://www.github.com/googleapis/python-iap/issues/5)) ([2ba31c5](https://www.github.com/googleapis/python-iap/commit/2ba31c5a2ea2e52c4a79410548a252bf8fc0522e))
+
+
+### Miscellaneous Chores
+
+* release as 0.1.2 ([#10](https://www.github.com/googleapis/python-iap/issues/10)) ([4499ba5](https://www.github.com/googleapis/python-iap/commit/4499ba5ccd90edc882fbda73e4d792074ff44e6d))
+
+## [0.1.1](https://www.github.com/googleapis/python-iap/compare/v0.1.0...v0.1.1) (2021-07-21)
+
+
+### Bug Fixes
+
+* **deps:** pin 'google-{api,cloud}-core', 'google-auth' to allow 2.x versions ([#4](https://www.github.com/googleapis/python-iap/issues/4)) ([21e9e57](https://www.github.com/googleapis/python-iap/commit/21e9e57451a87d9f9dd1137142d138cb73aa746c))
+
+## 0.1.0 (2021-07-06)
+
+
+### Features
+
+* generate v1 ([6fdf055](https://www.github.com/googleapis/python-iap/commit/6fdf055c835adf6715bf43e9255d02abcd2affd4))
diff --git a/packages/google-cloud-iap/CODE_OF_CONDUCT.md b/packages/google-cloud-iap/CODE_OF_CONDUCT.md
new file mode 100644
index 000000000000..039f43681204
--- /dev/null
+++ b/packages/google-cloud-iap/CODE_OF_CONDUCT.md
@@ -0,0 +1,95 @@
+<!-- # Generated by synthtool. DO NOT EDIT! !-->
+# Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of
+experience, education, socio-economic status, nationality, personal appearance,
+race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+*   Using welcoming and inclusive language
+*   Being respectful of differing viewpoints and experiences
+*   Gracefully accepting constructive criticism
+*   Focusing on what is best for the community
+*   Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+*   The use of sexualized language or imagery and unwelcome sexual attention or
+    advances
+*   Trolling, insulting/derogatory comments, and personal or political attacks
+*   Public or private harassment
+*   Publishing others' private information, such as a physical or electronic
+    address, without explicit permission
+*   Other conduct which could reasonably be considered inappropriate in a
+    professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, or to ban temporarily or permanently any
+contributor for other behaviors that they deem inappropriate, threatening,
+offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+This Code of Conduct also applies outside the project spaces when the Project
+Steward has a reasonable belief that an individual's behavior may have a
+negative impact on the project or its community.
+
+## Conflict Resolution
+
+We do not believe that all conflict is bad; healthy debate and disagreement
+often yield positive results. However, it is never okay to be disrespectful or
+to engage in behavior that violates the project’s code of conduct.
+
+If you see someone violating the code of conduct, you are encouraged to address
+the behavior directly with those involved. Many issues can be resolved quickly
+and easily, and this gives people more control over the outcome of their
+dispute. If you are unable to resolve the matter for any reason, or if the
+behavior is threatening or harassing, report it. We are dedicated to providing
+an environment where participants feel welcome and safe.
+
+
+Reports should be directed to *googleapis-stewards@google.com*, the
+Project Steward(s) for *Google Cloud Client Libraries*. It is the Project Steward’s duty to
+receive and address reported violations of the code of conduct. They will then
+work with a committee consisting of representatives from the Open Source
+Programs Office and the Google Open Source Strategy team. If for any reason you
+are uncomfortable reaching out to the Project Steward, please email
+opensource@google.com.
+
+We will investigate every complaint, but you may not receive a direct response.
+We will use our discretion in determining when and how to follow up on reported
+incidents, which may range from not taking action to permanent expulsion from
+the project and project-sponsored spaces. We will notify the accused of the
+report and provide them an opportunity to discuss it before any action is taken.
+The identity of the reporter will be omitted from the details of the report
+supplied to the accused. In potentially harmful situations, such as ongoing
+harassment or threats to anyone's safety, we may take action without notice.
+
+## Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant, version 1.4,
+available at
+https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
\ No newline at end of file
diff --git a/packages/google-cloud-iap/CONTRIBUTING.rst b/packages/google-cloud-iap/CONTRIBUTING.rst
new file mode 100644
index 000000000000..a69125ff5ea5
--- /dev/null
+++ b/packages/google-cloud-iap/CONTRIBUTING.rst
@@ -0,0 +1,269 @@
+.. Generated by synthtool. DO NOT EDIT!
+############
+Contributing
+############
+
+#. **Please sign one of the contributor license agreements below.**
+#. Fork the repo, develop and test your code changes, add docs.
+#. Make sure that your commit messages clearly describe the changes.
+#. Send a pull request. (Please Read: `Faster Pull Request Reviews`_)
+
+.. _Faster Pull Request Reviews: https://github.com/kubernetes/community/blob/master/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
+
+.. contents:: Here are some guidelines for hacking on the Google Cloud Client libraries.
+
+***************
+Adding Features
+***************
+
+In order to add a feature:
+
+- The feature must be documented in both the API and narrative
+  documentation.
+
+- The feature must work fully on the following CPython versions:
+  3.7, 3.8, 3.9, 3.10 and 3.11 on both UNIX and Windows.
+
+- The feature must not add unnecessary dependencies (where
+  "unnecessary" is of course subjective, but new dependencies should
+  be discussed).
+
+****************************
+Using a Development Checkout
+****************************
+
+You'll have to create a development environment using a Git checkout:
+
+- While logged into your GitHub account, navigate to the
+  ``python-iap`` `repo`_ on GitHub.
+
+- Fork and clone the ``python-iap`` repository to your GitHub account by
+  clicking the "Fork" button.
+
+- Clone your fork of ``python-iap`` from your GitHub account to your local
+  computer, substituting your account username and specifying the destination
+  as ``hack-on-python-iap``.  E.g.::
+
+   $ cd ${HOME}
+   $ git clone git@github.com:USERNAME/python-iap.git hack-on-python-iap
+   $ cd hack-on-python-iap
+   # Configure remotes such that you can pull changes from the googleapis/python-iap
+   # repository into your local repository.
+   $ git remote add upstream git@github.com:googleapis/python-iap.git
+   # fetch and merge changes from upstream into main
+   $ git fetch upstream
+   $ git merge upstream/main
+
+Now your local repo is set up such that you will push changes to your GitHub
+repo, from which you can submit a pull request.
+
+To work on the codebase and run the tests, we recommend using ``nox``,
+but you can also use a ``virtualenv`` of your own creation.
+
+.. _repo: https://github.com/googleapis/python-iap
+
+Using ``nox``
+=============
+
+We use `nox <https://nox.readthedocs.io/en/latest/>`__ to instrument our tests.
+
+- To test your changes, run unit tests with ``nox``::
+    $ nox -s unit
+
+- To run a single unit test::
+
+    $ nox -s unit-3.11 -- -k <name of test>
+
+
+  .. note::
+
+    The unit tests and system tests are described in the
+    ``noxfile.py`` files in each directory.
+
+.. nox: https://pypi.org/project/nox/
+
+*****************************************
+I'm getting weird errors... Can you help?
+*****************************************
+
+If the error mentions ``Python.h`` not being found,
+install ``python-dev`` and try again.
+On Debian/Ubuntu::
+
+  $ sudo apt-get install python-dev
+
+************
+Coding Style
+************
+- We use the automatic code formatter ``black``. You can run it using
+  the nox session ``blacken``. This will eliminate many lint errors. Run via::
+
+   $ nox -s blacken
+
+- PEP8 compliance is required, with exceptions defined in the linter configuration.
+  If you have ``nox`` installed, you can test that you have not introduced
+  any non-compliant code via::
+
+   $ nox -s lint
+
+- In order to make ``nox -s lint`` run faster, you can set some environment
+  variables::
+
+   export GOOGLE_CLOUD_TESTING_REMOTE="upstream"
+   export GOOGLE_CLOUD_TESTING_BRANCH="main"
+
+  By doing this, you are specifying the location of the most up-to-date
+  version of ``python-iap``. The
+  remote name ``upstream`` should point to the official ``googleapis``
+  checkout and the branch should be the default branch on that remote (``main``).
+
+- This repository contains configuration for the
+  `pre-commit <https://pre-commit.com/>`__ tool, which automates checking
+  our linters during a commit.  If you have it installed on your ``$PATH``,
+  you can enable enforcing those checks via:
+
+.. code-block:: bash
+
+   $ pre-commit install
+   pre-commit installed at .git/hooks/pre-commit
+
+Exceptions to PEP8:
+
+- Many unit tests use a helper method, ``_call_fut`` ("FUT" is short for
+  "Function-Under-Test"), which is PEP8-incompliant, but more readable.
+  Some also use a local variable, ``MUT`` (short for "Module-Under-Test").
+
+********************
+Running System Tests
+********************
+
+- To run system tests, you can execute::
+
+   # Run all system tests
+   $ nox -s system
+
+   # Run a single system test
+   $ nox -s system- -- -k <name of test>
+
+
+  .. note::
+
+      System tests are only configured to run under Python.
+      For expediency, we do not run them in older versions of Python 3.
+
+  This alone will not run the tests. You'll need to change some local
+  auth settings and change some configuration in your project to
+  run all the tests.
+
+- System tests will be run against an actual project. You should use local credentials from gcloud when possible. See `Best practices for application authentication <https://cloud.google.com/docs/authentication/best-practices-applications#local_development_and_testing_with_the>`__. Some tests require a service account. For those tests see `Authenticating as a service account <https://cloud.google.com/docs/authentication/production>`__.
+
+*************
+Test Coverage
+*************
+
+- The codebase *must* have 100% test statement coverage after each commit.
+  You can test coverage via ``nox -s cover``.
+
+******************************************************
+Documentation Coverage and Building HTML Documentation
+******************************************************
+
+If you fix a bug, and the bug requires an API or behavior modification, all
+documentation in this package which references that API or behavior must be
+changed to reflect the bug fix, ideally in the same commit that fixes the bug
+or adds the feature.
+
+Build the docs via:
+
+   $ nox -s docs
+
+*************************
+Samples and code snippets
+*************************
+
+Code samples and snippets live in the `samples/` catalogue. Feel free to
+provide more examples, but make sure to write tests for those examples.
+Each folder containing example code requires its own `noxfile.py` script
+which automates testing. If you decide to create a new folder, you can
+base it on the `samples/snippets` folder (providing `noxfile.py` and
+the requirements files).
+
+The tests will run against a real Google Cloud Project, so you should
+configure them just like the System Tests.
+
+- To run sample tests, you can execute::
+
+   # Run all tests in a folder
+   $ cd samples/snippets
+   $ nox -s py-3.8
+
+   # Run a single sample test
+   $ cd samples/snippets
+   $ nox -s py-3.8 -- -k <name of test>
+
+********************************************
+Note About ``README`` as it pertains to PyPI
+********************************************
+
+The `description on PyPI`_ for the project comes directly from the
+``README``. Due to the reStructuredText (``rst``) parser used by
+PyPI, relative links which will work on GitHub (e.g. ``CONTRIBUTING.rst``
+instead of
+``https://github.com/googleapis/python-iap/blob/main/CONTRIBUTING.rst``)
+may cause problems creating links or rendering the description.
+
+.. _description on PyPI: https://pypi.org/project/google-cloud-iap
+
+
+*************************
+Supported Python Versions
+*************************
+
+We support:
+
+-  `Python 3.7`_
+-  `Python 3.8`_
+-  `Python 3.9`_
+-  `Python 3.10`_
+-  `Python 3.11`_
+
+.. _Python 3.7: https://docs.python.org/3.7/
+.. _Python 3.8: https://docs.python.org/3.8/
+.. _Python 3.9: https://docs.python.org/3.9/
+.. _Python 3.10: https://docs.python.org/3.10/
+.. _Python 3.11: https://docs.python.org/3.11/
+
+
+Supported versions can be found in our ``noxfile.py`` `config`_.
+
+.. _config: https://github.com/googleapis/python-iap/blob/main/noxfile.py
+
+
+**********
+Versioning
+**********
+
+This library follows `Semantic Versioning`_.
+
+.. _Semantic Versioning: http://semver.org/
+
+Some packages are currently in major version zero (``0.y.z``), which means that
+anything may change at any time and the public API should not be considered
+stable.
+
+******************************
+Contributor License Agreements
+******************************
+
+Before we can accept your pull requests you'll need to sign a Contributor
+License Agreement (CLA):
+
+- **If you are an individual writing original source code** and **you own the
+  intellectual property**, then you'll need to sign an
+  `individual CLA <https://developers.google.com/open-source/cla/individual>`__.
+- **If you work for a company that wants to allow you to contribute your work**,
+  then you'll need to sign a
+  `corporate CLA <https://developers.google.com/open-source/cla/corporate>`__.
+
+You can sign these electronically (just scroll to the bottom). After that,
+we'll be able to accept your pull requests.
diff --git a/packages/google-cloud-iap/LICENSE b/packages/google-cloud-iap/LICENSE
new file mode 100644
index 000000000000..d64569567334
--- /dev/null
+++ b/packages/google-cloud-iap/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/packages/google-cloud-iap/MANIFEST.in b/packages/google-cloud-iap/MANIFEST.in
new file mode 100644
index 000000000000..e783f4c6209b
--- /dev/null
+++ b/packages/google-cloud-iap/MANIFEST.in
@@ -0,0 +1,25 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Generated by synthtool. DO NOT EDIT!
+include README.rst LICENSE
+recursive-include google *.json *.proto py.typed
+recursive-include tests *
+global-exclude *.py[co]
+global-exclude __pycache__
+
+# Exclude scripts for samples readmegen
+prune scripts/readme-gen
diff --git a/packages/google-cloud-iap/README.rst b/packages/google-cloud-iap/README.rst
new file mode 100644
index 000000000000..9e5711bf31e3
--- /dev/null
+++ b/packages/google-cloud-iap/README.rst
@@ -0,0 +1,107 @@
+Python Client for Identity-Aware Proxy
+======================================
+
+|stable| |pypi| |versions|
+
+`Identity-Aware Proxy`_: Identity-Aware Proxy includes a number of features that can be used to protect access to Google Cloud hosted resources and applications hosted on Google Cloud.
+
+- `Client Library Documentation`_
+- `Product Documentation`_
+
+.. |stable| image:: https://img.shields.io/badge/support-stable-gold.svg
+   :target: https://github.com/googleapis/google-cloud-python/blob/main/README.rst#stability-levels
+.. |pypi| image:: https://img.shields.io/pypi/v/google-cloud-iap.svg
+   :target: https://pypi.org/project/google-cloud-iap/
+.. |versions| image:: https://img.shields.io/pypi/pyversions/google-cloud-iap.svg
+   :target: https://pypi.org/project/google-cloud-iap/
+.. _Identity-Aware Proxy: https://cloud.google.com/iap
+.. _Client Library Documentation: https://cloud.google.com/python/docs/reference/iap/latest
+.. _Product Documentation:  https://cloud.google.com/iap
+
+Quick Start
+-----------
+
+In order to use this library, you first need to go through the following steps:
+
+1. `Select or create a Cloud Platform project.`_
+2. `Enable billing for your project.`_
+3. `Enable the Identity-Aware Proxy.`_
+4. `Setup Authentication.`_
+
+.. _Select or create a Cloud Platform project.: https://console.cloud.google.com/project
+.. _Enable billing for your project.: https://cloud.google.com/billing/docs/how-to/modify-project#enable_billing_for_a_project
+.. _Enable the Identity-Aware Proxy.:  https://cloud.google.com/iap
+.. _Setup Authentication.: https://googleapis.dev/python/google-api-core/latest/auth.html
+
+Installation
+~~~~~~~~~~~~
+
+Install this library in a `virtualenv`_ using pip. `virtualenv`_ is a tool to
+create isolated Python environments. The basic problem it addresses is one of
+dependencies and versions, and indirectly permissions.
+
+With `virtualenv`_, it's possible to install this library without needing system
+install permissions, and without clashing with the installed system
+dependencies.
+
+.. _`virtualenv`: https://virtualenv.pypa.io/en/latest/
+
+
+Code samples and snippets
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Code samples and snippets live in the `samples/` folder.
+
+
+Supported Python Versions
+^^^^^^^^^^^^^^^^^^^^^^^^^
+Our client libraries are compatible with all current `active`_ and `maintenance`_ versions of
+Python.
+
+Python >= 3.7
+
+.. _active: https://devguide.python.org/devcycle/#in-development-main-branch
+.. _maintenance: https://devguide.python.org/devcycle/#maintenance-branches
+
+Unsupported Python Versions
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+Python <= 3.6
+
+If you are using an `end-of-life`_
+version of Python, we recommend that you update as soon as possible to an actively supported version.
+
+.. _end-of-life: https://devguide.python.org/devcycle/#end-of-life-branches
+
+Mac/Linux
+^^^^^^^^^
+
+.. code-block:: console
+
+    pip install virtualenv
+    virtualenv <your-env>
+    source <your-env>/bin/activate
+    <your-env>/bin/pip install google-cloud-iap
+
+
+Windows
+^^^^^^^
+
+.. code-block:: console
+
+    pip install virtualenv
+    virtualenv <your-env>
+    <your-env>\Scripts\activate
+    <your-env>\Scripts\pip.exe install google-cloud-iap
+
+Next Steps
+~~~~~~~~~~
+
+-  Read the `Client Library Documentation`_ for Identity-Aware Proxy
+   to see other available methods on the client.
+-  Read the `Identity-Aware Proxy Product documentation`_ to learn
+   more about the product and see How-to Guides.
+-  View this `README`_ to see the full list of Cloud
+   APIs that we cover.
+
+.. _Identity-Aware Proxy Product documentation:  https://cloud.google.com/iap
+.. _README: https://github.com/googleapis/google-cloud-python/blob/main/README.rst
diff --git a/packages/google-cloud-iap/SECURITY.md b/packages/google-cloud-iap/SECURITY.md
new file mode 100644
index 000000000000..8b58ae9c01ae
--- /dev/null
+++ b/packages/google-cloud-iap/SECURITY.md
@@ -0,0 +1,7 @@
+# Security Policy
+
+To report a security issue, please use [g.co/vulnz](https://g.co/vulnz).
+
+The Google Security Team will respond within 5 working days of your report on g.co/vulnz.
+
+We use g.co/vulnz for our intake, and do coordination and disclosure here using GitHub Security Advisory to privately discuss and fix the issue.
diff --git a/packages/google-cloud-iap/docs/CHANGELOG.md b/packages/google-cloud-iap/docs/CHANGELOG.md
new file mode 120000
index 000000000000..04c99a55caae
--- /dev/null
+++ b/packages/google-cloud-iap/docs/CHANGELOG.md
@@ -0,0 +1 @@
+../CHANGELOG.md
\ No newline at end of file
diff --git a/packages/google-cloud-iap/docs/README.rst b/packages/google-cloud-iap/docs/README.rst
new file mode 120000
index 000000000000..89a0106941ff
--- /dev/null
+++ b/packages/google-cloud-iap/docs/README.rst
@@ -0,0 +1 @@
+../README.rst
\ No newline at end of file
diff --git a/packages/google-cloud-iap/docs/_static/custom.css b/packages/google-cloud-iap/docs/_static/custom.css
new file mode 100644
index 000000000000..b0a295464b23
--- /dev/null
+++ b/packages/google-cloud-iap/docs/_static/custom.css
@@ -0,0 +1,20 @@
+div#python2-eol {
+	border-color: red;
+	border-width: medium;
+}
+
+/* Ensure minimum width for 'Parameters' / 'Returns' column */
+dl.field-list > dt {
+    min-width: 100px
+}
+
+/* Insert space between methods for readability */
+dl.method {
+	padding-top: 10px;
+	padding-bottom: 10px
+}
+
+/* Insert empty space between classes */
+dl.class {
+	padding-bottom: 50px
+}
diff --git a/packages/google-cloud-iap/docs/_templates/layout.html b/packages/google-cloud-iap/docs/_templates/layout.html
new file mode 100644
index 000000000000..6316a537f72b
--- /dev/null
+++ b/packages/google-cloud-iap/docs/_templates/layout.html
@@ -0,0 +1,50 @@
+
+{% extends "!layout.html" %}
+{%- block content %}
+{%- if theme_fixed_sidebar|lower == 'true' %}
+  <div class="document">
+    {{ sidebar() }}
+    {%- block document %}
+      <div class="documentwrapper">
+      {%- if render_sidebar %}
+        <div class="bodywrapper">
+      {%- endif %}
+
+          {%- block relbar_top %}
+            {%- if theme_show_relbar_top|tobool %}
+              <div class="related top">
+                &nbsp;
+                {{- rellink_markup () }}
+              </div>
+            {%- endif %}
+          {% endblock %}
+
+          <div class="body" role="main">
+          	<div class="admonition" id="python2-eol"> 
+          	 As of January 1, 2020 this library no longer supports Python 2 on the latest released version. 
+          	 Library versions released prior to that date will continue to be available. For more information please
+          	 visit <a href="https://cloud.google.com/python/docs/python2-sunset/">Python 2 support on Google Cloud</a>.
+          	</div>
+            {% block body %} {% endblock %}
+          </div>
+
+          {%- block relbar_bottom %}
+            {%- if theme_show_relbar_bottom|tobool %}
+              <div class="related bottom">
+                &nbsp;
+                {{- rellink_markup () }}
+              </div>
+            {%- endif %}
+          {% endblock %}
+
+      {%- if render_sidebar %}
+        </div>
+      {%- endif %}
+      </div>
+    {%- endblock %}
+    <div class="clearer"></div>
+  </div>
+{%- else %}
+{{ super() }}
+{%- endif %}
+{%- endblock %}
diff --git a/packages/google-cloud-iap/docs/conf.py b/packages/google-cloud-iap/docs/conf.py
new file mode 100644
index 000000000000..5449aabdcf35
--- /dev/null
+++ b/packages/google-cloud-iap/docs/conf.py
@@ -0,0 +1,384 @@
+# -*- coding: utf-8 -*-
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# google-cloud-iap documentation build configuration file
+#
+# This file is execfile()d with the current directory set to its
+# containing dir.
+#
+# Note that not all possible configuration values are present in this
+# autogenerated file.
+#
+# All configuration values have a default; values that are commented out
+# serve to show the default.
+
+import os
+import shlex
+import sys
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+sys.path.insert(0, os.path.abspath(".."))
+
+# For plugins that can not read conf.py.
+# See also: https://github.com/docascode/sphinx-docfx-yaml/issues/85
+sys.path.insert(0, os.path.abspath("."))
+
+__version__ = ""
+
+# -- General configuration ------------------------------------------------
+
+# If your documentation needs a minimal Sphinx version, state it here.
+needs_sphinx = "1.5.5"
+
+# Add any Sphinx extension module names here, as strings. They can be
+# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
+# ones.
+extensions = [
+    "sphinx.ext.autodoc",
+    "sphinx.ext.autosummary",
+    "sphinx.ext.intersphinx",
+    "sphinx.ext.coverage",
+    "sphinx.ext.doctest",
+    "sphinx.ext.napoleon",
+    "sphinx.ext.todo",
+    "sphinx.ext.viewcode",
+    "recommonmark",
+]
+
+# autodoc/autosummary flags
+autoclass_content = "both"
+autodoc_default_options = {"members": True}
+autosummary_generate = True
+
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ["_templates"]
+
+# The suffix(es) of source filenames.
+# You can specify multiple suffix as a list of string:
+# source_suffix = ['.rst', '.md']
+source_suffix = [".rst", ".md"]
+
+# The encoding of source files.
+# source_encoding = 'utf-8-sig'
+
+# The root toctree document.
+root_doc = "index"
+
+# General information about the project.
+project = "google-cloud-iap"
+copyright = "2019, Google"
+author = "Google APIs"
+
+# The version info for the project you're documenting, acts as replacement for
+# |version| and |release|, also used in various other places throughout the
+# built documents.
+#
+# The full version, including alpha/beta/rc tags.
+release = __version__
+# The short X.Y version.
+version = ".".join(release.split(".")[0:2])
+
+# The language for content autogenerated by Sphinx. Refer to documentation
+# for a list of supported languages.
+#
+# This is also used if you do content translation via gettext catalogs.
+# Usually you set "language" from the command line for these cases.
+language = None
+
+# There are two options for replacing |today|: either, you set today to some
+# non-false value, then it is used:
+# today = ''
+# Else, today_fmt is used as the format for a strftime call.
+# today_fmt = '%B %d, %Y'
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+exclude_patterns = [
+    "_build",
+    "**/.nox/**/*",
+    "samples/AUTHORING_GUIDE.md",
+    "samples/CONTRIBUTING.md",
+    "samples/snippets/README.rst",
+]
+
+# The reST default role (used for this markup: `text`) to use for all
+# documents.
+# default_role = None
+
+# If true, '()' will be appended to :func: etc. cross-reference text.
+# add_function_parentheses = True
+
+# If true, the current module name will be prepended to all description
+# unit titles (such as .. function::).
+# add_module_names = True
+
+# If true, sectionauthor and moduleauthor directives will be shown in the
+# output. They are ignored by default.
+# show_authors = False
+
+# The name of the Pygments (syntax highlighting) style to use.
+pygments_style = "sphinx"
+
+# A list of ignored prefixes for module index sorting.
+# modindex_common_prefix = []
+
+# If true, keep warnings as "system message" paragraphs in the built documents.
+# keep_warnings = False
+
+# If true, `todo` and `todoList` produce output, else they produce nothing.
+todo_include_todos = True
+
+
+# -- Options for HTML output ----------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  See the documentation for
+# a list of builtin themes.
+html_theme = "alabaster"
+
+# Theme options are theme-specific and customize the look and feel of a theme
+# further.  For a list of options available for each theme, see the
+# documentation.
+html_theme_options = {
+    "description": "Google Cloud Client Libraries for google-cloud-iap",
+    "github_user": "googleapis",
+    "github_repo": "python-iap",
+    "github_banner": True,
+    "font_family": "'Roboto', Georgia, sans",
+    "head_font_family": "'Roboto', Georgia, serif",
+    "code_font_family": "'Roboto Mono', 'Consolas', monospace",
+}
+
+# Add any paths that contain custom themes here, relative to this directory.
+# html_theme_path = []
+
+# The name for this set of Sphinx documents.  If None, it defaults to
+# "<project> v<release> documentation".
+# html_title = None
+
+# A shorter title for the navigation bar.  Default is the same as html_title.
+# html_short_title = None
+
+# The name of an image file (relative to this directory) to place at the top
+# of the sidebar.
+# html_logo = None
+
+# The name of an image file (within the static path) to use as favicon of the
+# docs.  This file should be a Windows icon file (.ico) being 16x16 or 32x32
+# pixels large.
+# html_favicon = None
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+html_static_path = ["_static"]
+
+# Add any extra paths that contain custom files (such as robots.txt or
+# .htaccess) here, relative to this directory. These files are copied
+# directly to the root of the documentation.
+# html_extra_path = []
+
+# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
+# using the given strftime format.
+# html_last_updated_fmt = '%b %d, %Y'
+
+# If true, SmartyPants will be used to convert quotes and dashes to
+# typographically correct entities.
+# html_use_smartypants = True
+
+# Custom sidebar templates, maps document names to template names.
+# html_sidebars = {}
+
+# Additional templates that should be rendered to pages, maps page names to
+# template names.
+# html_additional_pages = {}
+
+# If false, no module index is generated.
+# html_domain_indices = True
+
+# If false, no index is generated.
+# html_use_index = True
+
+# If true, the index is split into individual pages for each letter.
+# html_split_index = False
+
+# If true, links to the reST sources are added to the pages.
+# html_show_sourcelink = True
+
+# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
+# html_show_sphinx = True
+
+# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
+# html_show_copyright = True
+
+# If true, an OpenSearch description file will be output, and all pages will
+# contain a <link> tag referring to it.  The value of this option must be the
+# base URL from which the finished HTML is served.
+# html_use_opensearch = ''
+
+# This is the file name suffix for HTML files (e.g. ".xhtml").
+# html_file_suffix = None
+
+# Language to be used for generating the HTML full-text search index.
+# Sphinx supports the following languages:
+#   'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja'
+#   'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr'
+# html_search_language = 'en'
+
+# A dictionary with options for the search language support, empty by default.
+# Now only 'ja' uses this config value
+# html_search_options = {'type': 'default'}
+
+# The name of a javascript file (relative to the configuration directory) that
+# implements a search results scorer. If empty, the default will be used.
+# html_search_scorer = 'scorer.js'
+
+# Output file base name for HTML help builder.
+htmlhelp_basename = "google-cloud-iap-doc"
+
+# -- Options for warnings ------------------------------------------------------
+
+
+suppress_warnings = [
+    # Temporarily suppress this to avoid "more than one target found for
+    # cross-reference" warning, which are intractable for us to avoid while in
+    # a mono-repo.
+    # See https://github.com/sphinx-doc/sphinx/blob
+    # /2a65ffeef5c107c19084fabdd706cdff3f52d93c/sphinx/domains/python.py#L843
+    "ref.python"
+]
+
+# -- Options for LaTeX output ---------------------------------------------
+
+latex_elements = {
+    # The paper size ('letterpaper' or 'a4paper').
+    #'papersize': 'letterpaper',
+    # The font size ('10pt', '11pt' or '12pt').
+    #'pointsize': '10pt',
+    # Additional stuff for the LaTeX preamble.
+    #'preamble': '',
+    # Latex figure (float) alignment
+    #'figure_align': 'htbp',
+}
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title,
+#  author, documentclass [howto, manual, or own class]).
+latex_documents = [
+    (
+        root_doc,
+        "google-cloud-iap.tex",
+        "google-cloud-iap Documentation",
+        author,
+        "manual",
+    )
+]
+
+# The name of an image file (relative to this directory) to place at the top of
+# the title page.
+# latex_logo = None
+
+# For "manual" documents, if this is true, then toplevel headings are parts,
+# not chapters.
+# latex_use_parts = False
+
+# If true, show page references after internal links.
+# latex_show_pagerefs = False
+
+# If true, show URL addresses after external links.
+# latex_show_urls = False
+
+# Documents to append as an appendix to all manuals.
+# latex_appendices = []
+
+# If false, no module index is generated.
+# latex_domain_indices = True
+
+
+# -- Options for manual page output ---------------------------------------
+
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [
+    (
+        root_doc,
+        "google-cloud-iap",
+        "google-cloud-iap Documentation",
+        [author],
+        1,
+    )
+]
+
+# If true, show URL addresses after external links.
+# man_show_urls = False
+
+
+# -- Options for Texinfo output -------------------------------------------
+
+# Grouping the document tree into Texinfo files. List of tuples
+# (source start file, target name, title, author,
+#  dir menu entry, description, category)
+texinfo_documents = [
+    (
+        root_doc,
+        "google-cloud-iap",
+        "google-cloud-iap Documentation",
+        author,
+        "google-cloud-iap",
+        "google-cloud-iap Library",
+        "APIs",
+    )
+]
+
+# Documents to append as an appendix to all manuals.
+# texinfo_appendices = []
+
+# If false, no module index is generated.
+# texinfo_domain_indices = True
+
+# How to display URL addresses: 'footnote', 'no', or 'inline'.
+# texinfo_show_urls = 'footnote'
+
+# If true, do not generate a @detailmenu in the "Top" node's menu.
+# texinfo_no_detailmenu = False
+
+
+# Example configuration for intersphinx: refer to the Python standard library.
+intersphinx_mapping = {
+    "python": ("https://python.readthedocs.org/en/latest/", None),
+    "google-auth": ("https://googleapis.dev/python/google-auth/latest/", None),
+    "google.api_core": (
+        "https://googleapis.dev/python/google-api-core/latest/",
+        None,
+    ),
+    "grpc": ("https://grpc.github.io/grpc/python/", None),
+    "proto-plus": ("https://proto-plus-python.readthedocs.io/en/latest/", None),
+    "protobuf": ("https://googleapis.dev/python/protobuf/latest/", None),
+}
+
+
+# Napoleon settings
+napoleon_google_docstring = True
+napoleon_numpy_docstring = True
+napoleon_include_private_with_doc = False
+napoleon_include_special_with_doc = True
+napoleon_use_admonition_for_examples = False
+napoleon_use_admonition_for_notes = False
+napoleon_use_admonition_for_references = False
+napoleon_use_ivar = False
+napoleon_use_param = True
+napoleon_use_rtype = True
diff --git a/packages/google-cloud-iap/docs/iap_v1/identity_aware_proxy_admin_service.rst b/packages/google-cloud-iap/docs/iap_v1/identity_aware_proxy_admin_service.rst
new file mode 100644
index 000000000000..3098cf5d3834
--- /dev/null
+++ b/packages/google-cloud-iap/docs/iap_v1/identity_aware_proxy_admin_service.rst
@@ -0,0 +1,10 @@
+IdentityAwareProxyAdminService
+------------------------------------------------
+
+.. automodule:: google.cloud.iap_v1.services.identity_aware_proxy_admin_service
+    :members:
+    :inherited-members:
+
+.. automodule:: google.cloud.iap_v1.services.identity_aware_proxy_admin_service.pagers
+    :members:
+    :inherited-members:
diff --git a/packages/google-cloud-iap/docs/iap_v1/identity_aware_proxy_o_auth_service.rst b/packages/google-cloud-iap/docs/iap_v1/identity_aware_proxy_o_auth_service.rst
new file mode 100644
index 000000000000..172d1e671bee
--- /dev/null
+++ b/packages/google-cloud-iap/docs/iap_v1/identity_aware_proxy_o_auth_service.rst
@@ -0,0 +1,10 @@
+IdentityAwareProxyOAuthService
+------------------------------------------------
+
+.. automodule:: google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service
+    :members:
+    :inherited-members:
+
+.. automodule:: google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service.pagers
+    :members:
+    :inherited-members:
diff --git a/packages/google-cloud-iap/docs/iap_v1/services.rst b/packages/google-cloud-iap/docs/iap_v1/services.rst
new file mode 100644
index 000000000000..7f5aebfa27f7
--- /dev/null
+++ b/packages/google-cloud-iap/docs/iap_v1/services.rst
@@ -0,0 +1,7 @@
+Services for Google Cloud Iap v1 API
+====================================
+.. toctree::
+    :maxdepth: 2
+
+    identity_aware_proxy_admin_service
+    identity_aware_proxy_o_auth_service
diff --git a/packages/google-cloud-iap/docs/iap_v1/types.rst b/packages/google-cloud-iap/docs/iap_v1/types.rst
new file mode 100644
index 000000000000..711d3b91bff3
--- /dev/null
+++ b/packages/google-cloud-iap/docs/iap_v1/types.rst
@@ -0,0 +1,6 @@
+Types for Google Cloud Iap v1 API
+=================================
+
+.. automodule:: google.cloud.iap_v1.types
+    :members:
+    :show-inheritance:
diff --git a/packages/google-cloud-iap/docs/index.rst b/packages/google-cloud-iap/docs/index.rst
new file mode 100644
index 000000000000..29ceab9eb6eb
--- /dev/null
+++ b/packages/google-cloud-iap/docs/index.rst
@@ -0,0 +1,23 @@
+.. include:: README.rst
+
+.. include:: multiprocessing.rst
+
+
+API Reference
+-------------
+.. toctree::
+    :maxdepth: 2
+
+    iap_v1/services
+    iap_v1/types
+
+
+Changelog
+---------
+
+For a list of all ``google-cloud-iap`` releases:
+
+.. toctree::
+    :maxdepth: 2
+
+    CHANGELOG
diff --git a/packages/google-cloud-iap/docs/multiprocessing.rst b/packages/google-cloud-iap/docs/multiprocessing.rst
new file mode 100644
index 000000000000..536d17b2ea65
--- /dev/null
+++ b/packages/google-cloud-iap/docs/multiprocessing.rst
@@ -0,0 +1,7 @@
+.. note::
+
+   Because this client uses :mod:`grpc` library, it is safe to
+   share instances across threads. In multiprocessing scenarios, the best
+   practice is to create client instances *after* the invocation of
+   :func:`os.fork` by :class:`multiprocessing.pool.Pool` or
+   :class:`multiprocessing.Process`.
diff --git a/packages/google-cloud-iap/google-cloud-iap.txt b/packages/google-cloud-iap/google-cloud-iap.txt
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/packages/google-cloud-iap/google/cloud/iap/__init__.py b/packages/google-cloud-iap/google/cloud/iap/__init__.py
new file mode 100644
index 000000000000..a7d4e1969af6
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap/__init__.py
@@ -0,0 +1,105 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from google.cloud.iap import gapic_version as package_version
+
+__version__ = package_version.__version__
+
+
+from google.cloud.iap_v1.services.identity_aware_proxy_admin_service.async_client import (
+    IdentityAwareProxyAdminServiceAsyncClient,
+)
+from google.cloud.iap_v1.services.identity_aware_proxy_admin_service.client import (
+    IdentityAwareProxyAdminServiceClient,
+)
+from google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service.async_client import (
+    IdentityAwareProxyOAuthServiceAsyncClient,
+)
+from google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service.client import (
+    IdentityAwareProxyOAuthServiceClient,
+)
+from google.cloud.iap_v1.types.service import (
+    AccessDeniedPageSettings,
+    AccessSettings,
+    AllowedDomainsSettings,
+    ApplicationSettings,
+    AttributePropagationSettings,
+    Brand,
+    CorsSettings,
+    CreateBrandRequest,
+    CreateIdentityAwareProxyClientRequest,
+    CreateTunnelDestGroupRequest,
+    CsmSettings,
+    DeleteIdentityAwareProxyClientRequest,
+    DeleteTunnelDestGroupRequest,
+    GcipSettings,
+    GetBrandRequest,
+    GetIapSettingsRequest,
+    GetIdentityAwareProxyClientRequest,
+    GetTunnelDestGroupRequest,
+    IapSettings,
+    IdentityAwareProxyClient,
+    ListBrandsRequest,
+    ListBrandsResponse,
+    ListIdentityAwareProxyClientsRequest,
+    ListIdentityAwareProxyClientsResponse,
+    ListTunnelDestGroupsRequest,
+    ListTunnelDestGroupsResponse,
+    OAuthSettings,
+    ReauthSettings,
+    ResetIdentityAwareProxyClientSecretRequest,
+    TunnelDestGroup,
+    UpdateIapSettingsRequest,
+    UpdateTunnelDestGroupRequest,
+)
+
+__all__ = (
+    "IdentityAwareProxyAdminServiceClient",
+    "IdentityAwareProxyAdminServiceAsyncClient",
+    "IdentityAwareProxyOAuthServiceClient",
+    "IdentityAwareProxyOAuthServiceAsyncClient",
+    "AccessDeniedPageSettings",
+    "AccessSettings",
+    "AllowedDomainsSettings",
+    "ApplicationSettings",
+    "AttributePropagationSettings",
+    "Brand",
+    "CorsSettings",
+    "CreateBrandRequest",
+    "CreateIdentityAwareProxyClientRequest",
+    "CreateTunnelDestGroupRequest",
+    "CsmSettings",
+    "DeleteIdentityAwareProxyClientRequest",
+    "DeleteTunnelDestGroupRequest",
+    "GcipSettings",
+    "GetBrandRequest",
+    "GetIapSettingsRequest",
+    "GetIdentityAwareProxyClientRequest",
+    "GetTunnelDestGroupRequest",
+    "IapSettings",
+    "IdentityAwareProxyClient",
+    "ListBrandsRequest",
+    "ListBrandsResponse",
+    "ListIdentityAwareProxyClientsRequest",
+    "ListIdentityAwareProxyClientsResponse",
+    "ListTunnelDestGroupsRequest",
+    "ListTunnelDestGroupsResponse",
+    "OAuthSettings",
+    "ReauthSettings",
+    "ResetIdentityAwareProxyClientSecretRequest",
+    "TunnelDestGroup",
+    "UpdateIapSettingsRequest",
+    "UpdateTunnelDestGroupRequest",
+)
diff --git a/packages/google-cloud-iap/google/cloud/iap/gapic_version.py b/packages/google-cloud-iap/google/cloud/iap/gapic_version.py
new file mode 100644
index 000000000000..6f9b28f95196
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap/gapic_version.py
@@ -0,0 +1,16 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+__version__ = "1.10.1"  # {x-release-please-version}
diff --git a/packages/google-cloud-iap/google/cloud/iap/py.typed b/packages/google-cloud-iap/google/cloud/iap/py.typed
new file mode 100644
index 000000000000..90095aa69189
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap/py.typed
@@ -0,0 +1,2 @@
+# Marker file for PEP 561.
+# The google-cloud-iap package uses inline types.
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/__init__.py b/packages/google-cloud-iap/google/cloud/iap_v1/__init__.py
new file mode 100644
index 000000000000..c8ca40362dd2
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/__init__.py
@@ -0,0 +1,101 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from google.cloud.iap_v1 import gapic_version as package_version
+
+__version__ = package_version.__version__
+
+
+from .services.identity_aware_proxy_admin_service import (
+    IdentityAwareProxyAdminServiceAsyncClient,
+    IdentityAwareProxyAdminServiceClient,
+)
+from .services.identity_aware_proxy_o_auth_service import (
+    IdentityAwareProxyOAuthServiceAsyncClient,
+    IdentityAwareProxyOAuthServiceClient,
+)
+from .types.service import (
+    AccessDeniedPageSettings,
+    AccessSettings,
+    AllowedDomainsSettings,
+    ApplicationSettings,
+    AttributePropagationSettings,
+    Brand,
+    CorsSettings,
+    CreateBrandRequest,
+    CreateIdentityAwareProxyClientRequest,
+    CreateTunnelDestGroupRequest,
+    CsmSettings,
+    DeleteIdentityAwareProxyClientRequest,
+    DeleteTunnelDestGroupRequest,
+    GcipSettings,
+    GetBrandRequest,
+    GetIapSettingsRequest,
+    GetIdentityAwareProxyClientRequest,
+    GetTunnelDestGroupRequest,
+    IapSettings,
+    IdentityAwareProxyClient,
+    ListBrandsRequest,
+    ListBrandsResponse,
+    ListIdentityAwareProxyClientsRequest,
+    ListIdentityAwareProxyClientsResponse,
+    ListTunnelDestGroupsRequest,
+    ListTunnelDestGroupsResponse,
+    OAuthSettings,
+    ReauthSettings,
+    ResetIdentityAwareProxyClientSecretRequest,
+    TunnelDestGroup,
+    UpdateIapSettingsRequest,
+    UpdateTunnelDestGroupRequest,
+)
+
+__all__ = (
+    "IdentityAwareProxyAdminServiceAsyncClient",
+    "IdentityAwareProxyOAuthServiceAsyncClient",
+    "AccessDeniedPageSettings",
+    "AccessSettings",
+    "AllowedDomainsSettings",
+    "ApplicationSettings",
+    "AttributePropagationSettings",
+    "Brand",
+    "CorsSettings",
+    "CreateBrandRequest",
+    "CreateIdentityAwareProxyClientRequest",
+    "CreateTunnelDestGroupRequest",
+    "CsmSettings",
+    "DeleteIdentityAwareProxyClientRequest",
+    "DeleteTunnelDestGroupRequest",
+    "GcipSettings",
+    "GetBrandRequest",
+    "GetIapSettingsRequest",
+    "GetIdentityAwareProxyClientRequest",
+    "GetTunnelDestGroupRequest",
+    "IapSettings",
+    "IdentityAwareProxyAdminServiceClient",
+    "IdentityAwareProxyClient",
+    "IdentityAwareProxyOAuthServiceClient",
+    "ListBrandsRequest",
+    "ListBrandsResponse",
+    "ListIdentityAwareProxyClientsRequest",
+    "ListIdentityAwareProxyClientsResponse",
+    "ListTunnelDestGroupsRequest",
+    "ListTunnelDestGroupsResponse",
+    "OAuthSettings",
+    "ReauthSettings",
+    "ResetIdentityAwareProxyClientSecretRequest",
+    "TunnelDestGroup",
+    "UpdateIapSettingsRequest",
+    "UpdateTunnelDestGroupRequest",
+)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/gapic_metadata.json b/packages/google-cloud-iap/google/cloud/iap_v1/gapic_metadata.json
new file mode 100644
index 000000000000..98e95fde4736
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/gapic_metadata.json
@@ -0,0 +1,317 @@
+ {
+  "comment": "This file maps proto services/RPCs to the corresponding library clients/methods",
+  "language": "python",
+  "libraryPackage": "google.cloud.iap_v1",
+  "protoPackage": "google.cloud.iap.v1",
+  "schema": "1.0",
+  "services": {
+    "IdentityAwareProxyAdminService": {
+      "clients": {
+        "grpc": {
+          "libraryClient": "IdentityAwareProxyAdminServiceClient",
+          "rpcs": {
+            "CreateTunnelDestGroup": {
+              "methods": [
+                "create_tunnel_dest_group"
+              ]
+            },
+            "DeleteTunnelDestGroup": {
+              "methods": [
+                "delete_tunnel_dest_group"
+              ]
+            },
+            "GetIamPolicy": {
+              "methods": [
+                "get_iam_policy"
+              ]
+            },
+            "GetIapSettings": {
+              "methods": [
+                "get_iap_settings"
+              ]
+            },
+            "GetTunnelDestGroup": {
+              "methods": [
+                "get_tunnel_dest_group"
+              ]
+            },
+            "ListTunnelDestGroups": {
+              "methods": [
+                "list_tunnel_dest_groups"
+              ]
+            },
+            "SetIamPolicy": {
+              "methods": [
+                "set_iam_policy"
+              ]
+            },
+            "TestIamPermissions": {
+              "methods": [
+                "test_iam_permissions"
+              ]
+            },
+            "UpdateIapSettings": {
+              "methods": [
+                "update_iap_settings"
+              ]
+            },
+            "UpdateTunnelDestGroup": {
+              "methods": [
+                "update_tunnel_dest_group"
+              ]
+            }
+          }
+        },
+        "grpc-async": {
+          "libraryClient": "IdentityAwareProxyAdminServiceAsyncClient",
+          "rpcs": {
+            "CreateTunnelDestGroup": {
+              "methods": [
+                "create_tunnel_dest_group"
+              ]
+            },
+            "DeleteTunnelDestGroup": {
+              "methods": [
+                "delete_tunnel_dest_group"
+              ]
+            },
+            "GetIamPolicy": {
+              "methods": [
+                "get_iam_policy"
+              ]
+            },
+            "GetIapSettings": {
+              "methods": [
+                "get_iap_settings"
+              ]
+            },
+            "GetTunnelDestGroup": {
+              "methods": [
+                "get_tunnel_dest_group"
+              ]
+            },
+            "ListTunnelDestGroups": {
+              "methods": [
+                "list_tunnel_dest_groups"
+              ]
+            },
+            "SetIamPolicy": {
+              "methods": [
+                "set_iam_policy"
+              ]
+            },
+            "TestIamPermissions": {
+              "methods": [
+                "test_iam_permissions"
+              ]
+            },
+            "UpdateIapSettings": {
+              "methods": [
+                "update_iap_settings"
+              ]
+            },
+            "UpdateTunnelDestGroup": {
+              "methods": [
+                "update_tunnel_dest_group"
+              ]
+            }
+          }
+        },
+        "rest": {
+          "libraryClient": "IdentityAwareProxyAdminServiceClient",
+          "rpcs": {
+            "CreateTunnelDestGroup": {
+              "methods": [
+                "create_tunnel_dest_group"
+              ]
+            },
+            "DeleteTunnelDestGroup": {
+              "methods": [
+                "delete_tunnel_dest_group"
+              ]
+            },
+            "GetIamPolicy": {
+              "methods": [
+                "get_iam_policy"
+              ]
+            },
+            "GetIapSettings": {
+              "methods": [
+                "get_iap_settings"
+              ]
+            },
+            "GetTunnelDestGroup": {
+              "methods": [
+                "get_tunnel_dest_group"
+              ]
+            },
+            "ListTunnelDestGroups": {
+              "methods": [
+                "list_tunnel_dest_groups"
+              ]
+            },
+            "SetIamPolicy": {
+              "methods": [
+                "set_iam_policy"
+              ]
+            },
+            "TestIamPermissions": {
+              "methods": [
+                "test_iam_permissions"
+              ]
+            },
+            "UpdateIapSettings": {
+              "methods": [
+                "update_iap_settings"
+              ]
+            },
+            "UpdateTunnelDestGroup": {
+              "methods": [
+                "update_tunnel_dest_group"
+              ]
+            }
+          }
+        }
+      }
+    },
+    "IdentityAwareProxyOAuthService": {
+      "clients": {
+        "grpc": {
+          "libraryClient": "IdentityAwareProxyOAuthServiceClient",
+          "rpcs": {
+            "CreateBrand": {
+              "methods": [
+                "create_brand"
+              ]
+            },
+            "CreateIdentityAwareProxyClient": {
+              "methods": [
+                "create_identity_aware_proxy_client"
+              ]
+            },
+            "DeleteIdentityAwareProxyClient": {
+              "methods": [
+                "delete_identity_aware_proxy_client"
+              ]
+            },
+            "GetBrand": {
+              "methods": [
+                "get_brand"
+              ]
+            },
+            "GetIdentityAwareProxyClient": {
+              "methods": [
+                "get_identity_aware_proxy_client"
+              ]
+            },
+            "ListBrands": {
+              "methods": [
+                "list_brands"
+              ]
+            },
+            "ListIdentityAwareProxyClients": {
+              "methods": [
+                "list_identity_aware_proxy_clients"
+              ]
+            },
+            "ResetIdentityAwareProxyClientSecret": {
+              "methods": [
+                "reset_identity_aware_proxy_client_secret"
+              ]
+            }
+          }
+        },
+        "grpc-async": {
+          "libraryClient": "IdentityAwareProxyOAuthServiceAsyncClient",
+          "rpcs": {
+            "CreateBrand": {
+              "methods": [
+                "create_brand"
+              ]
+            },
+            "CreateIdentityAwareProxyClient": {
+              "methods": [
+                "create_identity_aware_proxy_client"
+              ]
+            },
+            "DeleteIdentityAwareProxyClient": {
+              "methods": [
+                "delete_identity_aware_proxy_client"
+              ]
+            },
+            "GetBrand": {
+              "methods": [
+                "get_brand"
+              ]
+            },
+            "GetIdentityAwareProxyClient": {
+              "methods": [
+                "get_identity_aware_proxy_client"
+              ]
+            },
+            "ListBrands": {
+              "methods": [
+                "list_brands"
+              ]
+            },
+            "ListIdentityAwareProxyClients": {
+              "methods": [
+                "list_identity_aware_proxy_clients"
+              ]
+            },
+            "ResetIdentityAwareProxyClientSecret": {
+              "methods": [
+                "reset_identity_aware_proxy_client_secret"
+              ]
+            }
+          }
+        },
+        "rest": {
+          "libraryClient": "IdentityAwareProxyOAuthServiceClient",
+          "rpcs": {
+            "CreateBrand": {
+              "methods": [
+                "create_brand"
+              ]
+            },
+            "CreateIdentityAwareProxyClient": {
+              "methods": [
+                "create_identity_aware_proxy_client"
+              ]
+            },
+            "DeleteIdentityAwareProxyClient": {
+              "methods": [
+                "delete_identity_aware_proxy_client"
+              ]
+            },
+            "GetBrand": {
+              "methods": [
+                "get_brand"
+              ]
+            },
+            "GetIdentityAwareProxyClient": {
+              "methods": [
+                "get_identity_aware_proxy_client"
+              ]
+            },
+            "ListBrands": {
+              "methods": [
+                "list_brands"
+              ]
+            },
+            "ListIdentityAwareProxyClients": {
+              "methods": [
+                "list_identity_aware_proxy_clients"
+              ]
+            },
+            "ResetIdentityAwareProxyClientSecret": {
+              "methods": [
+                "reset_identity_aware_proxy_client_secret"
+              ]
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/gapic_version.py b/packages/google-cloud-iap/google/cloud/iap_v1/gapic_version.py
new file mode 100644
index 000000000000..6f9b28f95196
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/gapic_version.py
@@ -0,0 +1,16 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+__version__ = "1.10.1"  # {x-release-please-version}
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/py.typed b/packages/google-cloud-iap/google/cloud/iap_v1/py.typed
new file mode 100644
index 000000000000..90095aa69189
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/py.typed
@@ -0,0 +1,2 @@
+# Marker file for PEP 561.
+# The google-cloud-iap package uses inline types.
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/__init__.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/__init__.py
new file mode 100644
index 000000000000..e8e1c3845db5
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/__init__.py
@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/__init__.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/__init__.py
new file mode 100644
index 000000000000..01c544c36d7e
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/__init__.py
@@ -0,0 +1,22 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from .async_client import IdentityAwareProxyAdminServiceAsyncClient
+from .client import IdentityAwareProxyAdminServiceClient
+
+__all__ = (
+    "IdentityAwareProxyAdminServiceClient",
+    "IdentityAwareProxyAdminServiceAsyncClient",
+)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/async_client.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/async_client.py
new file mode 100644
index 000000000000..cf81cea66722
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/async_client.py
@@ -0,0 +1,1343 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from collections import OrderedDict
+import functools
+import re
+from typing import (
+    Dict,
+    Mapping,
+    MutableMapping,
+    MutableSequence,
+    Optional,
+    Sequence,
+    Tuple,
+    Type,
+    Union,
+)
+
+from google.api_core import exceptions as core_exceptions
+from google.api_core import gapic_v1
+from google.api_core import retry as retries
+from google.api_core.client_options import ClientOptions
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.oauth2 import service_account  # type: ignore
+
+from google.cloud.iap_v1 import gapic_version as package_version
+
+try:
+    OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault]
+except AttributeError:  # pragma: NO COVER
+    OptionalRetry = Union[retries.Retry, object]  # type: ignore
+
+from google.iam.v1 import iam_policy_pb2  # type: ignore
+from google.iam.v1 import policy_pb2  # type: ignore
+from google.protobuf import field_mask_pb2  # type: ignore
+
+from google.cloud.iap_v1.services.identity_aware_proxy_admin_service import pagers
+from google.cloud.iap_v1.types import service
+
+from .client import IdentityAwareProxyAdminServiceClient
+from .transports.base import (
+    DEFAULT_CLIENT_INFO,
+    IdentityAwareProxyAdminServiceTransport,
+)
+from .transports.grpc_asyncio import IdentityAwareProxyAdminServiceGrpcAsyncIOTransport
+
+
+class IdentityAwareProxyAdminServiceAsyncClient:
+    """APIs for Identity-Aware Proxy Admin configurations."""
+
+    _client: IdentityAwareProxyAdminServiceClient
+
+    DEFAULT_ENDPOINT = IdentityAwareProxyAdminServiceClient.DEFAULT_ENDPOINT
+    DEFAULT_MTLS_ENDPOINT = IdentityAwareProxyAdminServiceClient.DEFAULT_MTLS_ENDPOINT
+
+    tunnel_dest_group_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.tunnel_dest_group_path
+    )
+    parse_tunnel_dest_group_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.parse_tunnel_dest_group_path
+    )
+    tunnel_location_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.tunnel_location_path
+    )
+    parse_tunnel_location_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.parse_tunnel_location_path
+    )
+    common_billing_account_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.common_billing_account_path
+    )
+    parse_common_billing_account_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.parse_common_billing_account_path
+    )
+    common_folder_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.common_folder_path
+    )
+    parse_common_folder_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.parse_common_folder_path
+    )
+    common_organization_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.common_organization_path
+    )
+    parse_common_organization_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.parse_common_organization_path
+    )
+    common_project_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.common_project_path
+    )
+    parse_common_project_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.parse_common_project_path
+    )
+    common_location_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.common_location_path
+    )
+    parse_common_location_path = staticmethod(
+        IdentityAwareProxyAdminServiceClient.parse_common_location_path
+    )
+
+    @classmethod
+    def from_service_account_info(cls, info: dict, *args, **kwargs):
+        """Creates an instance of this client using the provided credentials
+            info.
+
+        Args:
+            info (dict): The service account private key info.
+            args: Additional arguments to pass to the constructor.
+            kwargs: Additional arguments to pass to the constructor.
+
+        Returns:
+            IdentityAwareProxyAdminServiceAsyncClient: The constructed client.
+        """
+        return IdentityAwareProxyAdminServiceClient.from_service_account_info.__func__(IdentityAwareProxyAdminServiceAsyncClient, info, *args, **kwargs)  # type: ignore
+
+    @classmethod
+    def from_service_account_file(cls, filename: str, *args, **kwargs):
+        """Creates an instance of this client using the provided credentials
+            file.
+
+        Args:
+            filename (str): The path to the service account private key json
+                file.
+            args: Additional arguments to pass to the constructor.
+            kwargs: Additional arguments to pass to the constructor.
+
+        Returns:
+            IdentityAwareProxyAdminServiceAsyncClient: The constructed client.
+        """
+        return IdentityAwareProxyAdminServiceClient.from_service_account_file.__func__(IdentityAwareProxyAdminServiceAsyncClient, filename, *args, **kwargs)  # type: ignore
+
+    from_service_account_json = from_service_account_file
+
+    @classmethod
+    def get_mtls_endpoint_and_cert_source(
+        cls, client_options: Optional[ClientOptions] = None
+    ):
+        """Return the API endpoint and client cert source for mutual TLS.
+
+        The client cert source is determined in the following order:
+        (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the
+        client cert source is None.
+        (2) if `client_options.client_cert_source` is provided, use the provided one; if the
+        default client cert source exists, use the default one; otherwise the client cert
+        source is None.
+
+        The API endpoint is determined in the following order:
+        (1) if `client_options.api_endpoint` if provided, use the provided one.
+        (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the
+        default mTLS endpoint; if the environment variable is "never", use the default API
+        endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise
+        use the default API endpoint.
+
+        More details can be found at https://google.aip.dev/auth/4114.
+
+        Args:
+            client_options (google.api_core.client_options.ClientOptions): Custom options for the
+                client. Only the `api_endpoint` and `client_cert_source` properties may be used
+                in this method.
+
+        Returns:
+            Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the
+                client cert source to use.
+
+        Raises:
+            google.auth.exceptions.MutualTLSChannelError: If any errors happen.
+        """
+        return IdentityAwareProxyAdminServiceClient.get_mtls_endpoint_and_cert_source(client_options)  # type: ignore
+
+    @property
+    def transport(self) -> IdentityAwareProxyAdminServiceTransport:
+        """Returns the transport used by the client instance.
+
+        Returns:
+            IdentityAwareProxyAdminServiceTransport: The transport used by the client instance.
+        """
+        return self._client.transport
+
+    get_transport_class = functools.partial(
+        type(IdentityAwareProxyAdminServiceClient).get_transport_class,
+        type(IdentityAwareProxyAdminServiceClient),
+    )
+
+    def __init__(
+        self,
+        *,
+        credentials: Optional[ga_credentials.Credentials] = None,
+        transport: Union[str, IdentityAwareProxyAdminServiceTransport] = "grpc_asyncio",
+        client_options: Optional[ClientOptions] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+    ) -> None:
+        """Instantiates the identity aware proxy admin service client.
+
+        Args:
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+            transport (Union[str, ~.IdentityAwareProxyAdminServiceTransport]): The
+                transport to use. If set to None, a transport is chosen
+                automatically.
+            client_options (ClientOptions): Custom options for the client. It
+                won't take effect if a ``transport`` instance is provided.
+                (1) The ``api_endpoint`` property can be used to override the
+                default endpoint provided by the client. GOOGLE_API_USE_MTLS_ENDPOINT
+                environment variable can also be used to override the endpoint:
+                "always" (always use the default mTLS endpoint), "never" (always
+                use the default regular endpoint) and "auto" (auto switch to the
+                default mTLS endpoint if client certificate is present, this is
+                the default value). However, the ``api_endpoint`` property takes
+                precedence if provided.
+                (2) If GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable
+                is "true", then the ``client_cert_source`` property can be used
+                to provide client certificate for mutual TLS transport. If
+                not provided, the default SSL client certificate will be used if
+                present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not
+                set, no client certificate will be used.
+
+        Raises:
+            google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport
+                creation failed for any reason.
+        """
+        self._client = IdentityAwareProxyAdminServiceClient(
+            credentials=credentials,
+            transport=transport,
+            client_options=client_options,
+            client_info=client_info,
+        )
+
+    async def set_iam_policy(
+        self,
+        request: Optional[Union[iam_policy_pb2.SetIamPolicyRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> policy_pb2.Policy:
+        r"""Sets the access control policy for an Identity-Aware Proxy
+        protected resource. Replaces any existing policy. More
+        information about managing access via IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+            from google.iam.v1 import iam_policy_pb2  # type: ignore
+
+            async def sample_set_iam_policy():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iam_policy_pb2.SetIamPolicyRequest(
+                    resource="resource_value",
+                )
+
+                # Make the request
+                response = await client.set_iam_policy(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.iam.v1.iam_policy_pb2.SetIamPolicyRequest, dict]]):
+                The request object. Request message for ``SetIamPolicy`` method.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.iam.v1.policy_pb2.Policy:
+                An Identity and Access Management (IAM) policy, which specifies access
+                   controls for Google Cloud resources.
+
+                   A Policy is a collection of bindings. A binding binds
+                   one or more members, or principals, to a single role.
+                   Principals can be user accounts, service accounts,
+                   Google groups, and domains (such as G Suite). A role
+                   is a named list of permissions; each role can be an
+                   IAM predefined role or a user-created custom role.
+
+                   For some types of Google Cloud resources, a binding
+                   can also specify a condition, which is a logical
+                   expression that allows access to a resource only if
+                   the expression evaluates to true. A condition can add
+                   constraints based on attributes of the request, the
+                   resource, or both. To learn which resources support
+                   conditions in their IAM policies, see the [IAM
+                   documentation](\ https://cloud.google.com/iam/help/conditions/resource-policies).
+
+                   **JSON example:**
+
+                      {
+                         "bindings": [
+                            {
+                               "role":
+                               "roles/resourcemanager.organizationAdmin",
+                               "members": [ "user:mike@example.com",
+                               "group:admins@example.com",
+                               "domain:google.com",
+                               "serviceAccount:my-project-id@appspot.gserviceaccount.com"
+                               ]
+
+                            }, { "role":
+                            "roles/resourcemanager.organizationViewer",
+                            "members": [ "user:eve@example.com" ],
+                            "condition": { "title": "expirable access",
+                            "description": "Does not grant access after
+                            Sep 2020", "expression": "request.time <
+                            timestamp('2020-10-01T00:00:00.000Z')", } }
+
+                         ], "etag": "BwWWja0YfJA=", "version": 3
+
+                      }
+
+                   **YAML example:**
+
+                      bindings: - members: - user:\ mike@example.com -
+                      group:\ admins@example.com - domain:google.com -
+                      serviceAccount:\ my-project-id@appspot.gserviceaccount.com
+                      role: roles/resourcemanager.organizationAdmin -
+                      members: - user:\ eve@example.com role:
+                      roles/resourcemanager.organizationViewer
+                      condition: title: expirable access description:
+                      Does not grant access after Sep 2020 expression:
+                      request.time <
+                      timestamp('2020-10-01T00:00:00.000Z') etag:
+                      BwWWja0YfJA= version: 3
+
+                   For a description of IAM and its features, see the
+                   [IAM
+                   documentation](\ https://cloud.google.com/iam/docs/).
+
+        """
+        # Create or coerce a protobuf request object.
+        # The request isn't a proto-plus wrapped type,
+        # so it must be constructed via keyword expansion.
+        if isinstance(request, dict):
+            request = iam_policy_pb2.SetIamPolicyRequest(**request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.set_iam_policy,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("resource", request.resource),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def get_iam_policy(
+        self,
+        request: Optional[Union[iam_policy_pb2.GetIamPolicyRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> policy_pb2.Policy:
+        r"""Gets the access control policy for an Identity-Aware Proxy
+        protected resource. More information about managing access via
+        IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+            from google.iam.v1 import iam_policy_pb2  # type: ignore
+
+            async def sample_get_iam_policy():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iam_policy_pb2.GetIamPolicyRequest(
+                    resource="resource_value",
+                )
+
+                # Make the request
+                response = await client.get_iam_policy(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.iam.v1.iam_policy_pb2.GetIamPolicyRequest, dict]]):
+                The request object. Request message for ``GetIamPolicy`` method.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.iam.v1.policy_pb2.Policy:
+                An Identity and Access Management (IAM) policy, which specifies access
+                   controls for Google Cloud resources.
+
+                   A Policy is a collection of bindings. A binding binds
+                   one or more members, or principals, to a single role.
+                   Principals can be user accounts, service accounts,
+                   Google groups, and domains (such as G Suite). A role
+                   is a named list of permissions; each role can be an
+                   IAM predefined role or a user-created custom role.
+
+                   For some types of Google Cloud resources, a binding
+                   can also specify a condition, which is a logical
+                   expression that allows access to a resource only if
+                   the expression evaluates to true. A condition can add
+                   constraints based on attributes of the request, the
+                   resource, or both. To learn which resources support
+                   conditions in their IAM policies, see the [IAM
+                   documentation](\ https://cloud.google.com/iam/help/conditions/resource-policies).
+
+                   **JSON example:**
+
+                      {
+                         "bindings": [
+                            {
+                               "role":
+                               "roles/resourcemanager.organizationAdmin",
+                               "members": [ "user:mike@example.com",
+                               "group:admins@example.com",
+                               "domain:google.com",
+                               "serviceAccount:my-project-id@appspot.gserviceaccount.com"
+                               ]
+
+                            }, { "role":
+                            "roles/resourcemanager.organizationViewer",
+                            "members": [ "user:eve@example.com" ],
+                            "condition": { "title": "expirable access",
+                            "description": "Does not grant access after
+                            Sep 2020", "expression": "request.time <
+                            timestamp('2020-10-01T00:00:00.000Z')", } }
+
+                         ], "etag": "BwWWja0YfJA=", "version": 3
+
+                      }
+
+                   **YAML example:**
+
+                      bindings: - members: - user:\ mike@example.com -
+                      group:\ admins@example.com - domain:google.com -
+                      serviceAccount:\ my-project-id@appspot.gserviceaccount.com
+                      role: roles/resourcemanager.organizationAdmin -
+                      members: - user:\ eve@example.com role:
+                      roles/resourcemanager.organizationViewer
+                      condition: title: expirable access description:
+                      Does not grant access after Sep 2020 expression:
+                      request.time <
+                      timestamp('2020-10-01T00:00:00.000Z') etag:
+                      BwWWja0YfJA= version: 3
+
+                   For a description of IAM and its features, see the
+                   [IAM
+                   documentation](\ https://cloud.google.com/iam/docs/).
+
+        """
+        # Create or coerce a protobuf request object.
+        # The request isn't a proto-plus wrapped type,
+        # so it must be constructed via keyword expansion.
+        if isinstance(request, dict):
+            request = iam_policy_pb2.GetIamPolicyRequest(**request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.get_iam_policy,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("resource", request.resource),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def test_iam_permissions(
+        self,
+        request: Optional[Union[iam_policy_pb2.TestIamPermissionsRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> iam_policy_pb2.TestIamPermissionsResponse:
+        r"""Returns permissions that a caller has on the Identity-Aware
+        Proxy protected resource. More information about managing access
+        via IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+            from google.iam.v1 import iam_policy_pb2  # type: ignore
+
+            async def sample_test_iam_permissions():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iam_policy_pb2.TestIamPermissionsRequest(
+                    resource="resource_value",
+                    permissions=['permissions_value1', 'permissions_value2'],
+                )
+
+                # Make the request
+                response = await client.test_iam_permissions(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.iam.v1.iam_policy_pb2.TestIamPermissionsRequest, dict]]):
+                The request object. Request message for ``TestIamPermissions`` method.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.iam.v1.iam_policy_pb2.TestIamPermissionsResponse:
+                Response message for TestIamPermissions method.
+        """
+        # Create or coerce a protobuf request object.
+        # The request isn't a proto-plus wrapped type,
+        # so it must be constructed via keyword expansion.
+        if isinstance(request, dict):
+            request = iam_policy_pb2.TestIamPermissionsRequest(**request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.test_iam_permissions,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("resource", request.resource),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def get_iap_settings(
+        self,
+        request: Optional[Union[service.GetIapSettingsRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.IapSettings:
+        r"""Gets the IAP settings on a particular IAP protected
+        resource.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_get_iap_settings():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.GetIapSettingsRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                response = await client.get_iap_settings(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.GetIapSettingsRequest, dict]]):
+                The request object. The request sent to GetIapSettings.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.IapSettings:
+                The IAP configurable settings.
+        """
+        # Create or coerce a protobuf request object.
+        request = service.GetIapSettingsRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.get_iap_settings,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def update_iap_settings(
+        self,
+        request: Optional[Union[service.UpdateIapSettingsRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.IapSettings:
+        r"""Updates the IAP settings on a particular IAP protected resource.
+        It replaces all fields unless the ``update_mask`` is set.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_update_iap_settings():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceAsyncClient()
+
+                # Initialize request argument(s)
+                iap_settings = iap_v1.IapSettings()
+                iap_settings.name = "name_value"
+
+                request = iap_v1.UpdateIapSettingsRequest(
+                    iap_settings=iap_settings,
+                )
+
+                # Make the request
+                response = await client.update_iap_settings(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.UpdateIapSettingsRequest, dict]]):
+                The request object. The request sent to
+                UpdateIapSettings.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.IapSettings:
+                The IAP configurable settings.
+        """
+        # Create or coerce a protobuf request object.
+        request = service.UpdateIapSettingsRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.update_iap_settings,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata(
+                (("iap_settings.name", request.iap_settings.name),)
+            ),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def list_tunnel_dest_groups(
+        self,
+        request: Optional[Union[service.ListTunnelDestGroupsRequest, dict]] = None,
+        *,
+        parent: Optional[str] = None,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> pagers.ListTunnelDestGroupsAsyncPager:
+        r"""Lists the existing TunnelDestGroups. To group across all
+        locations, use a ``-`` as the location ID. For example:
+        ``/v1/projects/123/iap_tunnel/locations/-/destGroups``
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_list_tunnel_dest_groups():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.ListTunnelDestGroupsRequest(
+                    parent="parent_value",
+                )
+
+                # Make the request
+                page_result = client.list_tunnel_dest_groups(request=request)
+
+                # Handle the response
+                async for response in page_result:
+                    print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.ListTunnelDestGroupsRequest, dict]]):
+                The request object. The request to ListTunnelDestGroups.
+            parent (:class:`str`):
+                Required. Google Cloud Project ID and location. In the
+                following format:
+                ``projects/{project_number/id}/iap_tunnel/locations/{location}``.
+                A ``-`` can be used for the location to group across all
+                locations.
+
+                This corresponds to the ``parent`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.services.identity_aware_proxy_admin_service.pagers.ListTunnelDestGroupsAsyncPager:
+                The response from
+                ListTunnelDestGroups.
+                Iterating over this object will yield
+                results and resolve additional pages
+                automatically.
+
+        """
+        # Create or coerce a protobuf request object.
+        # Quick check: If we got a request object, we should *not* have
+        # gotten any keyword arguments that map to the request.
+        has_flattened_params = any([parent])
+        if request is not None and has_flattened_params:
+            raise ValueError(
+                "If the `request` argument is set, then none of "
+                "the individual field arguments should be set."
+            )
+
+        request = service.ListTunnelDestGroupsRequest(request)
+
+        # If we have keyword arguments corresponding to fields on the
+        # request, apply these.
+        if parent is not None:
+            request.parent = parent
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.list_tunnel_dest_groups,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # This method is paged; wrap the response in a pager, which provides
+        # an `__aiter__` convenience method.
+        response = pagers.ListTunnelDestGroupsAsyncPager(
+            method=rpc,
+            request=request,
+            response=response,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def create_tunnel_dest_group(
+        self,
+        request: Optional[Union[service.CreateTunnelDestGroupRequest, dict]] = None,
+        *,
+        parent: Optional[str] = None,
+        tunnel_dest_group: Optional[service.TunnelDestGroup] = None,
+        tunnel_dest_group_id: Optional[str] = None,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.TunnelDestGroup:
+        r"""Creates a new TunnelDestGroup.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_create_tunnel_dest_group():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceAsyncClient()
+
+                # Initialize request argument(s)
+                tunnel_dest_group = iap_v1.TunnelDestGroup()
+                tunnel_dest_group.name = "name_value"
+
+                request = iap_v1.CreateTunnelDestGroupRequest(
+                    parent="parent_value",
+                    tunnel_dest_group=tunnel_dest_group,
+                    tunnel_dest_group_id="tunnel_dest_group_id_value",
+                )
+
+                # Make the request
+                response = await client.create_tunnel_dest_group(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.CreateTunnelDestGroupRequest, dict]]):
+                The request object. The request to CreateTunnelDestGroup.
+            parent (:class:`str`):
+                Required. Google Cloud Project ID and location. In the
+                following format:
+                ``projects/{project_number/id}/iap_tunnel/locations/{location}``.
+
+                This corresponds to the ``parent`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            tunnel_dest_group (:class:`google.cloud.iap_v1.types.TunnelDestGroup`):
+                Required. The TunnelDestGroup to
+                create.
+
+                This corresponds to the ``tunnel_dest_group`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            tunnel_dest_group_id (:class:`str`):
+                Required. The ID to use for the TunnelDestGroup, which
+                becomes the final component of the resource name.
+
+                This value must be 4-63 characters, and valid characters
+                are ``[a-z]-``.
+
+                This corresponds to the ``tunnel_dest_group_id`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.TunnelDestGroup:
+                A TunnelDestGroup.
+        """
+        # Create or coerce a protobuf request object.
+        # Quick check: If we got a request object, we should *not* have
+        # gotten any keyword arguments that map to the request.
+        has_flattened_params = any([parent, tunnel_dest_group, tunnel_dest_group_id])
+        if request is not None and has_flattened_params:
+            raise ValueError(
+                "If the `request` argument is set, then none of "
+                "the individual field arguments should be set."
+            )
+
+        request = service.CreateTunnelDestGroupRequest(request)
+
+        # If we have keyword arguments corresponding to fields on the
+        # request, apply these.
+        if parent is not None:
+            request.parent = parent
+        if tunnel_dest_group is not None:
+            request.tunnel_dest_group = tunnel_dest_group
+        if tunnel_dest_group_id is not None:
+            request.tunnel_dest_group_id = tunnel_dest_group_id
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.create_tunnel_dest_group,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def get_tunnel_dest_group(
+        self,
+        request: Optional[Union[service.GetTunnelDestGroupRequest, dict]] = None,
+        *,
+        name: Optional[str] = None,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.TunnelDestGroup:
+        r"""Retrieves an existing TunnelDestGroup.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_get_tunnel_dest_group():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.GetTunnelDestGroupRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                response = await client.get_tunnel_dest_group(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.GetTunnelDestGroupRequest, dict]]):
+                The request object. The request to GetTunnelDestGroup.
+            name (:class:`str`):
+                Required. Name of the TunnelDestGroup to be fetched. In
+                the following format:
+                ``projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}``.
+
+                This corresponds to the ``name`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.TunnelDestGroup:
+                A TunnelDestGroup.
+        """
+        # Create or coerce a protobuf request object.
+        # Quick check: If we got a request object, we should *not* have
+        # gotten any keyword arguments that map to the request.
+        has_flattened_params = any([name])
+        if request is not None and has_flattened_params:
+            raise ValueError(
+                "If the `request` argument is set, then none of "
+                "the individual field arguments should be set."
+            )
+
+        request = service.GetTunnelDestGroupRequest(request)
+
+        # If we have keyword arguments corresponding to fields on the
+        # request, apply these.
+        if name is not None:
+            request.name = name
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.get_tunnel_dest_group,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def delete_tunnel_dest_group(
+        self,
+        request: Optional[Union[service.DeleteTunnelDestGroupRequest, dict]] = None,
+        *,
+        name: Optional[str] = None,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> None:
+        r"""Deletes a TunnelDestGroup.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_delete_tunnel_dest_group():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.DeleteTunnelDestGroupRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                await client.delete_tunnel_dest_group(request=request)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.DeleteTunnelDestGroupRequest, dict]]):
+                The request object. The request to DeleteTunnelDestGroup.
+            name (:class:`str`):
+                Required. Name of the TunnelDestGroup to delete. In the
+                following format:
+                ``projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}``.
+
+                This corresponds to the ``name`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+        """
+        # Create or coerce a protobuf request object.
+        # Quick check: If we got a request object, we should *not* have
+        # gotten any keyword arguments that map to the request.
+        has_flattened_params = any([name])
+        if request is not None and has_flattened_params:
+            raise ValueError(
+                "If the `request` argument is set, then none of "
+                "the individual field arguments should be set."
+            )
+
+        request = service.DeleteTunnelDestGroupRequest(request)
+
+        # If we have keyword arguments corresponding to fields on the
+        # request, apply these.
+        if name is not None:
+            request.name = name
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.delete_tunnel_dest_group,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+    async def update_tunnel_dest_group(
+        self,
+        request: Optional[Union[service.UpdateTunnelDestGroupRequest, dict]] = None,
+        *,
+        tunnel_dest_group: Optional[service.TunnelDestGroup] = None,
+        update_mask: Optional[field_mask_pb2.FieldMask] = None,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.TunnelDestGroup:
+        r"""Updates a TunnelDestGroup.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_update_tunnel_dest_group():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceAsyncClient()
+
+                # Initialize request argument(s)
+                tunnel_dest_group = iap_v1.TunnelDestGroup()
+                tunnel_dest_group.name = "name_value"
+
+                request = iap_v1.UpdateTunnelDestGroupRequest(
+                    tunnel_dest_group=tunnel_dest_group,
+                )
+
+                # Make the request
+                response = await client.update_tunnel_dest_group(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.UpdateTunnelDestGroupRequest, dict]]):
+                The request object. The request to UpdateTunnelDestGroup.
+            tunnel_dest_group (:class:`google.cloud.iap_v1.types.TunnelDestGroup`):
+                Required. The new values for the
+                TunnelDestGroup.
+
+                This corresponds to the ``tunnel_dest_group`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            update_mask (:class:`google.protobuf.field_mask_pb2.FieldMask`):
+                A field mask that specifies which IAP
+                settings to update. If omitted, then all
+                of the settings are updated. See
+                https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask
+
+                This corresponds to the ``update_mask`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.TunnelDestGroup:
+                A TunnelDestGroup.
+        """
+        # Create or coerce a protobuf request object.
+        # Quick check: If we got a request object, we should *not* have
+        # gotten any keyword arguments that map to the request.
+        has_flattened_params = any([tunnel_dest_group, update_mask])
+        if request is not None and has_flattened_params:
+            raise ValueError(
+                "If the `request` argument is set, then none of "
+                "the individual field arguments should be set."
+            )
+
+        request = service.UpdateTunnelDestGroupRequest(request)
+
+        # If we have keyword arguments corresponding to fields on the
+        # request, apply these.
+        if tunnel_dest_group is not None:
+            request.tunnel_dest_group = tunnel_dest_group
+        if update_mask is not None:
+            request.update_mask = update_mask
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.update_tunnel_dest_group,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata(
+                (("tunnel_dest_group.name", request.tunnel_dest_group.name),)
+            ),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, exc_type, exc, tb):
+        await self.transport.close()
+
+
+DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
+    gapic_version=package_version.__version__
+)
+
+
+__all__ = ("IdentityAwareProxyAdminServiceAsyncClient",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/client.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/client.py
new file mode 100644
index 000000000000..48dcae8c2b12
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/client.py
@@ -0,0 +1,1584 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from collections import OrderedDict
+import os
+import re
+from typing import (
+    Dict,
+    Mapping,
+    MutableMapping,
+    MutableSequence,
+    Optional,
+    Sequence,
+    Tuple,
+    Type,
+    Union,
+    cast,
+)
+
+from google.api_core import client_options as client_options_lib
+from google.api_core import exceptions as core_exceptions
+from google.api_core import gapic_v1
+from google.api_core import retry as retries
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.auth.exceptions import MutualTLSChannelError  # type: ignore
+from google.auth.transport import mtls  # type: ignore
+from google.auth.transport.grpc import SslCredentials  # type: ignore
+from google.oauth2 import service_account  # type: ignore
+
+from google.cloud.iap_v1 import gapic_version as package_version
+
+try:
+    OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault]
+except AttributeError:  # pragma: NO COVER
+    OptionalRetry = Union[retries.Retry, object]  # type: ignore
+
+from google.iam.v1 import iam_policy_pb2  # type: ignore
+from google.iam.v1 import policy_pb2  # type: ignore
+from google.protobuf import field_mask_pb2  # type: ignore
+
+from google.cloud.iap_v1.services.identity_aware_proxy_admin_service import pagers
+from google.cloud.iap_v1.types import service
+
+from .transports.base import (
+    DEFAULT_CLIENT_INFO,
+    IdentityAwareProxyAdminServiceTransport,
+)
+from .transports.grpc import IdentityAwareProxyAdminServiceGrpcTransport
+from .transports.grpc_asyncio import IdentityAwareProxyAdminServiceGrpcAsyncIOTransport
+from .transports.rest import IdentityAwareProxyAdminServiceRestTransport
+
+
+class IdentityAwareProxyAdminServiceClientMeta(type):
+    """Metaclass for the IdentityAwareProxyAdminService client.
+
+    This provides class-level methods for building and retrieving
+    support objects (e.g. transport) without polluting the client instance
+    objects.
+    """
+
+    _transport_registry = (
+        OrderedDict()
+    )  # type: Dict[str, Type[IdentityAwareProxyAdminServiceTransport]]
+    _transport_registry["grpc"] = IdentityAwareProxyAdminServiceGrpcTransport
+    _transport_registry[
+        "grpc_asyncio"
+    ] = IdentityAwareProxyAdminServiceGrpcAsyncIOTransport
+    _transport_registry["rest"] = IdentityAwareProxyAdminServiceRestTransport
+
+    def get_transport_class(
+        cls,
+        label: Optional[str] = None,
+    ) -> Type[IdentityAwareProxyAdminServiceTransport]:
+        """Returns an appropriate transport class.
+
+        Args:
+            label: The name of the desired transport. If none is
+                provided, then the first transport in the registry is used.
+
+        Returns:
+            The transport class to use.
+        """
+        # If a specific transport is requested, return that one.
+        if label:
+            return cls._transport_registry[label]
+
+        # No transport is requested; return the default (that is, the first one
+        # in the dictionary).
+        return next(iter(cls._transport_registry.values()))
+
+
+class IdentityAwareProxyAdminServiceClient(
+    metaclass=IdentityAwareProxyAdminServiceClientMeta
+):
+    """APIs for Identity-Aware Proxy Admin configurations."""
+
+    @staticmethod
+    def _get_default_mtls_endpoint(api_endpoint):
+        """Converts api endpoint to mTLS endpoint.
+
+        Convert "*.sandbox.googleapis.com" and "*.googleapis.com" to
+        "*.mtls.sandbox.googleapis.com" and "*.mtls.googleapis.com" respectively.
+        Args:
+            api_endpoint (Optional[str]): the api endpoint to convert.
+        Returns:
+            str: converted mTLS api endpoint.
+        """
+        if not api_endpoint:
+            return api_endpoint
+
+        mtls_endpoint_re = re.compile(
+            r"(?P<name>[^.]+)(?P<mtls>\.mtls)?(?P<sandbox>\.sandbox)?(?P<googledomain>\.googleapis\.com)?"
+        )
+
+        m = mtls_endpoint_re.match(api_endpoint)
+        name, mtls, sandbox, googledomain = m.groups()
+        if mtls or not googledomain:
+            return api_endpoint
+
+        if sandbox:
+            return api_endpoint.replace(
+                "sandbox.googleapis.com", "mtls.sandbox.googleapis.com"
+            )
+
+        return api_endpoint.replace(".googleapis.com", ".mtls.googleapis.com")
+
+    DEFAULT_ENDPOINT = "iap.googleapis.com"
+    DEFAULT_MTLS_ENDPOINT = _get_default_mtls_endpoint.__func__(  # type: ignore
+        DEFAULT_ENDPOINT
+    )
+
+    @classmethod
+    def from_service_account_info(cls, info: dict, *args, **kwargs):
+        """Creates an instance of this client using the provided credentials
+            info.
+
+        Args:
+            info (dict): The service account private key info.
+            args: Additional arguments to pass to the constructor.
+            kwargs: Additional arguments to pass to the constructor.
+
+        Returns:
+            IdentityAwareProxyAdminServiceClient: The constructed client.
+        """
+        credentials = service_account.Credentials.from_service_account_info(info)
+        kwargs["credentials"] = credentials
+        return cls(*args, **kwargs)
+
+    @classmethod
+    def from_service_account_file(cls, filename: str, *args, **kwargs):
+        """Creates an instance of this client using the provided credentials
+            file.
+
+        Args:
+            filename (str): The path to the service account private key json
+                file.
+            args: Additional arguments to pass to the constructor.
+            kwargs: Additional arguments to pass to the constructor.
+
+        Returns:
+            IdentityAwareProxyAdminServiceClient: The constructed client.
+        """
+        credentials = service_account.Credentials.from_service_account_file(filename)
+        kwargs["credentials"] = credentials
+        return cls(*args, **kwargs)
+
+    from_service_account_json = from_service_account_file
+
+    @property
+    def transport(self) -> IdentityAwareProxyAdminServiceTransport:
+        """Returns the transport used by the client instance.
+
+        Returns:
+            IdentityAwareProxyAdminServiceTransport: The transport used by the client
+                instance.
+        """
+        return self._transport
+
+    @staticmethod
+    def tunnel_dest_group_path(
+        project: str,
+        location: str,
+        dest_group: str,
+    ) -> str:
+        """Returns a fully-qualified tunnel_dest_group string."""
+        return "projects/{project}/iap_tunnel/locations/{location}/destGroups/{dest_group}".format(
+            project=project,
+            location=location,
+            dest_group=dest_group,
+        )
+
+    @staticmethod
+    def parse_tunnel_dest_group_path(path: str) -> Dict[str, str]:
+        """Parses a tunnel_dest_group path into its component segments."""
+        m = re.match(
+            r"^projects/(?P<project>.+?)/iap_tunnel/locations/(?P<location>.+?)/destGroups/(?P<dest_group>.+?)$",
+            path,
+        )
+        return m.groupdict() if m else {}
+
+    @staticmethod
+    def tunnel_location_path(
+        project: str,
+        location: str,
+    ) -> str:
+        """Returns a fully-qualified tunnel_location string."""
+        return "projects/{project}/iap_tunnel/locations/{location}".format(
+            project=project,
+            location=location,
+        )
+
+    @staticmethod
+    def parse_tunnel_location_path(path: str) -> Dict[str, str]:
+        """Parses a tunnel_location path into its component segments."""
+        m = re.match(
+            r"^projects/(?P<project>.+?)/iap_tunnel/locations/(?P<location>.+?)$", path
+        )
+        return m.groupdict() if m else {}
+
+    @staticmethod
+    def common_billing_account_path(
+        billing_account: str,
+    ) -> str:
+        """Returns a fully-qualified billing_account string."""
+        return "billingAccounts/{billing_account}".format(
+            billing_account=billing_account,
+        )
+
+    @staticmethod
+    def parse_common_billing_account_path(path: str) -> Dict[str, str]:
+        """Parse a billing_account path into its component segments."""
+        m = re.match(r"^billingAccounts/(?P<billing_account>.+?)$", path)
+        return m.groupdict() if m else {}
+
+    @staticmethod
+    def common_folder_path(
+        folder: str,
+    ) -> str:
+        """Returns a fully-qualified folder string."""
+        return "folders/{folder}".format(
+            folder=folder,
+        )
+
+    @staticmethod
+    def parse_common_folder_path(path: str) -> Dict[str, str]:
+        """Parse a folder path into its component segments."""
+        m = re.match(r"^folders/(?P<folder>.+?)$", path)
+        return m.groupdict() if m else {}
+
+    @staticmethod
+    def common_organization_path(
+        organization: str,
+    ) -> str:
+        """Returns a fully-qualified organization string."""
+        return "organizations/{organization}".format(
+            organization=organization,
+        )
+
+    @staticmethod
+    def parse_common_organization_path(path: str) -> Dict[str, str]:
+        """Parse a organization path into its component segments."""
+        m = re.match(r"^organizations/(?P<organization>.+?)$", path)
+        return m.groupdict() if m else {}
+
+    @staticmethod
+    def common_project_path(
+        project: str,
+    ) -> str:
+        """Returns a fully-qualified project string."""
+        return "projects/{project}".format(
+            project=project,
+        )
+
+    @staticmethod
+    def parse_common_project_path(path: str) -> Dict[str, str]:
+        """Parse a project path into its component segments."""
+        m = re.match(r"^projects/(?P<project>.+?)$", path)
+        return m.groupdict() if m else {}
+
+    @staticmethod
+    def common_location_path(
+        project: str,
+        location: str,
+    ) -> str:
+        """Returns a fully-qualified location string."""
+        return "projects/{project}/locations/{location}".format(
+            project=project,
+            location=location,
+        )
+
+    @staticmethod
+    def parse_common_location_path(path: str) -> Dict[str, str]:
+        """Parse a location path into its component segments."""
+        m = re.match(r"^projects/(?P<project>.+?)/locations/(?P<location>.+?)$", path)
+        return m.groupdict() if m else {}
+
+    @classmethod
+    def get_mtls_endpoint_and_cert_source(
+        cls, client_options: Optional[client_options_lib.ClientOptions] = None
+    ):
+        """Return the API endpoint and client cert source for mutual TLS.
+
+        The client cert source is determined in the following order:
+        (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the
+        client cert source is None.
+        (2) if `client_options.client_cert_source` is provided, use the provided one; if the
+        default client cert source exists, use the default one; otherwise the client cert
+        source is None.
+
+        The API endpoint is determined in the following order:
+        (1) if `client_options.api_endpoint` if provided, use the provided one.
+        (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the
+        default mTLS endpoint; if the environment variable is "never", use the default API
+        endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise
+        use the default API endpoint.
+
+        More details can be found at https://google.aip.dev/auth/4114.
+
+        Args:
+            client_options (google.api_core.client_options.ClientOptions): Custom options for the
+                client. Only the `api_endpoint` and `client_cert_source` properties may be used
+                in this method.
+
+        Returns:
+            Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the
+                client cert source to use.
+
+        Raises:
+            google.auth.exceptions.MutualTLSChannelError: If any errors happen.
+        """
+        if client_options is None:
+            client_options = client_options_lib.ClientOptions()
+        use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false")
+        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")
+        if use_client_cert not in ("true", "false"):
+            raise ValueError(
+                "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
+            )
+        if use_mtls_endpoint not in ("auto", "never", "always"):
+            raise MutualTLSChannelError(
+                "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
+            )
+
+        # Figure out the client cert source to use.
+        client_cert_source = None
+        if use_client_cert == "true":
+            if client_options.client_cert_source:
+                client_cert_source = client_options.client_cert_source
+            elif mtls.has_default_client_cert_source():
+                client_cert_source = mtls.default_client_cert_source()
+
+        # Figure out which api endpoint to use.
+        if client_options.api_endpoint is not None:
+            api_endpoint = client_options.api_endpoint
+        elif use_mtls_endpoint == "always" or (
+            use_mtls_endpoint == "auto" and client_cert_source
+        ):
+            api_endpoint = cls.DEFAULT_MTLS_ENDPOINT
+        else:
+            api_endpoint = cls.DEFAULT_ENDPOINT
+
+        return api_endpoint, client_cert_source
+
+    def __init__(
+        self,
+        *,
+        credentials: Optional[ga_credentials.Credentials] = None,
+        transport: Optional[Union[str, IdentityAwareProxyAdminServiceTransport]] = None,
+        client_options: Optional[Union[client_options_lib.ClientOptions, dict]] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+    ) -> None:
+        """Instantiates the identity aware proxy admin service client.
+
+        Args:
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+            transport (Union[str, IdentityAwareProxyAdminServiceTransport]): The
+                transport to use. If set to None, a transport is chosen
+                automatically.
+            client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]): Custom options for the
+                client. It won't take effect if a ``transport`` instance is provided.
+                (1) The ``api_endpoint`` property can be used to override the
+                default endpoint provided by the client. GOOGLE_API_USE_MTLS_ENDPOINT
+                environment variable can also be used to override the endpoint:
+                "always" (always use the default mTLS endpoint), "never" (always
+                use the default regular endpoint) and "auto" (auto switch to the
+                default mTLS endpoint if client certificate is present, this is
+                the default value). However, the ``api_endpoint`` property takes
+                precedence if provided.
+                (2) If GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable
+                is "true", then the ``client_cert_source`` property can be used
+                to provide client certificate for mutual TLS transport. If
+                not provided, the default SSL client certificate will be used if
+                present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not
+                set, no client certificate will be used.
+            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
+                The client info used to send a user-agent string along with
+                API requests. If ``None``, then default info will be used.
+                Generally, you only need to set this if you're developing
+                your own client library.
+
+        Raises:
+            google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport
+                creation failed for any reason.
+        """
+        if isinstance(client_options, dict):
+            client_options = client_options_lib.from_dict(client_options)
+        if client_options is None:
+            client_options = client_options_lib.ClientOptions()
+        client_options = cast(client_options_lib.ClientOptions, client_options)
+
+        api_endpoint, client_cert_source_func = self.get_mtls_endpoint_and_cert_source(
+            client_options
+        )
+
+        api_key_value = getattr(client_options, "api_key", None)
+        if api_key_value and credentials:
+            raise ValueError(
+                "client_options.api_key and credentials are mutually exclusive"
+            )
+
+        # Save or instantiate the transport.
+        # Ordinarily, we provide the transport, but allowing a custom transport
+        # instance provides an extensibility point for unusual situations.
+        if isinstance(transport, IdentityAwareProxyAdminServiceTransport):
+            # transport is a IdentityAwareProxyAdminServiceTransport instance.
+            if credentials or client_options.credentials_file or api_key_value:
+                raise ValueError(
+                    "When providing a transport instance, "
+                    "provide its credentials directly."
+                )
+            if client_options.scopes:
+                raise ValueError(
+                    "When providing a transport instance, provide its scopes "
+                    "directly."
+                )
+            self._transport = transport
+        else:
+            import google.auth._default  # type: ignore
+
+            if api_key_value and hasattr(
+                google.auth._default, "get_api_key_credentials"
+            ):
+                credentials = google.auth._default.get_api_key_credentials(
+                    api_key_value
+                )
+
+            Transport = type(self).get_transport_class(transport)
+            self._transport = Transport(
+                credentials=credentials,
+                credentials_file=client_options.credentials_file,
+                host=api_endpoint,
+                scopes=client_options.scopes,
+                client_cert_source_for_mtls=client_cert_source_func,
+                quota_project_id=client_options.quota_project_id,
+                client_info=client_info,
+                always_use_jwt_access=True,
+                api_audience=client_options.api_audience,
+            )
+
+    def set_iam_policy(
+        self,
+        request: Optional[Union[iam_policy_pb2.SetIamPolicyRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> policy_pb2.Policy:
+        r"""Sets the access control policy for an Identity-Aware Proxy
+        protected resource. Replaces any existing policy. More
+        information about managing access via IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+            from google.iam.v1 import iam_policy_pb2  # type: ignore
+
+            def sample_set_iam_policy():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceClient()
+
+                # Initialize request argument(s)
+                request = iam_policy_pb2.SetIamPolicyRequest(
+                    resource="resource_value",
+                )
+
+                # Make the request
+                response = client.set_iam_policy(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.iam.v1.iam_policy_pb2.SetIamPolicyRequest, dict]):
+                The request object. Request message for ``SetIamPolicy`` method.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.iam.v1.policy_pb2.Policy:
+                An Identity and Access Management (IAM) policy, which specifies access
+                   controls for Google Cloud resources.
+
+                   A Policy is a collection of bindings. A binding binds
+                   one or more members, or principals, to a single role.
+                   Principals can be user accounts, service accounts,
+                   Google groups, and domains (such as G Suite). A role
+                   is a named list of permissions; each role can be an
+                   IAM predefined role or a user-created custom role.
+
+                   For some types of Google Cloud resources, a binding
+                   can also specify a condition, which is a logical
+                   expression that allows access to a resource only if
+                   the expression evaluates to true. A condition can add
+                   constraints based on attributes of the request, the
+                   resource, or both. To learn which resources support
+                   conditions in their IAM policies, see the [IAM
+                   documentation](\ https://cloud.google.com/iam/help/conditions/resource-policies).
+
+                   **JSON example:**
+
+                      {
+                         "bindings": [
+                            {
+                               "role":
+                               "roles/resourcemanager.organizationAdmin",
+                               "members": [ "user:mike@example.com",
+                               "group:admins@example.com",
+                               "domain:google.com",
+                               "serviceAccount:my-project-id@appspot.gserviceaccount.com"
+                               ]
+
+                            }, { "role":
+                            "roles/resourcemanager.organizationViewer",
+                            "members": [ "user:eve@example.com" ],
+                            "condition": { "title": "expirable access",
+                            "description": "Does not grant access after
+                            Sep 2020", "expression": "request.time <
+                            timestamp('2020-10-01T00:00:00.000Z')", } }
+
+                         ], "etag": "BwWWja0YfJA=", "version": 3
+
+                      }
+
+                   **YAML example:**
+
+                      bindings: - members: - user:\ mike@example.com -
+                      group:\ admins@example.com - domain:google.com -
+                      serviceAccount:\ my-project-id@appspot.gserviceaccount.com
+                      role: roles/resourcemanager.organizationAdmin -
+                      members: - user:\ eve@example.com role:
+                      roles/resourcemanager.organizationViewer
+                      condition: title: expirable access description:
+                      Does not grant access after Sep 2020 expression:
+                      request.time <
+                      timestamp('2020-10-01T00:00:00.000Z') etag:
+                      BwWWja0YfJA= version: 3
+
+                   For a description of IAM and its features, see the
+                   [IAM
+                   documentation](\ https://cloud.google.com/iam/docs/).
+
+        """
+        # Create or coerce a protobuf request object.
+        if isinstance(request, dict):
+            # The request isn't a proto-plus wrapped type,
+            # so it must be constructed via keyword expansion.
+            request = iam_policy_pb2.SetIamPolicyRequest(**request)
+        elif not request:
+            # Null request, just make one.
+            request = iam_policy_pb2.SetIamPolicyRequest()
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.set_iam_policy]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("resource", request.resource),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def get_iam_policy(
+        self,
+        request: Optional[Union[iam_policy_pb2.GetIamPolicyRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> policy_pb2.Policy:
+        r"""Gets the access control policy for an Identity-Aware Proxy
+        protected resource. More information about managing access via
+        IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+            from google.iam.v1 import iam_policy_pb2  # type: ignore
+
+            def sample_get_iam_policy():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceClient()
+
+                # Initialize request argument(s)
+                request = iam_policy_pb2.GetIamPolicyRequest(
+                    resource="resource_value",
+                )
+
+                # Make the request
+                response = client.get_iam_policy(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.iam.v1.iam_policy_pb2.GetIamPolicyRequest, dict]):
+                The request object. Request message for ``GetIamPolicy`` method.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.iam.v1.policy_pb2.Policy:
+                An Identity and Access Management (IAM) policy, which specifies access
+                   controls for Google Cloud resources.
+
+                   A Policy is a collection of bindings. A binding binds
+                   one or more members, or principals, to a single role.
+                   Principals can be user accounts, service accounts,
+                   Google groups, and domains (such as G Suite). A role
+                   is a named list of permissions; each role can be an
+                   IAM predefined role or a user-created custom role.
+
+                   For some types of Google Cloud resources, a binding
+                   can also specify a condition, which is a logical
+                   expression that allows access to a resource only if
+                   the expression evaluates to true. A condition can add
+                   constraints based on attributes of the request, the
+                   resource, or both. To learn which resources support
+                   conditions in their IAM policies, see the [IAM
+                   documentation](\ https://cloud.google.com/iam/help/conditions/resource-policies).
+
+                   **JSON example:**
+
+                      {
+                         "bindings": [
+                            {
+                               "role":
+                               "roles/resourcemanager.organizationAdmin",
+                               "members": [ "user:mike@example.com",
+                               "group:admins@example.com",
+                               "domain:google.com",
+                               "serviceAccount:my-project-id@appspot.gserviceaccount.com"
+                               ]
+
+                            }, { "role":
+                            "roles/resourcemanager.organizationViewer",
+                            "members": [ "user:eve@example.com" ],
+                            "condition": { "title": "expirable access",
+                            "description": "Does not grant access after
+                            Sep 2020", "expression": "request.time <
+                            timestamp('2020-10-01T00:00:00.000Z')", } }
+
+                         ], "etag": "BwWWja0YfJA=", "version": 3
+
+                      }
+
+                   **YAML example:**
+
+                      bindings: - members: - user:\ mike@example.com -
+                      group:\ admins@example.com - domain:google.com -
+                      serviceAccount:\ my-project-id@appspot.gserviceaccount.com
+                      role: roles/resourcemanager.organizationAdmin -
+                      members: - user:\ eve@example.com role:
+                      roles/resourcemanager.organizationViewer
+                      condition: title: expirable access description:
+                      Does not grant access after Sep 2020 expression:
+                      request.time <
+                      timestamp('2020-10-01T00:00:00.000Z') etag:
+                      BwWWja0YfJA= version: 3
+
+                   For a description of IAM and its features, see the
+                   [IAM
+                   documentation](\ https://cloud.google.com/iam/docs/).
+
+        """
+        # Create or coerce a protobuf request object.
+        if isinstance(request, dict):
+            # The request isn't a proto-plus wrapped type,
+            # so it must be constructed via keyword expansion.
+            request = iam_policy_pb2.GetIamPolicyRequest(**request)
+        elif not request:
+            # Null request, just make one.
+            request = iam_policy_pb2.GetIamPolicyRequest()
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.get_iam_policy]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("resource", request.resource),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def test_iam_permissions(
+        self,
+        request: Optional[Union[iam_policy_pb2.TestIamPermissionsRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> iam_policy_pb2.TestIamPermissionsResponse:
+        r"""Returns permissions that a caller has on the Identity-Aware
+        Proxy protected resource. More information about managing access
+        via IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+            from google.iam.v1 import iam_policy_pb2  # type: ignore
+
+            def sample_test_iam_permissions():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceClient()
+
+                # Initialize request argument(s)
+                request = iam_policy_pb2.TestIamPermissionsRequest(
+                    resource="resource_value",
+                    permissions=['permissions_value1', 'permissions_value2'],
+                )
+
+                # Make the request
+                response = client.test_iam_permissions(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.iam.v1.iam_policy_pb2.TestIamPermissionsRequest, dict]):
+                The request object. Request message for ``TestIamPermissions`` method.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.iam.v1.iam_policy_pb2.TestIamPermissionsResponse:
+                Response message for TestIamPermissions method.
+        """
+        # Create or coerce a protobuf request object.
+        if isinstance(request, dict):
+            # The request isn't a proto-plus wrapped type,
+            # so it must be constructed via keyword expansion.
+            request = iam_policy_pb2.TestIamPermissionsRequest(**request)
+        elif not request:
+            # Null request, just make one.
+            request = iam_policy_pb2.TestIamPermissionsRequest()
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.test_iam_permissions]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("resource", request.resource),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def get_iap_settings(
+        self,
+        request: Optional[Union[service.GetIapSettingsRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.IapSettings:
+        r"""Gets the IAP settings on a particular IAP protected
+        resource.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_get_iap_settings():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.GetIapSettingsRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                response = client.get_iap_settings(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.GetIapSettingsRequest, dict]):
+                The request object. The request sent to GetIapSettings.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.IapSettings:
+                The IAP configurable settings.
+        """
+        # Create or coerce a protobuf request object.
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.GetIapSettingsRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.GetIapSettingsRequest):
+            request = service.GetIapSettingsRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.get_iap_settings]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def update_iap_settings(
+        self,
+        request: Optional[Union[service.UpdateIapSettingsRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.IapSettings:
+        r"""Updates the IAP settings on a particular IAP protected resource.
+        It replaces all fields unless the ``update_mask`` is set.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_update_iap_settings():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceClient()
+
+                # Initialize request argument(s)
+                iap_settings = iap_v1.IapSettings()
+                iap_settings.name = "name_value"
+
+                request = iap_v1.UpdateIapSettingsRequest(
+                    iap_settings=iap_settings,
+                )
+
+                # Make the request
+                response = client.update_iap_settings(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.UpdateIapSettingsRequest, dict]):
+                The request object. The request sent to
+                UpdateIapSettings.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.IapSettings:
+                The IAP configurable settings.
+        """
+        # Create or coerce a protobuf request object.
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.UpdateIapSettingsRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.UpdateIapSettingsRequest):
+            request = service.UpdateIapSettingsRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.update_iap_settings]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata(
+                (("iap_settings.name", request.iap_settings.name),)
+            ),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def list_tunnel_dest_groups(
+        self,
+        request: Optional[Union[service.ListTunnelDestGroupsRequest, dict]] = None,
+        *,
+        parent: Optional[str] = None,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> pagers.ListTunnelDestGroupsPager:
+        r"""Lists the existing TunnelDestGroups. To group across all
+        locations, use a ``-`` as the location ID. For example:
+        ``/v1/projects/123/iap_tunnel/locations/-/destGroups``
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_list_tunnel_dest_groups():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.ListTunnelDestGroupsRequest(
+                    parent="parent_value",
+                )
+
+                # Make the request
+                page_result = client.list_tunnel_dest_groups(request=request)
+
+                # Handle the response
+                for response in page_result:
+                    print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.ListTunnelDestGroupsRequest, dict]):
+                The request object. The request to ListTunnelDestGroups.
+            parent (str):
+                Required. Google Cloud Project ID and location. In the
+                following format:
+                ``projects/{project_number/id}/iap_tunnel/locations/{location}``.
+                A ``-`` can be used for the location to group across all
+                locations.
+
+                This corresponds to the ``parent`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.services.identity_aware_proxy_admin_service.pagers.ListTunnelDestGroupsPager:
+                The response from
+                ListTunnelDestGroups.
+                Iterating over this object will yield
+                results and resolve additional pages
+                automatically.
+
+        """
+        # Create or coerce a protobuf request object.
+        # Quick check: If we got a request object, we should *not* have
+        # gotten any keyword arguments that map to the request.
+        has_flattened_params = any([parent])
+        if request is not None and has_flattened_params:
+            raise ValueError(
+                "If the `request` argument is set, then none of "
+                "the individual field arguments should be set."
+            )
+
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.ListTunnelDestGroupsRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.ListTunnelDestGroupsRequest):
+            request = service.ListTunnelDestGroupsRequest(request)
+            # If we have keyword arguments corresponding to fields on the
+            # request, apply these.
+            if parent is not None:
+                request.parent = parent
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.list_tunnel_dest_groups]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # This method is paged; wrap the response in a pager, which provides
+        # an `__iter__` convenience method.
+        response = pagers.ListTunnelDestGroupsPager(
+            method=rpc,
+            request=request,
+            response=response,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def create_tunnel_dest_group(
+        self,
+        request: Optional[Union[service.CreateTunnelDestGroupRequest, dict]] = None,
+        *,
+        parent: Optional[str] = None,
+        tunnel_dest_group: Optional[service.TunnelDestGroup] = None,
+        tunnel_dest_group_id: Optional[str] = None,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.TunnelDestGroup:
+        r"""Creates a new TunnelDestGroup.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_create_tunnel_dest_group():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceClient()
+
+                # Initialize request argument(s)
+                tunnel_dest_group = iap_v1.TunnelDestGroup()
+                tunnel_dest_group.name = "name_value"
+
+                request = iap_v1.CreateTunnelDestGroupRequest(
+                    parent="parent_value",
+                    tunnel_dest_group=tunnel_dest_group,
+                    tunnel_dest_group_id="tunnel_dest_group_id_value",
+                )
+
+                # Make the request
+                response = client.create_tunnel_dest_group(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.CreateTunnelDestGroupRequest, dict]):
+                The request object. The request to CreateTunnelDestGroup.
+            parent (str):
+                Required. Google Cloud Project ID and location. In the
+                following format:
+                ``projects/{project_number/id}/iap_tunnel/locations/{location}``.
+
+                This corresponds to the ``parent`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            tunnel_dest_group (google.cloud.iap_v1.types.TunnelDestGroup):
+                Required. The TunnelDestGroup to
+                create.
+
+                This corresponds to the ``tunnel_dest_group`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            tunnel_dest_group_id (str):
+                Required. The ID to use for the TunnelDestGroup, which
+                becomes the final component of the resource name.
+
+                This value must be 4-63 characters, and valid characters
+                are ``[a-z]-``.
+
+                This corresponds to the ``tunnel_dest_group_id`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.TunnelDestGroup:
+                A TunnelDestGroup.
+        """
+        # Create or coerce a protobuf request object.
+        # Quick check: If we got a request object, we should *not* have
+        # gotten any keyword arguments that map to the request.
+        has_flattened_params = any([parent, tunnel_dest_group, tunnel_dest_group_id])
+        if request is not None and has_flattened_params:
+            raise ValueError(
+                "If the `request` argument is set, then none of "
+                "the individual field arguments should be set."
+            )
+
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.CreateTunnelDestGroupRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.CreateTunnelDestGroupRequest):
+            request = service.CreateTunnelDestGroupRequest(request)
+            # If we have keyword arguments corresponding to fields on the
+            # request, apply these.
+            if parent is not None:
+                request.parent = parent
+            if tunnel_dest_group is not None:
+                request.tunnel_dest_group = tunnel_dest_group
+            if tunnel_dest_group_id is not None:
+                request.tunnel_dest_group_id = tunnel_dest_group_id
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.create_tunnel_dest_group]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def get_tunnel_dest_group(
+        self,
+        request: Optional[Union[service.GetTunnelDestGroupRequest, dict]] = None,
+        *,
+        name: Optional[str] = None,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.TunnelDestGroup:
+        r"""Retrieves an existing TunnelDestGroup.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_get_tunnel_dest_group():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.GetTunnelDestGroupRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                response = client.get_tunnel_dest_group(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.GetTunnelDestGroupRequest, dict]):
+                The request object. The request to GetTunnelDestGroup.
+            name (str):
+                Required. Name of the TunnelDestGroup to be fetched. In
+                the following format:
+                ``projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}``.
+
+                This corresponds to the ``name`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.TunnelDestGroup:
+                A TunnelDestGroup.
+        """
+        # Create or coerce a protobuf request object.
+        # Quick check: If we got a request object, we should *not* have
+        # gotten any keyword arguments that map to the request.
+        has_flattened_params = any([name])
+        if request is not None and has_flattened_params:
+            raise ValueError(
+                "If the `request` argument is set, then none of "
+                "the individual field arguments should be set."
+            )
+
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.GetTunnelDestGroupRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.GetTunnelDestGroupRequest):
+            request = service.GetTunnelDestGroupRequest(request)
+            # If we have keyword arguments corresponding to fields on the
+            # request, apply these.
+            if name is not None:
+                request.name = name
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.get_tunnel_dest_group]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def delete_tunnel_dest_group(
+        self,
+        request: Optional[Union[service.DeleteTunnelDestGroupRequest, dict]] = None,
+        *,
+        name: Optional[str] = None,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> None:
+        r"""Deletes a TunnelDestGroup.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_delete_tunnel_dest_group():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.DeleteTunnelDestGroupRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                client.delete_tunnel_dest_group(request=request)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.DeleteTunnelDestGroupRequest, dict]):
+                The request object. The request to DeleteTunnelDestGroup.
+            name (str):
+                Required. Name of the TunnelDestGroup to delete. In the
+                following format:
+                ``projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}``.
+
+                This corresponds to the ``name`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+        """
+        # Create or coerce a protobuf request object.
+        # Quick check: If we got a request object, we should *not* have
+        # gotten any keyword arguments that map to the request.
+        has_flattened_params = any([name])
+        if request is not None and has_flattened_params:
+            raise ValueError(
+                "If the `request` argument is set, then none of "
+                "the individual field arguments should be set."
+            )
+
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.DeleteTunnelDestGroupRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.DeleteTunnelDestGroupRequest):
+            request = service.DeleteTunnelDestGroupRequest(request)
+            # If we have keyword arguments corresponding to fields on the
+            # request, apply these.
+            if name is not None:
+                request.name = name
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.delete_tunnel_dest_group]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+    def update_tunnel_dest_group(
+        self,
+        request: Optional[Union[service.UpdateTunnelDestGroupRequest, dict]] = None,
+        *,
+        tunnel_dest_group: Optional[service.TunnelDestGroup] = None,
+        update_mask: Optional[field_mask_pb2.FieldMask] = None,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.TunnelDestGroup:
+        r"""Updates a TunnelDestGroup.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_update_tunnel_dest_group():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyAdminServiceClient()
+
+                # Initialize request argument(s)
+                tunnel_dest_group = iap_v1.TunnelDestGroup()
+                tunnel_dest_group.name = "name_value"
+
+                request = iap_v1.UpdateTunnelDestGroupRequest(
+                    tunnel_dest_group=tunnel_dest_group,
+                )
+
+                # Make the request
+                response = client.update_tunnel_dest_group(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.UpdateTunnelDestGroupRequest, dict]):
+                The request object. The request to UpdateTunnelDestGroup.
+            tunnel_dest_group (google.cloud.iap_v1.types.TunnelDestGroup):
+                Required. The new values for the
+                TunnelDestGroup.
+
+                This corresponds to the ``tunnel_dest_group`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            update_mask (google.protobuf.field_mask_pb2.FieldMask):
+                A field mask that specifies which IAP
+                settings to update. If omitted, then all
+                of the settings are updated. See
+                https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask
+
+                This corresponds to the ``update_mask`` field
+                on the ``request`` instance; if ``request`` is provided, this
+                should not be set.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.TunnelDestGroup:
+                A TunnelDestGroup.
+        """
+        # Create or coerce a protobuf request object.
+        # Quick check: If we got a request object, we should *not* have
+        # gotten any keyword arguments that map to the request.
+        has_flattened_params = any([tunnel_dest_group, update_mask])
+        if request is not None and has_flattened_params:
+            raise ValueError(
+                "If the `request` argument is set, then none of "
+                "the individual field arguments should be set."
+            )
+
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.UpdateTunnelDestGroupRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.UpdateTunnelDestGroupRequest):
+            request = service.UpdateTunnelDestGroupRequest(request)
+            # If we have keyword arguments corresponding to fields on the
+            # request, apply these.
+            if tunnel_dest_group is not None:
+                request.tunnel_dest_group = tunnel_dest_group
+            if update_mask is not None:
+                request.update_mask = update_mask
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.update_tunnel_dest_group]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata(
+                (("tunnel_dest_group.name", request.tunnel_dest_group.name),)
+            ),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def __enter__(self) -> "IdentityAwareProxyAdminServiceClient":
+        return self
+
+    def __exit__(self, type, value, traceback):
+        """Releases underlying transport's resources.
+
+        .. warning::
+            ONLY use as a context manager if the transport is NOT shared
+            with other clients! Exiting the with block will CLOSE the transport
+            and may cause errors in other clients!
+        """
+        self.transport.close()
+
+
+DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
+    gapic_version=package_version.__version__
+)
+
+
+__all__ = ("IdentityAwareProxyAdminServiceClient",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/pagers.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/pagers.py
new file mode 100644
index 000000000000..55d09d6d7ce0
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/pagers.py
@@ -0,0 +1,155 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from typing import (
+    Any,
+    AsyncIterator,
+    Awaitable,
+    Callable,
+    Iterator,
+    Optional,
+    Sequence,
+    Tuple,
+)
+
+from google.cloud.iap_v1.types import service
+
+
+class ListTunnelDestGroupsPager:
+    """A pager for iterating through ``list_tunnel_dest_groups`` requests.
+
+    This class thinly wraps an initial
+    :class:`google.cloud.iap_v1.types.ListTunnelDestGroupsResponse` object, and
+    provides an ``__iter__`` method to iterate through its
+    ``tunnel_dest_groups`` field.
+
+    If there are more pages, the ``__iter__`` method will make additional
+    ``ListTunnelDestGroups`` requests and continue to iterate
+    through the ``tunnel_dest_groups`` field on the
+    corresponding responses.
+
+    All the usual :class:`google.cloud.iap_v1.types.ListTunnelDestGroupsResponse`
+    attributes are available on the pager. If multiple requests are made, only
+    the most recent response is retained, and thus used for attribute lookup.
+    """
+
+    def __init__(
+        self,
+        method: Callable[..., service.ListTunnelDestGroupsResponse],
+        request: service.ListTunnelDestGroupsRequest,
+        response: service.ListTunnelDestGroupsResponse,
+        *,
+        metadata: Sequence[Tuple[str, str]] = ()
+    ):
+        """Instantiate the pager.
+
+        Args:
+            method (Callable): The method that was originally called, and
+                which instantiated this pager.
+            request (google.cloud.iap_v1.types.ListTunnelDestGroupsRequest):
+                The initial request object.
+            response (google.cloud.iap_v1.types.ListTunnelDestGroupsResponse):
+                The initial response object.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+        """
+        self._method = method
+        self._request = service.ListTunnelDestGroupsRequest(request)
+        self._response = response
+        self._metadata = metadata
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._response, name)
+
+    @property
+    def pages(self) -> Iterator[service.ListTunnelDestGroupsResponse]:
+        yield self._response
+        while self._response.next_page_token:
+            self._request.page_token = self._response.next_page_token
+            self._response = self._method(self._request, metadata=self._metadata)
+            yield self._response
+
+    def __iter__(self) -> Iterator[service.TunnelDestGroup]:
+        for page in self.pages:
+            yield from page.tunnel_dest_groups
+
+    def __repr__(self) -> str:
+        return "{0}<{1!r}>".format(self.__class__.__name__, self._response)
+
+
+class ListTunnelDestGroupsAsyncPager:
+    """A pager for iterating through ``list_tunnel_dest_groups`` requests.
+
+    This class thinly wraps an initial
+    :class:`google.cloud.iap_v1.types.ListTunnelDestGroupsResponse` object, and
+    provides an ``__aiter__`` method to iterate through its
+    ``tunnel_dest_groups`` field.
+
+    If there are more pages, the ``__aiter__`` method will make additional
+    ``ListTunnelDestGroups`` requests and continue to iterate
+    through the ``tunnel_dest_groups`` field on the
+    corresponding responses.
+
+    All the usual :class:`google.cloud.iap_v1.types.ListTunnelDestGroupsResponse`
+    attributes are available on the pager. If multiple requests are made, only
+    the most recent response is retained, and thus used for attribute lookup.
+    """
+
+    def __init__(
+        self,
+        method: Callable[..., Awaitable[service.ListTunnelDestGroupsResponse]],
+        request: service.ListTunnelDestGroupsRequest,
+        response: service.ListTunnelDestGroupsResponse,
+        *,
+        metadata: Sequence[Tuple[str, str]] = ()
+    ):
+        """Instantiates the pager.
+
+        Args:
+            method (Callable): The method that was originally called, and
+                which instantiated this pager.
+            request (google.cloud.iap_v1.types.ListTunnelDestGroupsRequest):
+                The initial request object.
+            response (google.cloud.iap_v1.types.ListTunnelDestGroupsResponse):
+                The initial response object.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+        """
+        self._method = method
+        self._request = service.ListTunnelDestGroupsRequest(request)
+        self._response = response
+        self._metadata = metadata
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._response, name)
+
+    @property
+    async def pages(self) -> AsyncIterator[service.ListTunnelDestGroupsResponse]:
+        yield self._response
+        while self._response.next_page_token:
+            self._request.page_token = self._response.next_page_token
+            self._response = await self._method(self._request, metadata=self._metadata)
+            yield self._response
+
+    def __aiter__(self) -> AsyncIterator[service.TunnelDestGroup]:
+        async def async_generator():
+            async for page in self.pages:
+                for response in page.tunnel_dest_groups:
+                    yield response
+
+        return async_generator()
+
+    def __repr__(self) -> str:
+        return "{0}<{1!r}>".format(self.__class__.__name__, self._response)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/__init__.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/__init__.py
new file mode 100644
index 000000000000..5a269ec69ff8
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/__init__.py
@@ -0,0 +1,41 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from collections import OrderedDict
+from typing import Dict, Type
+
+from .base import IdentityAwareProxyAdminServiceTransport
+from .grpc import IdentityAwareProxyAdminServiceGrpcTransport
+from .grpc_asyncio import IdentityAwareProxyAdminServiceGrpcAsyncIOTransport
+from .rest import (
+    IdentityAwareProxyAdminServiceRestInterceptor,
+    IdentityAwareProxyAdminServiceRestTransport,
+)
+
+# Compile a registry of transports.
+_transport_registry = (
+    OrderedDict()
+)  # type: Dict[str, Type[IdentityAwareProxyAdminServiceTransport]]
+_transport_registry["grpc"] = IdentityAwareProxyAdminServiceGrpcTransport
+_transport_registry["grpc_asyncio"] = IdentityAwareProxyAdminServiceGrpcAsyncIOTransport
+_transport_registry["rest"] = IdentityAwareProxyAdminServiceRestTransport
+
+__all__ = (
+    "IdentityAwareProxyAdminServiceTransport",
+    "IdentityAwareProxyAdminServiceGrpcTransport",
+    "IdentityAwareProxyAdminServiceGrpcAsyncIOTransport",
+    "IdentityAwareProxyAdminServiceRestTransport",
+    "IdentityAwareProxyAdminServiceRestInterceptor",
+)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/base.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/base.py
new file mode 100644
index 000000000000..9e5553c3327c
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/base.py
@@ -0,0 +1,290 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+import abc
+from typing import Awaitable, Callable, Dict, Optional, Sequence, Union
+
+import google.api_core
+from google.api_core import exceptions as core_exceptions
+from google.api_core import gapic_v1
+from google.api_core import retry as retries
+import google.auth  # type: ignore
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.iam.v1 import iam_policy_pb2  # type: ignore
+from google.iam.v1 import policy_pb2  # type: ignore
+from google.oauth2 import service_account  # type: ignore
+from google.protobuf import empty_pb2  # type: ignore
+
+from google.cloud.iap_v1 import gapic_version as package_version
+from google.cloud.iap_v1.types import service
+
+DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
+    gapic_version=package_version.__version__
+)
+
+
+class IdentityAwareProxyAdminServiceTransport(abc.ABC):
+    """Abstract transport class for IdentityAwareProxyAdminService."""
+
+    AUTH_SCOPES = ("https://www.googleapis.com/auth/cloud-platform",)
+
+    DEFAULT_HOST: str = "iap.googleapis.com"
+
+    def __init__(
+        self,
+        *,
+        host: str = DEFAULT_HOST,
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        quota_project_id: Optional[str] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
+        api_audience: Optional[str] = None,
+        **kwargs,
+    ) -> None:
+        """Instantiate the transport.
+
+        Args:
+            host (Optional[str]):
+                 The hostname to connect to.
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is mutually exclusive with credentials.
+            scopes (Optional[Sequence[str]]): A list of scopes.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
+                The client info used to send a user-agent string along with
+                API requests. If ``None``, then default info will be used.
+                Generally, you only need to set this if you're developing
+                your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
+        """
+
+        scopes_kwargs = {"scopes": scopes, "default_scopes": self.AUTH_SCOPES}
+
+        # Save the scopes.
+        self._scopes = scopes
+
+        # If no credentials are provided, then determine the appropriate
+        # defaults.
+        if credentials and credentials_file:
+            raise core_exceptions.DuplicateCredentialArgs(
+                "'credentials_file' and 'credentials' are mutually exclusive"
+            )
+
+        if credentials_file is not None:
+            credentials, _ = google.auth.load_credentials_from_file(
+                credentials_file, **scopes_kwargs, quota_project_id=quota_project_id
+            )
+        elif credentials is None:
+            credentials, _ = google.auth.default(
+                **scopes_kwargs, quota_project_id=quota_project_id
+            )
+            # Don't apply audience if the credentials file passed from user.
+            if hasattr(credentials, "with_gdch_audience"):
+                credentials = credentials.with_gdch_audience(
+                    api_audience if api_audience else host
+                )
+
+        # If the credentials are service account credentials, then always try to use self signed JWT.
+        if (
+            always_use_jwt_access
+            and isinstance(credentials, service_account.Credentials)
+            and hasattr(service_account.Credentials, "with_always_use_jwt_access")
+        ):
+            credentials = credentials.with_always_use_jwt_access(True)
+
+        # Save the credentials.
+        self._credentials = credentials
+
+        # Save the hostname. Default to port 443 (HTTPS) if none is specified.
+        if ":" not in host:
+            host += ":443"
+        self._host = host
+
+    def _prep_wrapped_messages(self, client_info):
+        # Precompute the wrapped methods.
+        self._wrapped_methods = {
+            self.set_iam_policy: gapic_v1.method.wrap_method(
+                self.set_iam_policy,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.get_iam_policy: gapic_v1.method.wrap_method(
+                self.get_iam_policy,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.test_iam_permissions: gapic_v1.method.wrap_method(
+                self.test_iam_permissions,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.get_iap_settings: gapic_v1.method.wrap_method(
+                self.get_iap_settings,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.update_iap_settings: gapic_v1.method.wrap_method(
+                self.update_iap_settings,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.list_tunnel_dest_groups: gapic_v1.method.wrap_method(
+                self.list_tunnel_dest_groups,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.create_tunnel_dest_group: gapic_v1.method.wrap_method(
+                self.create_tunnel_dest_group,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.get_tunnel_dest_group: gapic_v1.method.wrap_method(
+                self.get_tunnel_dest_group,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.delete_tunnel_dest_group: gapic_v1.method.wrap_method(
+                self.delete_tunnel_dest_group,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.update_tunnel_dest_group: gapic_v1.method.wrap_method(
+                self.update_tunnel_dest_group,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+        }
+
+    def close(self):
+        """Closes resources associated with the transport.
+
+        .. warning::
+             Only call this method if the transport is NOT shared
+             with other clients - this may cause errors in other clients!
+        """
+        raise NotImplementedError()
+
+    @property
+    def set_iam_policy(
+        self,
+    ) -> Callable[
+        [iam_policy_pb2.SetIamPolicyRequest],
+        Union[policy_pb2.Policy, Awaitable[policy_pb2.Policy]],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def get_iam_policy(
+        self,
+    ) -> Callable[
+        [iam_policy_pb2.GetIamPolicyRequest],
+        Union[policy_pb2.Policy, Awaitable[policy_pb2.Policy]],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def test_iam_permissions(
+        self,
+    ) -> Callable[
+        [iam_policy_pb2.TestIamPermissionsRequest],
+        Union[
+            iam_policy_pb2.TestIamPermissionsResponse,
+            Awaitable[iam_policy_pb2.TestIamPermissionsResponse],
+        ],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def get_iap_settings(
+        self,
+    ) -> Callable[
+        [service.GetIapSettingsRequest],
+        Union[service.IapSettings, Awaitable[service.IapSettings]],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def update_iap_settings(
+        self,
+    ) -> Callable[
+        [service.UpdateIapSettingsRequest],
+        Union[service.IapSettings, Awaitable[service.IapSettings]],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def list_tunnel_dest_groups(
+        self,
+    ) -> Callable[
+        [service.ListTunnelDestGroupsRequest],
+        Union[
+            service.ListTunnelDestGroupsResponse,
+            Awaitable[service.ListTunnelDestGroupsResponse],
+        ],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def create_tunnel_dest_group(
+        self,
+    ) -> Callable[
+        [service.CreateTunnelDestGroupRequest],
+        Union[service.TunnelDestGroup, Awaitable[service.TunnelDestGroup]],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def get_tunnel_dest_group(
+        self,
+    ) -> Callable[
+        [service.GetTunnelDestGroupRequest],
+        Union[service.TunnelDestGroup, Awaitable[service.TunnelDestGroup]],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def delete_tunnel_dest_group(
+        self,
+    ) -> Callable[
+        [service.DeleteTunnelDestGroupRequest],
+        Union[empty_pb2.Empty, Awaitable[empty_pb2.Empty]],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def update_tunnel_dest_group(
+        self,
+    ) -> Callable[
+        [service.UpdateTunnelDestGroupRequest],
+        Union[service.TunnelDestGroup, Awaitable[service.TunnelDestGroup]],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def kind(self) -> str:
+        raise NotImplementedError()
+
+
+__all__ = ("IdentityAwareProxyAdminServiceTransport",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/grpc.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/grpc.py
new file mode 100644
index 000000000000..742bcbf6b2dd
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/grpc.py
@@ -0,0 +1,522 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from typing import Callable, Dict, Optional, Sequence, Tuple, Union
+import warnings
+
+from google.api_core import gapic_v1, grpc_helpers
+import google.auth  # type: ignore
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.auth.transport.grpc import SslCredentials  # type: ignore
+from google.iam.v1 import iam_policy_pb2  # type: ignore
+from google.iam.v1 import policy_pb2  # type: ignore
+from google.protobuf import empty_pb2  # type: ignore
+import grpc  # type: ignore
+
+from google.cloud.iap_v1.types import service
+
+from .base import DEFAULT_CLIENT_INFO, IdentityAwareProxyAdminServiceTransport
+
+
+class IdentityAwareProxyAdminServiceGrpcTransport(
+    IdentityAwareProxyAdminServiceTransport
+):
+    """gRPC backend transport for IdentityAwareProxyAdminService.
+
+    APIs for Identity-Aware Proxy Admin configurations.
+
+    This class defines the same methods as the primary client, so the
+    primary client can load the underlying transport implementation
+    and call it.
+
+    It sends protocol buffers over the wire using gRPC (which is built on
+    top of HTTP/2); the ``grpcio`` package must be installed.
+    """
+
+    _stubs: Dict[str, Callable]
+
+    def __init__(
+        self,
+        *,
+        host: str = "iap.googleapis.com",
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        channel: Optional[grpc.Channel] = None,
+        api_mtls_endpoint: Optional[str] = None,
+        client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None,
+        ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None,
+        client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None,
+        quota_project_id: Optional[str] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
+        api_audience: Optional[str] = None,
+    ) -> None:
+        """Instantiate the transport.
+
+        Args:
+            host (Optional[str]):
+                 The hostname to connect to.
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+                This argument is ignored if ``channel`` is provided.
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is ignored if ``channel`` is provided.
+            scopes (Optional(Sequence[str])): A list of scopes. This argument is
+                ignored if ``channel`` is provided.
+            channel (Optional[grpc.Channel]): A ``Channel`` instance through
+                which to make calls.
+            api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint.
+                If provided, it overrides the ``host`` argument and tries to create
+                a mutual TLS channel with client SSL credentials from
+                ``client_cert_source`` or application default SSL credentials.
+            client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]):
+                Deprecated. A callback to provide client SSL certificate bytes and
+                private key bytes, both in PEM format. It is ignored if
+                ``api_mtls_endpoint`` is None.
+            ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials
+                for the grpc channel. It is ignored if ``channel`` is provided.
+            client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]):
+                A callback to provide client certificate bytes and private key bytes,
+                both in PEM format. It is used to configure a mutual TLS channel. It is
+                ignored if ``channel`` or ``ssl_channel_credentials`` is provided.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
+                The client info used to send a user-agent string along with
+                API requests. If ``None``, then default info will be used.
+                Generally, you only need to set this if you're developing
+                your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
+
+        Raises:
+          google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport
+              creation failed for any reason.
+          google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials``
+              and ``credentials_file`` are passed.
+        """
+        self._grpc_channel = None
+        self._ssl_channel_credentials = ssl_channel_credentials
+        self._stubs: Dict[str, Callable] = {}
+
+        if api_mtls_endpoint:
+            warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning)
+        if client_cert_source:
+            warnings.warn("client_cert_source is deprecated", DeprecationWarning)
+
+        if channel:
+            # Ignore credentials if a channel was passed.
+            credentials = False
+            # If a channel was explicitly provided, set it.
+            self._grpc_channel = channel
+            self._ssl_channel_credentials = None
+
+        else:
+            if api_mtls_endpoint:
+                host = api_mtls_endpoint
+
+                # Create SSL credentials with client_cert_source or application
+                # default SSL credentials.
+                if client_cert_source:
+                    cert, key = client_cert_source()
+                    self._ssl_channel_credentials = grpc.ssl_channel_credentials(
+                        certificate_chain=cert, private_key=key
+                    )
+                else:
+                    self._ssl_channel_credentials = SslCredentials().ssl_credentials
+
+            else:
+                if client_cert_source_for_mtls and not ssl_channel_credentials:
+                    cert, key = client_cert_source_for_mtls()
+                    self._ssl_channel_credentials = grpc.ssl_channel_credentials(
+                        certificate_chain=cert, private_key=key
+                    )
+
+        # The base transport sets the host, credentials and scopes
+        super().__init__(
+            host=host,
+            credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
+            client_info=client_info,
+            always_use_jwt_access=always_use_jwt_access,
+            api_audience=api_audience,
+        )
+
+        if not self._grpc_channel:
+            self._grpc_channel = type(self).create_channel(
+                self._host,
+                # use the credentials which are saved
+                credentials=self._credentials,
+                # Set ``credentials_file`` to ``None`` here as
+                # the credentials that we saved earlier should be used.
+                credentials_file=None,
+                scopes=self._scopes,
+                ssl_credentials=self._ssl_channel_credentials,
+                quota_project_id=quota_project_id,
+                options=[
+                    ("grpc.max_send_message_length", -1),
+                    ("grpc.max_receive_message_length", -1),
+                ],
+            )
+
+        # Wrap messages. This must be done after self._grpc_channel exists
+        self._prep_wrapped_messages(client_info)
+
+    @classmethod
+    def create_channel(
+        cls,
+        host: str = "iap.googleapis.com",
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        quota_project_id: Optional[str] = None,
+        **kwargs,
+    ) -> grpc.Channel:
+        """Create and return a gRPC channel object.
+        Args:
+            host (Optional[str]): The host for the channel to use.
+            credentials (Optional[~.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify this application to the service. If
+                none are specified, the client will attempt to ascertain
+                the credentials from the environment.
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is mutually exclusive with credentials.
+            scopes (Optional[Sequence[str]]): A optional list of scopes needed for this
+                service. These are only used when credentials are not specified and
+                are passed to :func:`google.auth.default`.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            kwargs (Optional[dict]): Keyword arguments, which are passed to the
+                channel creation.
+        Returns:
+            grpc.Channel: A gRPC channel object.
+
+        Raises:
+            google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials``
+              and ``credentials_file`` are passed.
+        """
+
+        return grpc_helpers.create_channel(
+            host,
+            credentials=credentials,
+            credentials_file=credentials_file,
+            quota_project_id=quota_project_id,
+            default_scopes=cls.AUTH_SCOPES,
+            scopes=scopes,
+            default_host=cls.DEFAULT_HOST,
+            **kwargs,
+        )
+
+    @property
+    def grpc_channel(self) -> grpc.Channel:
+        """Return the channel designed to connect to this service."""
+        return self._grpc_channel
+
+    @property
+    def set_iam_policy(
+        self,
+    ) -> Callable[[iam_policy_pb2.SetIamPolicyRequest], policy_pb2.Policy]:
+        r"""Return a callable for the set iam policy method over gRPC.
+
+        Sets the access control policy for an Identity-Aware Proxy
+        protected resource. Replaces any existing policy. More
+        information about managing access via IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        Returns:
+            Callable[[~.SetIamPolicyRequest],
+                    ~.Policy]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "set_iam_policy" not in self._stubs:
+            self._stubs["set_iam_policy"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/SetIamPolicy",
+                request_serializer=iam_policy_pb2.SetIamPolicyRequest.SerializeToString,
+                response_deserializer=policy_pb2.Policy.FromString,
+            )
+        return self._stubs["set_iam_policy"]
+
+    @property
+    def get_iam_policy(
+        self,
+    ) -> Callable[[iam_policy_pb2.GetIamPolicyRequest], policy_pb2.Policy]:
+        r"""Return a callable for the get iam policy method over gRPC.
+
+        Gets the access control policy for an Identity-Aware Proxy
+        protected resource. More information about managing access via
+        IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        Returns:
+            Callable[[~.GetIamPolicyRequest],
+                    ~.Policy]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "get_iam_policy" not in self._stubs:
+            self._stubs["get_iam_policy"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/GetIamPolicy",
+                request_serializer=iam_policy_pb2.GetIamPolicyRequest.SerializeToString,
+                response_deserializer=policy_pb2.Policy.FromString,
+            )
+        return self._stubs["get_iam_policy"]
+
+    @property
+    def test_iam_permissions(
+        self,
+    ) -> Callable[
+        [iam_policy_pb2.TestIamPermissionsRequest],
+        iam_policy_pb2.TestIamPermissionsResponse,
+    ]:
+        r"""Return a callable for the test iam permissions method over gRPC.
+
+        Returns permissions that a caller has on the Identity-Aware
+        Proxy protected resource. More information about managing access
+        via IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        Returns:
+            Callable[[~.TestIamPermissionsRequest],
+                    ~.TestIamPermissionsResponse]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "test_iam_permissions" not in self._stubs:
+            self._stubs["test_iam_permissions"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/TestIamPermissions",
+                request_serializer=iam_policy_pb2.TestIamPermissionsRequest.SerializeToString,
+                response_deserializer=iam_policy_pb2.TestIamPermissionsResponse.FromString,
+            )
+        return self._stubs["test_iam_permissions"]
+
+    @property
+    def get_iap_settings(
+        self,
+    ) -> Callable[[service.GetIapSettingsRequest], service.IapSettings]:
+        r"""Return a callable for the get iap settings method over gRPC.
+
+        Gets the IAP settings on a particular IAP protected
+        resource.
+
+        Returns:
+            Callable[[~.GetIapSettingsRequest],
+                    ~.IapSettings]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "get_iap_settings" not in self._stubs:
+            self._stubs["get_iap_settings"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/GetIapSettings",
+                request_serializer=service.GetIapSettingsRequest.serialize,
+                response_deserializer=service.IapSettings.deserialize,
+            )
+        return self._stubs["get_iap_settings"]
+
+    @property
+    def update_iap_settings(
+        self,
+    ) -> Callable[[service.UpdateIapSettingsRequest], service.IapSettings]:
+        r"""Return a callable for the update iap settings method over gRPC.
+
+        Updates the IAP settings on a particular IAP protected resource.
+        It replaces all fields unless the ``update_mask`` is set.
+
+        Returns:
+            Callable[[~.UpdateIapSettingsRequest],
+                    ~.IapSettings]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "update_iap_settings" not in self._stubs:
+            self._stubs["update_iap_settings"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/UpdateIapSettings",
+                request_serializer=service.UpdateIapSettingsRequest.serialize,
+                response_deserializer=service.IapSettings.deserialize,
+            )
+        return self._stubs["update_iap_settings"]
+
+    @property
+    def list_tunnel_dest_groups(
+        self,
+    ) -> Callable[
+        [service.ListTunnelDestGroupsRequest], service.ListTunnelDestGroupsResponse
+    ]:
+        r"""Return a callable for the list tunnel dest groups method over gRPC.
+
+        Lists the existing TunnelDestGroups. To group across all
+        locations, use a ``-`` as the location ID. For example:
+        ``/v1/projects/123/iap_tunnel/locations/-/destGroups``
+
+        Returns:
+            Callable[[~.ListTunnelDestGroupsRequest],
+                    ~.ListTunnelDestGroupsResponse]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "list_tunnel_dest_groups" not in self._stubs:
+            self._stubs["list_tunnel_dest_groups"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/ListTunnelDestGroups",
+                request_serializer=service.ListTunnelDestGroupsRequest.serialize,
+                response_deserializer=service.ListTunnelDestGroupsResponse.deserialize,
+            )
+        return self._stubs["list_tunnel_dest_groups"]
+
+    @property
+    def create_tunnel_dest_group(
+        self,
+    ) -> Callable[[service.CreateTunnelDestGroupRequest], service.TunnelDestGroup]:
+        r"""Return a callable for the create tunnel dest group method over gRPC.
+
+        Creates a new TunnelDestGroup.
+
+        Returns:
+            Callable[[~.CreateTunnelDestGroupRequest],
+                    ~.TunnelDestGroup]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "create_tunnel_dest_group" not in self._stubs:
+            self._stubs["create_tunnel_dest_group"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/CreateTunnelDestGroup",
+                request_serializer=service.CreateTunnelDestGroupRequest.serialize,
+                response_deserializer=service.TunnelDestGroup.deserialize,
+            )
+        return self._stubs["create_tunnel_dest_group"]
+
+    @property
+    def get_tunnel_dest_group(
+        self,
+    ) -> Callable[[service.GetTunnelDestGroupRequest], service.TunnelDestGroup]:
+        r"""Return a callable for the get tunnel dest group method over gRPC.
+
+        Retrieves an existing TunnelDestGroup.
+
+        Returns:
+            Callable[[~.GetTunnelDestGroupRequest],
+                    ~.TunnelDestGroup]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "get_tunnel_dest_group" not in self._stubs:
+            self._stubs["get_tunnel_dest_group"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/GetTunnelDestGroup",
+                request_serializer=service.GetTunnelDestGroupRequest.serialize,
+                response_deserializer=service.TunnelDestGroup.deserialize,
+            )
+        return self._stubs["get_tunnel_dest_group"]
+
+    @property
+    def delete_tunnel_dest_group(
+        self,
+    ) -> Callable[[service.DeleteTunnelDestGroupRequest], empty_pb2.Empty]:
+        r"""Return a callable for the delete tunnel dest group method over gRPC.
+
+        Deletes a TunnelDestGroup.
+
+        Returns:
+            Callable[[~.DeleteTunnelDestGroupRequest],
+                    ~.Empty]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "delete_tunnel_dest_group" not in self._stubs:
+            self._stubs["delete_tunnel_dest_group"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/DeleteTunnelDestGroup",
+                request_serializer=service.DeleteTunnelDestGroupRequest.serialize,
+                response_deserializer=empty_pb2.Empty.FromString,
+            )
+        return self._stubs["delete_tunnel_dest_group"]
+
+    @property
+    def update_tunnel_dest_group(
+        self,
+    ) -> Callable[[service.UpdateTunnelDestGroupRequest], service.TunnelDestGroup]:
+        r"""Return a callable for the update tunnel dest group method over gRPC.
+
+        Updates a TunnelDestGroup.
+
+        Returns:
+            Callable[[~.UpdateTunnelDestGroupRequest],
+                    ~.TunnelDestGroup]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "update_tunnel_dest_group" not in self._stubs:
+            self._stubs["update_tunnel_dest_group"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/UpdateTunnelDestGroup",
+                request_serializer=service.UpdateTunnelDestGroupRequest.serialize,
+                response_deserializer=service.TunnelDestGroup.deserialize,
+            )
+        return self._stubs["update_tunnel_dest_group"]
+
+    def close(self):
+        self.grpc_channel.close()
+
+    @property
+    def kind(self) -> str:
+        return "grpc"
+
+
+__all__ = ("IdentityAwareProxyAdminServiceGrpcTransport",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/grpc_asyncio.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/grpc_asyncio.py
new file mode 100644
index 000000000000..d55615fdaf7b
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/grpc_asyncio.py
@@ -0,0 +1,528 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from typing import Awaitable, Callable, Dict, Optional, Sequence, Tuple, Union
+import warnings
+
+from google.api_core import gapic_v1, grpc_helpers_async
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.auth.transport.grpc import SslCredentials  # type: ignore
+from google.iam.v1 import iam_policy_pb2  # type: ignore
+from google.iam.v1 import policy_pb2  # type: ignore
+from google.protobuf import empty_pb2  # type: ignore
+import grpc  # type: ignore
+from grpc.experimental import aio  # type: ignore
+
+from google.cloud.iap_v1.types import service
+
+from .base import DEFAULT_CLIENT_INFO, IdentityAwareProxyAdminServiceTransport
+from .grpc import IdentityAwareProxyAdminServiceGrpcTransport
+
+
+class IdentityAwareProxyAdminServiceGrpcAsyncIOTransport(
+    IdentityAwareProxyAdminServiceTransport
+):
+    """gRPC AsyncIO backend transport for IdentityAwareProxyAdminService.
+
+    APIs for Identity-Aware Proxy Admin configurations.
+
+    This class defines the same methods as the primary client, so the
+    primary client can load the underlying transport implementation
+    and call it.
+
+    It sends protocol buffers over the wire using gRPC (which is built on
+    top of HTTP/2); the ``grpcio`` package must be installed.
+    """
+
+    _grpc_channel: aio.Channel
+    _stubs: Dict[str, Callable] = {}
+
+    @classmethod
+    def create_channel(
+        cls,
+        host: str = "iap.googleapis.com",
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        quota_project_id: Optional[str] = None,
+        **kwargs,
+    ) -> aio.Channel:
+        """Create and return a gRPC AsyncIO channel object.
+        Args:
+            host (Optional[str]): The host for the channel to use.
+            credentials (Optional[~.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify this application to the service. If
+                none are specified, the client will attempt to ascertain
+                the credentials from the environment.
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is ignored if ``channel`` is provided.
+            scopes (Optional[Sequence[str]]): A optional list of scopes needed for this
+                service. These are only used when credentials are not specified and
+                are passed to :func:`google.auth.default`.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            kwargs (Optional[dict]): Keyword arguments, which are passed to the
+                channel creation.
+        Returns:
+            aio.Channel: A gRPC AsyncIO channel object.
+        """
+
+        return grpc_helpers_async.create_channel(
+            host,
+            credentials=credentials,
+            credentials_file=credentials_file,
+            quota_project_id=quota_project_id,
+            default_scopes=cls.AUTH_SCOPES,
+            scopes=scopes,
+            default_host=cls.DEFAULT_HOST,
+            **kwargs,
+        )
+
+    def __init__(
+        self,
+        *,
+        host: str = "iap.googleapis.com",
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        channel: Optional[aio.Channel] = None,
+        api_mtls_endpoint: Optional[str] = None,
+        client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None,
+        ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None,
+        client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None,
+        quota_project_id: Optional[str] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
+        api_audience: Optional[str] = None,
+    ) -> None:
+        """Instantiate the transport.
+
+        Args:
+            host (Optional[str]):
+                 The hostname to connect to.
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+                This argument is ignored if ``channel`` is provided.
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is ignored if ``channel`` is provided.
+            scopes (Optional[Sequence[str]]): A optional list of scopes needed for this
+                service. These are only used when credentials are not specified and
+                are passed to :func:`google.auth.default`.
+            channel (Optional[aio.Channel]): A ``Channel`` instance through
+                which to make calls.
+            api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint.
+                If provided, it overrides the ``host`` argument and tries to create
+                a mutual TLS channel with client SSL credentials from
+                ``client_cert_source`` or application default SSL credentials.
+            client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]):
+                Deprecated. A callback to provide client SSL certificate bytes and
+                private key bytes, both in PEM format. It is ignored if
+                ``api_mtls_endpoint`` is None.
+            ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials
+                for the grpc channel. It is ignored if ``channel`` is provided.
+            client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]):
+                A callback to provide client certificate bytes and private key bytes,
+                both in PEM format. It is used to configure a mutual TLS channel. It is
+                ignored if ``channel`` or ``ssl_channel_credentials`` is provided.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
+                The client info used to send a user-agent string along with
+                API requests. If ``None``, then default info will be used.
+                Generally, you only need to set this if you're developing
+                your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
+
+        Raises:
+            google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport
+              creation failed for any reason.
+          google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials``
+              and ``credentials_file`` are passed.
+        """
+        self._grpc_channel = None
+        self._ssl_channel_credentials = ssl_channel_credentials
+        self._stubs: Dict[str, Callable] = {}
+
+        if api_mtls_endpoint:
+            warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning)
+        if client_cert_source:
+            warnings.warn("client_cert_source is deprecated", DeprecationWarning)
+
+        if channel:
+            # Ignore credentials if a channel was passed.
+            credentials = False
+            # If a channel was explicitly provided, set it.
+            self._grpc_channel = channel
+            self._ssl_channel_credentials = None
+        else:
+            if api_mtls_endpoint:
+                host = api_mtls_endpoint
+
+                # Create SSL credentials with client_cert_source or application
+                # default SSL credentials.
+                if client_cert_source:
+                    cert, key = client_cert_source()
+                    self._ssl_channel_credentials = grpc.ssl_channel_credentials(
+                        certificate_chain=cert, private_key=key
+                    )
+                else:
+                    self._ssl_channel_credentials = SslCredentials().ssl_credentials
+
+            else:
+                if client_cert_source_for_mtls and not ssl_channel_credentials:
+                    cert, key = client_cert_source_for_mtls()
+                    self._ssl_channel_credentials = grpc.ssl_channel_credentials(
+                        certificate_chain=cert, private_key=key
+                    )
+
+        # The base transport sets the host, credentials and scopes
+        super().__init__(
+            host=host,
+            credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
+            client_info=client_info,
+            always_use_jwt_access=always_use_jwt_access,
+            api_audience=api_audience,
+        )
+
+        if not self._grpc_channel:
+            self._grpc_channel = type(self).create_channel(
+                self._host,
+                # use the credentials which are saved
+                credentials=self._credentials,
+                # Set ``credentials_file`` to ``None`` here as
+                # the credentials that we saved earlier should be used.
+                credentials_file=None,
+                scopes=self._scopes,
+                ssl_credentials=self._ssl_channel_credentials,
+                quota_project_id=quota_project_id,
+                options=[
+                    ("grpc.max_send_message_length", -1),
+                    ("grpc.max_receive_message_length", -1),
+                ],
+            )
+
+        # Wrap messages. This must be done after self._grpc_channel exists
+        self._prep_wrapped_messages(client_info)
+
+    @property
+    def grpc_channel(self) -> aio.Channel:
+        """Create the channel designed to connect to this service.
+
+        This property caches on the instance; repeated calls return
+        the same channel.
+        """
+        # Return the channel from cache.
+        return self._grpc_channel
+
+    @property
+    def set_iam_policy(
+        self,
+    ) -> Callable[[iam_policy_pb2.SetIamPolicyRequest], Awaitable[policy_pb2.Policy]]:
+        r"""Return a callable for the set iam policy method over gRPC.
+
+        Sets the access control policy for an Identity-Aware Proxy
+        protected resource. Replaces any existing policy. More
+        information about managing access via IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        Returns:
+            Callable[[~.SetIamPolicyRequest],
+                    Awaitable[~.Policy]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "set_iam_policy" not in self._stubs:
+            self._stubs["set_iam_policy"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/SetIamPolicy",
+                request_serializer=iam_policy_pb2.SetIamPolicyRequest.SerializeToString,
+                response_deserializer=policy_pb2.Policy.FromString,
+            )
+        return self._stubs["set_iam_policy"]
+
+    @property
+    def get_iam_policy(
+        self,
+    ) -> Callable[[iam_policy_pb2.GetIamPolicyRequest], Awaitable[policy_pb2.Policy]]:
+        r"""Return a callable for the get iam policy method over gRPC.
+
+        Gets the access control policy for an Identity-Aware Proxy
+        protected resource. More information about managing access via
+        IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        Returns:
+            Callable[[~.GetIamPolicyRequest],
+                    Awaitable[~.Policy]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "get_iam_policy" not in self._stubs:
+            self._stubs["get_iam_policy"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/GetIamPolicy",
+                request_serializer=iam_policy_pb2.GetIamPolicyRequest.SerializeToString,
+                response_deserializer=policy_pb2.Policy.FromString,
+            )
+        return self._stubs["get_iam_policy"]
+
+    @property
+    def test_iam_permissions(
+        self,
+    ) -> Callable[
+        [iam_policy_pb2.TestIamPermissionsRequest],
+        Awaitable[iam_policy_pb2.TestIamPermissionsResponse],
+    ]:
+        r"""Return a callable for the test iam permissions method over gRPC.
+
+        Returns permissions that a caller has on the Identity-Aware
+        Proxy protected resource. More information about managing access
+        via IAP can be found at:
+        https://cloud.google.com/iap/docs/managing-access#managing_access_via_the_api
+
+        Returns:
+            Callable[[~.TestIamPermissionsRequest],
+                    Awaitable[~.TestIamPermissionsResponse]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "test_iam_permissions" not in self._stubs:
+            self._stubs["test_iam_permissions"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/TestIamPermissions",
+                request_serializer=iam_policy_pb2.TestIamPermissionsRequest.SerializeToString,
+                response_deserializer=iam_policy_pb2.TestIamPermissionsResponse.FromString,
+            )
+        return self._stubs["test_iam_permissions"]
+
+    @property
+    def get_iap_settings(
+        self,
+    ) -> Callable[[service.GetIapSettingsRequest], Awaitable[service.IapSettings]]:
+        r"""Return a callable for the get iap settings method over gRPC.
+
+        Gets the IAP settings on a particular IAP protected
+        resource.
+
+        Returns:
+            Callable[[~.GetIapSettingsRequest],
+                    Awaitable[~.IapSettings]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "get_iap_settings" not in self._stubs:
+            self._stubs["get_iap_settings"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/GetIapSettings",
+                request_serializer=service.GetIapSettingsRequest.serialize,
+                response_deserializer=service.IapSettings.deserialize,
+            )
+        return self._stubs["get_iap_settings"]
+
+    @property
+    def update_iap_settings(
+        self,
+    ) -> Callable[[service.UpdateIapSettingsRequest], Awaitable[service.IapSettings]]:
+        r"""Return a callable for the update iap settings method over gRPC.
+
+        Updates the IAP settings on a particular IAP protected resource.
+        It replaces all fields unless the ``update_mask`` is set.
+
+        Returns:
+            Callable[[~.UpdateIapSettingsRequest],
+                    Awaitable[~.IapSettings]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "update_iap_settings" not in self._stubs:
+            self._stubs["update_iap_settings"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/UpdateIapSettings",
+                request_serializer=service.UpdateIapSettingsRequest.serialize,
+                response_deserializer=service.IapSettings.deserialize,
+            )
+        return self._stubs["update_iap_settings"]
+
+    @property
+    def list_tunnel_dest_groups(
+        self,
+    ) -> Callable[
+        [service.ListTunnelDestGroupsRequest],
+        Awaitable[service.ListTunnelDestGroupsResponse],
+    ]:
+        r"""Return a callable for the list tunnel dest groups method over gRPC.
+
+        Lists the existing TunnelDestGroups. To group across all
+        locations, use a ``-`` as the location ID. For example:
+        ``/v1/projects/123/iap_tunnel/locations/-/destGroups``
+
+        Returns:
+            Callable[[~.ListTunnelDestGroupsRequest],
+                    Awaitable[~.ListTunnelDestGroupsResponse]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "list_tunnel_dest_groups" not in self._stubs:
+            self._stubs["list_tunnel_dest_groups"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/ListTunnelDestGroups",
+                request_serializer=service.ListTunnelDestGroupsRequest.serialize,
+                response_deserializer=service.ListTunnelDestGroupsResponse.deserialize,
+            )
+        return self._stubs["list_tunnel_dest_groups"]
+
+    @property
+    def create_tunnel_dest_group(
+        self,
+    ) -> Callable[
+        [service.CreateTunnelDestGroupRequest], Awaitable[service.TunnelDestGroup]
+    ]:
+        r"""Return a callable for the create tunnel dest group method over gRPC.
+
+        Creates a new TunnelDestGroup.
+
+        Returns:
+            Callable[[~.CreateTunnelDestGroupRequest],
+                    Awaitable[~.TunnelDestGroup]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "create_tunnel_dest_group" not in self._stubs:
+            self._stubs["create_tunnel_dest_group"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/CreateTunnelDestGroup",
+                request_serializer=service.CreateTunnelDestGroupRequest.serialize,
+                response_deserializer=service.TunnelDestGroup.deserialize,
+            )
+        return self._stubs["create_tunnel_dest_group"]
+
+    @property
+    def get_tunnel_dest_group(
+        self,
+    ) -> Callable[
+        [service.GetTunnelDestGroupRequest], Awaitable[service.TunnelDestGroup]
+    ]:
+        r"""Return a callable for the get tunnel dest group method over gRPC.
+
+        Retrieves an existing TunnelDestGroup.
+
+        Returns:
+            Callable[[~.GetTunnelDestGroupRequest],
+                    Awaitable[~.TunnelDestGroup]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "get_tunnel_dest_group" not in self._stubs:
+            self._stubs["get_tunnel_dest_group"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/GetTunnelDestGroup",
+                request_serializer=service.GetTunnelDestGroupRequest.serialize,
+                response_deserializer=service.TunnelDestGroup.deserialize,
+            )
+        return self._stubs["get_tunnel_dest_group"]
+
+    @property
+    def delete_tunnel_dest_group(
+        self,
+    ) -> Callable[[service.DeleteTunnelDestGroupRequest], Awaitable[empty_pb2.Empty]]:
+        r"""Return a callable for the delete tunnel dest group method over gRPC.
+
+        Deletes a TunnelDestGroup.
+
+        Returns:
+            Callable[[~.DeleteTunnelDestGroupRequest],
+                    Awaitable[~.Empty]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "delete_tunnel_dest_group" not in self._stubs:
+            self._stubs["delete_tunnel_dest_group"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/DeleteTunnelDestGroup",
+                request_serializer=service.DeleteTunnelDestGroupRequest.serialize,
+                response_deserializer=empty_pb2.Empty.FromString,
+            )
+        return self._stubs["delete_tunnel_dest_group"]
+
+    @property
+    def update_tunnel_dest_group(
+        self,
+    ) -> Callable[
+        [service.UpdateTunnelDestGroupRequest], Awaitable[service.TunnelDestGroup]
+    ]:
+        r"""Return a callable for the update tunnel dest group method over gRPC.
+
+        Updates a TunnelDestGroup.
+
+        Returns:
+            Callable[[~.UpdateTunnelDestGroupRequest],
+                    Awaitable[~.TunnelDestGroup]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "update_tunnel_dest_group" not in self._stubs:
+            self._stubs["update_tunnel_dest_group"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyAdminService/UpdateTunnelDestGroup",
+                request_serializer=service.UpdateTunnelDestGroupRequest.serialize,
+                response_deserializer=service.TunnelDestGroup.deserialize,
+            )
+        return self._stubs["update_tunnel_dest_group"]
+
+    def close(self):
+        return self.grpc_channel.close()
+
+
+__all__ = ("IdentityAwareProxyAdminServiceGrpcAsyncIOTransport",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/rest.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/rest.py
new file mode 100644
index 000000000000..2eead816f2b0
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_admin_service/transports/rest.py
@@ -0,0 +1,1634 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+import dataclasses
+import json  # type: ignore
+import re
+from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union
+import warnings
+
+from google.api_core import gapic_v1, path_template, rest_helpers, rest_streaming
+from google.api_core import exceptions as core_exceptions
+from google.api_core import retry as retries
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.auth.transport.grpc import SslCredentials  # type: ignore
+from google.auth.transport.requests import AuthorizedSession  # type: ignore
+from google.protobuf import json_format
+import grpc  # type: ignore
+from requests import __version__ as requests_version
+
+try:
+    OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault]
+except AttributeError:  # pragma: NO COVER
+    OptionalRetry = Union[retries.Retry, object]  # type: ignore
+
+
+from google.iam.v1 import iam_policy_pb2  # type: ignore
+from google.iam.v1 import policy_pb2  # type: ignore
+from google.protobuf import empty_pb2  # type: ignore
+
+from google.cloud.iap_v1.types import service
+
+from .base import DEFAULT_CLIENT_INFO as BASE_DEFAULT_CLIENT_INFO
+from .base import IdentityAwareProxyAdminServiceTransport
+
+DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
+    gapic_version=BASE_DEFAULT_CLIENT_INFO.gapic_version,
+    grpc_version=None,
+    rest_version=requests_version,
+)
+
+
+class IdentityAwareProxyAdminServiceRestInterceptor:
+    """Interceptor for IdentityAwareProxyAdminService.
+
+    Interceptors are used to manipulate requests, request metadata, and responses
+    in arbitrary ways.
+    Example use cases include:
+    * Logging
+    * Verifying requests according to service or custom semantics
+    * Stripping extraneous information from responses
+
+    These use cases and more can be enabled by injecting an
+    instance of a custom subclass when constructing the IdentityAwareProxyAdminServiceRestTransport.
+
+    .. code-block:: python
+        class MyCustomIdentityAwareProxyAdminServiceInterceptor(IdentityAwareProxyAdminServiceRestInterceptor):
+            def pre_create_tunnel_dest_group(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_create_tunnel_dest_group(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_delete_tunnel_dest_group(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def pre_get_iam_policy(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_get_iam_policy(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_get_iap_settings(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_get_iap_settings(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_get_tunnel_dest_group(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_get_tunnel_dest_group(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_list_tunnel_dest_groups(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_list_tunnel_dest_groups(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_set_iam_policy(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_set_iam_policy(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_test_iam_permissions(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_test_iam_permissions(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_update_iap_settings(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_update_iap_settings(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_update_tunnel_dest_group(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_update_tunnel_dest_group(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+        transport = IdentityAwareProxyAdminServiceRestTransport(interceptor=MyCustomIdentityAwareProxyAdminServiceInterceptor())
+        client = IdentityAwareProxyAdminServiceClient(transport=transport)
+
+
+    """
+
+    def pre_create_tunnel_dest_group(
+        self,
+        request: service.CreateTunnelDestGroupRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[service.CreateTunnelDestGroupRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for create_tunnel_dest_group
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyAdminService server.
+        """
+        return request, metadata
+
+    def post_create_tunnel_dest_group(
+        self, response: service.TunnelDestGroup
+    ) -> service.TunnelDestGroup:
+        """Post-rpc interceptor for create_tunnel_dest_group
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyAdminService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_delete_tunnel_dest_group(
+        self,
+        request: service.DeleteTunnelDestGroupRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[service.DeleteTunnelDestGroupRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for delete_tunnel_dest_group
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyAdminService server.
+        """
+        return request, metadata
+
+    def pre_get_iam_policy(
+        self,
+        request: iam_policy_pb2.GetIamPolicyRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[iam_policy_pb2.GetIamPolicyRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for get_iam_policy
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyAdminService server.
+        """
+        return request, metadata
+
+    def post_get_iam_policy(self, response: policy_pb2.Policy) -> policy_pb2.Policy:
+        """Post-rpc interceptor for get_iam_policy
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyAdminService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_get_iap_settings(
+        self,
+        request: service.GetIapSettingsRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[service.GetIapSettingsRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for get_iap_settings
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyAdminService server.
+        """
+        return request, metadata
+
+    def post_get_iap_settings(
+        self, response: service.IapSettings
+    ) -> service.IapSettings:
+        """Post-rpc interceptor for get_iap_settings
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyAdminService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_get_tunnel_dest_group(
+        self,
+        request: service.GetTunnelDestGroupRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[service.GetTunnelDestGroupRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for get_tunnel_dest_group
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyAdminService server.
+        """
+        return request, metadata
+
+    def post_get_tunnel_dest_group(
+        self, response: service.TunnelDestGroup
+    ) -> service.TunnelDestGroup:
+        """Post-rpc interceptor for get_tunnel_dest_group
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyAdminService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_list_tunnel_dest_groups(
+        self,
+        request: service.ListTunnelDestGroupsRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[service.ListTunnelDestGroupsRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for list_tunnel_dest_groups
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyAdminService server.
+        """
+        return request, metadata
+
+    def post_list_tunnel_dest_groups(
+        self, response: service.ListTunnelDestGroupsResponse
+    ) -> service.ListTunnelDestGroupsResponse:
+        """Post-rpc interceptor for list_tunnel_dest_groups
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyAdminService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_set_iam_policy(
+        self,
+        request: iam_policy_pb2.SetIamPolicyRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[iam_policy_pb2.SetIamPolicyRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for set_iam_policy
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyAdminService server.
+        """
+        return request, metadata
+
+    def post_set_iam_policy(self, response: policy_pb2.Policy) -> policy_pb2.Policy:
+        """Post-rpc interceptor for set_iam_policy
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyAdminService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_test_iam_permissions(
+        self,
+        request: iam_policy_pb2.TestIamPermissionsRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[iam_policy_pb2.TestIamPermissionsRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for test_iam_permissions
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyAdminService server.
+        """
+        return request, metadata
+
+    def post_test_iam_permissions(
+        self, response: iam_policy_pb2.TestIamPermissionsResponse
+    ) -> iam_policy_pb2.TestIamPermissionsResponse:
+        """Post-rpc interceptor for test_iam_permissions
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyAdminService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_update_iap_settings(
+        self,
+        request: service.UpdateIapSettingsRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[service.UpdateIapSettingsRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for update_iap_settings
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyAdminService server.
+        """
+        return request, metadata
+
+    def post_update_iap_settings(
+        self, response: service.IapSettings
+    ) -> service.IapSettings:
+        """Post-rpc interceptor for update_iap_settings
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyAdminService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_update_tunnel_dest_group(
+        self,
+        request: service.UpdateTunnelDestGroupRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[service.UpdateTunnelDestGroupRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for update_tunnel_dest_group
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyAdminService server.
+        """
+        return request, metadata
+
+    def post_update_tunnel_dest_group(
+        self, response: service.TunnelDestGroup
+    ) -> service.TunnelDestGroup:
+        """Post-rpc interceptor for update_tunnel_dest_group
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyAdminService server but before
+        it is returned to user code.
+        """
+        return response
+
+
+@dataclasses.dataclass
+class IdentityAwareProxyAdminServiceRestStub:
+    _session: AuthorizedSession
+    _host: str
+    _interceptor: IdentityAwareProxyAdminServiceRestInterceptor
+
+
+class IdentityAwareProxyAdminServiceRestTransport(
+    IdentityAwareProxyAdminServiceTransport
+):
+    """REST backend transport for IdentityAwareProxyAdminService.
+
+    APIs for Identity-Aware Proxy Admin configurations.
+
+    This class defines the same methods as the primary client, so the
+    primary client can load the underlying transport implementation
+    and call it.
+
+    It sends JSON representations of protocol buffers over HTTP/1.1
+
+    """
+
+    def __init__(
+        self,
+        *,
+        host: str = "iap.googleapis.com",
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None,
+        quota_project_id: Optional[str] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
+        url_scheme: str = "https",
+        interceptor: Optional[IdentityAwareProxyAdminServiceRestInterceptor] = None,
+        api_audience: Optional[str] = None,
+    ) -> None:
+        """Instantiate the transport.
+
+        Args:
+            host (Optional[str]):
+                 The hostname to connect to.
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is ignored if ``channel`` is provided.
+            scopes (Optional(Sequence[str])): A list of scopes. This argument is
+                ignored if ``channel`` is provided.
+            client_cert_source_for_mtls (Callable[[], Tuple[bytes, bytes]]): Client
+                certificate to configure mutual TLS HTTP channel. It is ignored
+                if ``channel`` is provided.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
+                The client info used to send a user-agent string along with
+                API requests. If ``None``, then default info will be used.
+                Generally, you only need to set this if you are developing
+                your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
+            url_scheme: the protocol scheme for the API endpoint.  Normally
+                "https", but for testing or local servers,
+                "http" can be specified.
+        """
+        # Run the base constructor
+        # TODO(yon-mg): resolve other ctor params i.e. scopes, quota, etc.
+        # TODO: When custom host (api_endpoint) is set, `scopes` must *also* be set on the
+        # credentials object
+        maybe_url_match = re.match("^(?P<scheme>http(?:s)?://)?(?P<host>.*)$", host)
+        if maybe_url_match is None:
+            raise ValueError(
+                f"Unexpected hostname structure: {host}"
+            )  # pragma: NO COVER
+
+        url_match_items = maybe_url_match.groupdict()
+
+        host = f"{url_scheme}://{host}" if not url_match_items["scheme"] else host
+
+        super().__init__(
+            host=host,
+            credentials=credentials,
+            client_info=client_info,
+            always_use_jwt_access=always_use_jwt_access,
+            api_audience=api_audience,
+        )
+        self._session = AuthorizedSession(
+            self._credentials, default_host=self.DEFAULT_HOST
+        )
+        if client_cert_source_for_mtls:
+            self._session.configure_mtls_channel(client_cert_source_for_mtls)
+        self._interceptor = (
+            interceptor or IdentityAwareProxyAdminServiceRestInterceptor()
+        )
+        self._prep_wrapped_messages(client_info)
+
+    class _CreateTunnelDestGroup(IdentityAwareProxyAdminServiceRestStub):
+        def __hash__(self):
+            return hash("CreateTunnelDestGroup")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {
+            "tunnelDestGroupId": "",
+        }
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.CreateTunnelDestGroupRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.TunnelDestGroup:
+            r"""Call the create tunnel dest group method over HTTP.
+
+            Args:
+                request (~.service.CreateTunnelDestGroupRequest):
+                    The request object. The request to CreateTunnelDestGroup.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.service.TunnelDestGroup:
+                    A TunnelDestGroup.
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "post",
+                    "uri": "/v1/{parent=projects/*/iap_tunnel/locations/*}/destGroups",
+                    "body": "tunnel_dest_group",
+                },
+            ]
+            request, metadata = self._interceptor.pre_create_tunnel_dest_group(
+                request, metadata
+            )
+            pb_request = service.CreateTunnelDestGroupRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            # Jsonify the request body
+
+            body = json_format.MessageToJson(
+                transcoded_request["body"],
+                including_default_value_fields=False,
+                use_integers_for_enums=True,
+            )
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+                data=body,
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.TunnelDestGroup()
+            pb_resp = service.TunnelDestGroup.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_create_tunnel_dest_group(resp)
+            return resp
+
+    class _DeleteTunnelDestGroup(IdentityAwareProxyAdminServiceRestStub):
+        def __hash__(self):
+            return hash("DeleteTunnelDestGroup")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.DeleteTunnelDestGroupRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ):
+            r"""Call the delete tunnel dest group method over HTTP.
+
+            Args:
+                request (~.service.DeleteTunnelDestGroupRequest):
+                    The request object. The request to DeleteTunnelDestGroup.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "delete",
+                    "uri": "/v1/{name=projects/*/iap_tunnel/locations/*/destGroups/*}",
+                },
+            ]
+            request, metadata = self._interceptor.pre_delete_tunnel_dest_group(
+                request, metadata
+            )
+            pb_request = service.DeleteTunnelDestGroupRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+    class _GetIamPolicy(IdentityAwareProxyAdminServiceRestStub):
+        def __hash__(self):
+            return hash("GetIamPolicy")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: iam_policy_pb2.GetIamPolicyRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> policy_pb2.Policy:
+            r"""Call the get iam policy method over HTTP.
+
+            Args:
+                request (~.iam_policy_pb2.GetIamPolicyRequest):
+                    The request object. Request message for ``GetIamPolicy`` method.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.policy_pb2.Policy:
+                    An Identity and Access Management (IAM) policy, which
+                specifies access controls for Google Cloud resources.
+
+                A ``Policy`` is a collection of ``bindings``. A
+                ``binding`` binds one or more ``members``, or
+                principals, to a single ``role``. Principals can be user
+                accounts, service accounts, Google groups, and domains
+                (such as G Suite). A ``role`` is a named list of
+                permissions; each ``role`` can be an IAM predefined role
+                or a user-created custom role.
+
+                For some types of Google Cloud resources, a ``binding``
+                can also specify a ``condition``, which is a logical
+                expression that allows access to a resource only if the
+                expression evaluates to ``true``. A condition can add
+                constraints based on attributes of the request, the
+                resource, or both. To learn which resources support
+                conditions in their IAM policies, see the `IAM
+                documentation <https://cloud.google.com/iam/help/conditions/resource-policies>`__.
+
+                **JSON example:**
+
+                ::
+
+                    {
+                      "bindings": [
+                        {
+                          "role": "roles/resourcemanager.organizationAdmin",
+                          "members": [
+                            "user:mike@example.com",
+                            "group:admins@example.com",
+                            "domain:google.com",
+                            "serviceAccount:my-project-id@appspot.gserviceaccount.com"
+                          ]
+                        },
+                        {
+                          "role": "roles/resourcemanager.organizationViewer",
+                          "members": [
+                            "user:eve@example.com"
+                          ],
+                          "condition": {
+                            "title": "expirable access",
+                            "description": "Does not grant access after Sep 2020",
+                            "expression": "request.time <
+                            timestamp('2020-10-01T00:00:00.000Z')",
+                          }
+                        }
+                      ],
+                      "etag": "BwWWja0YfJA=",
+                      "version": 3
+                    }
+
+                **YAML example:**
+
+                ::
+
+                    bindings:
+                    - members:
+                      - user:mike@example.com
+                      - group:admins@example.com
+                      - domain:google.com
+                      - serviceAccount:my-project-id@appspot.gserviceaccount.com
+                      role: roles/resourcemanager.organizationAdmin
+                    - members:
+                      - user:eve@example.com
+                      role: roles/resourcemanager.organizationViewer
+                      condition:
+                        title: expirable access
+                        description: Does not grant access after Sep 2020
+                        expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
+                    etag: BwWWja0YfJA=
+                    version: 3
+
+                For a description of IAM and its features, see the `IAM
+                documentation <https://cloud.google.com/iam/docs/>`__.
+
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "post",
+                    "uri": "/v1/{resource=**}:getIamPolicy",
+                    "body": "*",
+                },
+            ]
+            request, metadata = self._interceptor.pre_get_iam_policy(request, metadata)
+            pb_request = request
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            # Jsonify the request body
+
+            body = json_format.MessageToJson(
+                transcoded_request["body"],
+                including_default_value_fields=False,
+                use_integers_for_enums=True,
+            )
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+                data=body,
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = policy_pb2.Policy()
+            pb_resp = resp
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_get_iam_policy(resp)
+            return resp
+
+    class _GetIapSettings(IdentityAwareProxyAdminServiceRestStub):
+        def __hash__(self):
+            return hash("GetIapSettings")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.GetIapSettingsRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.IapSettings:
+            r"""Call the get iap settings method over HTTP.
+
+            Args:
+                request (~.service.GetIapSettingsRequest):
+                    The request object. The request sent to GetIapSettings.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.service.IapSettings:
+                    The IAP configurable settings.
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "get",
+                    "uri": "/v1/{name=**}:iapSettings",
+                },
+            ]
+            request, metadata = self._interceptor.pre_get_iap_settings(
+                request, metadata
+            )
+            pb_request = service.GetIapSettingsRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.IapSettings()
+            pb_resp = service.IapSettings.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_get_iap_settings(resp)
+            return resp
+
+    class _GetTunnelDestGroup(IdentityAwareProxyAdminServiceRestStub):
+        def __hash__(self):
+            return hash("GetTunnelDestGroup")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.GetTunnelDestGroupRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.TunnelDestGroup:
+            r"""Call the get tunnel dest group method over HTTP.
+
+            Args:
+                request (~.service.GetTunnelDestGroupRequest):
+                    The request object. The request to GetTunnelDestGroup.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.service.TunnelDestGroup:
+                    A TunnelDestGroup.
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "get",
+                    "uri": "/v1/{name=projects/*/iap_tunnel/locations/*/destGroups/*}",
+                },
+            ]
+            request, metadata = self._interceptor.pre_get_tunnel_dest_group(
+                request, metadata
+            )
+            pb_request = service.GetTunnelDestGroupRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.TunnelDestGroup()
+            pb_resp = service.TunnelDestGroup.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_get_tunnel_dest_group(resp)
+            return resp
+
+    class _ListTunnelDestGroups(IdentityAwareProxyAdminServiceRestStub):
+        def __hash__(self):
+            return hash("ListTunnelDestGroups")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.ListTunnelDestGroupsRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.ListTunnelDestGroupsResponse:
+            r"""Call the list tunnel dest groups method over HTTP.
+
+            Args:
+                request (~.service.ListTunnelDestGroupsRequest):
+                    The request object. The request to ListTunnelDestGroups.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.service.ListTunnelDestGroupsResponse:
+                    The response from
+                ListTunnelDestGroups.
+
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "get",
+                    "uri": "/v1/{parent=projects/*/iap_tunnel/locations/*}/destGroups",
+                },
+            ]
+            request, metadata = self._interceptor.pre_list_tunnel_dest_groups(
+                request, metadata
+            )
+            pb_request = service.ListTunnelDestGroupsRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.ListTunnelDestGroupsResponse()
+            pb_resp = service.ListTunnelDestGroupsResponse.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_list_tunnel_dest_groups(resp)
+            return resp
+
+    class _SetIamPolicy(IdentityAwareProxyAdminServiceRestStub):
+        def __hash__(self):
+            return hash("SetIamPolicy")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: iam_policy_pb2.SetIamPolicyRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> policy_pb2.Policy:
+            r"""Call the set iam policy method over HTTP.
+
+            Args:
+                request (~.iam_policy_pb2.SetIamPolicyRequest):
+                    The request object. Request message for ``SetIamPolicy`` method.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.policy_pb2.Policy:
+                    An Identity and Access Management (IAM) policy, which
+                specifies access controls for Google Cloud resources.
+
+                A ``Policy`` is a collection of ``bindings``. A
+                ``binding`` binds one or more ``members``, or
+                principals, to a single ``role``. Principals can be user
+                accounts, service accounts, Google groups, and domains
+                (such as G Suite). A ``role`` is a named list of
+                permissions; each ``role`` can be an IAM predefined role
+                or a user-created custom role.
+
+                For some types of Google Cloud resources, a ``binding``
+                can also specify a ``condition``, which is a logical
+                expression that allows access to a resource only if the
+                expression evaluates to ``true``. A condition can add
+                constraints based on attributes of the request, the
+                resource, or both. To learn which resources support
+                conditions in their IAM policies, see the `IAM
+                documentation <https://cloud.google.com/iam/help/conditions/resource-policies>`__.
+
+                **JSON example:**
+
+                ::
+
+                    {
+                      "bindings": [
+                        {
+                          "role": "roles/resourcemanager.organizationAdmin",
+                          "members": [
+                            "user:mike@example.com",
+                            "group:admins@example.com",
+                            "domain:google.com",
+                            "serviceAccount:my-project-id@appspot.gserviceaccount.com"
+                          ]
+                        },
+                        {
+                          "role": "roles/resourcemanager.organizationViewer",
+                          "members": [
+                            "user:eve@example.com"
+                          ],
+                          "condition": {
+                            "title": "expirable access",
+                            "description": "Does not grant access after Sep 2020",
+                            "expression": "request.time <
+                            timestamp('2020-10-01T00:00:00.000Z')",
+                          }
+                        }
+                      ],
+                      "etag": "BwWWja0YfJA=",
+                      "version": 3
+                    }
+
+                **YAML example:**
+
+                ::
+
+                    bindings:
+                    - members:
+                      - user:mike@example.com
+                      - group:admins@example.com
+                      - domain:google.com
+                      - serviceAccount:my-project-id@appspot.gserviceaccount.com
+                      role: roles/resourcemanager.organizationAdmin
+                    - members:
+                      - user:eve@example.com
+                      role: roles/resourcemanager.organizationViewer
+                      condition:
+                        title: expirable access
+                        description: Does not grant access after Sep 2020
+                        expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
+                    etag: BwWWja0YfJA=
+                    version: 3
+
+                For a description of IAM and its features, see the `IAM
+                documentation <https://cloud.google.com/iam/docs/>`__.
+
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "post",
+                    "uri": "/v1/{resource=**}:setIamPolicy",
+                    "body": "*",
+                },
+            ]
+            request, metadata = self._interceptor.pre_set_iam_policy(request, metadata)
+            pb_request = request
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            # Jsonify the request body
+
+            body = json_format.MessageToJson(
+                transcoded_request["body"],
+                including_default_value_fields=False,
+                use_integers_for_enums=True,
+            )
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+                data=body,
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = policy_pb2.Policy()
+            pb_resp = resp
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_set_iam_policy(resp)
+            return resp
+
+    class _TestIamPermissions(IdentityAwareProxyAdminServiceRestStub):
+        def __hash__(self):
+            return hash("TestIamPermissions")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: iam_policy_pb2.TestIamPermissionsRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> iam_policy_pb2.TestIamPermissionsResponse:
+            r"""Call the test iam permissions method over HTTP.
+
+            Args:
+                request (~.iam_policy_pb2.TestIamPermissionsRequest):
+                    The request object. Request message for ``TestIamPermissions`` method.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.iam_policy_pb2.TestIamPermissionsResponse:
+                    Response message for ``TestIamPermissions`` method.
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "post",
+                    "uri": "/v1/{resource=**}:testIamPermissions",
+                    "body": "*",
+                },
+            ]
+            request, metadata = self._interceptor.pre_test_iam_permissions(
+                request, metadata
+            )
+            pb_request = request
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            # Jsonify the request body
+
+            body = json_format.MessageToJson(
+                transcoded_request["body"],
+                including_default_value_fields=False,
+                use_integers_for_enums=True,
+            )
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+                data=body,
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = iam_policy_pb2.TestIamPermissionsResponse()
+            pb_resp = resp
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_test_iam_permissions(resp)
+            return resp
+
+    class _UpdateIapSettings(IdentityAwareProxyAdminServiceRestStub):
+        def __hash__(self):
+            return hash("UpdateIapSettings")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.UpdateIapSettingsRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.IapSettings:
+            r"""Call the update iap settings method over HTTP.
+
+            Args:
+                request (~.service.UpdateIapSettingsRequest):
+                    The request object. The request sent to
+                UpdateIapSettings.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.service.IapSettings:
+                    The IAP configurable settings.
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "patch",
+                    "uri": "/v1/{iap_settings.name=**}:iapSettings",
+                    "body": "iap_settings",
+                },
+            ]
+            request, metadata = self._interceptor.pre_update_iap_settings(
+                request, metadata
+            )
+            pb_request = service.UpdateIapSettingsRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            # Jsonify the request body
+
+            body = json_format.MessageToJson(
+                transcoded_request["body"],
+                including_default_value_fields=False,
+                use_integers_for_enums=True,
+            )
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+                data=body,
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.IapSettings()
+            pb_resp = service.IapSettings.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_update_iap_settings(resp)
+            return resp
+
+    class _UpdateTunnelDestGroup(IdentityAwareProxyAdminServiceRestStub):
+        def __hash__(self):
+            return hash("UpdateTunnelDestGroup")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.UpdateTunnelDestGroupRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.TunnelDestGroup:
+            r"""Call the update tunnel dest group method over HTTP.
+
+            Args:
+                request (~.service.UpdateTunnelDestGroupRequest):
+                    The request object. The request to UpdateTunnelDestGroup.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.service.TunnelDestGroup:
+                    A TunnelDestGroup.
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "patch",
+                    "uri": "/v1/{tunnel_dest_group.name=projects/*/iap_tunnel/locations/*/destGroups/*}",
+                    "body": "tunnel_dest_group",
+                },
+            ]
+            request, metadata = self._interceptor.pre_update_tunnel_dest_group(
+                request, metadata
+            )
+            pb_request = service.UpdateTunnelDestGroupRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            # Jsonify the request body
+
+            body = json_format.MessageToJson(
+                transcoded_request["body"],
+                including_default_value_fields=False,
+                use_integers_for_enums=True,
+            )
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+                data=body,
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.TunnelDestGroup()
+            pb_resp = service.TunnelDestGroup.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_update_tunnel_dest_group(resp)
+            return resp
+
+    @property
+    def create_tunnel_dest_group(
+        self,
+    ) -> Callable[[service.CreateTunnelDestGroupRequest], service.TunnelDestGroup]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._CreateTunnelDestGroup(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def delete_tunnel_dest_group(
+        self,
+    ) -> Callable[[service.DeleteTunnelDestGroupRequest], empty_pb2.Empty]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._DeleteTunnelDestGroup(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def get_iam_policy(
+        self,
+    ) -> Callable[[iam_policy_pb2.GetIamPolicyRequest], policy_pb2.Policy]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._GetIamPolicy(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def get_iap_settings(
+        self,
+    ) -> Callable[[service.GetIapSettingsRequest], service.IapSettings]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._GetIapSettings(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def get_tunnel_dest_group(
+        self,
+    ) -> Callable[[service.GetTunnelDestGroupRequest], service.TunnelDestGroup]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._GetTunnelDestGroup(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def list_tunnel_dest_groups(
+        self,
+    ) -> Callable[
+        [service.ListTunnelDestGroupsRequest], service.ListTunnelDestGroupsResponse
+    ]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._ListTunnelDestGroups(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def set_iam_policy(
+        self,
+    ) -> Callable[[iam_policy_pb2.SetIamPolicyRequest], policy_pb2.Policy]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._SetIamPolicy(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def test_iam_permissions(
+        self,
+    ) -> Callable[
+        [iam_policy_pb2.TestIamPermissionsRequest],
+        iam_policy_pb2.TestIamPermissionsResponse,
+    ]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._TestIamPermissions(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def update_iap_settings(
+        self,
+    ) -> Callable[[service.UpdateIapSettingsRequest], service.IapSettings]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._UpdateIapSettings(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def update_tunnel_dest_group(
+        self,
+    ) -> Callable[[service.UpdateTunnelDestGroupRequest], service.TunnelDestGroup]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._UpdateTunnelDestGroup(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def kind(self) -> str:
+        return "rest"
+
+    def close(self):
+        self._session.close()
+
+
+__all__ = ("IdentityAwareProxyAdminServiceRestTransport",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/__init__.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/__init__.py
new file mode 100644
index 000000000000..7cdc6b2b41eb
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/__init__.py
@@ -0,0 +1,22 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from .async_client import IdentityAwareProxyOAuthServiceAsyncClient
+from .client import IdentityAwareProxyOAuthServiceClient
+
+__all__ = (
+    "IdentityAwareProxyOAuthServiceClient",
+    "IdentityAwareProxyOAuthServiceAsyncClient",
+)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/async_client.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/async_client.py
new file mode 100644
index 000000000000..d6675fd15855
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/async_client.py
@@ -0,0 +1,906 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from collections import OrderedDict
+import functools
+import re
+from typing import (
+    Dict,
+    Mapping,
+    MutableMapping,
+    MutableSequence,
+    Optional,
+    Sequence,
+    Tuple,
+    Type,
+    Union,
+)
+
+from google.api_core import exceptions as core_exceptions
+from google.api_core import gapic_v1
+from google.api_core import retry as retries
+from google.api_core.client_options import ClientOptions
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.oauth2 import service_account  # type: ignore
+
+from google.cloud.iap_v1 import gapic_version as package_version
+
+try:
+    OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault]
+except AttributeError:  # pragma: NO COVER
+    OptionalRetry = Union[retries.Retry, object]  # type: ignore
+
+from google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service import pagers
+from google.cloud.iap_v1.types import service
+
+from .client import IdentityAwareProxyOAuthServiceClient
+from .transports.base import (
+    DEFAULT_CLIENT_INFO,
+    IdentityAwareProxyOAuthServiceTransport,
+)
+from .transports.grpc_asyncio import IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport
+
+
+class IdentityAwareProxyOAuthServiceAsyncClient:
+    """API to programmatically create, list and retrieve Identity
+    Aware Proxy (IAP) OAuth brands; and create, retrieve, delete and
+    reset-secret of IAP OAuth clients.
+    """
+
+    _client: IdentityAwareProxyOAuthServiceClient
+
+    DEFAULT_ENDPOINT = IdentityAwareProxyOAuthServiceClient.DEFAULT_ENDPOINT
+    DEFAULT_MTLS_ENDPOINT = IdentityAwareProxyOAuthServiceClient.DEFAULT_MTLS_ENDPOINT
+
+    common_billing_account_path = staticmethod(
+        IdentityAwareProxyOAuthServiceClient.common_billing_account_path
+    )
+    parse_common_billing_account_path = staticmethod(
+        IdentityAwareProxyOAuthServiceClient.parse_common_billing_account_path
+    )
+    common_folder_path = staticmethod(
+        IdentityAwareProxyOAuthServiceClient.common_folder_path
+    )
+    parse_common_folder_path = staticmethod(
+        IdentityAwareProxyOAuthServiceClient.parse_common_folder_path
+    )
+    common_organization_path = staticmethod(
+        IdentityAwareProxyOAuthServiceClient.common_organization_path
+    )
+    parse_common_organization_path = staticmethod(
+        IdentityAwareProxyOAuthServiceClient.parse_common_organization_path
+    )
+    common_project_path = staticmethod(
+        IdentityAwareProxyOAuthServiceClient.common_project_path
+    )
+    parse_common_project_path = staticmethod(
+        IdentityAwareProxyOAuthServiceClient.parse_common_project_path
+    )
+    common_location_path = staticmethod(
+        IdentityAwareProxyOAuthServiceClient.common_location_path
+    )
+    parse_common_location_path = staticmethod(
+        IdentityAwareProxyOAuthServiceClient.parse_common_location_path
+    )
+
+    @classmethod
+    def from_service_account_info(cls, info: dict, *args, **kwargs):
+        """Creates an instance of this client using the provided credentials
+            info.
+
+        Args:
+            info (dict): The service account private key info.
+            args: Additional arguments to pass to the constructor.
+            kwargs: Additional arguments to pass to the constructor.
+
+        Returns:
+            IdentityAwareProxyOAuthServiceAsyncClient: The constructed client.
+        """
+        return IdentityAwareProxyOAuthServiceClient.from_service_account_info.__func__(IdentityAwareProxyOAuthServiceAsyncClient, info, *args, **kwargs)  # type: ignore
+
+    @classmethod
+    def from_service_account_file(cls, filename: str, *args, **kwargs):
+        """Creates an instance of this client using the provided credentials
+            file.
+
+        Args:
+            filename (str): The path to the service account private key json
+                file.
+            args: Additional arguments to pass to the constructor.
+            kwargs: Additional arguments to pass to the constructor.
+
+        Returns:
+            IdentityAwareProxyOAuthServiceAsyncClient: The constructed client.
+        """
+        return IdentityAwareProxyOAuthServiceClient.from_service_account_file.__func__(IdentityAwareProxyOAuthServiceAsyncClient, filename, *args, **kwargs)  # type: ignore
+
+    from_service_account_json = from_service_account_file
+
+    @classmethod
+    def get_mtls_endpoint_and_cert_source(
+        cls, client_options: Optional[ClientOptions] = None
+    ):
+        """Return the API endpoint and client cert source for mutual TLS.
+
+        The client cert source is determined in the following order:
+        (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the
+        client cert source is None.
+        (2) if `client_options.client_cert_source` is provided, use the provided one; if the
+        default client cert source exists, use the default one; otherwise the client cert
+        source is None.
+
+        The API endpoint is determined in the following order:
+        (1) if `client_options.api_endpoint` if provided, use the provided one.
+        (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the
+        default mTLS endpoint; if the environment variable is "never", use the default API
+        endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise
+        use the default API endpoint.
+
+        More details can be found at https://google.aip.dev/auth/4114.
+
+        Args:
+            client_options (google.api_core.client_options.ClientOptions): Custom options for the
+                client. Only the `api_endpoint` and `client_cert_source` properties may be used
+                in this method.
+
+        Returns:
+            Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the
+                client cert source to use.
+
+        Raises:
+            google.auth.exceptions.MutualTLSChannelError: If any errors happen.
+        """
+        return IdentityAwareProxyOAuthServiceClient.get_mtls_endpoint_and_cert_source(client_options)  # type: ignore
+
+    @property
+    def transport(self) -> IdentityAwareProxyOAuthServiceTransport:
+        """Returns the transport used by the client instance.
+
+        Returns:
+            IdentityAwareProxyOAuthServiceTransport: The transport used by the client instance.
+        """
+        return self._client.transport
+
+    get_transport_class = functools.partial(
+        type(IdentityAwareProxyOAuthServiceClient).get_transport_class,
+        type(IdentityAwareProxyOAuthServiceClient),
+    )
+
+    def __init__(
+        self,
+        *,
+        credentials: Optional[ga_credentials.Credentials] = None,
+        transport: Union[str, IdentityAwareProxyOAuthServiceTransport] = "grpc_asyncio",
+        client_options: Optional[ClientOptions] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+    ) -> None:
+        """Instantiates the identity aware proxy o auth service client.
+
+        Args:
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+            transport (Union[str, ~.IdentityAwareProxyOAuthServiceTransport]): The
+                transport to use. If set to None, a transport is chosen
+                automatically.
+            client_options (ClientOptions): Custom options for the client. It
+                won't take effect if a ``transport`` instance is provided.
+                (1) The ``api_endpoint`` property can be used to override the
+                default endpoint provided by the client. GOOGLE_API_USE_MTLS_ENDPOINT
+                environment variable can also be used to override the endpoint:
+                "always" (always use the default mTLS endpoint), "never" (always
+                use the default regular endpoint) and "auto" (auto switch to the
+                default mTLS endpoint if client certificate is present, this is
+                the default value). However, the ``api_endpoint`` property takes
+                precedence if provided.
+                (2) If GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable
+                is "true", then the ``client_cert_source`` property can be used
+                to provide client certificate for mutual TLS transport. If
+                not provided, the default SSL client certificate will be used if
+                present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not
+                set, no client certificate will be used.
+
+        Raises:
+            google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport
+                creation failed for any reason.
+        """
+        self._client = IdentityAwareProxyOAuthServiceClient(
+            credentials=credentials,
+            transport=transport,
+            client_options=client_options,
+            client_info=client_info,
+        )
+
+    async def list_brands(
+        self,
+        request: Optional[Union[service.ListBrandsRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.ListBrandsResponse:
+        r"""Lists the existing brands for the project.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_list_brands():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.ListBrandsRequest(
+                    parent="parent_value",
+                )
+
+                # Make the request
+                response = await client.list_brands(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.ListBrandsRequest, dict]]):
+                The request object. The request sent to ListBrands.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.ListBrandsResponse:
+                Response message for ListBrands.
+        """
+        # Create or coerce a protobuf request object.
+        request = service.ListBrandsRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.list_brands,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def create_brand(
+        self,
+        request: Optional[Union[service.CreateBrandRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.Brand:
+        r"""Constructs a new OAuth brand for the project if one
+        does not exist. The created brand is "internal only",
+        meaning that OAuth clients created under it only accept
+        requests from users who belong to the same Google
+        Workspace organization as the project. The brand is
+        created in an un-reviewed status. NOTE: The "internal
+        only" status can be manually changed in the Google Cloud
+        Console. Requires that a brand does not already exist
+        for the project, and that the specified support email is
+        owned by the caller.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_create_brand():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.CreateBrandRequest(
+                    parent="parent_value",
+                )
+
+                # Make the request
+                response = await client.create_brand(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.CreateBrandRequest, dict]]):
+                The request object. The request sent to CreateBrand.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.Brand:
+                OAuth brand data.
+                NOTE: Only contains a portion of the
+                data that describes a brand.
+
+        """
+        # Create or coerce a protobuf request object.
+        request = service.CreateBrandRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.create_brand,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def get_brand(
+        self,
+        request: Optional[Union[service.GetBrandRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.Brand:
+        r"""Retrieves the OAuth brand of the project.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_get_brand():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.GetBrandRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                response = await client.get_brand(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.GetBrandRequest, dict]]):
+                The request object. The request sent to GetBrand.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.Brand:
+                OAuth brand data.
+                NOTE: Only contains a portion of the
+                data that describes a brand.
+
+        """
+        # Create or coerce a protobuf request object.
+        request = service.GetBrandRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.get_brand,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def create_identity_aware_proxy_client(
+        self,
+        request: Optional[
+            Union[service.CreateIdentityAwareProxyClientRequest, dict]
+        ] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.IdentityAwareProxyClient:
+        r"""Creates an Identity Aware Proxy (IAP) OAuth client.
+        The client is owned by IAP. Requires that the brand for
+        the project exists and that it is set for internal-only
+        use.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_create_identity_aware_proxy_client():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.CreateIdentityAwareProxyClientRequest(
+                    parent="parent_value",
+                )
+
+                # Make the request
+                response = await client.create_identity_aware_proxy_client(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.CreateIdentityAwareProxyClientRequest, dict]]):
+                The request object. The request sent to
+                CreateIdentityAwareProxyClient.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.IdentityAwareProxyClient:
+                Contains the data that describes an
+                Identity Aware Proxy owned client.
+
+        """
+        # Create or coerce a protobuf request object.
+        request = service.CreateIdentityAwareProxyClientRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.create_identity_aware_proxy_client,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def list_identity_aware_proxy_clients(
+        self,
+        request: Optional[
+            Union[service.ListIdentityAwareProxyClientsRequest, dict]
+        ] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> pagers.ListIdentityAwareProxyClientsAsyncPager:
+        r"""Lists the existing clients for the brand.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_list_identity_aware_proxy_clients():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.ListIdentityAwareProxyClientsRequest(
+                    parent="parent_value",
+                )
+
+                # Make the request
+                page_result = client.list_identity_aware_proxy_clients(request=request)
+
+                # Handle the response
+                async for response in page_result:
+                    print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.ListIdentityAwareProxyClientsRequest, dict]]):
+                The request object. The request sent to
+                ListIdentityAwareProxyClients.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service.pagers.ListIdentityAwareProxyClientsAsyncPager:
+                Response message for
+                ListIdentityAwareProxyClients.
+                Iterating over this object will yield
+                results and resolve additional pages
+                automatically.
+
+        """
+        # Create or coerce a protobuf request object.
+        request = service.ListIdentityAwareProxyClientsRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.list_identity_aware_proxy_clients,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # This method is paged; wrap the response in a pager, which provides
+        # an `__aiter__` convenience method.
+        response = pagers.ListIdentityAwareProxyClientsAsyncPager(
+            method=rpc,
+            request=request,
+            response=response,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def get_identity_aware_proxy_client(
+        self,
+        request: Optional[
+            Union[service.GetIdentityAwareProxyClientRequest, dict]
+        ] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.IdentityAwareProxyClient:
+        r"""Retrieves an Identity Aware Proxy (IAP) OAuth client.
+        Requires that the client is owned by IAP.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_get_identity_aware_proxy_client():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.GetIdentityAwareProxyClientRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                response = await client.get_identity_aware_proxy_client(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.GetIdentityAwareProxyClientRequest, dict]]):
+                The request object. The request sent to
+                GetIdentityAwareProxyClient.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.IdentityAwareProxyClient:
+                Contains the data that describes an
+                Identity Aware Proxy owned client.
+
+        """
+        # Create or coerce a protobuf request object.
+        request = service.GetIdentityAwareProxyClientRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.get_identity_aware_proxy_client,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def reset_identity_aware_proxy_client_secret(
+        self,
+        request: Optional[
+            Union[service.ResetIdentityAwareProxyClientSecretRequest, dict]
+        ] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.IdentityAwareProxyClient:
+        r"""Resets an Identity Aware Proxy (IAP) OAuth client
+        secret. Useful if the secret was compromised. Requires
+        that the client is owned by IAP.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_reset_identity_aware_proxy_client_secret():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.ResetIdentityAwareProxyClientSecretRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                response = await client.reset_identity_aware_proxy_client_secret(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.ResetIdentityAwareProxyClientSecretRequest, dict]]):
+                The request object. The request sent to
+                ResetIdentityAwareProxyClientSecret.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.IdentityAwareProxyClient:
+                Contains the data that describes an
+                Identity Aware Proxy owned client.
+
+        """
+        # Create or coerce a protobuf request object.
+        request = service.ResetIdentityAwareProxyClientSecretRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.reset_identity_aware_proxy_client_secret,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        response = await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    async def delete_identity_aware_proxy_client(
+        self,
+        request: Optional[
+            Union[service.DeleteIdentityAwareProxyClientRequest, dict]
+        ] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> None:
+        r"""Deletes an Identity Aware Proxy (IAP) OAuth client.
+        Useful for removing obsolete clients, managing the
+        number of clients in a given project, and cleaning up
+        after tests. Requires that the client is owned by IAP.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            async def sample_delete_identity_aware_proxy_client():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceAsyncClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.DeleteIdentityAwareProxyClientRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                await client.delete_identity_aware_proxy_client(request=request)
+
+        Args:
+            request (Optional[Union[google.cloud.iap_v1.types.DeleteIdentityAwareProxyClientRequest, dict]]):
+                The request object. The request sent to
+                DeleteIdentityAwareProxyClient.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+        """
+        # Create or coerce a protobuf request object.
+        request = service.DeleteIdentityAwareProxyClientRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = gapic_v1.method_async.wrap_method(
+            self._client._transport.delete_identity_aware_proxy_client,
+            default_timeout=None,
+            client_info=DEFAULT_CLIENT_INFO,
+        )
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        await rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, exc_type, exc, tb):
+        await self.transport.close()
+
+
+DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
+    gapic_version=package_version.__version__
+)
+
+
+__all__ = ("IdentityAwareProxyOAuthServiceAsyncClient",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/client.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/client.py
new file mode 100644
index 000000000000..d07e1fae7157
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/client.py
@@ -0,0 +1,1137 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from collections import OrderedDict
+import os
+import re
+from typing import (
+    Dict,
+    Mapping,
+    MutableMapping,
+    MutableSequence,
+    Optional,
+    Sequence,
+    Tuple,
+    Type,
+    Union,
+    cast,
+)
+
+from google.api_core import client_options as client_options_lib
+from google.api_core import exceptions as core_exceptions
+from google.api_core import gapic_v1
+from google.api_core import retry as retries
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.auth.exceptions import MutualTLSChannelError  # type: ignore
+from google.auth.transport import mtls  # type: ignore
+from google.auth.transport.grpc import SslCredentials  # type: ignore
+from google.oauth2 import service_account  # type: ignore
+
+from google.cloud.iap_v1 import gapic_version as package_version
+
+try:
+    OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault]
+except AttributeError:  # pragma: NO COVER
+    OptionalRetry = Union[retries.Retry, object]  # type: ignore
+
+from google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service import pagers
+from google.cloud.iap_v1.types import service
+
+from .transports.base import (
+    DEFAULT_CLIENT_INFO,
+    IdentityAwareProxyOAuthServiceTransport,
+)
+from .transports.grpc import IdentityAwareProxyOAuthServiceGrpcTransport
+from .transports.grpc_asyncio import IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport
+from .transports.rest import IdentityAwareProxyOAuthServiceRestTransport
+
+
+class IdentityAwareProxyOAuthServiceClientMeta(type):
+    """Metaclass for the IdentityAwareProxyOAuthService client.
+
+    This provides class-level methods for building and retrieving
+    support objects (e.g. transport) without polluting the client instance
+    objects.
+    """
+
+    _transport_registry = (
+        OrderedDict()
+    )  # type: Dict[str, Type[IdentityAwareProxyOAuthServiceTransport]]
+    _transport_registry["grpc"] = IdentityAwareProxyOAuthServiceGrpcTransport
+    _transport_registry[
+        "grpc_asyncio"
+    ] = IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport
+    _transport_registry["rest"] = IdentityAwareProxyOAuthServiceRestTransport
+
+    def get_transport_class(
+        cls,
+        label: Optional[str] = None,
+    ) -> Type[IdentityAwareProxyOAuthServiceTransport]:
+        """Returns an appropriate transport class.
+
+        Args:
+            label: The name of the desired transport. If none is
+                provided, then the first transport in the registry is used.
+
+        Returns:
+            The transport class to use.
+        """
+        # If a specific transport is requested, return that one.
+        if label:
+            return cls._transport_registry[label]
+
+        # No transport is requested; return the default (that is, the first one
+        # in the dictionary).
+        return next(iter(cls._transport_registry.values()))
+
+
+class IdentityAwareProxyOAuthServiceClient(
+    metaclass=IdentityAwareProxyOAuthServiceClientMeta
+):
+    """API to programmatically create, list and retrieve Identity
+    Aware Proxy (IAP) OAuth brands; and create, retrieve, delete and
+    reset-secret of IAP OAuth clients.
+    """
+
+    @staticmethod
+    def _get_default_mtls_endpoint(api_endpoint):
+        """Converts api endpoint to mTLS endpoint.
+
+        Convert "*.sandbox.googleapis.com" and "*.googleapis.com" to
+        "*.mtls.sandbox.googleapis.com" and "*.mtls.googleapis.com" respectively.
+        Args:
+            api_endpoint (Optional[str]): the api endpoint to convert.
+        Returns:
+            str: converted mTLS api endpoint.
+        """
+        if not api_endpoint:
+            return api_endpoint
+
+        mtls_endpoint_re = re.compile(
+            r"(?P<name>[^.]+)(?P<mtls>\.mtls)?(?P<sandbox>\.sandbox)?(?P<googledomain>\.googleapis\.com)?"
+        )
+
+        m = mtls_endpoint_re.match(api_endpoint)
+        name, mtls, sandbox, googledomain = m.groups()
+        if mtls or not googledomain:
+            return api_endpoint
+
+        if sandbox:
+            return api_endpoint.replace(
+                "sandbox.googleapis.com", "mtls.sandbox.googleapis.com"
+            )
+
+        return api_endpoint.replace(".googleapis.com", ".mtls.googleapis.com")
+
+    DEFAULT_ENDPOINT = "iap.googleapis.com"
+    DEFAULT_MTLS_ENDPOINT = _get_default_mtls_endpoint.__func__(  # type: ignore
+        DEFAULT_ENDPOINT
+    )
+
+    @classmethod
+    def from_service_account_info(cls, info: dict, *args, **kwargs):
+        """Creates an instance of this client using the provided credentials
+            info.
+
+        Args:
+            info (dict): The service account private key info.
+            args: Additional arguments to pass to the constructor.
+            kwargs: Additional arguments to pass to the constructor.
+
+        Returns:
+            IdentityAwareProxyOAuthServiceClient: The constructed client.
+        """
+        credentials = service_account.Credentials.from_service_account_info(info)
+        kwargs["credentials"] = credentials
+        return cls(*args, **kwargs)
+
+    @classmethod
+    def from_service_account_file(cls, filename: str, *args, **kwargs):
+        """Creates an instance of this client using the provided credentials
+            file.
+
+        Args:
+            filename (str): The path to the service account private key json
+                file.
+            args: Additional arguments to pass to the constructor.
+            kwargs: Additional arguments to pass to the constructor.
+
+        Returns:
+            IdentityAwareProxyOAuthServiceClient: The constructed client.
+        """
+        credentials = service_account.Credentials.from_service_account_file(filename)
+        kwargs["credentials"] = credentials
+        return cls(*args, **kwargs)
+
+    from_service_account_json = from_service_account_file
+
+    @property
+    def transport(self) -> IdentityAwareProxyOAuthServiceTransport:
+        """Returns the transport used by the client instance.
+
+        Returns:
+            IdentityAwareProxyOAuthServiceTransport: The transport used by the client
+                instance.
+        """
+        return self._transport
+
+    @staticmethod
+    def common_billing_account_path(
+        billing_account: str,
+    ) -> str:
+        """Returns a fully-qualified billing_account string."""
+        return "billingAccounts/{billing_account}".format(
+            billing_account=billing_account,
+        )
+
+    @staticmethod
+    def parse_common_billing_account_path(path: str) -> Dict[str, str]:
+        """Parse a billing_account path into its component segments."""
+        m = re.match(r"^billingAccounts/(?P<billing_account>.+?)$", path)
+        return m.groupdict() if m else {}
+
+    @staticmethod
+    def common_folder_path(
+        folder: str,
+    ) -> str:
+        """Returns a fully-qualified folder string."""
+        return "folders/{folder}".format(
+            folder=folder,
+        )
+
+    @staticmethod
+    def parse_common_folder_path(path: str) -> Dict[str, str]:
+        """Parse a folder path into its component segments."""
+        m = re.match(r"^folders/(?P<folder>.+?)$", path)
+        return m.groupdict() if m else {}
+
+    @staticmethod
+    def common_organization_path(
+        organization: str,
+    ) -> str:
+        """Returns a fully-qualified organization string."""
+        return "organizations/{organization}".format(
+            organization=organization,
+        )
+
+    @staticmethod
+    def parse_common_organization_path(path: str) -> Dict[str, str]:
+        """Parse a organization path into its component segments."""
+        m = re.match(r"^organizations/(?P<organization>.+?)$", path)
+        return m.groupdict() if m else {}
+
+    @staticmethod
+    def common_project_path(
+        project: str,
+    ) -> str:
+        """Returns a fully-qualified project string."""
+        return "projects/{project}".format(
+            project=project,
+        )
+
+    @staticmethod
+    def parse_common_project_path(path: str) -> Dict[str, str]:
+        """Parse a project path into its component segments."""
+        m = re.match(r"^projects/(?P<project>.+?)$", path)
+        return m.groupdict() if m else {}
+
+    @staticmethod
+    def common_location_path(
+        project: str,
+        location: str,
+    ) -> str:
+        """Returns a fully-qualified location string."""
+        return "projects/{project}/locations/{location}".format(
+            project=project,
+            location=location,
+        )
+
+    @staticmethod
+    def parse_common_location_path(path: str) -> Dict[str, str]:
+        """Parse a location path into its component segments."""
+        m = re.match(r"^projects/(?P<project>.+?)/locations/(?P<location>.+?)$", path)
+        return m.groupdict() if m else {}
+
+    @classmethod
+    def get_mtls_endpoint_and_cert_source(
+        cls, client_options: Optional[client_options_lib.ClientOptions] = None
+    ):
+        """Return the API endpoint and client cert source for mutual TLS.
+
+        The client cert source is determined in the following order:
+        (1) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is not "true", the
+        client cert source is None.
+        (2) if `client_options.client_cert_source` is provided, use the provided one; if the
+        default client cert source exists, use the default one; otherwise the client cert
+        source is None.
+
+        The API endpoint is determined in the following order:
+        (1) if `client_options.api_endpoint` if provided, use the provided one.
+        (2) if `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is "always", use the
+        default mTLS endpoint; if the environment variable is "never", use the default API
+        endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise
+        use the default API endpoint.
+
+        More details can be found at https://google.aip.dev/auth/4114.
+
+        Args:
+            client_options (google.api_core.client_options.ClientOptions): Custom options for the
+                client. Only the `api_endpoint` and `client_cert_source` properties may be used
+                in this method.
+
+        Returns:
+            Tuple[str, Callable[[], Tuple[bytes, bytes]]]: returns the API endpoint and the
+                client cert source to use.
+
+        Raises:
+            google.auth.exceptions.MutualTLSChannelError: If any errors happen.
+        """
+        if client_options is None:
+            client_options = client_options_lib.ClientOptions()
+        use_client_cert = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false")
+        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")
+        if use_client_cert not in ("true", "false"):
+            raise ValueError(
+                "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
+            )
+        if use_mtls_endpoint not in ("auto", "never", "always"):
+            raise MutualTLSChannelError(
+                "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
+            )
+
+        # Figure out the client cert source to use.
+        client_cert_source = None
+        if use_client_cert == "true":
+            if client_options.client_cert_source:
+                client_cert_source = client_options.client_cert_source
+            elif mtls.has_default_client_cert_source():
+                client_cert_source = mtls.default_client_cert_source()
+
+        # Figure out which api endpoint to use.
+        if client_options.api_endpoint is not None:
+            api_endpoint = client_options.api_endpoint
+        elif use_mtls_endpoint == "always" or (
+            use_mtls_endpoint == "auto" and client_cert_source
+        ):
+            api_endpoint = cls.DEFAULT_MTLS_ENDPOINT
+        else:
+            api_endpoint = cls.DEFAULT_ENDPOINT
+
+        return api_endpoint, client_cert_source
+
+    def __init__(
+        self,
+        *,
+        credentials: Optional[ga_credentials.Credentials] = None,
+        transport: Optional[Union[str, IdentityAwareProxyOAuthServiceTransport]] = None,
+        client_options: Optional[Union[client_options_lib.ClientOptions, dict]] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+    ) -> None:
+        """Instantiates the identity aware proxy o auth service client.
+
+        Args:
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+            transport (Union[str, IdentityAwareProxyOAuthServiceTransport]): The
+                transport to use. If set to None, a transport is chosen
+                automatically.
+            client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]): Custom options for the
+                client. It won't take effect if a ``transport`` instance is provided.
+                (1) The ``api_endpoint`` property can be used to override the
+                default endpoint provided by the client. GOOGLE_API_USE_MTLS_ENDPOINT
+                environment variable can also be used to override the endpoint:
+                "always" (always use the default mTLS endpoint), "never" (always
+                use the default regular endpoint) and "auto" (auto switch to the
+                default mTLS endpoint if client certificate is present, this is
+                the default value). However, the ``api_endpoint`` property takes
+                precedence if provided.
+                (2) If GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable
+                is "true", then the ``client_cert_source`` property can be used
+                to provide client certificate for mutual TLS transport. If
+                not provided, the default SSL client certificate will be used if
+                present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is "false" or not
+                set, no client certificate will be used.
+            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
+                The client info used to send a user-agent string along with
+                API requests. If ``None``, then default info will be used.
+                Generally, you only need to set this if you're developing
+                your own client library.
+
+        Raises:
+            google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport
+                creation failed for any reason.
+        """
+        if isinstance(client_options, dict):
+            client_options = client_options_lib.from_dict(client_options)
+        if client_options is None:
+            client_options = client_options_lib.ClientOptions()
+        client_options = cast(client_options_lib.ClientOptions, client_options)
+
+        api_endpoint, client_cert_source_func = self.get_mtls_endpoint_and_cert_source(
+            client_options
+        )
+
+        api_key_value = getattr(client_options, "api_key", None)
+        if api_key_value and credentials:
+            raise ValueError(
+                "client_options.api_key and credentials are mutually exclusive"
+            )
+
+        # Save or instantiate the transport.
+        # Ordinarily, we provide the transport, but allowing a custom transport
+        # instance provides an extensibility point for unusual situations.
+        if isinstance(transport, IdentityAwareProxyOAuthServiceTransport):
+            # transport is a IdentityAwareProxyOAuthServiceTransport instance.
+            if credentials or client_options.credentials_file or api_key_value:
+                raise ValueError(
+                    "When providing a transport instance, "
+                    "provide its credentials directly."
+                )
+            if client_options.scopes:
+                raise ValueError(
+                    "When providing a transport instance, provide its scopes "
+                    "directly."
+                )
+            self._transport = transport
+        else:
+            import google.auth._default  # type: ignore
+
+            if api_key_value and hasattr(
+                google.auth._default, "get_api_key_credentials"
+            ):
+                credentials = google.auth._default.get_api_key_credentials(
+                    api_key_value
+                )
+
+            Transport = type(self).get_transport_class(transport)
+            self._transport = Transport(
+                credentials=credentials,
+                credentials_file=client_options.credentials_file,
+                host=api_endpoint,
+                scopes=client_options.scopes,
+                client_cert_source_for_mtls=client_cert_source_func,
+                quota_project_id=client_options.quota_project_id,
+                client_info=client_info,
+                always_use_jwt_access=True,
+                api_audience=client_options.api_audience,
+            )
+
+    def list_brands(
+        self,
+        request: Optional[Union[service.ListBrandsRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.ListBrandsResponse:
+        r"""Lists the existing brands for the project.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_list_brands():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.ListBrandsRequest(
+                    parent="parent_value",
+                )
+
+                # Make the request
+                response = client.list_brands(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.ListBrandsRequest, dict]):
+                The request object. The request sent to ListBrands.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.ListBrandsResponse:
+                Response message for ListBrands.
+        """
+        # Create or coerce a protobuf request object.
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.ListBrandsRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.ListBrandsRequest):
+            request = service.ListBrandsRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.list_brands]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def create_brand(
+        self,
+        request: Optional[Union[service.CreateBrandRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.Brand:
+        r"""Constructs a new OAuth brand for the project if one
+        does not exist. The created brand is "internal only",
+        meaning that OAuth clients created under it only accept
+        requests from users who belong to the same Google
+        Workspace organization as the project. The brand is
+        created in an un-reviewed status. NOTE: The "internal
+        only" status can be manually changed in the Google Cloud
+        Console. Requires that a brand does not already exist
+        for the project, and that the specified support email is
+        owned by the caller.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_create_brand():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.CreateBrandRequest(
+                    parent="parent_value",
+                )
+
+                # Make the request
+                response = client.create_brand(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.CreateBrandRequest, dict]):
+                The request object. The request sent to CreateBrand.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.Brand:
+                OAuth brand data.
+                NOTE: Only contains a portion of the
+                data that describes a brand.
+
+        """
+        # Create or coerce a protobuf request object.
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.CreateBrandRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.CreateBrandRequest):
+            request = service.CreateBrandRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.create_brand]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def get_brand(
+        self,
+        request: Optional[Union[service.GetBrandRequest, dict]] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.Brand:
+        r"""Retrieves the OAuth brand of the project.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_get_brand():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.GetBrandRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                response = client.get_brand(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.GetBrandRequest, dict]):
+                The request object. The request sent to GetBrand.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.Brand:
+                OAuth brand data.
+                NOTE: Only contains a portion of the
+                data that describes a brand.
+
+        """
+        # Create or coerce a protobuf request object.
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.GetBrandRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.GetBrandRequest):
+            request = service.GetBrandRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[self._transport.get_brand]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def create_identity_aware_proxy_client(
+        self,
+        request: Optional[
+            Union[service.CreateIdentityAwareProxyClientRequest, dict]
+        ] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.IdentityAwareProxyClient:
+        r"""Creates an Identity Aware Proxy (IAP) OAuth client.
+        The client is owned by IAP. Requires that the brand for
+        the project exists and that it is set for internal-only
+        use.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_create_identity_aware_proxy_client():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.CreateIdentityAwareProxyClientRequest(
+                    parent="parent_value",
+                )
+
+                # Make the request
+                response = client.create_identity_aware_proxy_client(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.CreateIdentityAwareProxyClientRequest, dict]):
+                The request object. The request sent to
+                CreateIdentityAwareProxyClient.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.IdentityAwareProxyClient:
+                Contains the data that describes an
+                Identity Aware Proxy owned client.
+
+        """
+        # Create or coerce a protobuf request object.
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.CreateIdentityAwareProxyClientRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.CreateIdentityAwareProxyClientRequest):
+            request = service.CreateIdentityAwareProxyClientRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[
+            self._transport.create_identity_aware_proxy_client
+        ]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def list_identity_aware_proxy_clients(
+        self,
+        request: Optional[
+            Union[service.ListIdentityAwareProxyClientsRequest, dict]
+        ] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> pagers.ListIdentityAwareProxyClientsPager:
+        r"""Lists the existing clients for the brand.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_list_identity_aware_proxy_clients():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.ListIdentityAwareProxyClientsRequest(
+                    parent="parent_value",
+                )
+
+                # Make the request
+                page_result = client.list_identity_aware_proxy_clients(request=request)
+
+                # Handle the response
+                for response in page_result:
+                    print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.ListIdentityAwareProxyClientsRequest, dict]):
+                The request object. The request sent to
+                ListIdentityAwareProxyClients.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service.pagers.ListIdentityAwareProxyClientsPager:
+                Response message for
+                ListIdentityAwareProxyClients.
+                Iterating over this object will yield
+                results and resolve additional pages
+                automatically.
+
+        """
+        # Create or coerce a protobuf request object.
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.ListIdentityAwareProxyClientsRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.ListIdentityAwareProxyClientsRequest):
+            request = service.ListIdentityAwareProxyClientsRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[
+            self._transport.list_identity_aware_proxy_clients
+        ]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", request.parent),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # This method is paged; wrap the response in a pager, which provides
+        # an `__iter__` convenience method.
+        response = pagers.ListIdentityAwareProxyClientsPager(
+            method=rpc,
+            request=request,
+            response=response,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def get_identity_aware_proxy_client(
+        self,
+        request: Optional[
+            Union[service.GetIdentityAwareProxyClientRequest, dict]
+        ] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.IdentityAwareProxyClient:
+        r"""Retrieves an Identity Aware Proxy (IAP) OAuth client.
+        Requires that the client is owned by IAP.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_get_identity_aware_proxy_client():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.GetIdentityAwareProxyClientRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                response = client.get_identity_aware_proxy_client(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.GetIdentityAwareProxyClientRequest, dict]):
+                The request object. The request sent to
+                GetIdentityAwareProxyClient.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.IdentityAwareProxyClient:
+                Contains the data that describes an
+                Identity Aware Proxy owned client.
+
+        """
+        # Create or coerce a protobuf request object.
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.GetIdentityAwareProxyClientRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.GetIdentityAwareProxyClientRequest):
+            request = service.GetIdentityAwareProxyClientRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[
+            self._transport.get_identity_aware_proxy_client
+        ]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def reset_identity_aware_proxy_client_secret(
+        self,
+        request: Optional[
+            Union[service.ResetIdentityAwareProxyClientSecretRequest, dict]
+        ] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> service.IdentityAwareProxyClient:
+        r"""Resets an Identity Aware Proxy (IAP) OAuth client
+        secret. Useful if the secret was compromised. Requires
+        that the client is owned by IAP.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_reset_identity_aware_proxy_client_secret():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.ResetIdentityAwareProxyClientSecretRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                response = client.reset_identity_aware_proxy_client_secret(request=request)
+
+                # Handle the response
+                print(response)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.ResetIdentityAwareProxyClientSecretRequest, dict]):
+                The request object. The request sent to
+                ResetIdentityAwareProxyClientSecret.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+
+        Returns:
+            google.cloud.iap_v1.types.IdentityAwareProxyClient:
+                Contains the data that describes an
+                Identity Aware Proxy owned client.
+
+        """
+        # Create or coerce a protobuf request object.
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.ResetIdentityAwareProxyClientSecretRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.ResetIdentityAwareProxyClientSecretRequest):
+            request = service.ResetIdentityAwareProxyClientSecretRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[
+            self._transport.reset_identity_aware_proxy_client_secret
+        ]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        response = rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+        # Done; return the response.
+        return response
+
+    def delete_identity_aware_proxy_client(
+        self,
+        request: Optional[
+            Union[service.DeleteIdentityAwareProxyClientRequest, dict]
+        ] = None,
+        *,
+        retry: OptionalRetry = gapic_v1.method.DEFAULT,
+        timeout: Union[float, object] = gapic_v1.method.DEFAULT,
+        metadata: Sequence[Tuple[str, str]] = (),
+    ) -> None:
+        r"""Deletes an Identity Aware Proxy (IAP) OAuth client.
+        Useful for removing obsolete clients, managing the
+        number of clients in a given project, and cleaning up
+        after tests. Requires that the client is owned by IAP.
+
+        .. code-block:: python
+
+            # This snippet has been automatically generated and should be regarded as a
+            # code template only.
+            # It will require modifications to work:
+            # - It may require correct/in-range values for request initialization.
+            # - It may require specifying regional endpoints when creating the service
+            #   client as shown in:
+            #   https://googleapis.dev/python/google-api-core/latest/client_options.html
+            from google.cloud import iap_v1
+
+            def sample_delete_identity_aware_proxy_client():
+                # Create a client
+                client = iap_v1.IdentityAwareProxyOAuthServiceClient()
+
+                # Initialize request argument(s)
+                request = iap_v1.DeleteIdentityAwareProxyClientRequest(
+                    name="name_value",
+                )
+
+                # Make the request
+                client.delete_identity_aware_proxy_client(request=request)
+
+        Args:
+            request (Union[google.cloud.iap_v1.types.DeleteIdentityAwareProxyClientRequest, dict]):
+                The request object. The request sent to
+                DeleteIdentityAwareProxyClient.
+            retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                should be retried.
+            timeout (float): The timeout for this request.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+        """
+        # Create or coerce a protobuf request object.
+        # Minor optimization to avoid making a copy if the user passes
+        # in a service.DeleteIdentityAwareProxyClientRequest.
+        # There's no risk of modifying the input as we've already verified
+        # there are no flattened fields.
+        if not isinstance(request, service.DeleteIdentityAwareProxyClientRequest):
+            request = service.DeleteIdentityAwareProxyClientRequest(request)
+
+        # Wrap the RPC method; this adds retry and timeout information,
+        # and friendly error handling.
+        rpc = self._transport._wrapped_methods[
+            self._transport.delete_identity_aware_proxy_client
+        ]
+
+        # Certain fields should be provided within the metadata header;
+        # add these here.
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("name", request.name),)),
+        )
+
+        # Send the request.
+        rpc(
+            request,
+            retry=retry,
+            timeout=timeout,
+            metadata=metadata,
+        )
+
+    def __enter__(self) -> "IdentityAwareProxyOAuthServiceClient":
+        return self
+
+    def __exit__(self, type, value, traceback):
+        """Releases underlying transport's resources.
+
+        .. warning::
+            ONLY use as a context manager if the transport is NOT shared
+            with other clients! Exiting the with block will CLOSE the transport
+            and may cause errors in other clients!
+        """
+        self.transport.close()
+
+
+DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
+    gapic_version=package_version.__version__
+)
+
+
+__all__ = ("IdentityAwareProxyOAuthServiceClient",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/pagers.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/pagers.py
new file mode 100644
index 000000000000..c059aa815717
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/pagers.py
@@ -0,0 +1,157 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from typing import (
+    Any,
+    AsyncIterator,
+    Awaitable,
+    Callable,
+    Iterator,
+    Optional,
+    Sequence,
+    Tuple,
+)
+
+from google.cloud.iap_v1.types import service
+
+
+class ListIdentityAwareProxyClientsPager:
+    """A pager for iterating through ``list_identity_aware_proxy_clients`` requests.
+
+    This class thinly wraps an initial
+    :class:`google.cloud.iap_v1.types.ListIdentityAwareProxyClientsResponse` object, and
+    provides an ``__iter__`` method to iterate through its
+    ``identity_aware_proxy_clients`` field.
+
+    If there are more pages, the ``__iter__`` method will make additional
+    ``ListIdentityAwareProxyClients`` requests and continue to iterate
+    through the ``identity_aware_proxy_clients`` field on the
+    corresponding responses.
+
+    All the usual :class:`google.cloud.iap_v1.types.ListIdentityAwareProxyClientsResponse`
+    attributes are available on the pager. If multiple requests are made, only
+    the most recent response is retained, and thus used for attribute lookup.
+    """
+
+    def __init__(
+        self,
+        method: Callable[..., service.ListIdentityAwareProxyClientsResponse],
+        request: service.ListIdentityAwareProxyClientsRequest,
+        response: service.ListIdentityAwareProxyClientsResponse,
+        *,
+        metadata: Sequence[Tuple[str, str]] = ()
+    ):
+        """Instantiate the pager.
+
+        Args:
+            method (Callable): The method that was originally called, and
+                which instantiated this pager.
+            request (google.cloud.iap_v1.types.ListIdentityAwareProxyClientsRequest):
+                The initial request object.
+            response (google.cloud.iap_v1.types.ListIdentityAwareProxyClientsResponse):
+                The initial response object.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+        """
+        self._method = method
+        self._request = service.ListIdentityAwareProxyClientsRequest(request)
+        self._response = response
+        self._metadata = metadata
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._response, name)
+
+    @property
+    def pages(self) -> Iterator[service.ListIdentityAwareProxyClientsResponse]:
+        yield self._response
+        while self._response.next_page_token:
+            self._request.page_token = self._response.next_page_token
+            self._response = self._method(self._request, metadata=self._metadata)
+            yield self._response
+
+    def __iter__(self) -> Iterator[service.IdentityAwareProxyClient]:
+        for page in self.pages:
+            yield from page.identity_aware_proxy_clients
+
+    def __repr__(self) -> str:
+        return "{0}<{1!r}>".format(self.__class__.__name__, self._response)
+
+
+class ListIdentityAwareProxyClientsAsyncPager:
+    """A pager for iterating through ``list_identity_aware_proxy_clients`` requests.
+
+    This class thinly wraps an initial
+    :class:`google.cloud.iap_v1.types.ListIdentityAwareProxyClientsResponse` object, and
+    provides an ``__aiter__`` method to iterate through its
+    ``identity_aware_proxy_clients`` field.
+
+    If there are more pages, the ``__aiter__`` method will make additional
+    ``ListIdentityAwareProxyClients`` requests and continue to iterate
+    through the ``identity_aware_proxy_clients`` field on the
+    corresponding responses.
+
+    All the usual :class:`google.cloud.iap_v1.types.ListIdentityAwareProxyClientsResponse`
+    attributes are available on the pager. If multiple requests are made, only
+    the most recent response is retained, and thus used for attribute lookup.
+    """
+
+    def __init__(
+        self,
+        method: Callable[..., Awaitable[service.ListIdentityAwareProxyClientsResponse]],
+        request: service.ListIdentityAwareProxyClientsRequest,
+        response: service.ListIdentityAwareProxyClientsResponse,
+        *,
+        metadata: Sequence[Tuple[str, str]] = ()
+    ):
+        """Instantiates the pager.
+
+        Args:
+            method (Callable): The method that was originally called, and
+                which instantiated this pager.
+            request (google.cloud.iap_v1.types.ListIdentityAwareProxyClientsRequest):
+                The initial request object.
+            response (google.cloud.iap_v1.types.ListIdentityAwareProxyClientsResponse):
+                The initial response object.
+            metadata (Sequence[Tuple[str, str]]): Strings which should be
+                sent along with the request as metadata.
+        """
+        self._method = method
+        self._request = service.ListIdentityAwareProxyClientsRequest(request)
+        self._response = response
+        self._metadata = metadata
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._response, name)
+
+    @property
+    async def pages(
+        self,
+    ) -> AsyncIterator[service.ListIdentityAwareProxyClientsResponse]:
+        yield self._response
+        while self._response.next_page_token:
+            self._request.page_token = self._response.next_page_token
+            self._response = await self._method(self._request, metadata=self._metadata)
+            yield self._response
+
+    def __aiter__(self) -> AsyncIterator[service.IdentityAwareProxyClient]:
+        async def async_generator():
+            async for page in self.pages:
+                for response in page.identity_aware_proxy_clients:
+                    yield response
+
+        return async_generator()
+
+    def __repr__(self) -> str:
+        return "{0}<{1!r}>".format(self.__class__.__name__, self._response)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/__init__.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/__init__.py
new file mode 100644
index 000000000000..e30ecbe86563
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/__init__.py
@@ -0,0 +1,41 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from collections import OrderedDict
+from typing import Dict, Type
+
+from .base import IdentityAwareProxyOAuthServiceTransport
+from .grpc import IdentityAwareProxyOAuthServiceGrpcTransport
+from .grpc_asyncio import IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport
+from .rest import (
+    IdentityAwareProxyOAuthServiceRestInterceptor,
+    IdentityAwareProxyOAuthServiceRestTransport,
+)
+
+# Compile a registry of transports.
+_transport_registry = (
+    OrderedDict()
+)  # type: Dict[str, Type[IdentityAwareProxyOAuthServiceTransport]]
+_transport_registry["grpc"] = IdentityAwareProxyOAuthServiceGrpcTransport
+_transport_registry["grpc_asyncio"] = IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport
+_transport_registry["rest"] = IdentityAwareProxyOAuthServiceRestTransport
+
+__all__ = (
+    "IdentityAwareProxyOAuthServiceTransport",
+    "IdentityAwareProxyOAuthServiceGrpcTransport",
+    "IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport",
+    "IdentityAwareProxyOAuthServiceRestTransport",
+    "IdentityAwareProxyOAuthServiceRestInterceptor",
+)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/base.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/base.py
new file mode 100644
index 000000000000..ccce69f47bf9
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/base.py
@@ -0,0 +1,264 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+import abc
+from typing import Awaitable, Callable, Dict, Optional, Sequence, Union
+
+import google.api_core
+from google.api_core import exceptions as core_exceptions
+from google.api_core import gapic_v1
+from google.api_core import retry as retries
+import google.auth  # type: ignore
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.oauth2 import service_account  # type: ignore
+from google.protobuf import empty_pb2  # type: ignore
+
+from google.cloud.iap_v1 import gapic_version as package_version
+from google.cloud.iap_v1.types import service
+
+DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
+    gapic_version=package_version.__version__
+)
+
+
+class IdentityAwareProxyOAuthServiceTransport(abc.ABC):
+    """Abstract transport class for IdentityAwareProxyOAuthService."""
+
+    AUTH_SCOPES = ("https://www.googleapis.com/auth/cloud-platform",)
+
+    DEFAULT_HOST: str = "iap.googleapis.com"
+
+    def __init__(
+        self,
+        *,
+        host: str = DEFAULT_HOST,
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        quota_project_id: Optional[str] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
+        api_audience: Optional[str] = None,
+        **kwargs,
+    ) -> None:
+        """Instantiate the transport.
+
+        Args:
+            host (Optional[str]):
+                 The hostname to connect to.
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is mutually exclusive with credentials.
+            scopes (Optional[Sequence[str]]): A list of scopes.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
+                The client info used to send a user-agent string along with
+                API requests. If ``None``, then default info will be used.
+                Generally, you only need to set this if you're developing
+                your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
+        """
+
+        scopes_kwargs = {"scopes": scopes, "default_scopes": self.AUTH_SCOPES}
+
+        # Save the scopes.
+        self._scopes = scopes
+
+        # If no credentials are provided, then determine the appropriate
+        # defaults.
+        if credentials and credentials_file:
+            raise core_exceptions.DuplicateCredentialArgs(
+                "'credentials_file' and 'credentials' are mutually exclusive"
+            )
+
+        if credentials_file is not None:
+            credentials, _ = google.auth.load_credentials_from_file(
+                credentials_file, **scopes_kwargs, quota_project_id=quota_project_id
+            )
+        elif credentials is None:
+            credentials, _ = google.auth.default(
+                **scopes_kwargs, quota_project_id=quota_project_id
+            )
+            # Don't apply audience if the credentials file passed from user.
+            if hasattr(credentials, "with_gdch_audience"):
+                credentials = credentials.with_gdch_audience(
+                    api_audience if api_audience else host
+                )
+
+        # If the credentials are service account credentials, then always try to use self signed JWT.
+        if (
+            always_use_jwt_access
+            and isinstance(credentials, service_account.Credentials)
+            and hasattr(service_account.Credentials, "with_always_use_jwt_access")
+        ):
+            credentials = credentials.with_always_use_jwt_access(True)
+
+        # Save the credentials.
+        self._credentials = credentials
+
+        # Save the hostname. Default to port 443 (HTTPS) if none is specified.
+        if ":" not in host:
+            host += ":443"
+        self._host = host
+
+    def _prep_wrapped_messages(self, client_info):
+        # Precompute the wrapped methods.
+        self._wrapped_methods = {
+            self.list_brands: gapic_v1.method.wrap_method(
+                self.list_brands,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.create_brand: gapic_v1.method.wrap_method(
+                self.create_brand,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.get_brand: gapic_v1.method.wrap_method(
+                self.get_brand,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.create_identity_aware_proxy_client: gapic_v1.method.wrap_method(
+                self.create_identity_aware_proxy_client,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.list_identity_aware_proxy_clients: gapic_v1.method.wrap_method(
+                self.list_identity_aware_proxy_clients,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.get_identity_aware_proxy_client: gapic_v1.method.wrap_method(
+                self.get_identity_aware_proxy_client,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.reset_identity_aware_proxy_client_secret: gapic_v1.method.wrap_method(
+                self.reset_identity_aware_proxy_client_secret,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+            self.delete_identity_aware_proxy_client: gapic_v1.method.wrap_method(
+                self.delete_identity_aware_proxy_client,
+                default_timeout=None,
+                client_info=client_info,
+            ),
+        }
+
+    def close(self):
+        """Closes resources associated with the transport.
+
+        .. warning::
+             Only call this method if the transport is NOT shared
+             with other clients - this may cause errors in other clients!
+        """
+        raise NotImplementedError()
+
+    @property
+    def list_brands(
+        self,
+    ) -> Callable[
+        [service.ListBrandsRequest],
+        Union[service.ListBrandsResponse, Awaitable[service.ListBrandsResponse]],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def create_brand(
+        self,
+    ) -> Callable[
+        [service.CreateBrandRequest], Union[service.Brand, Awaitable[service.Brand]]
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def get_brand(
+        self,
+    ) -> Callable[
+        [service.GetBrandRequest], Union[service.Brand, Awaitable[service.Brand]]
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def create_identity_aware_proxy_client(
+        self,
+    ) -> Callable[
+        [service.CreateIdentityAwareProxyClientRequest],
+        Union[
+            service.IdentityAwareProxyClient,
+            Awaitable[service.IdentityAwareProxyClient],
+        ],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def list_identity_aware_proxy_clients(
+        self,
+    ) -> Callable[
+        [service.ListIdentityAwareProxyClientsRequest],
+        Union[
+            service.ListIdentityAwareProxyClientsResponse,
+            Awaitable[service.ListIdentityAwareProxyClientsResponse],
+        ],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def get_identity_aware_proxy_client(
+        self,
+    ) -> Callable[
+        [service.GetIdentityAwareProxyClientRequest],
+        Union[
+            service.IdentityAwareProxyClient,
+            Awaitable[service.IdentityAwareProxyClient],
+        ],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def reset_identity_aware_proxy_client_secret(
+        self,
+    ) -> Callable[
+        [service.ResetIdentityAwareProxyClientSecretRequest],
+        Union[
+            service.IdentityAwareProxyClient,
+            Awaitable[service.IdentityAwareProxyClient],
+        ],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def delete_identity_aware_proxy_client(
+        self,
+    ) -> Callable[
+        [service.DeleteIdentityAwareProxyClientRequest],
+        Union[empty_pb2.Empty, Awaitable[empty_pb2.Empty]],
+    ]:
+        raise NotImplementedError()
+
+    @property
+    def kind(self) -> str:
+        raise NotImplementedError()
+
+
+__all__ = ("IdentityAwareProxyOAuthServiceTransport",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/grpc.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/grpc.py
new file mode 100644
index 000000000000..4e4d927c08fd
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/grpc.py
@@ -0,0 +1,492 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from typing import Callable, Dict, Optional, Sequence, Tuple, Union
+import warnings
+
+from google.api_core import gapic_v1, grpc_helpers
+import google.auth  # type: ignore
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.auth.transport.grpc import SslCredentials  # type: ignore
+from google.protobuf import empty_pb2  # type: ignore
+import grpc  # type: ignore
+
+from google.cloud.iap_v1.types import service
+
+from .base import DEFAULT_CLIENT_INFO, IdentityAwareProxyOAuthServiceTransport
+
+
+class IdentityAwareProxyOAuthServiceGrpcTransport(
+    IdentityAwareProxyOAuthServiceTransport
+):
+    """gRPC backend transport for IdentityAwareProxyOAuthService.
+
+    API to programmatically create, list and retrieve Identity
+    Aware Proxy (IAP) OAuth brands; and create, retrieve, delete and
+    reset-secret of IAP OAuth clients.
+
+    This class defines the same methods as the primary client, so the
+    primary client can load the underlying transport implementation
+    and call it.
+
+    It sends protocol buffers over the wire using gRPC (which is built on
+    top of HTTP/2); the ``grpcio`` package must be installed.
+    """
+
+    _stubs: Dict[str, Callable]
+
+    def __init__(
+        self,
+        *,
+        host: str = "iap.googleapis.com",
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        channel: Optional[grpc.Channel] = None,
+        api_mtls_endpoint: Optional[str] = None,
+        client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None,
+        ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None,
+        client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None,
+        quota_project_id: Optional[str] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
+        api_audience: Optional[str] = None,
+    ) -> None:
+        """Instantiate the transport.
+
+        Args:
+            host (Optional[str]):
+                 The hostname to connect to.
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+                This argument is ignored if ``channel`` is provided.
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is ignored if ``channel`` is provided.
+            scopes (Optional(Sequence[str])): A list of scopes. This argument is
+                ignored if ``channel`` is provided.
+            channel (Optional[grpc.Channel]): A ``Channel`` instance through
+                which to make calls.
+            api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint.
+                If provided, it overrides the ``host`` argument and tries to create
+                a mutual TLS channel with client SSL credentials from
+                ``client_cert_source`` or application default SSL credentials.
+            client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]):
+                Deprecated. A callback to provide client SSL certificate bytes and
+                private key bytes, both in PEM format. It is ignored if
+                ``api_mtls_endpoint`` is None.
+            ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials
+                for the grpc channel. It is ignored if ``channel`` is provided.
+            client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]):
+                A callback to provide client certificate bytes and private key bytes,
+                both in PEM format. It is used to configure a mutual TLS channel. It is
+                ignored if ``channel`` or ``ssl_channel_credentials`` is provided.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
+                The client info used to send a user-agent string along with
+                API requests. If ``None``, then default info will be used.
+                Generally, you only need to set this if you're developing
+                your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
+
+        Raises:
+          google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport
+              creation failed for any reason.
+          google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials``
+              and ``credentials_file`` are passed.
+        """
+        self._grpc_channel = None
+        self._ssl_channel_credentials = ssl_channel_credentials
+        self._stubs: Dict[str, Callable] = {}
+
+        if api_mtls_endpoint:
+            warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning)
+        if client_cert_source:
+            warnings.warn("client_cert_source is deprecated", DeprecationWarning)
+
+        if channel:
+            # Ignore credentials if a channel was passed.
+            credentials = False
+            # If a channel was explicitly provided, set it.
+            self._grpc_channel = channel
+            self._ssl_channel_credentials = None
+
+        else:
+            if api_mtls_endpoint:
+                host = api_mtls_endpoint
+
+                # Create SSL credentials with client_cert_source or application
+                # default SSL credentials.
+                if client_cert_source:
+                    cert, key = client_cert_source()
+                    self._ssl_channel_credentials = grpc.ssl_channel_credentials(
+                        certificate_chain=cert, private_key=key
+                    )
+                else:
+                    self._ssl_channel_credentials = SslCredentials().ssl_credentials
+
+            else:
+                if client_cert_source_for_mtls and not ssl_channel_credentials:
+                    cert, key = client_cert_source_for_mtls()
+                    self._ssl_channel_credentials = grpc.ssl_channel_credentials(
+                        certificate_chain=cert, private_key=key
+                    )
+
+        # The base transport sets the host, credentials and scopes
+        super().__init__(
+            host=host,
+            credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
+            client_info=client_info,
+            always_use_jwt_access=always_use_jwt_access,
+            api_audience=api_audience,
+        )
+
+        if not self._grpc_channel:
+            self._grpc_channel = type(self).create_channel(
+                self._host,
+                # use the credentials which are saved
+                credentials=self._credentials,
+                # Set ``credentials_file`` to ``None`` here as
+                # the credentials that we saved earlier should be used.
+                credentials_file=None,
+                scopes=self._scopes,
+                ssl_credentials=self._ssl_channel_credentials,
+                quota_project_id=quota_project_id,
+                options=[
+                    ("grpc.max_send_message_length", -1),
+                    ("grpc.max_receive_message_length", -1),
+                ],
+            )
+
+        # Wrap messages. This must be done after self._grpc_channel exists
+        self._prep_wrapped_messages(client_info)
+
+    @classmethod
+    def create_channel(
+        cls,
+        host: str = "iap.googleapis.com",
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        quota_project_id: Optional[str] = None,
+        **kwargs,
+    ) -> grpc.Channel:
+        """Create and return a gRPC channel object.
+        Args:
+            host (Optional[str]): The host for the channel to use.
+            credentials (Optional[~.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify this application to the service. If
+                none are specified, the client will attempt to ascertain
+                the credentials from the environment.
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is mutually exclusive with credentials.
+            scopes (Optional[Sequence[str]]): A optional list of scopes needed for this
+                service. These are only used when credentials are not specified and
+                are passed to :func:`google.auth.default`.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            kwargs (Optional[dict]): Keyword arguments, which are passed to the
+                channel creation.
+        Returns:
+            grpc.Channel: A gRPC channel object.
+
+        Raises:
+            google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials``
+              and ``credentials_file`` are passed.
+        """
+
+        return grpc_helpers.create_channel(
+            host,
+            credentials=credentials,
+            credentials_file=credentials_file,
+            quota_project_id=quota_project_id,
+            default_scopes=cls.AUTH_SCOPES,
+            scopes=scopes,
+            default_host=cls.DEFAULT_HOST,
+            **kwargs,
+        )
+
+    @property
+    def grpc_channel(self) -> grpc.Channel:
+        """Return the channel designed to connect to this service."""
+        return self._grpc_channel
+
+    @property
+    def list_brands(
+        self,
+    ) -> Callable[[service.ListBrandsRequest], service.ListBrandsResponse]:
+        r"""Return a callable for the list brands method over gRPC.
+
+        Lists the existing brands for the project.
+
+        Returns:
+            Callable[[~.ListBrandsRequest],
+                    ~.ListBrandsResponse]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "list_brands" not in self._stubs:
+            self._stubs["list_brands"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/ListBrands",
+                request_serializer=service.ListBrandsRequest.serialize,
+                response_deserializer=service.ListBrandsResponse.deserialize,
+            )
+        return self._stubs["list_brands"]
+
+    @property
+    def create_brand(self) -> Callable[[service.CreateBrandRequest], service.Brand]:
+        r"""Return a callable for the create brand method over gRPC.
+
+        Constructs a new OAuth brand for the project if one
+        does not exist. The created brand is "internal only",
+        meaning that OAuth clients created under it only accept
+        requests from users who belong to the same Google
+        Workspace organization as the project. The brand is
+        created in an un-reviewed status. NOTE: The "internal
+        only" status can be manually changed in the Google Cloud
+        Console. Requires that a brand does not already exist
+        for the project, and that the specified support email is
+        owned by the caller.
+
+        Returns:
+            Callable[[~.CreateBrandRequest],
+                    ~.Brand]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "create_brand" not in self._stubs:
+            self._stubs["create_brand"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/CreateBrand",
+                request_serializer=service.CreateBrandRequest.serialize,
+                response_deserializer=service.Brand.deserialize,
+            )
+        return self._stubs["create_brand"]
+
+    @property
+    def get_brand(self) -> Callable[[service.GetBrandRequest], service.Brand]:
+        r"""Return a callable for the get brand method over gRPC.
+
+        Retrieves the OAuth brand of the project.
+
+        Returns:
+            Callable[[~.GetBrandRequest],
+                    ~.Brand]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "get_brand" not in self._stubs:
+            self._stubs["get_brand"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/GetBrand",
+                request_serializer=service.GetBrandRequest.serialize,
+                response_deserializer=service.Brand.deserialize,
+            )
+        return self._stubs["get_brand"]
+
+    @property
+    def create_identity_aware_proxy_client(
+        self,
+    ) -> Callable[
+        [service.CreateIdentityAwareProxyClientRequest],
+        service.IdentityAwareProxyClient,
+    ]:
+        r"""Return a callable for the create identity aware proxy
+        client method over gRPC.
+
+        Creates an Identity Aware Proxy (IAP) OAuth client.
+        The client is owned by IAP. Requires that the brand for
+        the project exists and that it is set for internal-only
+        use.
+
+        Returns:
+            Callable[[~.CreateIdentityAwareProxyClientRequest],
+                    ~.IdentityAwareProxyClient]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "create_identity_aware_proxy_client" not in self._stubs:
+            self._stubs[
+                "create_identity_aware_proxy_client"
+            ] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/CreateIdentityAwareProxyClient",
+                request_serializer=service.CreateIdentityAwareProxyClientRequest.serialize,
+                response_deserializer=service.IdentityAwareProxyClient.deserialize,
+            )
+        return self._stubs["create_identity_aware_proxy_client"]
+
+    @property
+    def list_identity_aware_proxy_clients(
+        self,
+    ) -> Callable[
+        [service.ListIdentityAwareProxyClientsRequest],
+        service.ListIdentityAwareProxyClientsResponse,
+    ]:
+        r"""Return a callable for the list identity aware proxy
+        clients method over gRPC.
+
+        Lists the existing clients for the brand.
+
+        Returns:
+            Callable[[~.ListIdentityAwareProxyClientsRequest],
+                    ~.ListIdentityAwareProxyClientsResponse]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "list_identity_aware_proxy_clients" not in self._stubs:
+            self._stubs[
+                "list_identity_aware_proxy_clients"
+            ] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/ListIdentityAwareProxyClients",
+                request_serializer=service.ListIdentityAwareProxyClientsRequest.serialize,
+                response_deserializer=service.ListIdentityAwareProxyClientsResponse.deserialize,
+            )
+        return self._stubs["list_identity_aware_proxy_clients"]
+
+    @property
+    def get_identity_aware_proxy_client(
+        self,
+    ) -> Callable[
+        [service.GetIdentityAwareProxyClientRequest], service.IdentityAwareProxyClient
+    ]:
+        r"""Return a callable for the get identity aware proxy
+        client method over gRPC.
+
+        Retrieves an Identity Aware Proxy (IAP) OAuth client.
+        Requires that the client is owned by IAP.
+
+        Returns:
+            Callable[[~.GetIdentityAwareProxyClientRequest],
+                    ~.IdentityAwareProxyClient]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "get_identity_aware_proxy_client" not in self._stubs:
+            self._stubs[
+                "get_identity_aware_proxy_client"
+            ] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/GetIdentityAwareProxyClient",
+                request_serializer=service.GetIdentityAwareProxyClientRequest.serialize,
+                response_deserializer=service.IdentityAwareProxyClient.deserialize,
+            )
+        return self._stubs["get_identity_aware_proxy_client"]
+
+    @property
+    def reset_identity_aware_proxy_client_secret(
+        self,
+    ) -> Callable[
+        [service.ResetIdentityAwareProxyClientSecretRequest],
+        service.IdentityAwareProxyClient,
+    ]:
+        r"""Return a callable for the reset identity aware proxy
+        client secret method over gRPC.
+
+        Resets an Identity Aware Proxy (IAP) OAuth client
+        secret. Useful if the secret was compromised. Requires
+        that the client is owned by IAP.
+
+        Returns:
+            Callable[[~.ResetIdentityAwareProxyClientSecretRequest],
+                    ~.IdentityAwareProxyClient]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "reset_identity_aware_proxy_client_secret" not in self._stubs:
+            self._stubs[
+                "reset_identity_aware_proxy_client_secret"
+            ] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/ResetIdentityAwareProxyClientSecret",
+                request_serializer=service.ResetIdentityAwareProxyClientSecretRequest.serialize,
+                response_deserializer=service.IdentityAwareProxyClient.deserialize,
+            )
+        return self._stubs["reset_identity_aware_proxy_client_secret"]
+
+    @property
+    def delete_identity_aware_proxy_client(
+        self,
+    ) -> Callable[[service.DeleteIdentityAwareProxyClientRequest], empty_pb2.Empty]:
+        r"""Return a callable for the delete identity aware proxy
+        client method over gRPC.
+
+        Deletes an Identity Aware Proxy (IAP) OAuth client.
+        Useful for removing obsolete clients, managing the
+        number of clients in a given project, and cleaning up
+        after tests. Requires that the client is owned by IAP.
+
+        Returns:
+            Callable[[~.DeleteIdentityAwareProxyClientRequest],
+                    ~.Empty]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "delete_identity_aware_proxy_client" not in self._stubs:
+            self._stubs[
+                "delete_identity_aware_proxy_client"
+            ] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/DeleteIdentityAwareProxyClient",
+                request_serializer=service.DeleteIdentityAwareProxyClientRequest.serialize,
+                response_deserializer=empty_pb2.Empty.FromString,
+            )
+        return self._stubs["delete_identity_aware_proxy_client"]
+
+    def close(self):
+        self.grpc_channel.close()
+
+    @property
+    def kind(self) -> str:
+        return "grpc"
+
+
+__all__ = ("IdentityAwareProxyOAuthServiceGrpcTransport",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/grpc_asyncio.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/grpc_asyncio.py
new file mode 100644
index 000000000000..139d3cb3a721
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/grpc_asyncio.py
@@ -0,0 +1,498 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from typing import Awaitable, Callable, Dict, Optional, Sequence, Tuple, Union
+import warnings
+
+from google.api_core import gapic_v1, grpc_helpers_async
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.auth.transport.grpc import SslCredentials  # type: ignore
+from google.protobuf import empty_pb2  # type: ignore
+import grpc  # type: ignore
+from grpc.experimental import aio  # type: ignore
+
+from google.cloud.iap_v1.types import service
+
+from .base import DEFAULT_CLIENT_INFO, IdentityAwareProxyOAuthServiceTransport
+from .grpc import IdentityAwareProxyOAuthServiceGrpcTransport
+
+
+class IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport(
+    IdentityAwareProxyOAuthServiceTransport
+):
+    """gRPC AsyncIO backend transport for IdentityAwareProxyOAuthService.
+
+    API to programmatically create, list and retrieve Identity
+    Aware Proxy (IAP) OAuth brands; and create, retrieve, delete and
+    reset-secret of IAP OAuth clients.
+
+    This class defines the same methods as the primary client, so the
+    primary client can load the underlying transport implementation
+    and call it.
+
+    It sends protocol buffers over the wire using gRPC (which is built on
+    top of HTTP/2); the ``grpcio`` package must be installed.
+    """
+
+    _grpc_channel: aio.Channel
+    _stubs: Dict[str, Callable] = {}
+
+    @classmethod
+    def create_channel(
+        cls,
+        host: str = "iap.googleapis.com",
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        quota_project_id: Optional[str] = None,
+        **kwargs,
+    ) -> aio.Channel:
+        """Create and return a gRPC AsyncIO channel object.
+        Args:
+            host (Optional[str]): The host for the channel to use.
+            credentials (Optional[~.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify this application to the service. If
+                none are specified, the client will attempt to ascertain
+                the credentials from the environment.
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is ignored if ``channel`` is provided.
+            scopes (Optional[Sequence[str]]): A optional list of scopes needed for this
+                service. These are only used when credentials are not specified and
+                are passed to :func:`google.auth.default`.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            kwargs (Optional[dict]): Keyword arguments, which are passed to the
+                channel creation.
+        Returns:
+            aio.Channel: A gRPC AsyncIO channel object.
+        """
+
+        return grpc_helpers_async.create_channel(
+            host,
+            credentials=credentials,
+            credentials_file=credentials_file,
+            quota_project_id=quota_project_id,
+            default_scopes=cls.AUTH_SCOPES,
+            scopes=scopes,
+            default_host=cls.DEFAULT_HOST,
+            **kwargs,
+        )
+
+    def __init__(
+        self,
+        *,
+        host: str = "iap.googleapis.com",
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        channel: Optional[aio.Channel] = None,
+        api_mtls_endpoint: Optional[str] = None,
+        client_cert_source: Optional[Callable[[], Tuple[bytes, bytes]]] = None,
+        ssl_channel_credentials: Optional[grpc.ChannelCredentials] = None,
+        client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None,
+        quota_project_id: Optional[str] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
+        api_audience: Optional[str] = None,
+    ) -> None:
+        """Instantiate the transport.
+
+        Args:
+            host (Optional[str]):
+                 The hostname to connect to.
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+                This argument is ignored if ``channel`` is provided.
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is ignored if ``channel`` is provided.
+            scopes (Optional[Sequence[str]]): A optional list of scopes needed for this
+                service. These are only used when credentials are not specified and
+                are passed to :func:`google.auth.default`.
+            channel (Optional[aio.Channel]): A ``Channel`` instance through
+                which to make calls.
+            api_mtls_endpoint (Optional[str]): Deprecated. The mutual TLS endpoint.
+                If provided, it overrides the ``host`` argument and tries to create
+                a mutual TLS channel with client SSL credentials from
+                ``client_cert_source`` or application default SSL credentials.
+            client_cert_source (Optional[Callable[[], Tuple[bytes, bytes]]]):
+                Deprecated. A callback to provide client SSL certificate bytes and
+                private key bytes, both in PEM format. It is ignored if
+                ``api_mtls_endpoint`` is None.
+            ssl_channel_credentials (grpc.ChannelCredentials): SSL credentials
+                for the grpc channel. It is ignored if ``channel`` is provided.
+            client_cert_source_for_mtls (Optional[Callable[[], Tuple[bytes, bytes]]]):
+                A callback to provide client certificate bytes and private key bytes,
+                both in PEM format. It is used to configure a mutual TLS channel. It is
+                ignored if ``channel`` or ``ssl_channel_credentials`` is provided.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
+                The client info used to send a user-agent string along with
+                API requests. If ``None``, then default info will be used.
+                Generally, you only need to set this if you're developing
+                your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
+
+        Raises:
+            google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport
+              creation failed for any reason.
+          google.api_core.exceptions.DuplicateCredentialArgs: If both ``credentials``
+              and ``credentials_file`` are passed.
+        """
+        self._grpc_channel = None
+        self._ssl_channel_credentials = ssl_channel_credentials
+        self._stubs: Dict[str, Callable] = {}
+
+        if api_mtls_endpoint:
+            warnings.warn("api_mtls_endpoint is deprecated", DeprecationWarning)
+        if client_cert_source:
+            warnings.warn("client_cert_source is deprecated", DeprecationWarning)
+
+        if channel:
+            # Ignore credentials if a channel was passed.
+            credentials = False
+            # If a channel was explicitly provided, set it.
+            self._grpc_channel = channel
+            self._ssl_channel_credentials = None
+        else:
+            if api_mtls_endpoint:
+                host = api_mtls_endpoint
+
+                # Create SSL credentials with client_cert_source or application
+                # default SSL credentials.
+                if client_cert_source:
+                    cert, key = client_cert_source()
+                    self._ssl_channel_credentials = grpc.ssl_channel_credentials(
+                        certificate_chain=cert, private_key=key
+                    )
+                else:
+                    self._ssl_channel_credentials = SslCredentials().ssl_credentials
+
+            else:
+                if client_cert_source_for_mtls and not ssl_channel_credentials:
+                    cert, key = client_cert_source_for_mtls()
+                    self._ssl_channel_credentials = grpc.ssl_channel_credentials(
+                        certificate_chain=cert, private_key=key
+                    )
+
+        # The base transport sets the host, credentials and scopes
+        super().__init__(
+            host=host,
+            credentials=credentials,
+            credentials_file=credentials_file,
+            scopes=scopes,
+            quota_project_id=quota_project_id,
+            client_info=client_info,
+            always_use_jwt_access=always_use_jwt_access,
+            api_audience=api_audience,
+        )
+
+        if not self._grpc_channel:
+            self._grpc_channel = type(self).create_channel(
+                self._host,
+                # use the credentials which are saved
+                credentials=self._credentials,
+                # Set ``credentials_file`` to ``None`` here as
+                # the credentials that we saved earlier should be used.
+                credentials_file=None,
+                scopes=self._scopes,
+                ssl_credentials=self._ssl_channel_credentials,
+                quota_project_id=quota_project_id,
+                options=[
+                    ("grpc.max_send_message_length", -1),
+                    ("grpc.max_receive_message_length", -1),
+                ],
+            )
+
+        # Wrap messages. This must be done after self._grpc_channel exists
+        self._prep_wrapped_messages(client_info)
+
+    @property
+    def grpc_channel(self) -> aio.Channel:
+        """Create the channel designed to connect to this service.
+
+        This property caches on the instance; repeated calls return
+        the same channel.
+        """
+        # Return the channel from cache.
+        return self._grpc_channel
+
+    @property
+    def list_brands(
+        self,
+    ) -> Callable[[service.ListBrandsRequest], Awaitable[service.ListBrandsResponse]]:
+        r"""Return a callable for the list brands method over gRPC.
+
+        Lists the existing brands for the project.
+
+        Returns:
+            Callable[[~.ListBrandsRequest],
+                    Awaitable[~.ListBrandsResponse]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "list_brands" not in self._stubs:
+            self._stubs["list_brands"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/ListBrands",
+                request_serializer=service.ListBrandsRequest.serialize,
+                response_deserializer=service.ListBrandsResponse.deserialize,
+            )
+        return self._stubs["list_brands"]
+
+    @property
+    def create_brand(
+        self,
+    ) -> Callable[[service.CreateBrandRequest], Awaitable[service.Brand]]:
+        r"""Return a callable for the create brand method over gRPC.
+
+        Constructs a new OAuth brand for the project if one
+        does not exist. The created brand is "internal only",
+        meaning that OAuth clients created under it only accept
+        requests from users who belong to the same Google
+        Workspace organization as the project. The brand is
+        created in an un-reviewed status. NOTE: The "internal
+        only" status can be manually changed in the Google Cloud
+        Console. Requires that a brand does not already exist
+        for the project, and that the specified support email is
+        owned by the caller.
+
+        Returns:
+            Callable[[~.CreateBrandRequest],
+                    Awaitable[~.Brand]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "create_brand" not in self._stubs:
+            self._stubs["create_brand"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/CreateBrand",
+                request_serializer=service.CreateBrandRequest.serialize,
+                response_deserializer=service.Brand.deserialize,
+            )
+        return self._stubs["create_brand"]
+
+    @property
+    def get_brand(
+        self,
+    ) -> Callable[[service.GetBrandRequest], Awaitable[service.Brand]]:
+        r"""Return a callable for the get brand method over gRPC.
+
+        Retrieves the OAuth brand of the project.
+
+        Returns:
+            Callable[[~.GetBrandRequest],
+                    Awaitable[~.Brand]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "get_brand" not in self._stubs:
+            self._stubs["get_brand"] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/GetBrand",
+                request_serializer=service.GetBrandRequest.serialize,
+                response_deserializer=service.Brand.deserialize,
+            )
+        return self._stubs["get_brand"]
+
+    @property
+    def create_identity_aware_proxy_client(
+        self,
+    ) -> Callable[
+        [service.CreateIdentityAwareProxyClientRequest],
+        Awaitable[service.IdentityAwareProxyClient],
+    ]:
+        r"""Return a callable for the create identity aware proxy
+        client method over gRPC.
+
+        Creates an Identity Aware Proxy (IAP) OAuth client.
+        The client is owned by IAP. Requires that the brand for
+        the project exists and that it is set for internal-only
+        use.
+
+        Returns:
+            Callable[[~.CreateIdentityAwareProxyClientRequest],
+                    Awaitable[~.IdentityAwareProxyClient]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "create_identity_aware_proxy_client" not in self._stubs:
+            self._stubs[
+                "create_identity_aware_proxy_client"
+            ] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/CreateIdentityAwareProxyClient",
+                request_serializer=service.CreateIdentityAwareProxyClientRequest.serialize,
+                response_deserializer=service.IdentityAwareProxyClient.deserialize,
+            )
+        return self._stubs["create_identity_aware_proxy_client"]
+
+    @property
+    def list_identity_aware_proxy_clients(
+        self,
+    ) -> Callable[
+        [service.ListIdentityAwareProxyClientsRequest],
+        Awaitable[service.ListIdentityAwareProxyClientsResponse],
+    ]:
+        r"""Return a callable for the list identity aware proxy
+        clients method over gRPC.
+
+        Lists the existing clients for the brand.
+
+        Returns:
+            Callable[[~.ListIdentityAwareProxyClientsRequest],
+                    Awaitable[~.ListIdentityAwareProxyClientsResponse]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "list_identity_aware_proxy_clients" not in self._stubs:
+            self._stubs[
+                "list_identity_aware_proxy_clients"
+            ] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/ListIdentityAwareProxyClients",
+                request_serializer=service.ListIdentityAwareProxyClientsRequest.serialize,
+                response_deserializer=service.ListIdentityAwareProxyClientsResponse.deserialize,
+            )
+        return self._stubs["list_identity_aware_proxy_clients"]
+
+    @property
+    def get_identity_aware_proxy_client(
+        self,
+    ) -> Callable[
+        [service.GetIdentityAwareProxyClientRequest],
+        Awaitable[service.IdentityAwareProxyClient],
+    ]:
+        r"""Return a callable for the get identity aware proxy
+        client method over gRPC.
+
+        Retrieves an Identity Aware Proxy (IAP) OAuth client.
+        Requires that the client is owned by IAP.
+
+        Returns:
+            Callable[[~.GetIdentityAwareProxyClientRequest],
+                    Awaitable[~.IdentityAwareProxyClient]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "get_identity_aware_proxy_client" not in self._stubs:
+            self._stubs[
+                "get_identity_aware_proxy_client"
+            ] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/GetIdentityAwareProxyClient",
+                request_serializer=service.GetIdentityAwareProxyClientRequest.serialize,
+                response_deserializer=service.IdentityAwareProxyClient.deserialize,
+            )
+        return self._stubs["get_identity_aware_proxy_client"]
+
+    @property
+    def reset_identity_aware_proxy_client_secret(
+        self,
+    ) -> Callable[
+        [service.ResetIdentityAwareProxyClientSecretRequest],
+        Awaitable[service.IdentityAwareProxyClient],
+    ]:
+        r"""Return a callable for the reset identity aware proxy
+        client secret method over gRPC.
+
+        Resets an Identity Aware Proxy (IAP) OAuth client
+        secret. Useful if the secret was compromised. Requires
+        that the client is owned by IAP.
+
+        Returns:
+            Callable[[~.ResetIdentityAwareProxyClientSecretRequest],
+                    Awaitable[~.IdentityAwareProxyClient]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "reset_identity_aware_proxy_client_secret" not in self._stubs:
+            self._stubs[
+                "reset_identity_aware_proxy_client_secret"
+            ] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/ResetIdentityAwareProxyClientSecret",
+                request_serializer=service.ResetIdentityAwareProxyClientSecretRequest.serialize,
+                response_deserializer=service.IdentityAwareProxyClient.deserialize,
+            )
+        return self._stubs["reset_identity_aware_proxy_client_secret"]
+
+    @property
+    def delete_identity_aware_proxy_client(
+        self,
+    ) -> Callable[
+        [service.DeleteIdentityAwareProxyClientRequest], Awaitable[empty_pb2.Empty]
+    ]:
+        r"""Return a callable for the delete identity aware proxy
+        client method over gRPC.
+
+        Deletes an Identity Aware Proxy (IAP) OAuth client.
+        Useful for removing obsolete clients, managing the
+        number of clients in a given project, and cleaning up
+        after tests. Requires that the client is owned by IAP.
+
+        Returns:
+            Callable[[~.DeleteIdentityAwareProxyClientRequest],
+                    Awaitable[~.Empty]]:
+                A function that, when called, will call the underlying RPC
+                on the server.
+        """
+        # Generate a "stub function" on-the-fly which will actually make
+        # the request.
+        # gRPC handles serialization and deserialization, so we just need
+        # to pass in the functions for each.
+        if "delete_identity_aware_proxy_client" not in self._stubs:
+            self._stubs[
+                "delete_identity_aware_proxy_client"
+            ] = self.grpc_channel.unary_unary(
+                "/google.cloud.iap.v1.IdentityAwareProxyOAuthService/DeleteIdentityAwareProxyClient",
+                request_serializer=service.DeleteIdentityAwareProxyClientRequest.serialize,
+                response_deserializer=empty_pb2.Empty.FromString,
+            )
+        return self._stubs["delete_identity_aware_proxy_client"]
+
+    def close(self):
+        return self.grpc_channel.close()
+
+
+__all__ = ("IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/rest.py b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/rest.py
new file mode 100644
index 000000000000..2a8f6649f6ef
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/services/identity_aware_proxy_o_auth_service/transports/rest.py
@@ -0,0 +1,1231 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+import dataclasses
+import json  # type: ignore
+import re
+from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple, Union
+import warnings
+
+from google.api_core import gapic_v1, path_template, rest_helpers, rest_streaming
+from google.api_core import exceptions as core_exceptions
+from google.api_core import retry as retries
+from google.auth import credentials as ga_credentials  # type: ignore
+from google.auth.transport.grpc import SslCredentials  # type: ignore
+from google.auth.transport.requests import AuthorizedSession  # type: ignore
+from google.protobuf import json_format
+import grpc  # type: ignore
+from requests import __version__ as requests_version
+
+try:
+    OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault]
+except AttributeError:  # pragma: NO COVER
+    OptionalRetry = Union[retries.Retry, object]  # type: ignore
+
+
+from google.protobuf import empty_pb2  # type: ignore
+
+from google.cloud.iap_v1.types import service
+
+from .base import DEFAULT_CLIENT_INFO as BASE_DEFAULT_CLIENT_INFO
+from .base import IdentityAwareProxyOAuthServiceTransport
+
+DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
+    gapic_version=BASE_DEFAULT_CLIENT_INFO.gapic_version,
+    grpc_version=None,
+    rest_version=requests_version,
+)
+
+
+class IdentityAwareProxyOAuthServiceRestInterceptor:
+    """Interceptor for IdentityAwareProxyOAuthService.
+
+    Interceptors are used to manipulate requests, request metadata, and responses
+    in arbitrary ways.
+    Example use cases include:
+    * Logging
+    * Verifying requests according to service or custom semantics
+    * Stripping extraneous information from responses
+
+    These use cases and more can be enabled by injecting an
+    instance of a custom subclass when constructing the IdentityAwareProxyOAuthServiceRestTransport.
+
+    .. code-block:: python
+        class MyCustomIdentityAwareProxyOAuthServiceInterceptor(IdentityAwareProxyOAuthServiceRestInterceptor):
+            def pre_create_brand(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_create_brand(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_create_identity_aware_proxy_client(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_create_identity_aware_proxy_client(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_delete_identity_aware_proxy_client(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def pre_get_brand(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_get_brand(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_get_identity_aware_proxy_client(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_get_identity_aware_proxy_client(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_list_brands(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_list_brands(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_list_identity_aware_proxy_clients(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_list_identity_aware_proxy_clients(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+            def pre_reset_identity_aware_proxy_client_secret(self, request, metadata):
+                logging.log(f"Received request: {request}")
+                return request, metadata
+
+            def post_reset_identity_aware_proxy_client_secret(self, response):
+                logging.log(f"Received response: {response}")
+                return response
+
+        transport = IdentityAwareProxyOAuthServiceRestTransport(interceptor=MyCustomIdentityAwareProxyOAuthServiceInterceptor())
+        client = IdentityAwareProxyOAuthServiceClient(transport=transport)
+
+
+    """
+
+    def pre_create_brand(
+        self, request: service.CreateBrandRequest, metadata: Sequence[Tuple[str, str]]
+    ) -> Tuple[service.CreateBrandRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for create_brand
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyOAuthService server.
+        """
+        return request, metadata
+
+    def post_create_brand(self, response: service.Brand) -> service.Brand:
+        """Post-rpc interceptor for create_brand
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyOAuthService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_create_identity_aware_proxy_client(
+        self,
+        request: service.CreateIdentityAwareProxyClientRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[
+        service.CreateIdentityAwareProxyClientRequest, Sequence[Tuple[str, str]]
+    ]:
+        """Pre-rpc interceptor for create_identity_aware_proxy_client
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyOAuthService server.
+        """
+        return request, metadata
+
+    def post_create_identity_aware_proxy_client(
+        self, response: service.IdentityAwareProxyClient
+    ) -> service.IdentityAwareProxyClient:
+        """Post-rpc interceptor for create_identity_aware_proxy_client
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyOAuthService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_delete_identity_aware_proxy_client(
+        self,
+        request: service.DeleteIdentityAwareProxyClientRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[
+        service.DeleteIdentityAwareProxyClientRequest, Sequence[Tuple[str, str]]
+    ]:
+        """Pre-rpc interceptor for delete_identity_aware_proxy_client
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyOAuthService server.
+        """
+        return request, metadata
+
+    def pre_get_brand(
+        self, request: service.GetBrandRequest, metadata: Sequence[Tuple[str, str]]
+    ) -> Tuple[service.GetBrandRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for get_brand
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyOAuthService server.
+        """
+        return request, metadata
+
+    def post_get_brand(self, response: service.Brand) -> service.Brand:
+        """Post-rpc interceptor for get_brand
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyOAuthService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_get_identity_aware_proxy_client(
+        self,
+        request: service.GetIdentityAwareProxyClientRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[service.GetIdentityAwareProxyClientRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for get_identity_aware_proxy_client
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyOAuthService server.
+        """
+        return request, metadata
+
+    def post_get_identity_aware_proxy_client(
+        self, response: service.IdentityAwareProxyClient
+    ) -> service.IdentityAwareProxyClient:
+        """Post-rpc interceptor for get_identity_aware_proxy_client
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyOAuthService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_list_brands(
+        self, request: service.ListBrandsRequest, metadata: Sequence[Tuple[str, str]]
+    ) -> Tuple[service.ListBrandsRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for list_brands
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyOAuthService server.
+        """
+        return request, metadata
+
+    def post_list_brands(
+        self, response: service.ListBrandsResponse
+    ) -> service.ListBrandsResponse:
+        """Post-rpc interceptor for list_brands
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyOAuthService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_list_identity_aware_proxy_clients(
+        self,
+        request: service.ListIdentityAwareProxyClientsRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[service.ListIdentityAwareProxyClientsRequest, Sequence[Tuple[str, str]]]:
+        """Pre-rpc interceptor for list_identity_aware_proxy_clients
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyOAuthService server.
+        """
+        return request, metadata
+
+    def post_list_identity_aware_proxy_clients(
+        self, response: service.ListIdentityAwareProxyClientsResponse
+    ) -> service.ListIdentityAwareProxyClientsResponse:
+        """Post-rpc interceptor for list_identity_aware_proxy_clients
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyOAuthService server but before
+        it is returned to user code.
+        """
+        return response
+
+    def pre_reset_identity_aware_proxy_client_secret(
+        self,
+        request: service.ResetIdentityAwareProxyClientSecretRequest,
+        metadata: Sequence[Tuple[str, str]],
+    ) -> Tuple[
+        service.ResetIdentityAwareProxyClientSecretRequest, Sequence[Tuple[str, str]]
+    ]:
+        """Pre-rpc interceptor for reset_identity_aware_proxy_client_secret
+
+        Override in a subclass to manipulate the request or metadata
+        before they are sent to the IdentityAwareProxyOAuthService server.
+        """
+        return request, metadata
+
+    def post_reset_identity_aware_proxy_client_secret(
+        self, response: service.IdentityAwareProxyClient
+    ) -> service.IdentityAwareProxyClient:
+        """Post-rpc interceptor for reset_identity_aware_proxy_client_secret
+
+        Override in a subclass to manipulate the response
+        after it is returned by the IdentityAwareProxyOAuthService server but before
+        it is returned to user code.
+        """
+        return response
+
+
+@dataclasses.dataclass
+class IdentityAwareProxyOAuthServiceRestStub:
+    _session: AuthorizedSession
+    _host: str
+    _interceptor: IdentityAwareProxyOAuthServiceRestInterceptor
+
+
+class IdentityAwareProxyOAuthServiceRestTransport(
+    IdentityAwareProxyOAuthServiceTransport
+):
+    """REST backend transport for IdentityAwareProxyOAuthService.
+
+    API to programmatically create, list and retrieve Identity
+    Aware Proxy (IAP) OAuth brands; and create, retrieve, delete and
+    reset-secret of IAP OAuth clients.
+
+    This class defines the same methods as the primary client, so the
+    primary client can load the underlying transport implementation
+    and call it.
+
+    It sends JSON representations of protocol buffers over HTTP/1.1
+
+    """
+
+    def __init__(
+        self,
+        *,
+        host: str = "iap.googleapis.com",
+        credentials: Optional[ga_credentials.Credentials] = None,
+        credentials_file: Optional[str] = None,
+        scopes: Optional[Sequence[str]] = None,
+        client_cert_source_for_mtls: Optional[Callable[[], Tuple[bytes, bytes]]] = None,
+        quota_project_id: Optional[str] = None,
+        client_info: gapic_v1.client_info.ClientInfo = DEFAULT_CLIENT_INFO,
+        always_use_jwt_access: Optional[bool] = False,
+        url_scheme: str = "https",
+        interceptor: Optional[IdentityAwareProxyOAuthServiceRestInterceptor] = None,
+        api_audience: Optional[str] = None,
+    ) -> None:
+        """Instantiate the transport.
+
+        Args:
+            host (Optional[str]):
+                 The hostname to connect to.
+            credentials (Optional[google.auth.credentials.Credentials]): The
+                authorization credentials to attach to requests. These
+                credentials identify the application to the service; if none
+                are specified, the client will attempt to ascertain the
+                credentials from the environment.
+
+            credentials_file (Optional[str]): A file with credentials that can
+                be loaded with :func:`google.auth.load_credentials_from_file`.
+                This argument is ignored if ``channel`` is provided.
+            scopes (Optional(Sequence[str])): A list of scopes. This argument is
+                ignored if ``channel`` is provided.
+            client_cert_source_for_mtls (Callable[[], Tuple[bytes, bytes]]): Client
+                certificate to configure mutual TLS HTTP channel. It is ignored
+                if ``channel`` is provided.
+            quota_project_id (Optional[str]): An optional project to use for billing
+                and quota.
+            client_info (google.api_core.gapic_v1.client_info.ClientInfo):
+                The client info used to send a user-agent string along with
+                API requests. If ``None``, then default info will be used.
+                Generally, you only need to set this if you are developing
+                your own client library.
+            always_use_jwt_access (Optional[bool]): Whether self signed JWT should
+                be used for service account credentials.
+            url_scheme: the protocol scheme for the API endpoint.  Normally
+                "https", but for testing or local servers,
+                "http" can be specified.
+        """
+        # Run the base constructor
+        # TODO(yon-mg): resolve other ctor params i.e. scopes, quota, etc.
+        # TODO: When custom host (api_endpoint) is set, `scopes` must *also* be set on the
+        # credentials object
+        maybe_url_match = re.match("^(?P<scheme>http(?:s)?://)?(?P<host>.*)$", host)
+        if maybe_url_match is None:
+            raise ValueError(
+                f"Unexpected hostname structure: {host}"
+            )  # pragma: NO COVER
+
+        url_match_items = maybe_url_match.groupdict()
+
+        host = f"{url_scheme}://{host}" if not url_match_items["scheme"] else host
+
+        super().__init__(
+            host=host,
+            credentials=credentials,
+            client_info=client_info,
+            always_use_jwt_access=always_use_jwt_access,
+            api_audience=api_audience,
+        )
+        self._session = AuthorizedSession(
+            self._credentials, default_host=self.DEFAULT_HOST
+        )
+        if client_cert_source_for_mtls:
+            self._session.configure_mtls_channel(client_cert_source_for_mtls)
+        self._interceptor = (
+            interceptor or IdentityAwareProxyOAuthServiceRestInterceptor()
+        )
+        self._prep_wrapped_messages(client_info)
+
+    class _CreateBrand(IdentityAwareProxyOAuthServiceRestStub):
+        def __hash__(self):
+            return hash("CreateBrand")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.CreateBrandRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.Brand:
+            r"""Call the create brand method over HTTP.
+
+            Args:
+                request (~.service.CreateBrandRequest):
+                    The request object. The request sent to CreateBrand.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.service.Brand:
+                    OAuth brand data.
+                NOTE: Only contains a portion of the
+                data that describes a brand.
+
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "post",
+                    "uri": "/v1/{parent=projects/*}/brands",
+                    "body": "brand",
+                },
+            ]
+            request, metadata = self._interceptor.pre_create_brand(request, metadata)
+            pb_request = service.CreateBrandRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            # Jsonify the request body
+
+            body = json_format.MessageToJson(
+                transcoded_request["body"],
+                including_default_value_fields=False,
+                use_integers_for_enums=True,
+            )
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+                data=body,
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.Brand()
+            pb_resp = service.Brand.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_create_brand(resp)
+            return resp
+
+    class _CreateIdentityAwareProxyClient(IdentityAwareProxyOAuthServiceRestStub):
+        def __hash__(self):
+            return hash("CreateIdentityAwareProxyClient")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.CreateIdentityAwareProxyClientRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.IdentityAwareProxyClient:
+            r"""Call the create identity aware
+            proxy client method over HTTP.
+
+                Args:
+                    request (~.service.CreateIdentityAwareProxyClientRequest):
+                        The request object. The request sent to
+                    CreateIdentityAwareProxyClient.
+                    retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                        should be retried.
+                    timeout (float): The timeout for this request.
+                    metadata (Sequence[Tuple[str, str]]): Strings which should be
+                        sent along with the request as metadata.
+
+                Returns:
+                    ~.service.IdentityAwareProxyClient:
+                        Contains the data that describes an
+                    Identity Aware Proxy owned client.
+
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "post",
+                    "uri": "/v1/{parent=projects/*/brands/*}/identityAwareProxyClients",
+                    "body": "identity_aware_proxy_client",
+                },
+            ]
+            (
+                request,
+                metadata,
+            ) = self._interceptor.pre_create_identity_aware_proxy_client(
+                request, metadata
+            )
+            pb_request = service.CreateIdentityAwareProxyClientRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            # Jsonify the request body
+
+            body = json_format.MessageToJson(
+                transcoded_request["body"],
+                including_default_value_fields=False,
+                use_integers_for_enums=True,
+            )
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+                data=body,
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.IdentityAwareProxyClient()
+            pb_resp = service.IdentityAwareProxyClient.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_create_identity_aware_proxy_client(resp)
+            return resp
+
+    class _DeleteIdentityAwareProxyClient(IdentityAwareProxyOAuthServiceRestStub):
+        def __hash__(self):
+            return hash("DeleteIdentityAwareProxyClient")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.DeleteIdentityAwareProxyClientRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ):
+            r"""Call the delete identity aware
+            proxy client method over HTTP.
+
+                Args:
+                    request (~.service.DeleteIdentityAwareProxyClientRequest):
+                        The request object. The request sent to
+                    DeleteIdentityAwareProxyClient.
+                    retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                        should be retried.
+                    timeout (float): The timeout for this request.
+                    metadata (Sequence[Tuple[str, str]]): Strings which should be
+                        sent along with the request as metadata.
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "delete",
+                    "uri": "/v1/{name=projects/*/brands/*/identityAwareProxyClients/*}",
+                },
+            ]
+            (
+                request,
+                metadata,
+            ) = self._interceptor.pre_delete_identity_aware_proxy_client(
+                request, metadata
+            )
+            pb_request = service.DeleteIdentityAwareProxyClientRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+    class _GetBrand(IdentityAwareProxyOAuthServiceRestStub):
+        def __hash__(self):
+            return hash("GetBrand")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.GetBrandRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.Brand:
+            r"""Call the get brand method over HTTP.
+
+            Args:
+                request (~.service.GetBrandRequest):
+                    The request object. The request sent to GetBrand.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.service.Brand:
+                    OAuth brand data.
+                NOTE: Only contains a portion of the
+                data that describes a brand.
+
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "get",
+                    "uri": "/v1/{name=projects/*/brands/*}",
+                },
+            ]
+            request, metadata = self._interceptor.pre_get_brand(request, metadata)
+            pb_request = service.GetBrandRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.Brand()
+            pb_resp = service.Brand.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_get_brand(resp)
+            return resp
+
+    class _GetIdentityAwareProxyClient(IdentityAwareProxyOAuthServiceRestStub):
+        def __hash__(self):
+            return hash("GetIdentityAwareProxyClient")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.GetIdentityAwareProxyClientRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.IdentityAwareProxyClient:
+            r"""Call the get identity aware proxy
+            client method over HTTP.
+
+                Args:
+                    request (~.service.GetIdentityAwareProxyClientRequest):
+                        The request object. The request sent to
+                    GetIdentityAwareProxyClient.
+                    retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                        should be retried.
+                    timeout (float): The timeout for this request.
+                    metadata (Sequence[Tuple[str, str]]): Strings which should be
+                        sent along with the request as metadata.
+
+                Returns:
+                    ~.service.IdentityAwareProxyClient:
+                        Contains the data that describes an
+                    Identity Aware Proxy owned client.
+
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "get",
+                    "uri": "/v1/{name=projects/*/brands/*/identityAwareProxyClients/*}",
+                },
+            ]
+            request, metadata = self._interceptor.pre_get_identity_aware_proxy_client(
+                request, metadata
+            )
+            pb_request = service.GetIdentityAwareProxyClientRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.IdentityAwareProxyClient()
+            pb_resp = service.IdentityAwareProxyClient.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_get_identity_aware_proxy_client(resp)
+            return resp
+
+    class _ListBrands(IdentityAwareProxyOAuthServiceRestStub):
+        def __hash__(self):
+            return hash("ListBrands")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.ListBrandsRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.ListBrandsResponse:
+            r"""Call the list brands method over HTTP.
+
+            Args:
+                request (~.service.ListBrandsRequest):
+                    The request object. The request sent to ListBrands.
+                retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                    should be retried.
+                timeout (float): The timeout for this request.
+                metadata (Sequence[Tuple[str, str]]): Strings which should be
+                    sent along with the request as metadata.
+
+            Returns:
+                ~.service.ListBrandsResponse:
+                    Response message for ListBrands.
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "get",
+                    "uri": "/v1/{parent=projects/*}/brands",
+                },
+            ]
+            request, metadata = self._interceptor.pre_list_brands(request, metadata)
+            pb_request = service.ListBrandsRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.ListBrandsResponse()
+            pb_resp = service.ListBrandsResponse.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_list_brands(resp)
+            return resp
+
+    class _ListIdentityAwareProxyClients(IdentityAwareProxyOAuthServiceRestStub):
+        def __hash__(self):
+            return hash("ListIdentityAwareProxyClients")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.ListIdentityAwareProxyClientsRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.ListIdentityAwareProxyClientsResponse:
+            r"""Call the list identity aware proxy
+            clients method over HTTP.
+
+                Args:
+                    request (~.service.ListIdentityAwareProxyClientsRequest):
+                        The request object. The request sent to
+                    ListIdentityAwareProxyClients.
+                    retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                        should be retried.
+                    timeout (float): The timeout for this request.
+                    metadata (Sequence[Tuple[str, str]]): Strings which should be
+                        sent along with the request as metadata.
+
+                Returns:
+                    ~.service.ListIdentityAwareProxyClientsResponse:
+                        Response message for
+                    ListIdentityAwareProxyClients.
+
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "get",
+                    "uri": "/v1/{parent=projects/*/brands/*}/identityAwareProxyClients",
+                },
+            ]
+            request, metadata = self._interceptor.pre_list_identity_aware_proxy_clients(
+                request, metadata
+            )
+            pb_request = service.ListIdentityAwareProxyClientsRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.ListIdentityAwareProxyClientsResponse()
+            pb_resp = service.ListIdentityAwareProxyClientsResponse.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_list_identity_aware_proxy_clients(resp)
+            return resp
+
+    class _ResetIdentityAwareProxyClientSecret(IdentityAwareProxyOAuthServiceRestStub):
+        def __hash__(self):
+            return hash("ResetIdentityAwareProxyClientSecret")
+
+        __REQUIRED_FIELDS_DEFAULT_VALUES: Dict[str, Any] = {}
+
+        @classmethod
+        def _get_unset_required_fields(cls, message_dict):
+            return {
+                k: v
+                for k, v in cls.__REQUIRED_FIELDS_DEFAULT_VALUES.items()
+                if k not in message_dict
+            }
+
+        def __call__(
+            self,
+            request: service.ResetIdentityAwareProxyClientSecretRequest,
+            *,
+            retry: OptionalRetry = gapic_v1.method.DEFAULT,
+            timeout: Optional[float] = None,
+            metadata: Sequence[Tuple[str, str]] = (),
+        ) -> service.IdentityAwareProxyClient:
+            r"""Call the reset identity aware
+            proxy client secret method over HTTP.
+
+                Args:
+                    request (~.service.ResetIdentityAwareProxyClientSecretRequest):
+                        The request object. The request sent to
+                    ResetIdentityAwareProxyClientSecret.
+                    retry (google.api_core.retry.Retry): Designation of what errors, if any,
+                        should be retried.
+                    timeout (float): The timeout for this request.
+                    metadata (Sequence[Tuple[str, str]]): Strings which should be
+                        sent along with the request as metadata.
+
+                Returns:
+                    ~.service.IdentityAwareProxyClient:
+                        Contains the data that describes an
+                    Identity Aware Proxy owned client.
+
+            """
+
+            http_options: List[Dict[str, str]] = [
+                {
+                    "method": "post",
+                    "uri": "/v1/{name=projects/*/brands/*/identityAwareProxyClients/*}:resetSecret",
+                    "body": "*",
+                },
+            ]
+            (
+                request,
+                metadata,
+            ) = self._interceptor.pre_reset_identity_aware_proxy_client_secret(
+                request, metadata
+            )
+            pb_request = service.ResetIdentityAwareProxyClientSecretRequest.pb(request)
+            transcoded_request = path_template.transcode(http_options, pb_request)
+
+            # Jsonify the request body
+
+            body = json_format.MessageToJson(
+                transcoded_request["body"],
+                including_default_value_fields=False,
+                use_integers_for_enums=True,
+            )
+            uri = transcoded_request["uri"]
+            method = transcoded_request["method"]
+
+            # Jsonify the query params
+            query_params = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    including_default_value_fields=False,
+                    use_integers_for_enums=True,
+                )
+            )
+            query_params.update(self._get_unset_required_fields(query_params))
+
+            query_params["$alt"] = "json;enum-encoding=int"
+
+            # Send the request
+            headers = dict(metadata)
+            headers["Content-Type"] = "application/json"
+            response = getattr(self._session, method)(
+                "{host}{uri}".format(host=self._host, uri=uri),
+                timeout=timeout,
+                headers=headers,
+                params=rest_helpers.flatten_query_params(query_params, strict=True),
+                data=body,
+            )
+
+            # In case of error, raise the appropriate core_exceptions.GoogleAPICallError exception
+            # subclass.
+            if response.status_code >= 400:
+                raise core_exceptions.from_http_response(response)
+
+            # Return the response
+            resp = service.IdentityAwareProxyClient()
+            pb_resp = service.IdentityAwareProxyClient.pb(resp)
+
+            json_format.Parse(response.content, pb_resp, ignore_unknown_fields=True)
+            resp = self._interceptor.post_reset_identity_aware_proxy_client_secret(resp)
+            return resp
+
+    @property
+    def create_brand(self) -> Callable[[service.CreateBrandRequest], service.Brand]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._CreateBrand(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def create_identity_aware_proxy_client(
+        self,
+    ) -> Callable[
+        [service.CreateIdentityAwareProxyClientRequest],
+        service.IdentityAwareProxyClient,
+    ]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._CreateIdentityAwareProxyClient(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def delete_identity_aware_proxy_client(
+        self,
+    ) -> Callable[[service.DeleteIdentityAwareProxyClientRequest], empty_pb2.Empty]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._DeleteIdentityAwareProxyClient(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def get_brand(self) -> Callable[[service.GetBrandRequest], service.Brand]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._GetBrand(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def get_identity_aware_proxy_client(
+        self,
+    ) -> Callable[
+        [service.GetIdentityAwareProxyClientRequest], service.IdentityAwareProxyClient
+    ]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._GetIdentityAwareProxyClient(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def list_brands(
+        self,
+    ) -> Callable[[service.ListBrandsRequest], service.ListBrandsResponse]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._ListBrands(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def list_identity_aware_proxy_clients(
+        self,
+    ) -> Callable[
+        [service.ListIdentityAwareProxyClientsRequest],
+        service.ListIdentityAwareProxyClientsResponse,
+    ]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._ListIdentityAwareProxyClients(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def reset_identity_aware_proxy_client_secret(
+        self,
+    ) -> Callable[
+        [service.ResetIdentityAwareProxyClientSecretRequest],
+        service.IdentityAwareProxyClient,
+    ]:
+        # The return type is fine, but mypy isn't sophisticated enough to determine what's going on here.
+        # In C++ this would require a dynamic_cast
+        return self._ResetIdentityAwareProxyClientSecret(self._session, self._host, self._interceptor)  # type: ignore
+
+    @property
+    def kind(self) -> str:
+        return "rest"
+
+    def close(self):
+        self._session.close()
+
+
+__all__ = ("IdentityAwareProxyOAuthServiceRestTransport",)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/types/__init__.py b/packages/google-cloud-iap/google/cloud/iap_v1/types/__init__.py
new file mode 100644
index 000000000000..c7006a4f91a3
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/types/__init__.py
@@ -0,0 +1,84 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from .service import (
+    AccessDeniedPageSettings,
+    AccessSettings,
+    AllowedDomainsSettings,
+    ApplicationSettings,
+    AttributePropagationSettings,
+    Brand,
+    CorsSettings,
+    CreateBrandRequest,
+    CreateIdentityAwareProxyClientRequest,
+    CreateTunnelDestGroupRequest,
+    CsmSettings,
+    DeleteIdentityAwareProxyClientRequest,
+    DeleteTunnelDestGroupRequest,
+    GcipSettings,
+    GetBrandRequest,
+    GetIapSettingsRequest,
+    GetIdentityAwareProxyClientRequest,
+    GetTunnelDestGroupRequest,
+    IapSettings,
+    IdentityAwareProxyClient,
+    ListBrandsRequest,
+    ListBrandsResponse,
+    ListIdentityAwareProxyClientsRequest,
+    ListIdentityAwareProxyClientsResponse,
+    ListTunnelDestGroupsRequest,
+    ListTunnelDestGroupsResponse,
+    OAuthSettings,
+    ReauthSettings,
+    ResetIdentityAwareProxyClientSecretRequest,
+    TunnelDestGroup,
+    UpdateIapSettingsRequest,
+    UpdateTunnelDestGroupRequest,
+)
+
+__all__ = (
+    "AccessDeniedPageSettings",
+    "AccessSettings",
+    "AllowedDomainsSettings",
+    "ApplicationSettings",
+    "AttributePropagationSettings",
+    "Brand",
+    "CorsSettings",
+    "CreateBrandRequest",
+    "CreateIdentityAwareProxyClientRequest",
+    "CreateTunnelDestGroupRequest",
+    "CsmSettings",
+    "DeleteIdentityAwareProxyClientRequest",
+    "DeleteTunnelDestGroupRequest",
+    "GcipSettings",
+    "GetBrandRequest",
+    "GetIapSettingsRequest",
+    "GetIdentityAwareProxyClientRequest",
+    "GetTunnelDestGroupRequest",
+    "IapSettings",
+    "IdentityAwareProxyClient",
+    "ListBrandsRequest",
+    "ListBrandsResponse",
+    "ListIdentityAwareProxyClientsRequest",
+    "ListIdentityAwareProxyClientsResponse",
+    "ListTunnelDestGroupsRequest",
+    "ListTunnelDestGroupsResponse",
+    "OAuthSettings",
+    "ReauthSettings",
+    "ResetIdentityAwareProxyClientSecretRequest",
+    "TunnelDestGroup",
+    "UpdateIapSettingsRequest",
+    "UpdateTunnelDestGroupRequest",
+)
diff --git a/packages/google-cloud-iap/google/cloud/iap_v1/types/service.py b/packages/google-cloud-iap/google/cloud/iap_v1/types/service.py
new file mode 100644
index 000000000000..c4357bcaa077
--- /dev/null
+++ b/packages/google-cloud-iap/google/cloud/iap_v1/types/service.py
@@ -0,0 +1,1030 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+from __future__ import annotations
+
+from typing import MutableMapping, MutableSequence
+
+from google.protobuf import duration_pb2  # type: ignore
+from google.protobuf import field_mask_pb2  # type: ignore
+from google.protobuf import wrappers_pb2  # type: ignore
+import proto  # type: ignore
+
+__protobuf__ = proto.module(
+    package="google.cloud.iap.v1",
+    manifest={
+        "ListTunnelDestGroupsRequest",
+        "ListTunnelDestGroupsResponse",
+        "CreateTunnelDestGroupRequest",
+        "GetTunnelDestGroupRequest",
+        "DeleteTunnelDestGroupRequest",
+        "UpdateTunnelDestGroupRequest",
+        "TunnelDestGroup",
+        "GetIapSettingsRequest",
+        "UpdateIapSettingsRequest",
+        "IapSettings",
+        "AccessSettings",
+        "GcipSettings",
+        "CorsSettings",
+        "OAuthSettings",
+        "ReauthSettings",
+        "AllowedDomainsSettings",
+        "ApplicationSettings",
+        "CsmSettings",
+        "AccessDeniedPageSettings",
+        "AttributePropagationSettings",
+        "ListBrandsRequest",
+        "ListBrandsResponse",
+        "CreateBrandRequest",
+        "GetBrandRequest",
+        "ListIdentityAwareProxyClientsRequest",
+        "ListIdentityAwareProxyClientsResponse",
+        "CreateIdentityAwareProxyClientRequest",
+        "GetIdentityAwareProxyClientRequest",
+        "ResetIdentityAwareProxyClientSecretRequest",
+        "DeleteIdentityAwareProxyClientRequest",
+        "Brand",
+        "IdentityAwareProxyClient",
+    },
+)
+
+
+class ListTunnelDestGroupsRequest(proto.Message):
+    r"""The request to ListTunnelDestGroups.
+
+    Attributes:
+        parent (str):
+            Required. Google Cloud Project ID and location. In the
+            following format:
+            ``projects/{project_number/id}/iap_tunnel/locations/{location}``.
+            A ``-`` can be used for the location to group across all
+            locations.
+        page_size (int):
+            The maximum number of groups to return. The
+            service might return fewer than this value.
+            If unspecified, at most 100 groups are returned.
+            The maximum value is 1000; values above 1000 are
+            coerced to 1000.
+        page_token (str):
+            A page token, received from a previous
+            ``ListTunnelDestGroups`` call. Provide this to retrieve the
+            subsequent page.
+
+            When paginating, all other parameters provided to
+            ``ListTunnelDestGroups`` must match the call that provided
+            the page token.
+    """
+
+    parent: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+    page_size: int = proto.Field(
+        proto.INT32,
+        number=2,
+    )
+    page_token: str = proto.Field(
+        proto.STRING,
+        number=3,
+    )
+
+
+class ListTunnelDestGroupsResponse(proto.Message):
+    r"""The response from ListTunnelDestGroups.
+
+    Attributes:
+        tunnel_dest_groups (MutableSequence[google.cloud.iap_v1.types.TunnelDestGroup]):
+            TunnelDestGroup existing in the project.
+        next_page_token (str):
+            A token that you can send as ``page_token`` to retrieve the
+            next page. If this field is omitted, there are no subsequent
+            pages.
+    """
+
+    @property
+    def raw_page(self):
+        return self
+
+    tunnel_dest_groups: MutableSequence["TunnelDestGroup"] = proto.RepeatedField(
+        proto.MESSAGE,
+        number=1,
+        message="TunnelDestGroup",
+    )
+    next_page_token: str = proto.Field(
+        proto.STRING,
+        number=2,
+    )
+
+
+class CreateTunnelDestGroupRequest(proto.Message):
+    r"""The request to CreateTunnelDestGroup.
+
+    Attributes:
+        parent (str):
+            Required. Google Cloud Project ID and location. In the
+            following format:
+            ``projects/{project_number/id}/iap_tunnel/locations/{location}``.
+        tunnel_dest_group (google.cloud.iap_v1.types.TunnelDestGroup):
+            Required. The TunnelDestGroup to create.
+        tunnel_dest_group_id (str):
+            Required. The ID to use for the TunnelDestGroup, which
+            becomes the final component of the resource name.
+
+            This value must be 4-63 characters, and valid characters are
+            ``[a-z]-``.
+    """
+
+    parent: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+    tunnel_dest_group: "TunnelDestGroup" = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message="TunnelDestGroup",
+    )
+    tunnel_dest_group_id: str = proto.Field(
+        proto.STRING,
+        number=3,
+    )
+
+
+class GetTunnelDestGroupRequest(proto.Message):
+    r"""The request to GetTunnelDestGroup.
+
+    Attributes:
+        name (str):
+            Required. Name of the TunnelDestGroup to be fetched. In the
+            following format:
+            ``projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}``.
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+
+
+class DeleteTunnelDestGroupRequest(proto.Message):
+    r"""The request to DeleteTunnelDestGroup.
+
+    Attributes:
+        name (str):
+            Required. Name of the TunnelDestGroup to delete. In the
+            following format:
+            ``projects/{project_number/id}/iap_tunnel/locations/{location}/destGroups/{dest_group}``.
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+
+
+class UpdateTunnelDestGroupRequest(proto.Message):
+    r"""The request to UpdateTunnelDestGroup.
+
+    Attributes:
+        tunnel_dest_group (google.cloud.iap_v1.types.TunnelDestGroup):
+            Required. The new values for the
+            TunnelDestGroup.
+        update_mask (google.protobuf.field_mask_pb2.FieldMask):
+            A field mask that specifies which IAP
+            settings to update. If omitted, then all of the
+            settings are updated. See
+            https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask
+    """
+
+    tunnel_dest_group: "TunnelDestGroup" = proto.Field(
+        proto.MESSAGE,
+        number=1,
+        message="TunnelDestGroup",
+    )
+    update_mask: field_mask_pb2.FieldMask = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message=field_mask_pb2.FieldMask,
+    )
+
+
+class TunnelDestGroup(proto.Message):
+    r"""A TunnelDestGroup.
+
+    Attributes:
+        name (str):
+            Required. Immutable. Identifier for the
+            TunnelDestGroup. Must be unique within the
+            project and contain only lower case letters
+            (a-z) and dashes (-).
+        cidrs (MutableSequence[str]):
+            Unordered list. List of CIDRs that this group
+            applies to.
+        fqdns (MutableSequence[str]):
+            Unordered list. List of FQDNs that this group
+            applies to.
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+    cidrs: MutableSequence[str] = proto.RepeatedField(
+        proto.STRING,
+        number=2,
+    )
+    fqdns: MutableSequence[str] = proto.RepeatedField(
+        proto.STRING,
+        number=3,
+    )
+
+
+class GetIapSettingsRequest(proto.Message):
+    r"""The request sent to GetIapSettings.
+
+    Attributes:
+        name (str):
+            Required. The resource name for which to retrieve the
+            settings. Authorization: Requires the ``getSettings``
+            permission for the associated resource.
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+
+
+class UpdateIapSettingsRequest(proto.Message):
+    r"""The request sent to UpdateIapSettings.
+
+    Attributes:
+        iap_settings (google.cloud.iap_v1.types.IapSettings):
+            Required. The new values for the IAP settings to be updated.
+            Authorization: Requires the ``updateSettings`` permission
+            for the associated resource.
+        update_mask (google.protobuf.field_mask_pb2.FieldMask):
+            The field mask specifying which IAP settings should be
+            updated. If omitted, then all of the settings are updated.
+            See
+            https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask.
+
+            Note: All IAP reauth settings must always be set together,
+            using the field mask:
+            ``iapSettings.accessSettings.reauthSettings``.
+    """
+
+    iap_settings: "IapSettings" = proto.Field(
+        proto.MESSAGE,
+        number=1,
+        message="IapSettings",
+    )
+    update_mask: field_mask_pb2.FieldMask = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message=field_mask_pb2.FieldMask,
+    )
+
+
+class IapSettings(proto.Message):
+    r"""The IAP configurable settings.
+
+    Attributes:
+        name (str):
+            Required. The resource name of the IAP
+            protected resource.
+        access_settings (google.cloud.iap_v1.types.AccessSettings):
+            Top level wrapper for all access related
+            setting in IAP
+        application_settings (google.cloud.iap_v1.types.ApplicationSettings):
+            Top level wrapper for all application related
+            settings in IAP
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+    access_settings: "AccessSettings" = proto.Field(
+        proto.MESSAGE,
+        number=5,
+        message="AccessSettings",
+    )
+    application_settings: "ApplicationSettings" = proto.Field(
+        proto.MESSAGE,
+        number=6,
+        message="ApplicationSettings",
+    )
+
+
+class AccessSettings(proto.Message):
+    r"""Access related settings for IAP protected apps.
+
+    Attributes:
+        gcip_settings (google.cloud.iap_v1.types.GcipSettings):
+            GCIP claims and endpoint configurations for
+            3p identity providers.
+        cors_settings (google.cloud.iap_v1.types.CorsSettings):
+            Configuration to allow cross-origin requests
+            via IAP.
+        oauth_settings (google.cloud.iap_v1.types.OAuthSettings):
+            Settings to configure IAP's OAuth behavior.
+        reauth_settings (google.cloud.iap_v1.types.ReauthSettings):
+            Settings to configure reauthentication
+            policies in IAP.
+        allowed_domains_settings (google.cloud.iap_v1.types.AllowedDomainsSettings):
+            Settings to configure and enable allowed
+            domains.
+    """
+
+    gcip_settings: "GcipSettings" = proto.Field(
+        proto.MESSAGE,
+        number=1,
+        message="GcipSettings",
+    )
+    cors_settings: "CorsSettings" = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message="CorsSettings",
+    )
+    oauth_settings: "OAuthSettings" = proto.Field(
+        proto.MESSAGE,
+        number=3,
+        message="OAuthSettings",
+    )
+    reauth_settings: "ReauthSettings" = proto.Field(
+        proto.MESSAGE,
+        number=6,
+        message="ReauthSettings",
+    )
+    allowed_domains_settings: "AllowedDomainsSettings" = proto.Field(
+        proto.MESSAGE,
+        number=7,
+        message="AllowedDomainsSettings",
+    )
+
+
+class GcipSettings(proto.Message):
+    r"""Allows customers to configure tenant_id for GCIP instance per-app.
+
+    Attributes:
+        tenant_ids (MutableSequence[str]):
+            GCIP tenant ids that are linked to the IAP resource.
+            tenant_ids could be a string beginning with a number
+            character to indicate authenticating with GCIP tenant flow,
+            or in the format of \_ to indicate authenticating with GCIP
+            agent flow. If agent flow is used, tenant_ids should only
+            contain one single element, while for tenant flow,
+            tenant_ids can contain multiple elements.
+        login_page_uri (google.protobuf.wrappers_pb2.StringValue):
+            Login page URI associated with the GCIP
+            tenants. Typically, all resources within the
+            same project share the same login page, though
+            it could be overridden at the sub resource
+            level.
+    """
+
+    tenant_ids: MutableSequence[str] = proto.RepeatedField(
+        proto.STRING,
+        number=1,
+    )
+    login_page_uri: wrappers_pb2.StringValue = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message=wrappers_pb2.StringValue,
+    )
+
+
+class CorsSettings(proto.Message):
+    r"""Allows customers to configure HTTP request paths that'll
+    allow HTTP OPTIONS call to bypass authentication and
+    authorization.
+
+    Attributes:
+        allow_http_options (google.protobuf.wrappers_pb2.BoolValue):
+            Configuration to allow HTTP OPTIONS calls to
+            skip authorization. If undefined, IAP will not
+            apply any special logic to OPTIONS requests.
+    """
+
+    allow_http_options: wrappers_pb2.BoolValue = proto.Field(
+        proto.MESSAGE,
+        number=1,
+        message=wrappers_pb2.BoolValue,
+    )
+
+
+class OAuthSettings(proto.Message):
+    r"""Configuration for OAuth login&consent flow behavior as well
+    as for OAuth Credentials.
+
+    Attributes:
+        login_hint (google.protobuf.wrappers_pb2.StringValue):
+            Domain hint to send as hd=? parameter in
+            OAuth request flow. Enables redirect to primary
+            IDP by skipping Google's login screen.
+            https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
+            Note: IAP does not verify that the id token's hd
+            claim matches this value since access behavior
+            is managed by IAM policies.
+    """
+
+    login_hint: wrappers_pb2.StringValue = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message=wrappers_pb2.StringValue,
+    )
+
+
+class ReauthSettings(proto.Message):
+    r"""Configuration for IAP reauthentication policies.
+
+    Attributes:
+        method (google.cloud.iap_v1.types.ReauthSettings.Method):
+            Reauth method requested.
+        max_age (google.protobuf.duration_pb2.Duration):
+            Reauth session lifetime, how long before a
+            user has to reauthenticate again.
+        policy_type (google.cloud.iap_v1.types.ReauthSettings.PolicyType):
+            How IAP determines the effective policy in
+            cases of hierarchial policies. Policies are
+            merged from higher in the hierarchy to lower in
+            the hierarchy.
+    """
+
+    class Method(proto.Enum):
+        r"""Types of reauthentication methods supported by IAP.
+
+        Values:
+            METHOD_UNSPECIFIED (0):
+                Reauthentication disabled.
+            LOGIN (1):
+                Prompts the user to log in again.
+            PASSWORD (2):
+                No description available.
+            SECURE_KEY (3):
+                User must use their secure key 2nd factor
+                device.
+            ENROLLED_SECOND_FACTORS (4):
+                User can use any enabled 2nd factor.
+        """
+        METHOD_UNSPECIFIED = 0
+        LOGIN = 1
+        PASSWORD = 2
+        SECURE_KEY = 3
+        ENROLLED_SECOND_FACTORS = 4
+
+    class PolicyType(proto.Enum):
+        r"""Type of policy in the case of hierarchial policies.
+
+        Values:
+            POLICY_TYPE_UNSPECIFIED (0):
+                Default value. This value is unused.
+            MINIMUM (1):
+                This policy acts as a minimum to other
+                policies, lower in the hierarchy. Effective
+                policy may only be the same or stricter.
+            DEFAULT (2):
+                This policy acts as a default if no other
+                reauth policy is set.
+        """
+        POLICY_TYPE_UNSPECIFIED = 0
+        MINIMUM = 1
+        DEFAULT = 2
+
+    method: Method = proto.Field(
+        proto.ENUM,
+        number=1,
+        enum=Method,
+    )
+    max_age: duration_pb2.Duration = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message=duration_pb2.Duration,
+    )
+    policy_type: PolicyType = proto.Field(
+        proto.ENUM,
+        number=3,
+        enum=PolicyType,
+    )
+
+
+class AllowedDomainsSettings(proto.Message):
+    r"""Configuration for IAP allowed domains. Lets you to restrict
+    access to an app and allow access to only the domains that you
+    list.
+
+
+    .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields
+
+    Attributes:
+        enable (bool):
+            Configuration for customers to opt in for the
+            feature.
+
+            This field is a member of `oneof`_ ``_enable``.
+        domains (MutableSequence[str]):
+            List of trusted domains.
+    """
+
+    enable: bool = proto.Field(
+        proto.BOOL,
+        number=1,
+        optional=True,
+    )
+    domains: MutableSequence[str] = proto.RepeatedField(
+        proto.STRING,
+        number=2,
+    )
+
+
+class ApplicationSettings(proto.Message):
+    r"""Wrapper over application specific settings for IAP.
+
+    Attributes:
+        csm_settings (google.cloud.iap_v1.types.CsmSettings):
+            Settings to configure IAP's behavior for a
+            service mesh.
+        access_denied_page_settings (google.cloud.iap_v1.types.AccessDeniedPageSettings):
+            Customization for Access Denied page.
+        cookie_domain (google.protobuf.wrappers_pb2.StringValue):
+            The Domain value to set for cookies generated
+            by IAP. This value is not validated by the API,
+            but will be ignored at runtime if invalid.
+        attribute_propagation_settings (google.cloud.iap_v1.types.AttributePropagationSettings):
+            Settings to configure attribute propagation.
+    """
+
+    csm_settings: "CsmSettings" = proto.Field(
+        proto.MESSAGE,
+        number=1,
+        message="CsmSettings",
+    )
+    access_denied_page_settings: "AccessDeniedPageSettings" = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message="AccessDeniedPageSettings",
+    )
+    cookie_domain: wrappers_pb2.StringValue = proto.Field(
+        proto.MESSAGE,
+        number=3,
+        message=wrappers_pb2.StringValue,
+    )
+    attribute_propagation_settings: "AttributePropagationSettings" = proto.Field(
+        proto.MESSAGE,
+        number=4,
+        message="AttributePropagationSettings",
+    )
+
+
+class CsmSettings(proto.Message):
+    r"""Configuration for RCToken generated for service mesh
+    workloads protected by IAP. RCToken are IAP generated JWTs that
+    can be verified at the application. The RCToken is primarily
+    used for service mesh deployments, and can be scoped to a single
+    mesh by configuring the audience field accordingly.
+
+    Attributes:
+        rctoken_aud (google.protobuf.wrappers_pb2.StringValue):
+            Audience claim set in the generated RCToken.
+            This value is not validated by IAP.
+    """
+
+    rctoken_aud: wrappers_pb2.StringValue = proto.Field(
+        proto.MESSAGE,
+        number=1,
+        message=wrappers_pb2.StringValue,
+    )
+
+
+class AccessDeniedPageSettings(proto.Message):
+    r"""Custom content configuration for access denied page.
+    IAP allows customers to define a custom URI to use as the error
+    page when access is denied to users. If IAP prevents access to
+    this page, the default IAP error page will be displayed instead.
+
+
+    .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields
+
+    Attributes:
+        access_denied_page_uri (google.protobuf.wrappers_pb2.StringValue):
+            The URI to be redirected to when access is
+            denied.
+        generate_troubleshooting_uri (google.protobuf.wrappers_pb2.BoolValue):
+            Whether to generate a troubleshooting URL on
+            access denied events to this application.
+        remediation_token_generation_enabled (google.protobuf.wrappers_pb2.BoolValue):
+            Whether to generate remediation token on
+            access denied events to this application.
+
+            This field is a member of `oneof`_ ``_remediation_token_generation_enabled``.
+    """
+
+    access_denied_page_uri: wrappers_pb2.StringValue = proto.Field(
+        proto.MESSAGE,
+        number=1,
+        message=wrappers_pb2.StringValue,
+    )
+    generate_troubleshooting_uri: wrappers_pb2.BoolValue = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message=wrappers_pb2.BoolValue,
+    )
+    remediation_token_generation_enabled: wrappers_pb2.BoolValue = proto.Field(
+        proto.MESSAGE,
+        number=3,
+        optional=True,
+        message=wrappers_pb2.BoolValue,
+    )
+
+
+class AttributePropagationSettings(proto.Message):
+    r"""Configuration for propagating attributes to applications
+    protected by IAP.
+
+
+    .. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields
+
+    Attributes:
+        expression (str):
+            Raw string CEL expression. Must return a list of attributes.
+            A maximum of 45 attributes can be selected. Expressions can
+            select different attribute types from ``attributes``:
+            ``attributes.saml_attributes``,
+            ``attributes.iap_attributes``. The following functions are
+            supported:
+
+            -  filter ``<list>.filter(<iter_var>, <predicate>)``:
+               Returns a subset of ``<list>`` where ``<predicate>`` is
+               true for every item.
+
+            -  in ``<var> in <list>``: Returns true if ``<list>``
+               contains ``<var>``.
+
+            -  selectByName ``<list>.selectByName(<string>)``: Returns
+               the attribute in ``<list>`` with the given ``<string>``
+               name, otherwise returns empty.
+
+            -  emitAs ``<attribute>.emitAs(<string>)``: Sets the
+               ``<attribute>`` name field to the given ``<string>`` for
+               propagation in selected output credentials.
+
+            -  strict ``<attribute>.strict()``: Ignores the
+               ``x-goog-iap-attr-`` prefix for the provided
+               ``<attribute>`` when propagating with the ``HEADER``
+               output credential, such as request headers.
+
+            -  append ``<target_list>.append(<attribute>)`` OR
+               ``<target_list>.append(<list>)``: Appends the provided
+               ``<attribute>`` or ``<list>`` to the end of
+               ``<target_list>``.
+
+            Example expression:
+            ``attributes.saml_attributes.filter(x, x.name in ['test']).append(attributes.iap_attributes.selectByName('exact').emitAs('custom').strict())``
+
+            This field is a member of `oneof`_ ``_expression``.
+        output_credentials (MutableSequence[google.cloud.iap_v1.types.AttributePropagationSettings.OutputCredentials]):
+            Which output credentials attributes selected
+            by the CEL expression should be propagated in.
+            All attributes will be fully duplicated in each
+            selected output credential.
+        enable (bool):
+            Whether the provided attribute propagation
+            settings should be evaluated on user requests.
+            If set to true, attributes returned from the
+            expression will be propagated in the set output
+            credentials.
+
+            This field is a member of `oneof`_ ``_enable``.
+    """
+
+    class OutputCredentials(proto.Enum):
+        r"""Supported output credentials for attribute propagation. Each
+        output credential maps to a "field" in the response. For
+        example, selecting JWT will propagate all attributes in the IAP
+        JWT, header in the headers, etc.
+
+        Values:
+            OUTPUT_CREDENTIALS_UNSPECIFIED (0):
+                An output credential is required.
+            HEADER (1):
+                Propagate attributes in the headers with
+                "x-goog-iap-attr-" prefix.
+            JWT (2):
+                Propagate attributes in the JWT of the form:
+                ``"additional_claims": { "my_attribute": ["value1", "value2"] }``
+            RCTOKEN (3):
+                Propagate attributes in the RCToken of the form:
+                ``"additional_claims": { "my_attribute": ["value1", "value2"] }``
+        """
+        OUTPUT_CREDENTIALS_UNSPECIFIED = 0
+        HEADER = 1
+        JWT = 2
+        RCTOKEN = 3
+
+    expression: str = proto.Field(
+        proto.STRING,
+        number=1,
+        optional=True,
+    )
+    output_credentials: MutableSequence[OutputCredentials] = proto.RepeatedField(
+        proto.ENUM,
+        number=2,
+        enum=OutputCredentials,
+    )
+    enable: bool = proto.Field(
+        proto.BOOL,
+        number=3,
+        optional=True,
+    )
+
+
+class ListBrandsRequest(proto.Message):
+    r"""The request sent to ListBrands.
+
+    Attributes:
+        parent (str):
+            Required. GCP Project number/id. In the following format:
+            projects/{project_number/id}.
+    """
+
+    parent: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+
+
+class ListBrandsResponse(proto.Message):
+    r"""Response message for ListBrands.
+
+    Attributes:
+        brands (MutableSequence[google.cloud.iap_v1.types.Brand]):
+            Brands existing in the project.
+    """
+
+    brands: MutableSequence["Brand"] = proto.RepeatedField(
+        proto.MESSAGE,
+        number=1,
+        message="Brand",
+    )
+
+
+class CreateBrandRequest(proto.Message):
+    r"""The request sent to CreateBrand.
+
+    Attributes:
+        parent (str):
+            Required. GCP Project number/id under which the brand is to
+            be created. In the following format:
+            projects/{project_number/id}.
+        brand (google.cloud.iap_v1.types.Brand):
+            Required. The brand to be created.
+    """
+
+    parent: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+    brand: "Brand" = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message="Brand",
+    )
+
+
+class GetBrandRequest(proto.Message):
+    r"""The request sent to GetBrand.
+
+    Attributes:
+        name (str):
+            Required. Name of the brand to be fetched. In the following
+            format: projects/{project_number/id}/brands/{brand}.
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+
+
+class ListIdentityAwareProxyClientsRequest(proto.Message):
+    r"""The request sent to ListIdentityAwareProxyClients.
+
+    Attributes:
+        parent (str):
+            Required. Full brand path. In the following format:
+            projects/{project_number/id}/brands/{brand}.
+        page_size (int):
+            The maximum number of clients to return. The
+            service may return fewer than this value.
+            If unspecified, at most 100 clients will be
+            returned. The maximum value is 1000; values
+            above 1000 will be coerced to 1000.
+        page_token (str):
+            A page token, received from a previous
+            ``ListIdentityAwareProxyClients`` call. Provide this to
+            retrieve the subsequent page.
+
+            When paginating, all other parameters provided to
+            ``ListIdentityAwareProxyClients`` must match the call that
+            provided the page token.
+    """
+
+    parent: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+    page_size: int = proto.Field(
+        proto.INT32,
+        number=2,
+    )
+    page_token: str = proto.Field(
+        proto.STRING,
+        number=3,
+    )
+
+
+class ListIdentityAwareProxyClientsResponse(proto.Message):
+    r"""Response message for ListIdentityAwareProxyClients.
+
+    Attributes:
+        identity_aware_proxy_clients (MutableSequence[google.cloud.iap_v1.types.IdentityAwareProxyClient]):
+            Clients existing in the brand.
+        next_page_token (str):
+            A token, which can be send as ``page_token`` to retrieve the
+            next page. If this field is omitted, there are no subsequent
+            pages.
+    """
+
+    @property
+    def raw_page(self):
+        return self
+
+    identity_aware_proxy_clients: MutableSequence[
+        "IdentityAwareProxyClient"
+    ] = proto.RepeatedField(
+        proto.MESSAGE,
+        number=1,
+        message="IdentityAwareProxyClient",
+    )
+    next_page_token: str = proto.Field(
+        proto.STRING,
+        number=2,
+    )
+
+
+class CreateIdentityAwareProxyClientRequest(proto.Message):
+    r"""The request sent to CreateIdentityAwareProxyClient.
+
+    Attributes:
+        parent (str):
+            Required. Path to create the client in. In the following
+            format: projects/{project_number/id}/brands/{brand}. The
+            project must belong to a G Suite account.
+        identity_aware_proxy_client (google.cloud.iap_v1.types.IdentityAwareProxyClient):
+            Required. Identity Aware Proxy Client to be
+            created.
+    """
+
+    parent: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+    identity_aware_proxy_client: "IdentityAwareProxyClient" = proto.Field(
+        proto.MESSAGE,
+        number=2,
+        message="IdentityAwareProxyClient",
+    )
+
+
+class GetIdentityAwareProxyClientRequest(proto.Message):
+    r"""The request sent to GetIdentityAwareProxyClient.
+
+    Attributes:
+        name (str):
+            Required. Name of the Identity Aware Proxy client to be
+            fetched. In the following format:
+            projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+
+
+class ResetIdentityAwareProxyClientSecretRequest(proto.Message):
+    r"""The request sent to ResetIdentityAwareProxyClientSecret.
+
+    Attributes:
+        name (str):
+            Required. Name of the Identity Aware Proxy client to that
+            will have its secret reset. In the following format:
+            projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+
+
+class DeleteIdentityAwareProxyClientRequest(proto.Message):
+    r"""The request sent to DeleteIdentityAwareProxyClient.
+
+    Attributes:
+        name (str):
+            Required. Name of the Identity Aware Proxy client to be
+            deleted. In the following format:
+            projects/{project_number/id}/brands/{brand}/identityAwareProxyClients/{client_id}.
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+
+
+class Brand(proto.Message):
+    r"""OAuth brand data.
+    NOTE: Only contains a portion of the data that describes a
+    brand.
+
+    Attributes:
+        name (str):
+            Output only. Identifier of the brand.
+            NOTE: GCP project number achieves the same brand
+            identification purpose as only one brand per
+            project can be created.
+        support_email (str):
+            Support email displayed on the OAuth consent
+            screen.
+        application_title (str):
+            Application name displayed on OAuth consent
+            screen.
+        org_internal_only (bool):
+            Output only. Whether the brand is only
+            intended for usage inside the G Suite
+            organization only.
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+    support_email: str = proto.Field(
+        proto.STRING,
+        number=2,
+    )
+    application_title: str = proto.Field(
+        proto.STRING,
+        number=3,
+    )
+    org_internal_only: bool = proto.Field(
+        proto.BOOL,
+        number=4,
+    )
+
+
+class IdentityAwareProxyClient(proto.Message):
+    r"""Contains the data that describes an Identity Aware Proxy
+    owned client.
+
+    Attributes:
+        name (str):
+            Output only. Unique identifier of the OAuth
+            client.
+        secret (str):
+            Output only. Client secret of the OAuth
+            client.
+        display_name (str):
+            Human-friendly name given to the OAuth
+            client.
+    """
+
+    name: str = proto.Field(
+        proto.STRING,
+        number=1,
+    )
+    secret: str = proto.Field(
+        proto.STRING,
+        number=2,
+    )
+    display_name: str = proto.Field(
+        proto.STRING,
+        number=3,
+    )
+
+
+__all__ = tuple(sorted(__protobuf__.manifest))
diff --git a/packages/google-cloud-iap/mypy.ini b/packages/google-cloud-iap/mypy.ini
new file mode 100644
index 000000000000..574c5aed394b
--- /dev/null
+++ b/packages/google-cloud-iap/mypy.ini
@@ -0,0 +1,3 @@
+[mypy]
+python_version = 3.7
+namespace_packages = True
diff --git a/packages/google-cloud-iap/noxfile.py b/packages/google-cloud-iap/noxfile.py
new file mode 100644
index 000000000000..1749edb5dad7
--- /dev/null
+++ b/packages/google-cloud-iap/noxfile.py
@@ -0,0 +1,428 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2018 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Generated by synthtool. DO NOT EDIT!
+
+from __future__ import absolute_import
+
+import os
+import pathlib
+import re
+import shutil
+import warnings
+
+import nox
+
+BLACK_VERSION = "black==22.3.0"
+ISORT_VERSION = "isort==5.10.1"
+LINT_PATHS = ["docs", "google", "tests", "noxfile.py", "setup.py"]
+
+DEFAULT_PYTHON_VERSION = "3.9"
+
+UNIT_TEST_PYTHON_VERSIONS = ["3.7", "3.8", "3.9", "3.10", "3.11"]
+UNIT_TEST_STANDARD_DEPENDENCIES = [
+    "mock",
+    "asyncmock",
+    "pytest",
+    "pytest-cov",
+    "pytest-asyncio",
+]
+UNIT_TEST_EXTERNAL_DEPENDENCIES = []
+UNIT_TEST_LOCAL_DEPENDENCIES = []
+UNIT_TEST_DEPENDENCIES = []
+UNIT_TEST_EXTRAS = []
+UNIT_TEST_EXTRAS_BY_PYTHON = {}
+
+SYSTEM_TEST_PYTHON_VERSIONS = []
+SYSTEM_TEST_STANDARD_DEPENDENCIES = [
+    "mock",
+    "pytest",
+    "google-cloud-testutils",
+]
+SYSTEM_TEST_EXTERNAL_DEPENDENCIES = []
+SYSTEM_TEST_LOCAL_DEPENDENCIES = []
+SYSTEM_TEST_DEPENDENCIES = []
+SYSTEM_TEST_EXTRAS = []
+SYSTEM_TEST_EXTRAS_BY_PYTHON = {}
+
+CURRENT_DIRECTORY = pathlib.Path(__file__).parent.absolute()
+
+# 'docfx' is excluded since it only needs to run in 'docs-presubmit'
+nox.options.sessions = [
+    "unit",
+    "system",
+    "cover",
+    "lint",
+    "lint_setup_py",
+    "blacken",
+    "docs",
+]
+
+# Error if a python version is missing
+nox.options.error_on_missing_interpreters = True
+
+
+@nox.session(python=DEFAULT_PYTHON_VERSION)
+def lint(session):
+    """Run linters.
+
+    Returns a failure if the linters find linting errors or sufficiently
+    serious code quality issues.
+    """
+    session.install("flake8", BLACK_VERSION)
+    session.run(
+        "black",
+        "--check",
+        *LINT_PATHS,
+    )
+    session.run("flake8", "google", "tests")
+
+
+@nox.session(python=DEFAULT_PYTHON_VERSION)
+def blacken(session):
+    """Run black. Format code to uniform standard."""
+    session.install(BLACK_VERSION)
+    session.run(
+        "black",
+        *LINT_PATHS,
+    )
+
+
+@nox.session(python=DEFAULT_PYTHON_VERSION)
+def format(session):
+    """
+    Run isort to sort imports. Then run black
+    to format code to uniform standard.
+    """
+    session.install(BLACK_VERSION, ISORT_VERSION)
+    # Use the --fss option to sort imports using strict alphabetical order.
+    # See https://pycqa.github.io/isort/docs/configuration/options.html#force-sort-within-sections
+    session.run(
+        "isort",
+        "--fss",
+        *LINT_PATHS,
+    )
+    session.run(
+        "black",
+        *LINT_PATHS,
+    )
+
+
+@nox.session(python=DEFAULT_PYTHON_VERSION)
+def lint_setup_py(session):
+    """Verify that setup.py is valid (including RST check)."""
+    session.install("docutils", "pygments")
+    session.run("python", "setup.py", "check", "--restructuredtext", "--strict")
+
+
+def install_unittest_dependencies(session, *constraints):
+    standard_deps = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_DEPENDENCIES
+    session.install(*standard_deps, *constraints)
+
+    if UNIT_TEST_EXTERNAL_DEPENDENCIES:
+        warnings.warn(
+            "'unit_test_external_dependencies' is deprecated. Instead, please "
+            "use 'unit_test_dependencies' or 'unit_test_local_dependencies'.",
+            DeprecationWarning,
+        )
+        session.install(*UNIT_TEST_EXTERNAL_DEPENDENCIES, *constraints)
+
+    if UNIT_TEST_LOCAL_DEPENDENCIES:
+        session.install(*UNIT_TEST_LOCAL_DEPENDENCIES, *constraints)
+
+    if UNIT_TEST_EXTRAS_BY_PYTHON:
+        extras = UNIT_TEST_EXTRAS_BY_PYTHON.get(session.python, [])
+    elif UNIT_TEST_EXTRAS:
+        extras = UNIT_TEST_EXTRAS
+    else:
+        extras = []
+
+    if extras:
+        session.install("-e", f".[{','.join(extras)}]", *constraints)
+    else:
+        session.install("-e", ".", *constraints)
+
+
+def default(session):
+    # Install all test dependencies, then install this package in-place.
+
+    constraints_path = str(
+        CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
+    )
+    install_unittest_dependencies(session, "-c", constraints_path)
+
+    # Run py.test against the unit tests.
+    session.run(
+        "py.test",
+        "--quiet",
+        f"--junitxml=unit_{session.python}_sponge_log.xml",
+        "--cov=google",
+        "--cov=tests/unit",
+        "--cov-append",
+        "--cov-config=.coveragerc",
+        "--cov-report=",
+        "--cov-fail-under=0",
+        os.path.join("tests", "unit"),
+        *session.posargs,
+    )
+
+
+@nox.session(python=UNIT_TEST_PYTHON_VERSIONS)
+def unit(session):
+    """Run the unit test suite."""
+    default(session)
+
+
+def install_systemtest_dependencies(session, *constraints):
+
+    # Use pre-release gRPC for system tests.
+    # Exclude version 1.52.0rc1 which has a known issue.
+    # See https://github.com/grpc/grpc/issues/32163
+    session.install("--pre", "grpcio!=1.52.0rc1")
+
+    session.install(*SYSTEM_TEST_STANDARD_DEPENDENCIES, *constraints)
+
+    if SYSTEM_TEST_EXTERNAL_DEPENDENCIES:
+        session.install(*SYSTEM_TEST_EXTERNAL_DEPENDENCIES, *constraints)
+
+    if SYSTEM_TEST_LOCAL_DEPENDENCIES:
+        session.install("-e", *SYSTEM_TEST_LOCAL_DEPENDENCIES, *constraints)
+
+    if SYSTEM_TEST_DEPENDENCIES:
+        session.install("-e", *SYSTEM_TEST_DEPENDENCIES, *constraints)
+
+    if SYSTEM_TEST_EXTRAS_BY_PYTHON:
+        extras = SYSTEM_TEST_EXTRAS_BY_PYTHON.get(session.python, [])
+    elif SYSTEM_TEST_EXTRAS:
+        extras = SYSTEM_TEST_EXTRAS
+    else:
+        extras = []
+
+    if extras:
+        session.install("-e", f".[{','.join(extras)}]", *constraints)
+    else:
+        session.install("-e", ".", *constraints)
+
+
+@nox.session(python=SYSTEM_TEST_PYTHON_VERSIONS)
+def system(session):
+    """Run the system test suite."""
+    constraints_path = str(
+        CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
+    )
+    system_test_path = os.path.join("tests", "system.py")
+    system_test_folder_path = os.path.join("tests", "system")
+
+    # Check the value of `RUN_SYSTEM_TESTS` env var. It defaults to true.
+    if os.environ.get("RUN_SYSTEM_TESTS", "true") == "false":
+        session.skip("RUN_SYSTEM_TESTS is set to false, skipping")
+    # Install pyopenssl for mTLS testing.
+    if os.environ.get("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false") == "true":
+        session.install("pyopenssl")
+
+    system_test_exists = os.path.exists(system_test_path)
+    system_test_folder_exists = os.path.exists(system_test_folder_path)
+    # Sanity check: only run tests if found.
+    if not system_test_exists and not system_test_folder_exists:
+        session.skip("System tests were not found")
+
+    install_systemtest_dependencies(session, "-c", constraints_path)
+
+    # Run py.test against the system tests.
+    if system_test_exists:
+        session.run(
+            "py.test",
+            "--quiet",
+            f"--junitxml=system_{session.python}_sponge_log.xml",
+            system_test_path,
+            *session.posargs,
+        )
+    if system_test_folder_exists:
+        session.run(
+            "py.test",
+            "--quiet",
+            f"--junitxml=system_{session.python}_sponge_log.xml",
+            system_test_folder_path,
+            *session.posargs,
+        )
+
+
+@nox.session(python=DEFAULT_PYTHON_VERSION)
+def cover(session):
+    """Run the final coverage report.
+
+    This outputs the coverage report aggregating coverage from the unit
+    test runs (not system test runs), and then erases coverage data.
+    """
+    session.install("coverage", "pytest-cov")
+    session.run("coverage", "report", "--show-missing", "--fail-under=100")
+
+    session.run("coverage", "erase")
+
+
+@nox.session(python=DEFAULT_PYTHON_VERSION)
+def docs(session):
+    """Build the docs for this library."""
+
+    session.install("-e", ".")
+    session.install(
+        "sphinx==4.0.1",
+        "alabaster",
+        "recommonmark",
+    )
+
+    shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True)
+    session.run(
+        "sphinx-build",
+        "-W",  # warnings as errors
+        "-T",  # show full traceback on exception
+        "-N",  # no colors
+        "-b",
+        "html",
+        "-d",
+        os.path.join("docs", "_build", "doctrees", ""),
+        os.path.join("docs", ""),
+        os.path.join("docs", "_build", "html", ""),
+    )
+
+
+@nox.session(python=DEFAULT_PYTHON_VERSION)
+def docfx(session):
+    """Build the docfx yaml files for this library."""
+
+    session.install("-e", ".")
+    session.install(
+        "sphinx==4.0.1",
+        "alabaster",
+        "recommonmark",
+        "gcp-sphinx-docfx-yaml",
+    )
+
+    shutil.rmtree(os.path.join("docs", "_build"), ignore_errors=True)
+    session.run(
+        "sphinx-build",
+        "-T",  # show full traceback on exception
+        "-N",  # no colors
+        "-D",
+        (
+            "extensions=sphinx.ext.autodoc,"
+            "sphinx.ext.autosummary,"
+            "docfx_yaml.extension,"
+            "sphinx.ext.intersphinx,"
+            "sphinx.ext.coverage,"
+            "sphinx.ext.napoleon,"
+            "sphinx.ext.todo,"
+            "sphinx.ext.viewcode,"
+            "recommonmark"
+        ),
+        "-b",
+        "html",
+        "-d",
+        os.path.join("docs", "_build", "doctrees", ""),
+        os.path.join("docs", ""),
+        os.path.join("docs", "_build", "html", ""),
+    )
+
+
+@nox.session(python="3.11")
+def prerelease_deps(session):
+    """Run all tests with prerelease versions of dependencies installed."""
+
+    # Install all dependencies
+    session.install("-e", ".[all, tests, tracing]")
+    unit_deps_all = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_EXTERNAL_DEPENDENCIES
+    session.install(*unit_deps_all)
+    system_deps_all = (
+        SYSTEM_TEST_STANDARD_DEPENDENCIES
+        + SYSTEM_TEST_EXTERNAL_DEPENDENCIES
+        + SYSTEM_TEST_EXTRAS
+    )
+    session.install(*system_deps_all)
+
+    # Because we test minimum dependency versions on the minimum Python
+    # version, the first version we test with in the unit tests sessions has a
+    # constraints file containing all dependencies and extras.
+    with open(
+        CURRENT_DIRECTORY
+        / "testing"
+        / f"constraints-{UNIT_TEST_PYTHON_VERSIONS[0]}.txt",
+        encoding="utf-8",
+    ) as constraints_file:
+        constraints_text = constraints_file.read()
+
+    # Ignore leading whitespace and comment lines.
+    constraints_deps = [
+        match.group(1)
+        for match in re.finditer(
+            r"^\s*(\S+)(?===\S+)", constraints_text, flags=re.MULTILINE
+        )
+    ]
+
+    session.install(*constraints_deps)
+
+    prerel_deps = [
+        "protobuf",
+        # dependency of grpc
+        "six",
+        "googleapis-common-protos",
+        # Exclude version 1.52.0rc1 which has a known issue. See https://github.com/grpc/grpc/issues/32163
+        "grpcio!=1.52.0rc1",
+        "grpcio-status",
+        "google-api-core",
+        "proto-plus",
+        "google-cloud-testutils",
+        # dependencies of google-cloud-testutils"
+        "click",
+    ]
+
+    for dep in prerel_deps:
+        session.install("--pre", "--no-deps", "--upgrade", dep)
+
+    # Remaining dependencies
+    other_deps = [
+        "requests",
+        "google-auth",
+    ]
+    session.install(*other_deps)
+
+    # Print out prerelease package versions
+    session.run(
+        "python", "-c", "import google.protobuf; print(google.protobuf.__version__)"
+    )
+    session.run("python", "-c", "import grpc; print(grpc.__version__)")
+
+    session.run("py.test", "tests/unit")
+
+    system_test_path = os.path.join("tests", "system.py")
+    system_test_folder_path = os.path.join("tests", "system")
+
+    # Only run system tests if found.
+    if os.path.exists(system_test_path):
+        session.run(
+            "py.test",
+            "--verbose",
+            f"--junitxml=system_{session.python}_sponge_log.xml",
+            system_test_path,
+            *session.posargs,
+        )
+    if os.path.exists(system_test_folder_path):
+        session.run(
+            "py.test",
+            "--verbose",
+            f"--junitxml=system_{session.python}_sponge_log.xml",
+            system_test_folder_path,
+            *session.posargs,
+        )
diff --git a/packages/google-cloud-iap/release-please-config.json b/packages/google-cloud-iap/release-please-config.json
new file mode 100644
index 000000000000..4b7d19b5f211
--- /dev/null
+++ b/packages/google-cloud-iap/release-please-config.json
@@ -0,0 +1,24 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "release-type": "python",
+      "extra-files": [
+        "google/cloud/iap/gapic_version.py",
+        "google/cloud/iap_v1/gapic_version.py",
+        {
+          "type": "json",
+          "path": "samples/generated_samples/snippet_metadata_google.cloud.iap.v1.json",
+          "jsonpath": "$.clientLibrary.version"
+        }
+      ]
+    }
+  },
+  "release-type": "python",
+  "plugins": [
+    {
+      "type": "sentence-case"
+    }
+  ],
+  "initial-version": "0.1.0"
+}
diff --git a/packages/google-cloud-iap/renovate.json b/packages/google-cloud-iap/renovate.json
new file mode 100644
index 000000000000..39b2a0ec9296
--- /dev/null
+++ b/packages/google-cloud-iap/renovate.json
@@ -0,0 +1,12 @@
+{
+  "extends": [
+    "config:base",
+    "group:all",
+    ":preserveSemverRanges",
+    ":disableDependencyDashboard"
+  ],
+  "ignorePaths": [".pre-commit-config.yaml", ".kokoro/requirements.txt", "setup.py"],
+  "pip_requirements": {
+    "fileMatch": ["requirements-test.txt", "samples/[\\S/]*constraints.txt", "samples/[\\S/]*constraints-test.txt"]
+  }
+}
diff --git a/packages/google-cloud-iap/scripts/decrypt-secrets.sh b/packages/google-cloud-iap/scripts/decrypt-secrets.sh
new file mode 100755
index 000000000000..21f6d2a26d90
--- /dev/null
+++ b/packages/google-cloud-iap/scripts/decrypt-secrets.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+# Copyright 2015 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+ROOT=$( dirname "$DIR" )
+
+# Work from the project root.
+cd $ROOT
+
+# Prevent it from overriding files.
+# We recommend that sample authors use their own service account files and cloud project.
+# In that case, they are supposed to prepare these files by themselves.
+if [[ -f "testing/test-env.sh" ]] || \
+       [[ -f "testing/service-account.json" ]] || \
+       [[ -f "testing/client-secrets.json" ]]; then
+    echo "One or more target files exist, aborting."
+    exit 1
+fi
+
+# Use SECRET_MANAGER_PROJECT if set, fallback to cloud-devrel-kokoro-resources.
+PROJECT_ID="${SECRET_MANAGER_PROJECT:-cloud-devrel-kokoro-resources}"
+
+gcloud secrets versions access latest --secret="python-docs-samples-test-env" \
+       --project="${PROJECT_ID}" \
+       > testing/test-env.sh
+gcloud secrets versions access latest \
+       --secret="python-docs-samples-service-account" \
+       --project="${PROJECT_ID}" \
+       > testing/service-account.json
+gcloud secrets versions access latest \
+       --secret="python-docs-samples-client-secrets" \
+       --project="${PROJECT_ID}" \
+       > testing/client-secrets.json
diff --git a/packages/google-cloud-iap/scripts/fixup_iap_v1_keywords.py b/packages/google-cloud-iap/scripts/fixup_iap_v1_keywords.py
new file mode 100644
index 000000000000..7359ed1b64c0
--- /dev/null
+++ b/packages/google-cloud-iap/scripts/fixup_iap_v1_keywords.py
@@ -0,0 +1,193 @@
+#! /usr/bin/env python3
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+import argparse
+import os
+import libcst as cst
+import pathlib
+import sys
+from typing import (Any, Callable, Dict, List, Sequence, Tuple)
+
+
+def partition(
+    predicate: Callable[[Any], bool],
+    iterator: Sequence[Any]
+) -> Tuple[List[Any], List[Any]]:
+    """A stable, out-of-place partition."""
+    results = ([], [])
+
+    for i in iterator:
+        results[int(predicate(i))].append(i)
+
+    # Returns trueList, falseList
+    return results[1], results[0]
+
+
+class iapCallTransformer(cst.CSTTransformer):
+    CTRL_PARAMS: Tuple[str] = ('retry', 'timeout', 'metadata')
+    METHOD_TO_PARAMS: Dict[str, Tuple[str]] = {
+        'create_brand': ('parent', 'brand', ),
+        'create_identity_aware_proxy_client': ('parent', 'identity_aware_proxy_client', ),
+        'create_tunnel_dest_group': ('parent', 'tunnel_dest_group', 'tunnel_dest_group_id', ),
+        'delete_identity_aware_proxy_client': ('name', ),
+        'delete_tunnel_dest_group': ('name', ),
+        'get_brand': ('name', ),
+        'get_iam_policy': ('resource', 'options', ),
+        'get_iap_settings': ('name', ),
+        'get_identity_aware_proxy_client': ('name', ),
+        'get_tunnel_dest_group': ('name', ),
+        'list_brands': ('parent', ),
+        'list_identity_aware_proxy_clients': ('parent', 'page_size', 'page_token', ),
+        'list_tunnel_dest_groups': ('parent', 'page_size', 'page_token', ),
+        'reset_identity_aware_proxy_client_secret': ('name', ),
+        'set_iam_policy': ('resource', 'policy', 'update_mask', ),
+        'test_iam_permissions': ('resource', 'permissions', ),
+        'update_iap_settings': ('iap_settings', 'update_mask', ),
+        'update_tunnel_dest_group': ('tunnel_dest_group', 'update_mask', ),
+    }
+
+    def leave_Call(self, original: cst.Call, updated: cst.Call) -> cst.CSTNode:
+        try:
+            key = original.func.attr.value
+            kword_params = self.METHOD_TO_PARAMS[key]
+        except (AttributeError, KeyError):
+            # Either not a method from the API or too convoluted to be sure.
+            return updated
+
+        # If the existing code is valid, keyword args come after positional args.
+        # Therefore, all positional args must map to the first parameters.
+        args, kwargs = partition(lambda a: not bool(a.keyword), updated.args)
+        if any(k.keyword.value == "request" for k in kwargs):
+            # We've already fixed this file, don't fix it again.
+            return updated
+
+        kwargs, ctrl_kwargs = partition(
+            lambda a: a.keyword.value not in self.CTRL_PARAMS,
+            kwargs
+        )
+
+        args, ctrl_args = args[:len(kword_params)], args[len(kword_params):]
+        ctrl_kwargs.extend(cst.Arg(value=a.value, keyword=cst.Name(value=ctrl))
+                           for a, ctrl in zip(ctrl_args, self.CTRL_PARAMS))
+
+        request_arg = cst.Arg(
+            value=cst.Dict([
+                cst.DictElement(
+                    cst.SimpleString("'{}'".format(name)),
+cst.Element(value=arg.value)
+                )
+                # Note: the args + kwargs looks silly, but keep in mind that
+                # the control parameters had to be stripped out, and that
+                # those could have been passed positionally or by keyword.
+                for name, arg in zip(kword_params, args + kwargs)]),
+            keyword=cst.Name("request")
+        )
+
+        return updated.with_changes(
+            args=[request_arg] + ctrl_kwargs
+        )
+
+
+def fix_files(
+    in_dir: pathlib.Path,
+    out_dir: pathlib.Path,
+    *,
+    transformer=iapCallTransformer(),
+):
+    """Duplicate the input dir to the output dir, fixing file method calls.
+
+    Preconditions:
+    * in_dir is a real directory
+    * out_dir is a real, empty directory
+    """
+    pyfile_gen = (
+        pathlib.Path(os.path.join(root, f))
+        for root, _, files in os.walk(in_dir)
+        for f in files if os.path.splitext(f)[1] == ".py"
+    )
+
+    for fpath in pyfile_gen:
+        with open(fpath, 'r') as f:
+            src = f.read()
+
+        # Parse the code and insert method call fixes.
+        tree = cst.parse_module(src)
+        updated = tree.visit(transformer)
+
+        # Create the path and directory structure for the new file.
+        updated_path = out_dir.joinpath(fpath.relative_to(in_dir))
+        updated_path.parent.mkdir(parents=True, exist_ok=True)
+
+        # Generate the updated source file at the corresponding path.
+        with open(updated_path, 'w') as f:
+            f.write(updated.code)
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(
+        description="""Fix up source that uses the iap client library.
+
+The existing sources are NOT overwritten but are copied to output_dir with changes made.
+
+Note: This tool operates at a best-effort level at converting positional
+      parameters in client method calls to keyword based parameters.
+      Cases where it WILL FAIL include
+      A) * or ** expansion in a method call.
+      B) Calls via function or method alias (includes free function calls)
+      C) Indirect or dispatched calls (e.g. the method is looked up dynamically)
+
+      These all constitute false negatives. The tool will also detect false
+      positives when an API method shares a name with another method.
+""")
+    parser.add_argument(
+        '-d',
+        '--input-directory',
+        required=True,
+        dest='input_dir',
+        help='the input directory to walk for python files to fix up',
+    )
+    parser.add_argument(
+        '-o',
+        '--output-directory',
+        required=True,
+        dest='output_dir',
+        help='the directory to output files fixed via un-flattening',
+    )
+    args = parser.parse_args()
+    input_dir = pathlib.Path(args.input_dir)
+    output_dir = pathlib.Path(args.output_dir)
+    if not input_dir.is_dir():
+        print(
+            f"input directory '{input_dir}' does not exist or is not a directory",
+            file=sys.stderr,
+        )
+        sys.exit(-1)
+
+    if not output_dir.is_dir():
+        print(
+            f"output directory '{output_dir}' does not exist or is not a directory",
+            file=sys.stderr,
+        )
+        sys.exit(-1)
+
+    if os.listdir(output_dir):
+        print(
+            f"output directory '{output_dir}' is not empty",
+            file=sys.stderr,
+        )
+        sys.exit(-1)
+
+    fix_files(input_dir, output_dir)
diff --git a/packages/google-cloud-iap/scripts/readme-gen/readme_gen.py b/packages/google-cloud-iap/scripts/readme-gen/readme_gen.py
new file mode 100644
index 000000000000..91b59676bfc7
--- /dev/null
+++ b/packages/google-cloud-iap/scripts/readme-gen/readme_gen.py
@@ -0,0 +1,69 @@
+#!/usr/bin/env python
+
+# Copyright 2016 Google Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Generates READMEs using configuration defined in yaml."""
+
+import argparse
+import io
+import os
+import subprocess
+
+import jinja2
+import yaml
+
+
+jinja_env = jinja2.Environment(
+    trim_blocks=True,
+    loader=jinja2.FileSystemLoader(
+        os.path.abspath(os.path.join(os.path.dirname(__file__), "templates"))
+    ),
+    autoescape=True,
+)
+
+README_TMPL = jinja_env.get_template('README.tmpl.rst')
+
+
+def get_help(file):
+    return subprocess.check_output(['python', file, '--help']).decode()
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('source')
+    parser.add_argument('--destination', default='README.rst')
+
+    args = parser.parse_args()
+
+    source = os.path.abspath(args.source)
+    root = os.path.dirname(source)
+    destination = os.path.join(root, args.destination)
+
+    jinja_env.globals['get_help'] = get_help
+
+    with io.open(source, 'r') as f:
+        config = yaml.load(f)
+
+    # This allows get_help to execute in the right directory.
+    os.chdir(root)
+
+    output = README_TMPL.render(config)
+
+    with io.open(destination, 'w') as f:
+        f.write(output)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/packages/google-cloud-iap/scripts/readme-gen/templates/README.tmpl.rst b/packages/google-cloud-iap/scripts/readme-gen/templates/README.tmpl.rst
new file mode 100644
index 000000000000..4fd239765b0a
--- /dev/null
+++ b/packages/google-cloud-iap/scripts/readme-gen/templates/README.tmpl.rst
@@ -0,0 +1,87 @@
+{# The following line is a lie. BUT! Once jinja2 is done with it, it will
+    become truth! #}
+.. This file is automatically generated. Do not edit this file directly.
+
+{{product.name}} Python Samples
+===============================================================================
+
+.. image:: https://gstatic.com/cloudssh/images/open-btn.png
+   :target: https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/GoogleCloudPlatform/python-docs-samples&page=editor&open_in_editor={{folder}}/README.rst
+
+
+This directory contains samples for {{product.name}}. {{product.description}}
+
+{{description}}
+
+.. _{{product.name}}: {{product.url}}
+
+{% if required_api_url %}
+To run the sample, you need to enable the API at: {{required_api_url}}
+{% endif %}
+
+{% if required_role %}
+To run the sample, you need to have `{{required_role}}` role.
+{% endif %}
+
+{{other_required_steps}}
+
+{% if setup %}
+Setup
+-------------------------------------------------------------------------------
+
+{% for section in setup %}
+
+{% include section + '.tmpl.rst' %}
+
+{% endfor %}
+{% endif %}
+
+{% if samples %}
+Samples
+-------------------------------------------------------------------------------
+
+{% for sample in samples %}
+{{sample.name}}
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+{% if not sample.hide_cloudshell_button %}
+.. image:: https://gstatic.com/cloudssh/images/open-btn.png
+   :target: https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/GoogleCloudPlatform/python-docs-samples&page=editor&open_in_editor={{folder}}/{{sample.file}},{{folder}}/README.rst
+{% endif %}
+
+
+{{sample.description}}
+
+To run this sample:
+
+.. code-block:: bash
+
+    $ python {{sample.file}}
+{% if sample.show_help %}
+
+    {{get_help(sample.file)|indent}}
+{% endif %}
+
+
+{% endfor %}
+{% endif %}
+
+{% if cloud_client_library %}
+
+The client library
+-------------------------------------------------------------------------------
+
+This sample uses the `Google Cloud Client Library for Python`_.
+You can read the documentation for more details on API usage and use GitHub
+to `browse the source`_ and  `report issues`_.
+
+.. _Google Cloud Client Library for Python:
+    https://googlecloudplatform.github.io/google-cloud-python/
+.. _browse the source:
+    https://github.com/GoogleCloudPlatform/google-cloud-python
+.. _report issues:
+    https://github.com/GoogleCloudPlatform/google-cloud-python/issues
+
+{% endif %}
+
+.. _Google Cloud SDK: https://cloud.google.com/sdk/
\ No newline at end of file
diff --git a/packages/google-cloud-iap/scripts/readme-gen/templates/auth.tmpl.rst b/packages/google-cloud-iap/scripts/readme-gen/templates/auth.tmpl.rst
new file mode 100644
index 000000000000..1446b94a5e3a
--- /dev/null
+++ b/packages/google-cloud-iap/scripts/readme-gen/templates/auth.tmpl.rst
@@ -0,0 +1,9 @@
+Authentication
+++++++++++++++
+
+This sample requires you to have authentication setup. Refer to the
+`Authentication Getting Started Guide`_ for instructions on setting up
+credentials for applications.
+
+.. _Authentication Getting Started Guide:
+    https://cloud.google.com/docs/authentication/getting-started
diff --git a/packages/google-cloud-iap/scripts/readme-gen/templates/auth_api_key.tmpl.rst b/packages/google-cloud-iap/scripts/readme-gen/templates/auth_api_key.tmpl.rst
new file mode 100644
index 000000000000..11957ce2714a
--- /dev/null
+++ b/packages/google-cloud-iap/scripts/readme-gen/templates/auth_api_key.tmpl.rst
@@ -0,0 +1,14 @@
+Authentication
+++++++++++++++
+
+Authentication for this service is done via an `API Key`_. To obtain an API
+Key:
+
+1. Open the `Cloud Platform Console`_
+2. Make sure that billing is enabled for your project.
+3. From the **Credentials** page, create a new **API Key** or use an existing
+   one for your project.
+
+.. _API Key:
+    https://developers.google.com/api-client-library/python/guide/aaa_apikeys
+.. _Cloud Console: https://console.cloud.google.com/project?_
diff --git a/packages/google-cloud-iap/scripts/readme-gen/templates/install_deps.tmpl.rst b/packages/google-cloud-iap/scripts/readme-gen/templates/install_deps.tmpl.rst
new file mode 100644
index 000000000000..6f069c6c87a5
--- /dev/null
+++ b/packages/google-cloud-iap/scripts/readme-gen/templates/install_deps.tmpl.rst
@@ -0,0 +1,29 @@
+Install Dependencies
+++++++++++++++++++++
+
+#. Clone python-docs-samples and change directory to the sample directory you want to use.
+
+    .. code-block:: bash
+
+        $ git clone https://github.com/GoogleCloudPlatform/python-docs-samples.git
+
+#. Install `pip`_ and `virtualenv`_ if you do not already have them. You may want to refer to the `Python Development Environment Setup Guide`_ for Google Cloud Platform for instructions.
+
+   .. _Python Development Environment Setup Guide:
+       https://cloud.google.com/python/setup
+
+#. Create a virtualenv. Samples are compatible with Python 3.7+.
+
+    .. code-block:: bash
+
+        $ virtualenv env
+        $ source env/bin/activate
+
+#. Install the dependencies needed to run the samples.
+
+    .. code-block:: bash
+
+        $ pip install -r requirements.txt
+
+.. _pip: https://pip.pypa.io/
+.. _virtualenv: https://virtualenv.pypa.io/
diff --git a/packages/google-cloud-iap/scripts/readme-gen/templates/install_portaudio.tmpl.rst b/packages/google-cloud-iap/scripts/readme-gen/templates/install_portaudio.tmpl.rst
new file mode 100644
index 000000000000..5ea33d18c00c
--- /dev/null
+++ b/packages/google-cloud-iap/scripts/readme-gen/templates/install_portaudio.tmpl.rst
@@ -0,0 +1,35 @@
+Install PortAudio
++++++++++++++++++
+
+Install `PortAudio`_. This is required by the `PyAudio`_ library to stream
+audio from your computer's microphone. PyAudio depends on PortAudio for cross-platform compatibility, and is installed differently depending on the
+platform.
+
+* For Mac OS X, you can use `Homebrew`_::
+
+      brew install portaudio
+
+  **Note**: if you encounter an error when running `pip install` that indicates
+  it can't find `portaudio.h`, try running `pip install` with the following
+  flags::
+
+      pip install --global-option='build_ext' \
+          --global-option='-I/usr/local/include' \
+          --global-option='-L/usr/local/lib' \
+          pyaudio
+
+* For Debian / Ubuntu Linux::
+
+      apt-get install portaudio19-dev python-all-dev
+
+* Windows may work without having to install PortAudio explicitly (it will get
+  installed with PyAudio).
+
+For more details, see the `PyAudio installation`_ page.
+
+
+.. _PyAudio: https://people.csail.mit.edu/hubert/pyaudio/
+.. _PortAudio: http://www.portaudio.com/
+.. _PyAudio installation:
+  https://people.csail.mit.edu/hubert/pyaudio/#downloads
+.. _Homebrew: http://brew.sh
diff --git a/packages/google-cloud-iap/setup.cfg b/packages/google-cloud-iap/setup.cfg
new file mode 100644
index 000000000000..c3a2b39f6528
--- /dev/null
+++ b/packages/google-cloud-iap/setup.cfg
@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Generated by synthtool. DO NOT EDIT!
+[bdist_wheel]
+universal = 1
diff --git a/packages/google-cloud-iap/setup.py b/packages/google-cloud-iap/setup.py
new file mode 100644
index 000000000000..25e00709e93a
--- /dev/null
+++ b/packages/google-cloud-iap/setup.py
@@ -0,0 +1,91 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+import io
+import os
+
+import setuptools  # type: ignore
+
+package_root = os.path.abspath(os.path.dirname(__file__))
+
+name = "google-cloud-iap"
+
+
+description = "Google Cloud Iap API client library"
+
+version = {}
+with open(os.path.join(package_root, "google/cloud/iap/gapic_version.py")) as fp:
+    exec(fp.read(), version)
+version = version["__version__"]
+
+if version[0] == "0":
+    release_status = "Development Status :: 4 - Beta"
+else:
+    release_status = "Development Status :: 5 - Production/Stable"
+
+dependencies = [
+    "google-api-core[grpc] >= 1.34.0, <3.0.0dev,!=2.0.*,!=2.1.*,!=2.2.*,!=2.3.*,!=2.4.*,!=2.5.*,!=2.6.*,!=2.7.*,!=2.8.*,!=2.9.*,!=2.10.*",
+    "proto-plus >= 1.22.0, <2.0.0dev",
+    "proto-plus >= 1.22.2, <2.0.0dev; python_version>='3.11'",
+    "protobuf>=3.19.5,<5.0.0dev,!=3.20.0,!=3.20.1,!=4.21.0,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5",
+    "grpc-google-iam-v1 >= 0.12.4, <1.0.0dev",
+]
+url = "https://github.com/googleapis/google-cloud-python"
+
+package_root = os.path.abspath(os.path.dirname(__file__))
+
+readme_filename = os.path.join(package_root, "README.rst")
+with io.open(readme_filename, encoding="utf-8") as readme_file:
+    readme = readme_file.read()
+
+packages = [
+    package
+    for package in setuptools.PEP420PackageFinder.find()
+    if package.startswith("google")
+]
+
+namespaces = ["google", "google.cloud"]
+
+setuptools.setup(
+    name=name,
+    version=version,
+    description=description,
+    long_description=readme,
+    author="Google LLC",
+    author_email="googleapis-packages@google.com",
+    license="Apache 2.0",
+    url=url,
+    classifiers=[
+        release_status,
+        "Intended Audience :: Developers",
+        "License :: OSI Approved :: Apache Software License",
+        "Programming Language :: Python",
+        "Programming Language :: Python :: 3",
+        "Programming Language :: Python :: 3.7",
+        "Programming Language :: Python :: 3.8",
+        "Programming Language :: Python :: 3.9",
+        "Programming Language :: Python :: 3.10",
+        "Programming Language :: Python :: 3.11",
+        "Operating System :: OS Independent",
+        "Topic :: Internet",
+    ],
+    platforms="Posix; MacOS X; Windows",
+    packages=packages,
+    python_requires=">=3.7",
+    namespace_packages=namespaces,
+    install_requires=dependencies,
+    include_package_data=True,
+    zip_safe=False,
+)
diff --git a/packages/google-cloud-iap/testing/.gitignore b/packages/google-cloud-iap/testing/.gitignore
new file mode 100644
index 000000000000..b05fbd630881
--- /dev/null
+++ b/packages/google-cloud-iap/testing/.gitignore
@@ -0,0 +1,3 @@
+test-env.sh
+service-account.json
+client-secrets.json
\ No newline at end of file
diff --git a/packages/google-cloud-iap/testing/constraints-3.10.txt b/packages/google-cloud-iap/testing/constraints-3.10.txt
new file mode 100644
index 000000000000..ad3f0fa58e2d
--- /dev/null
+++ b/packages/google-cloud-iap/testing/constraints-3.10.txt
@@ -0,0 +1,7 @@
+# -*- coding: utf-8 -*-
+# This constraints file is required for unit tests.
+# List all library dependencies and extras in this file.
+google-api-core
+proto-plus
+protobuf
+grpc-google-iam-v1
diff --git a/packages/google-cloud-iap/testing/constraints-3.11.txt b/packages/google-cloud-iap/testing/constraints-3.11.txt
new file mode 100644
index 000000000000..ad3f0fa58e2d
--- /dev/null
+++ b/packages/google-cloud-iap/testing/constraints-3.11.txt
@@ -0,0 +1,7 @@
+# -*- coding: utf-8 -*-
+# This constraints file is required for unit tests.
+# List all library dependencies and extras in this file.
+google-api-core
+proto-plus
+protobuf
+grpc-google-iam-v1
diff --git a/packages/google-cloud-iap/testing/constraints-3.12.txt b/packages/google-cloud-iap/testing/constraints-3.12.txt
new file mode 100644
index 000000000000..ad3f0fa58e2d
--- /dev/null
+++ b/packages/google-cloud-iap/testing/constraints-3.12.txt
@@ -0,0 +1,7 @@
+# -*- coding: utf-8 -*-
+# This constraints file is required for unit tests.
+# List all library dependencies and extras in this file.
+google-api-core
+proto-plus
+protobuf
+grpc-google-iam-v1
diff --git a/packages/google-cloud-iap/testing/constraints-3.7.txt b/packages/google-cloud-iap/testing/constraints-3.7.txt
new file mode 100644
index 000000000000..2beecf99e0be
--- /dev/null
+++ b/packages/google-cloud-iap/testing/constraints-3.7.txt
@@ -0,0 +1,10 @@
+# This constraints file is used to check that lower bounds
+# are correct in setup.py
+# List all library dependencies and extras in this file.
+# Pin the version to the lower bound.
+# e.g., if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0dev",
+# Then this file should have google-cloud-foo==1.14.0
+google-api-core==1.34.0
+proto-plus==1.22.0
+protobuf==3.19.5
+grpc-google-iam-v1==0.12.4
diff --git a/packages/google-cloud-iap/testing/constraints-3.8.txt b/packages/google-cloud-iap/testing/constraints-3.8.txt
new file mode 100644
index 000000000000..ad3f0fa58e2d
--- /dev/null
+++ b/packages/google-cloud-iap/testing/constraints-3.8.txt
@@ -0,0 +1,7 @@
+# -*- coding: utf-8 -*-
+# This constraints file is required for unit tests.
+# List all library dependencies and extras in this file.
+google-api-core
+proto-plus
+protobuf
+grpc-google-iam-v1
diff --git a/packages/google-cloud-iap/testing/constraints-3.9.txt b/packages/google-cloud-iap/testing/constraints-3.9.txt
new file mode 100644
index 000000000000..ad3f0fa58e2d
--- /dev/null
+++ b/packages/google-cloud-iap/testing/constraints-3.9.txt
@@ -0,0 +1,7 @@
+# -*- coding: utf-8 -*-
+# This constraints file is required for unit tests.
+# List all library dependencies and extras in this file.
+google-api-core
+proto-plus
+protobuf
+grpc-google-iam-v1
diff --git a/packages/google-cloud-iap/tests/__init__.py b/packages/google-cloud-iap/tests/__init__.py
new file mode 100644
index 000000000000..e8e1c3845db5
--- /dev/null
+++ b/packages/google-cloud-iap/tests/__init__.py
@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
diff --git a/packages/google-cloud-iap/tests/unit/__init__.py b/packages/google-cloud-iap/tests/unit/__init__.py
new file mode 100644
index 000000000000..e8e1c3845db5
--- /dev/null
+++ b/packages/google-cloud-iap/tests/unit/__init__.py
@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
diff --git a/packages/google-cloud-iap/tests/unit/gapic/__init__.py b/packages/google-cloud-iap/tests/unit/gapic/__init__.py
new file mode 100644
index 000000000000..e8e1c3845db5
--- /dev/null
+++ b/packages/google-cloud-iap/tests/unit/gapic/__init__.py
@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
diff --git a/packages/google-cloud-iap/tests/unit/gapic/iap_v1/__init__.py b/packages/google-cloud-iap/tests/unit/gapic/iap_v1/__init__.py
new file mode 100644
index 000000000000..e8e1c3845db5
--- /dev/null
+++ b/packages/google-cloud-iap/tests/unit/gapic/iap_v1/__init__.py
@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
diff --git a/packages/google-cloud-iap/tests/unit/gapic/iap_v1/test_identity_aware_proxy_admin_service.py b/packages/google-cloud-iap/tests/unit/gapic/iap_v1/test_identity_aware_proxy_admin_service.py
new file mode 100644
index 000000000000..4a1b6caf5302
--- /dev/null
+++ b/packages/google-cloud-iap/tests/unit/gapic/iap_v1/test_identity_aware_proxy_admin_service.py
@@ -0,0 +1,6545 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+import os
+
+# try/except added for compatibility with python < 3.8
+try:
+    from unittest import mock
+    from unittest.mock import AsyncMock  # pragma: NO COVER
+except ImportError:  # pragma: NO COVER
+    import mock
+
+from collections.abc import Iterable
+import json
+import math
+
+from google.api_core import gapic_v1, grpc_helpers, grpc_helpers_async, path_template
+from google.api_core import client_options
+from google.api_core import exceptions as core_exceptions
+import google.auth
+from google.auth import credentials as ga_credentials
+from google.auth.exceptions import MutualTLSChannelError
+from google.iam.v1 import iam_policy_pb2  # type: ignore
+from google.iam.v1 import options_pb2  # type: ignore
+from google.iam.v1 import policy_pb2  # type: ignore
+from google.oauth2 import service_account
+from google.protobuf import duration_pb2  # type: ignore
+from google.protobuf import field_mask_pb2  # type: ignore
+from google.protobuf import json_format
+from google.protobuf import wrappers_pb2  # type: ignore
+from google.type import expr_pb2  # type: ignore
+import grpc
+from grpc.experimental import aio
+from proto.marshal.rules import wrappers
+from proto.marshal.rules.dates import DurationRule, TimestampRule
+import pytest
+from requests import PreparedRequest, Request, Response
+from requests.sessions import Session
+
+from google.cloud.iap_v1.services.identity_aware_proxy_admin_service import (
+    IdentityAwareProxyAdminServiceAsyncClient,
+    IdentityAwareProxyAdminServiceClient,
+    pagers,
+    transports,
+)
+from google.cloud.iap_v1.types import service
+
+
+def client_cert_source_callback():
+    return b"cert bytes", b"key bytes"
+
+
+# If default endpoint is localhost, then default mtls endpoint will be the same.
+# This method modifies the default endpoint so the client can produce a different
+# mtls endpoint for endpoint testing purposes.
+def modify_default_endpoint(client):
+    return (
+        "foo.googleapis.com"
+        if ("localhost" in client.DEFAULT_ENDPOINT)
+        else client.DEFAULT_ENDPOINT
+    )
+
+
+def test__get_default_mtls_endpoint():
+    api_endpoint = "example.googleapis.com"
+    api_mtls_endpoint = "example.mtls.googleapis.com"
+    sandbox_endpoint = "example.sandbox.googleapis.com"
+    sandbox_mtls_endpoint = "example.mtls.sandbox.googleapis.com"
+    non_googleapi = "api.example.com"
+
+    assert IdentityAwareProxyAdminServiceClient._get_default_mtls_endpoint(None) is None
+    assert (
+        IdentityAwareProxyAdminServiceClient._get_default_mtls_endpoint(api_endpoint)
+        == api_mtls_endpoint
+    )
+    assert (
+        IdentityAwareProxyAdminServiceClient._get_default_mtls_endpoint(
+            api_mtls_endpoint
+        )
+        == api_mtls_endpoint
+    )
+    assert (
+        IdentityAwareProxyAdminServiceClient._get_default_mtls_endpoint(
+            sandbox_endpoint
+        )
+        == sandbox_mtls_endpoint
+    )
+    assert (
+        IdentityAwareProxyAdminServiceClient._get_default_mtls_endpoint(
+            sandbox_mtls_endpoint
+        )
+        == sandbox_mtls_endpoint
+    )
+    assert (
+        IdentityAwareProxyAdminServiceClient._get_default_mtls_endpoint(non_googleapi)
+        == non_googleapi
+    )
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_name",
+    [
+        (IdentityAwareProxyAdminServiceClient, "grpc"),
+        (IdentityAwareProxyAdminServiceAsyncClient, "grpc_asyncio"),
+        (IdentityAwareProxyAdminServiceClient, "rest"),
+    ],
+)
+def test_identity_aware_proxy_admin_service_client_from_service_account_info(
+    client_class, transport_name
+):
+    creds = ga_credentials.AnonymousCredentials()
+    with mock.patch.object(
+        service_account.Credentials, "from_service_account_info"
+    ) as factory:
+        factory.return_value = creds
+        info = {"valid": True}
+        client = client_class.from_service_account_info(info, transport=transport_name)
+        assert client.transport._credentials == creds
+        assert isinstance(client, client_class)
+
+        assert client.transport._host == (
+            "iap.googleapis.com:443"
+            if transport_name in ["grpc", "grpc_asyncio"]
+            else "https://iap.googleapis.com"
+        )
+
+
+@pytest.mark.parametrize(
+    "transport_class,transport_name",
+    [
+        (transports.IdentityAwareProxyAdminServiceGrpcTransport, "grpc"),
+        (transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport, "grpc_asyncio"),
+        (transports.IdentityAwareProxyAdminServiceRestTransport, "rest"),
+    ],
+)
+def test_identity_aware_proxy_admin_service_client_service_account_always_use_jwt(
+    transport_class, transport_name
+):
+    with mock.patch.object(
+        service_account.Credentials, "with_always_use_jwt_access", create=True
+    ) as use_jwt:
+        creds = service_account.Credentials(None, None, None)
+        transport = transport_class(credentials=creds, always_use_jwt_access=True)
+        use_jwt.assert_called_once_with(True)
+
+    with mock.patch.object(
+        service_account.Credentials, "with_always_use_jwt_access", create=True
+    ) as use_jwt:
+        creds = service_account.Credentials(None, None, None)
+        transport = transport_class(credentials=creds, always_use_jwt_access=False)
+        use_jwt.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_name",
+    [
+        (IdentityAwareProxyAdminServiceClient, "grpc"),
+        (IdentityAwareProxyAdminServiceAsyncClient, "grpc_asyncio"),
+        (IdentityAwareProxyAdminServiceClient, "rest"),
+    ],
+)
+def test_identity_aware_proxy_admin_service_client_from_service_account_file(
+    client_class, transport_name
+):
+    creds = ga_credentials.AnonymousCredentials()
+    with mock.patch.object(
+        service_account.Credentials, "from_service_account_file"
+    ) as factory:
+        factory.return_value = creds
+        client = client_class.from_service_account_file(
+            "dummy/file/path.json", transport=transport_name
+        )
+        assert client.transport._credentials == creds
+        assert isinstance(client, client_class)
+
+        client = client_class.from_service_account_json(
+            "dummy/file/path.json", transport=transport_name
+        )
+        assert client.transport._credentials == creds
+        assert isinstance(client, client_class)
+
+        assert client.transport._host == (
+            "iap.googleapis.com:443"
+            if transport_name in ["grpc", "grpc_asyncio"]
+            else "https://iap.googleapis.com"
+        )
+
+
+def test_identity_aware_proxy_admin_service_client_get_transport_class():
+    transport = IdentityAwareProxyAdminServiceClient.get_transport_class()
+    available_transports = [
+        transports.IdentityAwareProxyAdminServiceGrpcTransport,
+        transports.IdentityAwareProxyAdminServiceRestTransport,
+    ]
+    assert transport in available_transports
+
+    transport = IdentityAwareProxyAdminServiceClient.get_transport_class("grpc")
+    assert transport == transports.IdentityAwareProxyAdminServiceGrpcTransport
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class,transport_name",
+    [
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceGrpcTransport,
+            "grpc",
+        ),
+        (
+            IdentityAwareProxyAdminServiceAsyncClient,
+            transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+        ),
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceRestTransport,
+            "rest",
+        ),
+    ],
+)
+@mock.patch.object(
+    IdentityAwareProxyAdminServiceClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyAdminServiceClient),
+)
+@mock.patch.object(
+    IdentityAwareProxyAdminServiceAsyncClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyAdminServiceAsyncClient),
+)
+def test_identity_aware_proxy_admin_service_client_client_options(
+    client_class, transport_class, transport_name
+):
+    # Check that if channel is provided we won't create a new one.
+    with mock.patch.object(
+        IdentityAwareProxyAdminServiceClient, "get_transport_class"
+    ) as gtc:
+        transport = transport_class(credentials=ga_credentials.AnonymousCredentials())
+        client = client_class(transport=transport)
+        gtc.assert_not_called()
+
+    # Check that if channel is provided via str we will create a new one.
+    with mock.patch.object(
+        IdentityAwareProxyAdminServiceClient, "get_transport_class"
+    ) as gtc:
+        client = client_class(transport=transport_name)
+        gtc.assert_called()
+
+    # Check the case api_endpoint is provided.
+    options = client_options.ClientOptions(api_endpoint="squid.clam.whelk")
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(transport=transport_name, client_options=options)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file=None,
+            host="squid.clam.whelk",
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+
+    # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is
+    # "never".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}):
+        with mock.patch.object(transport_class, "__init__") as patched:
+            patched.return_value = None
+            client = client_class(transport=transport_name)
+            patched.assert_called_once_with(
+                credentials=None,
+                credentials_file=None,
+                host=client.DEFAULT_ENDPOINT,
+                scopes=None,
+                client_cert_source_for_mtls=None,
+                quota_project_id=None,
+                client_info=transports.base.DEFAULT_CLIENT_INFO,
+                always_use_jwt_access=True,
+                api_audience=None,
+            )
+
+    # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is
+    # "always".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}):
+        with mock.patch.object(transport_class, "__init__") as patched:
+            patched.return_value = None
+            client = client_class(transport=transport_name)
+            patched.assert_called_once_with(
+                credentials=None,
+                credentials_file=None,
+                host=client.DEFAULT_MTLS_ENDPOINT,
+                scopes=None,
+                client_cert_source_for_mtls=None,
+                quota_project_id=None,
+                client_info=transports.base.DEFAULT_CLIENT_INFO,
+                always_use_jwt_access=True,
+                api_audience=None,
+            )
+
+    # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT has
+    # unsupported value.
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}):
+        with pytest.raises(MutualTLSChannelError):
+            client = client_class(transport=transport_name)
+
+    # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value.
+    with mock.patch.dict(
+        os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}
+    ):
+        with pytest.raises(ValueError):
+            client = client_class(transport=transport_name)
+
+    # Check the case quota_project_id is provided
+    options = client_options.ClientOptions(quota_project_id="octopus")
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(client_options=options, transport=transport_name)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file=None,
+            host=client.DEFAULT_ENDPOINT,
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id="octopus",
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+    # Check the case api_endpoint is provided
+    options = client_options.ClientOptions(
+        api_audience="https://language.googleapis.com"
+    )
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(client_options=options, transport=transport_name)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file=None,
+            host=client.DEFAULT_ENDPOINT,
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience="https://language.googleapis.com",
+        )
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class,transport_name,use_client_cert_env",
+    [
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceGrpcTransport,
+            "grpc",
+            "true",
+        ),
+        (
+            IdentityAwareProxyAdminServiceAsyncClient,
+            transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+            "true",
+        ),
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceGrpcTransport,
+            "grpc",
+            "false",
+        ),
+        (
+            IdentityAwareProxyAdminServiceAsyncClient,
+            transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+            "false",
+        ),
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceRestTransport,
+            "rest",
+            "true",
+        ),
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceRestTransport,
+            "rest",
+            "false",
+        ),
+    ],
+)
+@mock.patch.object(
+    IdentityAwareProxyAdminServiceClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyAdminServiceClient),
+)
+@mock.patch.object(
+    IdentityAwareProxyAdminServiceAsyncClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyAdminServiceAsyncClient),
+)
+@mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"})
+def test_identity_aware_proxy_admin_service_client_mtls_env_auto(
+    client_class, transport_class, transport_name, use_client_cert_env
+):
+    # This tests the endpoint autoswitch behavior. Endpoint is autoswitched to the default
+    # mtls endpoint, if GOOGLE_API_USE_CLIENT_CERTIFICATE is "true" and client cert exists.
+
+    # Check the case client_cert_source is provided. Whether client cert is used depends on
+    # GOOGLE_API_USE_CLIENT_CERTIFICATE value.
+    with mock.patch.dict(
+        os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}
+    ):
+        options = client_options.ClientOptions(
+            client_cert_source=client_cert_source_callback
+        )
+        with mock.patch.object(transport_class, "__init__") as patched:
+            patched.return_value = None
+            client = client_class(client_options=options, transport=transport_name)
+
+            if use_client_cert_env == "false":
+                expected_client_cert_source = None
+                expected_host = client.DEFAULT_ENDPOINT
+            else:
+                expected_client_cert_source = client_cert_source_callback
+                expected_host = client.DEFAULT_MTLS_ENDPOINT
+
+            patched.assert_called_once_with(
+                credentials=None,
+                credentials_file=None,
+                host=expected_host,
+                scopes=None,
+                client_cert_source_for_mtls=expected_client_cert_source,
+                quota_project_id=None,
+                client_info=transports.base.DEFAULT_CLIENT_INFO,
+                always_use_jwt_access=True,
+                api_audience=None,
+            )
+
+    # Check the case ADC client cert is provided. Whether client cert is used depends on
+    # GOOGLE_API_USE_CLIENT_CERTIFICATE value.
+    with mock.patch.dict(
+        os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}
+    ):
+        with mock.patch.object(transport_class, "__init__") as patched:
+            with mock.patch(
+                "google.auth.transport.mtls.has_default_client_cert_source",
+                return_value=True,
+            ):
+                with mock.patch(
+                    "google.auth.transport.mtls.default_client_cert_source",
+                    return_value=client_cert_source_callback,
+                ):
+                    if use_client_cert_env == "false":
+                        expected_host = client.DEFAULT_ENDPOINT
+                        expected_client_cert_source = None
+                    else:
+                        expected_host = client.DEFAULT_MTLS_ENDPOINT
+                        expected_client_cert_source = client_cert_source_callback
+
+                    patched.return_value = None
+                    client = client_class(transport=transport_name)
+                    patched.assert_called_once_with(
+                        credentials=None,
+                        credentials_file=None,
+                        host=expected_host,
+                        scopes=None,
+                        client_cert_source_for_mtls=expected_client_cert_source,
+                        quota_project_id=None,
+                        client_info=transports.base.DEFAULT_CLIENT_INFO,
+                        always_use_jwt_access=True,
+                        api_audience=None,
+                    )
+
+    # Check the case client_cert_source and ADC client cert are not provided.
+    with mock.patch.dict(
+        os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}
+    ):
+        with mock.patch.object(transport_class, "__init__") as patched:
+            with mock.patch(
+                "google.auth.transport.mtls.has_default_client_cert_source",
+                return_value=False,
+            ):
+                patched.return_value = None
+                client = client_class(transport=transport_name)
+                patched.assert_called_once_with(
+                    credentials=None,
+                    credentials_file=None,
+                    host=client.DEFAULT_ENDPOINT,
+                    scopes=None,
+                    client_cert_source_for_mtls=None,
+                    quota_project_id=None,
+                    client_info=transports.base.DEFAULT_CLIENT_INFO,
+                    always_use_jwt_access=True,
+                    api_audience=None,
+                )
+
+
+@pytest.mark.parametrize(
+    "client_class",
+    [IdentityAwareProxyAdminServiceClient, IdentityAwareProxyAdminServiceAsyncClient],
+)
+@mock.patch.object(
+    IdentityAwareProxyAdminServiceClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyAdminServiceClient),
+)
+@mock.patch.object(
+    IdentityAwareProxyAdminServiceAsyncClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyAdminServiceAsyncClient),
+)
+def test_identity_aware_proxy_admin_service_client_get_mtls_endpoint_and_cert_source(
+    client_class,
+):
+    mock_client_cert_source = mock.Mock()
+
+    # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "true".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}):
+        mock_api_endpoint = "foo"
+        options = client_options.ClientOptions(
+            client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint
+        )
+        api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(
+            options
+        )
+        assert api_endpoint == mock_api_endpoint
+        assert cert_source == mock_client_cert_source
+
+    # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "false".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}):
+        mock_client_cert_source = mock.Mock()
+        mock_api_endpoint = "foo"
+        options = client_options.ClientOptions(
+            client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint
+        )
+        api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(
+            options
+        )
+        assert api_endpoint == mock_api_endpoint
+        assert cert_source is None
+
+    # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "never".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}):
+        api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source()
+        assert api_endpoint == client_class.DEFAULT_ENDPOINT
+        assert cert_source is None
+
+    # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "always".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}):
+        api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source()
+        assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT
+        assert cert_source is None
+
+    # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert doesn't exist.
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}):
+        with mock.patch(
+            "google.auth.transport.mtls.has_default_client_cert_source",
+            return_value=False,
+        ):
+            api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source()
+            assert api_endpoint == client_class.DEFAULT_ENDPOINT
+            assert cert_source is None
+
+    # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert exists.
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}):
+        with mock.patch(
+            "google.auth.transport.mtls.has_default_client_cert_source",
+            return_value=True,
+        ):
+            with mock.patch(
+                "google.auth.transport.mtls.default_client_cert_source",
+                return_value=mock_client_cert_source,
+            ):
+                (
+                    api_endpoint,
+                    cert_source,
+                ) = client_class.get_mtls_endpoint_and_cert_source()
+                assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT
+                assert cert_source == mock_client_cert_source
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class,transport_name",
+    [
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceGrpcTransport,
+            "grpc",
+        ),
+        (
+            IdentityAwareProxyAdminServiceAsyncClient,
+            transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+        ),
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceRestTransport,
+            "rest",
+        ),
+    ],
+)
+def test_identity_aware_proxy_admin_service_client_client_options_scopes(
+    client_class, transport_class, transport_name
+):
+    # Check the case scopes are provided.
+    options = client_options.ClientOptions(
+        scopes=["1", "2"],
+    )
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(client_options=options, transport=transport_name)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file=None,
+            host=client.DEFAULT_ENDPOINT,
+            scopes=["1", "2"],
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class,transport_name,grpc_helpers",
+    [
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceGrpcTransport,
+            "grpc",
+            grpc_helpers,
+        ),
+        (
+            IdentityAwareProxyAdminServiceAsyncClient,
+            transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+            grpc_helpers_async,
+        ),
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceRestTransport,
+            "rest",
+            None,
+        ),
+    ],
+)
+def test_identity_aware_proxy_admin_service_client_client_options_credentials_file(
+    client_class, transport_class, transport_name, grpc_helpers
+):
+    # Check the case credentials file is provided.
+    options = client_options.ClientOptions(credentials_file="credentials.json")
+
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(client_options=options, transport=transport_name)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file="credentials.json",
+            host=client.DEFAULT_ENDPOINT,
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+
+
+def test_identity_aware_proxy_admin_service_client_client_options_from_dict():
+    with mock.patch(
+        "google.cloud.iap_v1.services.identity_aware_proxy_admin_service.transports.IdentityAwareProxyAdminServiceGrpcTransport.__init__"
+    ) as grpc_transport:
+        grpc_transport.return_value = None
+        client = IdentityAwareProxyAdminServiceClient(
+            client_options={"api_endpoint": "squid.clam.whelk"}
+        )
+        grpc_transport.assert_called_once_with(
+            credentials=None,
+            credentials_file=None,
+            host="squid.clam.whelk",
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class,transport_name,grpc_helpers",
+    [
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceGrpcTransport,
+            "grpc",
+            grpc_helpers,
+        ),
+        (
+            IdentityAwareProxyAdminServiceAsyncClient,
+            transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+            grpc_helpers_async,
+        ),
+    ],
+)
+def test_identity_aware_proxy_admin_service_client_create_channel_credentials_file(
+    client_class, transport_class, transport_name, grpc_helpers
+):
+    # Check the case credentials file is provided.
+    options = client_options.ClientOptions(credentials_file="credentials.json")
+
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(client_options=options, transport=transport_name)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file="credentials.json",
+            host=client.DEFAULT_ENDPOINT,
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+
+    # test that the credentials from file are saved and used as the credentials.
+    with mock.patch.object(
+        google.auth, "load_credentials_from_file", autospec=True
+    ) as load_creds, mock.patch.object(
+        google.auth, "default", autospec=True
+    ) as adc, mock.patch.object(
+        grpc_helpers, "create_channel"
+    ) as create_channel:
+        creds = ga_credentials.AnonymousCredentials()
+        file_creds = ga_credentials.AnonymousCredentials()
+        load_creds.return_value = (file_creds, None)
+        adc.return_value = (creds, None)
+        client = client_class(client_options=options, transport=transport_name)
+        create_channel.assert_called_with(
+            "iap.googleapis.com:443",
+            credentials=file_creds,
+            credentials_file=None,
+            quota_project_id=None,
+            default_scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            scopes=None,
+            default_host="iap.googleapis.com",
+            ssl_credentials=None,
+            options=[
+                ("grpc.max_send_message_length", -1),
+                ("grpc.max_receive_message_length", -1),
+            ],
+        )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        iam_policy_pb2.SetIamPolicyRequest,
+        dict,
+    ],
+)
+def test_set_iam_policy(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.set_iam_policy), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = policy_pb2.Policy(
+            version=774,
+            etag=b"etag_blob",
+        )
+        response = client.set_iam_policy(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == iam_policy_pb2.SetIamPolicyRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, policy_pb2.Policy)
+    assert response.version == 774
+    assert response.etag == b"etag_blob"
+
+
+def test_set_iam_policy_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.set_iam_policy), "__call__") as call:
+        client.set_iam_policy()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == iam_policy_pb2.SetIamPolicyRequest()
+
+
+@pytest.mark.asyncio
+async def test_set_iam_policy_async(
+    transport: str = "grpc_asyncio", request_type=iam_policy_pb2.SetIamPolicyRequest
+):
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.set_iam_policy), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            policy_pb2.Policy(
+                version=774,
+                etag=b"etag_blob",
+            )
+        )
+        response = await client.set_iam_policy(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == iam_policy_pb2.SetIamPolicyRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, policy_pb2.Policy)
+    assert response.version == 774
+    assert response.etag == b"etag_blob"
+
+
+@pytest.mark.asyncio
+async def test_set_iam_policy_async_from_dict():
+    await test_set_iam_policy_async(request_type=dict)
+
+
+def test_set_iam_policy_field_headers():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = iam_policy_pb2.SetIamPolicyRequest()
+
+    request.resource = "resource_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.set_iam_policy), "__call__") as call:
+        call.return_value = policy_pb2.Policy()
+        client.set_iam_policy(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "resource=resource_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_set_iam_policy_field_headers_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = iam_policy_pb2.SetIamPolicyRequest()
+
+    request.resource = "resource_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.set_iam_policy), "__call__") as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(policy_pb2.Policy())
+        await client.set_iam_policy(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "resource=resource_value",
+    ) in kw["metadata"]
+
+
+def test_set_iam_policy_from_dict_foreign():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.set_iam_policy), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = policy_pb2.Policy()
+        response = client.set_iam_policy(
+            request={
+                "resource": "resource_value",
+                "policy": policy_pb2.Policy(version=774),
+                "update_mask": field_mask_pb2.FieldMask(paths=["paths_value"]),
+            }
+        )
+        call.assert_called()
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        iam_policy_pb2.GetIamPolicyRequest,
+        dict,
+    ],
+)
+def test_get_iam_policy(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iam_policy), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = policy_pb2.Policy(
+            version=774,
+            etag=b"etag_blob",
+        )
+        response = client.get_iam_policy(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == iam_policy_pb2.GetIamPolicyRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, policy_pb2.Policy)
+    assert response.version == 774
+    assert response.etag == b"etag_blob"
+
+
+def test_get_iam_policy_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iam_policy), "__call__") as call:
+        client.get_iam_policy()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == iam_policy_pb2.GetIamPolicyRequest()
+
+
+@pytest.mark.asyncio
+async def test_get_iam_policy_async(
+    transport: str = "grpc_asyncio", request_type=iam_policy_pb2.GetIamPolicyRequest
+):
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iam_policy), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            policy_pb2.Policy(
+                version=774,
+                etag=b"etag_blob",
+            )
+        )
+        response = await client.get_iam_policy(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == iam_policy_pb2.GetIamPolicyRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, policy_pb2.Policy)
+    assert response.version == 774
+    assert response.etag == b"etag_blob"
+
+
+@pytest.mark.asyncio
+async def test_get_iam_policy_async_from_dict():
+    await test_get_iam_policy_async(request_type=dict)
+
+
+def test_get_iam_policy_field_headers():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = iam_policy_pb2.GetIamPolicyRequest()
+
+    request.resource = "resource_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iam_policy), "__call__") as call:
+        call.return_value = policy_pb2.Policy()
+        client.get_iam_policy(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "resource=resource_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_get_iam_policy_field_headers_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = iam_policy_pb2.GetIamPolicyRequest()
+
+    request.resource = "resource_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iam_policy), "__call__") as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(policy_pb2.Policy())
+        await client.get_iam_policy(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "resource=resource_value",
+    ) in kw["metadata"]
+
+
+def test_get_iam_policy_from_dict_foreign():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iam_policy), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = policy_pb2.Policy()
+        response = client.get_iam_policy(
+            request={
+                "resource": "resource_value",
+                "options": options_pb2.GetPolicyOptions(requested_policy_version=2598),
+            }
+        )
+        call.assert_called()
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        iam_policy_pb2.TestIamPermissionsRequest,
+        dict,
+    ],
+)
+def test_test_iam_permissions(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.test_iam_permissions), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = iam_policy_pb2.TestIamPermissionsResponse(
+            permissions=["permissions_value"],
+        )
+        response = client.test_iam_permissions(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == iam_policy_pb2.TestIamPermissionsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, iam_policy_pb2.TestIamPermissionsResponse)
+    assert response.permissions == ["permissions_value"]
+
+
+def test_test_iam_permissions_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.test_iam_permissions), "__call__"
+    ) as call:
+        client.test_iam_permissions()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == iam_policy_pb2.TestIamPermissionsRequest()
+
+
+@pytest.mark.asyncio
+async def test_test_iam_permissions_async(
+    transport: str = "grpc_asyncio",
+    request_type=iam_policy_pb2.TestIamPermissionsRequest,
+):
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.test_iam_permissions), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            iam_policy_pb2.TestIamPermissionsResponse(
+                permissions=["permissions_value"],
+            )
+        )
+        response = await client.test_iam_permissions(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == iam_policy_pb2.TestIamPermissionsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, iam_policy_pb2.TestIamPermissionsResponse)
+    assert response.permissions == ["permissions_value"]
+
+
+@pytest.mark.asyncio
+async def test_test_iam_permissions_async_from_dict():
+    await test_test_iam_permissions_async(request_type=dict)
+
+
+def test_test_iam_permissions_field_headers():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = iam_policy_pb2.TestIamPermissionsRequest()
+
+    request.resource = "resource_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.test_iam_permissions), "__call__"
+    ) as call:
+        call.return_value = iam_policy_pb2.TestIamPermissionsResponse()
+        client.test_iam_permissions(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "resource=resource_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_test_iam_permissions_field_headers_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = iam_policy_pb2.TestIamPermissionsRequest()
+
+    request.resource = "resource_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.test_iam_permissions), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            iam_policy_pb2.TestIamPermissionsResponse()
+        )
+        await client.test_iam_permissions(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "resource=resource_value",
+    ) in kw["metadata"]
+
+
+def test_test_iam_permissions_from_dict_foreign():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.test_iam_permissions), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = iam_policy_pb2.TestIamPermissionsResponse()
+        response = client.test_iam_permissions(
+            request={
+                "resource": "resource_value",
+                "permissions": ["permissions_value"],
+            }
+        )
+        call.assert_called()
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.GetIapSettingsRequest,
+        dict,
+    ],
+)
+def test_get_iap_settings(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iap_settings), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.IapSettings(
+            name="name_value",
+        )
+        response = client.get_iap_settings(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetIapSettingsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IapSettings)
+    assert response.name == "name_value"
+
+
+def test_get_iap_settings_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iap_settings), "__call__") as call:
+        client.get_iap_settings()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetIapSettingsRequest()
+
+
+@pytest.mark.asyncio
+async def test_get_iap_settings_async(
+    transport: str = "grpc_asyncio", request_type=service.GetIapSettingsRequest
+):
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iap_settings), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.IapSettings(
+                name="name_value",
+            )
+        )
+        response = await client.get_iap_settings(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetIapSettingsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IapSettings)
+    assert response.name == "name_value"
+
+
+@pytest.mark.asyncio
+async def test_get_iap_settings_async_from_dict():
+    await test_get_iap_settings_async(request_type=dict)
+
+
+def test_get_iap_settings_field_headers():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.GetIapSettingsRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iap_settings), "__call__") as call:
+        call.return_value = service.IapSettings()
+        client.get_iap_settings(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_get_iap_settings_field_headers_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.GetIapSettingsRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_iap_settings), "__call__") as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.IapSettings())
+        await client.get_iap_settings(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.UpdateIapSettingsRequest,
+        dict,
+    ],
+)
+def test_update_iap_settings(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_iap_settings), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.IapSettings(
+            name="name_value",
+        )
+        response = client.update_iap_settings(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.UpdateIapSettingsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IapSettings)
+    assert response.name == "name_value"
+
+
+def test_update_iap_settings_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_iap_settings), "__call__"
+    ) as call:
+        client.update_iap_settings()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.UpdateIapSettingsRequest()
+
+
+@pytest.mark.asyncio
+async def test_update_iap_settings_async(
+    transport: str = "grpc_asyncio", request_type=service.UpdateIapSettingsRequest
+):
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_iap_settings), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.IapSettings(
+                name="name_value",
+            )
+        )
+        response = await client.update_iap_settings(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.UpdateIapSettingsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IapSettings)
+    assert response.name == "name_value"
+
+
+@pytest.mark.asyncio
+async def test_update_iap_settings_async_from_dict():
+    await test_update_iap_settings_async(request_type=dict)
+
+
+def test_update_iap_settings_field_headers():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.UpdateIapSettingsRequest()
+
+    request.iap_settings.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_iap_settings), "__call__"
+    ) as call:
+        call.return_value = service.IapSettings()
+        client.update_iap_settings(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "iap_settings.name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_update_iap_settings_field_headers_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.UpdateIapSettingsRequest()
+
+    request.iap_settings.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_iap_settings), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.IapSettings())
+        await client.update_iap_settings(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "iap_settings.name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.ListTunnelDestGroupsRequest,
+        dict,
+    ],
+)
+def test_list_tunnel_dest_groups(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.ListTunnelDestGroupsResponse(
+            next_page_token="next_page_token_value",
+        )
+        response = client.list_tunnel_dest_groups(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ListTunnelDestGroupsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, pagers.ListTunnelDestGroupsPager)
+    assert response.next_page_token == "next_page_token_value"
+
+
+def test_list_tunnel_dest_groups_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups), "__call__"
+    ) as call:
+        client.list_tunnel_dest_groups()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ListTunnelDestGroupsRequest()
+
+
+@pytest.mark.asyncio
+async def test_list_tunnel_dest_groups_async(
+    transport: str = "grpc_asyncio", request_type=service.ListTunnelDestGroupsRequest
+):
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.ListTunnelDestGroupsResponse(
+                next_page_token="next_page_token_value",
+            )
+        )
+        response = await client.list_tunnel_dest_groups(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ListTunnelDestGroupsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, pagers.ListTunnelDestGroupsAsyncPager)
+    assert response.next_page_token == "next_page_token_value"
+
+
+@pytest.mark.asyncio
+async def test_list_tunnel_dest_groups_async_from_dict():
+    await test_list_tunnel_dest_groups_async(request_type=dict)
+
+
+def test_list_tunnel_dest_groups_field_headers():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.ListTunnelDestGroupsRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups), "__call__"
+    ) as call:
+        call.return_value = service.ListTunnelDestGroupsResponse()
+        client.list_tunnel_dest_groups(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_list_tunnel_dest_groups_field_headers_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.ListTunnelDestGroupsRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.ListTunnelDestGroupsResponse()
+        )
+        await client.list_tunnel_dest_groups(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+def test_list_tunnel_dest_groups_flattened():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.ListTunnelDestGroupsResponse()
+        # Call the method with a truthy value for each flattened field,
+        # using the keyword arguments to the method.
+        client.list_tunnel_dest_groups(
+            parent="parent_value",
+        )
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        arg = args[0].parent
+        mock_val = "parent_value"
+        assert arg == mock_val
+
+
+def test_list_tunnel_dest_groups_flattened_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        client.list_tunnel_dest_groups(
+            service.ListTunnelDestGroupsRequest(),
+            parent="parent_value",
+        )
+
+
+@pytest.mark.asyncio
+async def test_list_tunnel_dest_groups_flattened_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.ListTunnelDestGroupsResponse()
+
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.ListTunnelDestGroupsResponse()
+        )
+        # Call the method with a truthy value for each flattened field,
+        # using the keyword arguments to the method.
+        response = await client.list_tunnel_dest_groups(
+            parent="parent_value",
+        )
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        arg = args[0].parent
+        mock_val = "parent_value"
+        assert arg == mock_val
+
+
+@pytest.mark.asyncio
+async def test_list_tunnel_dest_groups_flattened_error_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        await client.list_tunnel_dest_groups(
+            service.ListTunnelDestGroupsRequest(),
+            parent="parent_value",
+        )
+
+
+def test_list_tunnel_dest_groups_pager(transport_name: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials,
+        transport=transport_name,
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups), "__call__"
+    ) as call:
+        # Set the response to a series of pages.
+        call.side_effect = (
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                ],
+                next_page_token="abc",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[],
+                next_page_token="def",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                ],
+                next_page_token="ghi",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                ],
+            ),
+            RuntimeError,
+        )
+
+        metadata = ()
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", ""),)),
+        )
+        pager = client.list_tunnel_dest_groups(request={})
+
+        assert pager._metadata == metadata
+
+        results = list(pager)
+        assert len(results) == 6
+        assert all(isinstance(i, service.TunnelDestGroup) for i in results)
+
+
+def test_list_tunnel_dest_groups_pages(transport_name: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials,
+        transport=transport_name,
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups), "__call__"
+    ) as call:
+        # Set the response to a series of pages.
+        call.side_effect = (
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                ],
+                next_page_token="abc",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[],
+                next_page_token="def",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                ],
+                next_page_token="ghi",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                ],
+            ),
+            RuntimeError,
+        )
+        pages = list(client.list_tunnel_dest_groups(request={}).pages)
+        for page_, token in zip(pages, ["abc", "def", "ghi", ""]):
+            assert page_.raw_page.next_page_token == token
+
+
+@pytest.mark.asyncio
+async def test_list_tunnel_dest_groups_async_pager():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials,
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups),
+        "__call__",
+        new_callable=mock.AsyncMock,
+    ) as call:
+        # Set the response to a series of pages.
+        call.side_effect = (
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                ],
+                next_page_token="abc",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[],
+                next_page_token="def",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                ],
+                next_page_token="ghi",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                ],
+            ),
+            RuntimeError,
+        )
+        async_pager = await client.list_tunnel_dest_groups(
+            request={},
+        )
+        assert async_pager.next_page_token == "abc"
+        responses = []
+        async for response in async_pager:  # pragma: no branch
+            responses.append(response)
+
+        assert len(responses) == 6
+        assert all(isinstance(i, service.TunnelDestGroup) for i in responses)
+
+
+@pytest.mark.asyncio
+async def test_list_tunnel_dest_groups_async_pages():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials,
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_tunnel_dest_groups),
+        "__call__",
+        new_callable=mock.AsyncMock,
+    ) as call:
+        # Set the response to a series of pages.
+        call.side_effect = (
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                ],
+                next_page_token="abc",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[],
+                next_page_token="def",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                ],
+                next_page_token="ghi",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                ],
+            ),
+            RuntimeError,
+        )
+        pages = []
+        async for page_ in (
+            await client.list_tunnel_dest_groups(request={})
+        ).pages:  # pragma: no branch
+            pages.append(page_)
+        for page_, token in zip(pages, ["abc", "def", "ghi", ""]):
+            assert page_.raw_page.next_page_token == token
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.CreateTunnelDestGroupRequest,
+        dict,
+    ],
+)
+def test_create_tunnel_dest_group(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.TunnelDestGroup(
+            name="name_value",
+            cidrs=["cidrs_value"],
+            fqdns=["fqdns_value"],
+        )
+        response = client.create_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.CreateTunnelDestGroupRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.TunnelDestGroup)
+    assert response.name == "name_value"
+    assert response.cidrs == ["cidrs_value"]
+    assert response.fqdns == ["fqdns_value"]
+
+
+def test_create_tunnel_dest_group_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_tunnel_dest_group), "__call__"
+    ) as call:
+        client.create_tunnel_dest_group()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.CreateTunnelDestGroupRequest()
+
+
+@pytest.mark.asyncio
+async def test_create_tunnel_dest_group_async(
+    transport: str = "grpc_asyncio", request_type=service.CreateTunnelDestGroupRequest
+):
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.TunnelDestGroup(
+                name="name_value",
+                cidrs=["cidrs_value"],
+                fqdns=["fqdns_value"],
+            )
+        )
+        response = await client.create_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.CreateTunnelDestGroupRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.TunnelDestGroup)
+    assert response.name == "name_value"
+    assert response.cidrs == ["cidrs_value"]
+    assert response.fqdns == ["fqdns_value"]
+
+
+@pytest.mark.asyncio
+async def test_create_tunnel_dest_group_async_from_dict():
+    await test_create_tunnel_dest_group_async(request_type=dict)
+
+
+def test_create_tunnel_dest_group_field_headers():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.CreateTunnelDestGroupRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_tunnel_dest_group), "__call__"
+    ) as call:
+        call.return_value = service.TunnelDestGroup()
+        client.create_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_create_tunnel_dest_group_field_headers_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.CreateTunnelDestGroupRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_tunnel_dest_group), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.TunnelDestGroup()
+        )
+        await client.create_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+def test_create_tunnel_dest_group_flattened():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.TunnelDestGroup()
+        # Call the method with a truthy value for each flattened field,
+        # using the keyword arguments to the method.
+        client.create_tunnel_dest_group(
+            parent="parent_value",
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            tunnel_dest_group_id="tunnel_dest_group_id_value",
+        )
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        arg = args[0].parent
+        mock_val = "parent_value"
+        assert arg == mock_val
+        arg = args[0].tunnel_dest_group
+        mock_val = service.TunnelDestGroup(name="name_value")
+        assert arg == mock_val
+        arg = args[0].tunnel_dest_group_id
+        mock_val = "tunnel_dest_group_id_value"
+        assert arg == mock_val
+
+
+def test_create_tunnel_dest_group_flattened_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        client.create_tunnel_dest_group(
+            service.CreateTunnelDestGroupRequest(),
+            parent="parent_value",
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            tunnel_dest_group_id="tunnel_dest_group_id_value",
+        )
+
+
+@pytest.mark.asyncio
+async def test_create_tunnel_dest_group_flattened_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.TunnelDestGroup()
+
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.TunnelDestGroup()
+        )
+        # Call the method with a truthy value for each flattened field,
+        # using the keyword arguments to the method.
+        response = await client.create_tunnel_dest_group(
+            parent="parent_value",
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            tunnel_dest_group_id="tunnel_dest_group_id_value",
+        )
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        arg = args[0].parent
+        mock_val = "parent_value"
+        assert arg == mock_val
+        arg = args[0].tunnel_dest_group
+        mock_val = service.TunnelDestGroup(name="name_value")
+        assert arg == mock_val
+        arg = args[0].tunnel_dest_group_id
+        mock_val = "tunnel_dest_group_id_value"
+        assert arg == mock_val
+
+
+@pytest.mark.asyncio
+async def test_create_tunnel_dest_group_flattened_error_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        await client.create_tunnel_dest_group(
+            service.CreateTunnelDestGroupRequest(),
+            parent="parent_value",
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            tunnel_dest_group_id="tunnel_dest_group_id_value",
+        )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.GetTunnelDestGroupRequest,
+        dict,
+    ],
+)
+def test_get_tunnel_dest_group(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.TunnelDestGroup(
+            name="name_value",
+            cidrs=["cidrs_value"],
+            fqdns=["fqdns_value"],
+        )
+        response = client.get_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetTunnelDestGroupRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.TunnelDestGroup)
+    assert response.name == "name_value"
+    assert response.cidrs == ["cidrs_value"]
+    assert response.fqdns == ["fqdns_value"]
+
+
+def test_get_tunnel_dest_group_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_tunnel_dest_group), "__call__"
+    ) as call:
+        client.get_tunnel_dest_group()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetTunnelDestGroupRequest()
+
+
+@pytest.mark.asyncio
+async def test_get_tunnel_dest_group_async(
+    transport: str = "grpc_asyncio", request_type=service.GetTunnelDestGroupRequest
+):
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.TunnelDestGroup(
+                name="name_value",
+                cidrs=["cidrs_value"],
+                fqdns=["fqdns_value"],
+            )
+        )
+        response = await client.get_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetTunnelDestGroupRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.TunnelDestGroup)
+    assert response.name == "name_value"
+    assert response.cidrs == ["cidrs_value"]
+    assert response.fqdns == ["fqdns_value"]
+
+
+@pytest.mark.asyncio
+async def test_get_tunnel_dest_group_async_from_dict():
+    await test_get_tunnel_dest_group_async(request_type=dict)
+
+
+def test_get_tunnel_dest_group_field_headers():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.GetTunnelDestGroupRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_tunnel_dest_group), "__call__"
+    ) as call:
+        call.return_value = service.TunnelDestGroup()
+        client.get_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_get_tunnel_dest_group_field_headers_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.GetTunnelDestGroupRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_tunnel_dest_group), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.TunnelDestGroup()
+        )
+        await client.get_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+def test_get_tunnel_dest_group_flattened():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.TunnelDestGroup()
+        # Call the method with a truthy value for each flattened field,
+        # using the keyword arguments to the method.
+        client.get_tunnel_dest_group(
+            name="name_value",
+        )
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        arg = args[0].name
+        mock_val = "name_value"
+        assert arg == mock_val
+
+
+def test_get_tunnel_dest_group_flattened_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        client.get_tunnel_dest_group(
+            service.GetTunnelDestGroupRequest(),
+            name="name_value",
+        )
+
+
+@pytest.mark.asyncio
+async def test_get_tunnel_dest_group_flattened_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.TunnelDestGroup()
+
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.TunnelDestGroup()
+        )
+        # Call the method with a truthy value for each flattened field,
+        # using the keyword arguments to the method.
+        response = await client.get_tunnel_dest_group(
+            name="name_value",
+        )
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        arg = args[0].name
+        mock_val = "name_value"
+        assert arg == mock_val
+
+
+@pytest.mark.asyncio
+async def test_get_tunnel_dest_group_flattened_error_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        await client.get_tunnel_dest_group(
+            service.GetTunnelDestGroupRequest(),
+            name="name_value",
+        )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.DeleteTunnelDestGroupRequest,
+        dict,
+    ],
+)
+def test_delete_tunnel_dest_group(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = None
+        response = client.delete_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.DeleteTunnelDestGroupRequest()
+
+    # Establish that the response is the type that we expect.
+    assert response is None
+
+
+def test_delete_tunnel_dest_group_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_tunnel_dest_group), "__call__"
+    ) as call:
+        client.delete_tunnel_dest_group()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.DeleteTunnelDestGroupRequest()
+
+
+@pytest.mark.asyncio
+async def test_delete_tunnel_dest_group_async(
+    transport: str = "grpc_asyncio", request_type=service.DeleteTunnelDestGroupRequest
+):
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(None)
+        response = await client.delete_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.DeleteTunnelDestGroupRequest()
+
+    # Establish that the response is the type that we expect.
+    assert response is None
+
+
+@pytest.mark.asyncio
+async def test_delete_tunnel_dest_group_async_from_dict():
+    await test_delete_tunnel_dest_group_async(request_type=dict)
+
+
+def test_delete_tunnel_dest_group_field_headers():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.DeleteTunnelDestGroupRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_tunnel_dest_group), "__call__"
+    ) as call:
+        call.return_value = None
+        client.delete_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_delete_tunnel_dest_group_field_headers_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.DeleteTunnelDestGroupRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_tunnel_dest_group), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(None)
+        await client.delete_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+def test_delete_tunnel_dest_group_flattened():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = None
+        # Call the method with a truthy value for each flattened field,
+        # using the keyword arguments to the method.
+        client.delete_tunnel_dest_group(
+            name="name_value",
+        )
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        arg = args[0].name
+        mock_val = "name_value"
+        assert arg == mock_val
+
+
+def test_delete_tunnel_dest_group_flattened_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        client.delete_tunnel_dest_group(
+            service.DeleteTunnelDestGroupRequest(),
+            name="name_value",
+        )
+
+
+@pytest.mark.asyncio
+async def test_delete_tunnel_dest_group_flattened_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = None
+
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(None)
+        # Call the method with a truthy value for each flattened field,
+        # using the keyword arguments to the method.
+        response = await client.delete_tunnel_dest_group(
+            name="name_value",
+        )
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        arg = args[0].name
+        mock_val = "name_value"
+        assert arg == mock_val
+
+
+@pytest.mark.asyncio
+async def test_delete_tunnel_dest_group_flattened_error_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        await client.delete_tunnel_dest_group(
+            service.DeleteTunnelDestGroupRequest(),
+            name="name_value",
+        )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.UpdateTunnelDestGroupRequest,
+        dict,
+    ],
+)
+def test_update_tunnel_dest_group(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.TunnelDestGroup(
+            name="name_value",
+            cidrs=["cidrs_value"],
+            fqdns=["fqdns_value"],
+        )
+        response = client.update_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.UpdateTunnelDestGroupRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.TunnelDestGroup)
+    assert response.name == "name_value"
+    assert response.cidrs == ["cidrs_value"]
+    assert response.fqdns == ["fqdns_value"]
+
+
+def test_update_tunnel_dest_group_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_tunnel_dest_group), "__call__"
+    ) as call:
+        client.update_tunnel_dest_group()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.UpdateTunnelDestGroupRequest()
+
+
+@pytest.mark.asyncio
+async def test_update_tunnel_dest_group_async(
+    transport: str = "grpc_asyncio", request_type=service.UpdateTunnelDestGroupRequest
+):
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.TunnelDestGroup(
+                name="name_value",
+                cidrs=["cidrs_value"],
+                fqdns=["fqdns_value"],
+            )
+        )
+        response = await client.update_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.UpdateTunnelDestGroupRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.TunnelDestGroup)
+    assert response.name == "name_value"
+    assert response.cidrs == ["cidrs_value"]
+    assert response.fqdns == ["fqdns_value"]
+
+
+@pytest.mark.asyncio
+async def test_update_tunnel_dest_group_async_from_dict():
+    await test_update_tunnel_dest_group_async(request_type=dict)
+
+
+def test_update_tunnel_dest_group_field_headers():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.UpdateTunnelDestGroupRequest()
+
+    request.tunnel_dest_group.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_tunnel_dest_group), "__call__"
+    ) as call:
+        call.return_value = service.TunnelDestGroup()
+        client.update_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "tunnel_dest_group.name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_update_tunnel_dest_group_field_headers_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.UpdateTunnelDestGroupRequest()
+
+    request.tunnel_dest_group.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_tunnel_dest_group), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.TunnelDestGroup()
+        )
+        await client.update_tunnel_dest_group(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "tunnel_dest_group.name=name_value",
+    ) in kw["metadata"]
+
+
+def test_update_tunnel_dest_group_flattened():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.TunnelDestGroup()
+        # Call the method with a truthy value for each flattened field,
+        # using the keyword arguments to the method.
+        client.update_tunnel_dest_group(
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            update_mask=field_mask_pb2.FieldMask(paths=["paths_value"]),
+        )
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        arg = args[0].tunnel_dest_group
+        mock_val = service.TunnelDestGroup(name="name_value")
+        assert arg == mock_val
+        arg = args[0].update_mask
+        mock_val = field_mask_pb2.FieldMask(paths=["paths_value"])
+        assert arg == mock_val
+
+
+def test_update_tunnel_dest_group_flattened_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        client.update_tunnel_dest_group(
+            service.UpdateTunnelDestGroupRequest(),
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            update_mask=field_mask_pb2.FieldMask(paths=["paths_value"]),
+        )
+
+
+@pytest.mark.asyncio
+async def test_update_tunnel_dest_group_flattened_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.update_tunnel_dest_group), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.TunnelDestGroup()
+
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.TunnelDestGroup()
+        )
+        # Call the method with a truthy value for each flattened field,
+        # using the keyword arguments to the method.
+        response = await client.update_tunnel_dest_group(
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            update_mask=field_mask_pb2.FieldMask(paths=["paths_value"]),
+        )
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        arg = args[0].tunnel_dest_group
+        mock_val = service.TunnelDestGroup(name="name_value")
+        assert arg == mock_val
+        arg = args[0].update_mask
+        mock_val = field_mask_pb2.FieldMask(paths=["paths_value"])
+        assert arg == mock_val
+
+
+@pytest.mark.asyncio
+async def test_update_tunnel_dest_group_flattened_error_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        await client.update_tunnel_dest_group(
+            service.UpdateTunnelDestGroupRequest(),
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            update_mask=field_mask_pb2.FieldMask(paths=["paths_value"]),
+        )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        iam_policy_pb2.SetIamPolicyRequest,
+        dict,
+    ],
+)
+def test_set_iam_policy_rest(request_type):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"resource": "sample1"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = policy_pb2.Policy(
+            version=774,
+            etag=b"etag_blob",
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = return_value
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.set_iam_policy(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, policy_pb2.Policy)
+    assert response.version == 774
+    assert response.etag == b"etag_blob"
+
+
+def test_set_iam_policy_rest_required_fields(
+    request_type=iam_policy_pb2.SetIamPolicyRequest,
+):
+    transport_class = transports.IdentityAwareProxyAdminServiceRestTransport
+
+    request_init = {}
+    request_init["resource"] = ""
+    request = request_type(**request_init)
+    pb_request = request
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).set_iam_policy._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["resource"] = "resource_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).set_iam_policy._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "resource" in jsonified_request
+    assert jsonified_request["resource"] == "resource_value"
+
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = policy_pb2.Policy()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "post",
+                "query_params": pb_request,
+            }
+            transcode_result["body"] = pb_request
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = return_value
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.set_iam_policy(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_set_iam_policy_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.set_iam_policy._get_unset_required_fields({})
+    assert set(unset_fields) == (
+        set(())
+        & set(
+            (
+                "resource",
+                "policy",
+            )
+        )
+    )
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_set_iam_policy_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyAdminServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor, "post_set_iam_policy"
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor, "pre_set_iam_policy"
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = iam_policy_pb2.SetIamPolicyRequest()
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = json_format.MessageToJson(policy_pb2.Policy())
+
+        request = iam_policy_pb2.SetIamPolicyRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = policy_pb2.Policy()
+
+        client.set_iam_policy(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_set_iam_policy_rest_bad_request(
+    transport: str = "rest", request_type=iam_policy_pb2.SetIamPolicyRequest
+):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"resource": "sample1"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.set_iam_policy(request)
+
+
+def test_set_iam_policy_rest_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        iam_policy_pb2.GetIamPolicyRequest,
+        dict,
+    ],
+)
+def test_get_iam_policy_rest(request_type):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"resource": "sample1"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = policy_pb2.Policy(
+            version=774,
+            etag=b"etag_blob",
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = return_value
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.get_iam_policy(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, policy_pb2.Policy)
+    assert response.version == 774
+    assert response.etag == b"etag_blob"
+
+
+def test_get_iam_policy_rest_required_fields(
+    request_type=iam_policy_pb2.GetIamPolicyRequest,
+):
+    transport_class = transports.IdentityAwareProxyAdminServiceRestTransport
+
+    request_init = {}
+    request_init["resource"] = ""
+    request = request_type(**request_init)
+    pb_request = request
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).get_iam_policy._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["resource"] = "resource_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).get_iam_policy._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "resource" in jsonified_request
+    assert jsonified_request["resource"] == "resource_value"
+
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = policy_pb2.Policy()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "post",
+                "query_params": pb_request,
+            }
+            transcode_result["body"] = pb_request
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = return_value
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.get_iam_policy(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_get_iam_policy_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.get_iam_policy._get_unset_required_fields({})
+    assert set(unset_fields) == (set(()) & set(("resource",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_get_iam_policy_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyAdminServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor, "post_get_iam_policy"
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor, "pre_get_iam_policy"
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = iam_policy_pb2.GetIamPolicyRequest()
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = json_format.MessageToJson(policy_pb2.Policy())
+
+        request = iam_policy_pb2.GetIamPolicyRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = policy_pb2.Policy()
+
+        client.get_iam_policy(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_get_iam_policy_rest_bad_request(
+    transport: str = "rest", request_type=iam_policy_pb2.GetIamPolicyRequest
+):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"resource": "sample1"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.get_iam_policy(request)
+
+
+def test_get_iam_policy_rest_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        iam_policy_pb2.TestIamPermissionsRequest,
+        dict,
+    ],
+)
+def test_test_iam_permissions_rest(request_type):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"resource": "sample1"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = iam_policy_pb2.TestIamPermissionsResponse(
+            permissions=["permissions_value"],
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = return_value
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.test_iam_permissions(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, iam_policy_pb2.TestIamPermissionsResponse)
+    assert response.permissions == ["permissions_value"]
+
+
+def test_test_iam_permissions_rest_required_fields(
+    request_type=iam_policy_pb2.TestIamPermissionsRequest,
+):
+    transport_class = transports.IdentityAwareProxyAdminServiceRestTransport
+
+    request_init = {}
+    request_init["resource"] = ""
+    request_init["permissions"] = ""
+    request = request_type(**request_init)
+    pb_request = request
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).test_iam_permissions._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["resource"] = "resource_value"
+    jsonified_request["permissions"] = "permissions_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).test_iam_permissions._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "resource" in jsonified_request
+    assert jsonified_request["resource"] == "resource_value"
+    assert "permissions" in jsonified_request
+    assert jsonified_request["permissions"] == "permissions_value"
+
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = iam_policy_pb2.TestIamPermissionsResponse()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "post",
+                "query_params": pb_request,
+            }
+            transcode_result["body"] = pb_request
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = return_value
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.test_iam_permissions(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_test_iam_permissions_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.test_iam_permissions._get_unset_required_fields({})
+    assert set(unset_fields) == (
+        set(())
+        & set(
+            (
+                "resource",
+                "permissions",
+            )
+        )
+    )
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_test_iam_permissions_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyAdminServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "post_test_iam_permissions",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "pre_test_iam_permissions",
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = iam_policy_pb2.TestIamPermissionsRequest()
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = json_format.MessageToJson(
+            iam_policy_pb2.TestIamPermissionsResponse()
+        )
+
+        request = iam_policy_pb2.TestIamPermissionsRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = iam_policy_pb2.TestIamPermissionsResponse()
+
+        client.test_iam_permissions(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_test_iam_permissions_rest_bad_request(
+    transport: str = "rest", request_type=iam_policy_pb2.TestIamPermissionsRequest
+):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"resource": "sample1"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.test_iam_permissions(request)
+
+
+def test_test_iam_permissions_rest_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.GetIapSettingsRequest,
+        dict,
+    ],
+)
+def test_get_iap_settings_rest(request_type):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"name": "sample1"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.IapSettings(
+            name="name_value",
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.IapSettings.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.get_iap_settings(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IapSettings)
+    assert response.name == "name_value"
+
+
+def test_get_iap_settings_rest_required_fields(
+    request_type=service.GetIapSettingsRequest,
+):
+    transport_class = transports.IdentityAwareProxyAdminServiceRestTransport
+
+    request_init = {}
+    request_init["name"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).get_iap_settings._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["name"] = "name_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).get_iap_settings._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "name" in jsonified_request
+    assert jsonified_request["name"] == "name_value"
+
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.IapSettings()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "get",
+                "query_params": pb_request,
+            }
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.IapSettings.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.get_iap_settings(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_get_iap_settings_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.get_iap_settings._get_unset_required_fields({})
+    assert set(unset_fields) == (set(()) & set(("name",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_get_iap_settings_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyAdminServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "post_get_iap_settings",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor, "pre_get_iap_settings"
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.GetIapSettingsRequest.pb(service.GetIapSettingsRequest())
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.IapSettings.to_json(service.IapSettings())
+
+        request = service.GetIapSettingsRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.IapSettings()
+
+        client.get_iap_settings(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_get_iap_settings_rest_bad_request(
+    transport: str = "rest", request_type=service.GetIapSettingsRequest
+):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"name": "sample1"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.get_iap_settings(request)
+
+
+def test_get_iap_settings_rest_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.UpdateIapSettingsRequest,
+        dict,
+    ],
+)
+def test_update_iap_settings_rest(request_type):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"iap_settings": {"name": "sample1"}}
+    request_init["iap_settings"] = {
+        "name": "sample1",
+        "access_settings": {
+            "gcip_settings": {
+                "tenant_ids": ["tenant_ids_value1", "tenant_ids_value2"],
+                "login_page_uri": {"value": "value_value"},
+            },
+            "cors_settings": {"allow_http_options": {"value": True}},
+            "oauth_settings": {"login_hint": {}},
+            "reauth_settings": {
+                "method": 1,
+                "max_age": {"seconds": 751, "nanos": 543},
+                "policy_type": 1,
+            },
+            "allowed_domains_settings": {
+                "enable": True,
+                "domains": ["domains_value1", "domains_value2"],
+            },
+        },
+        "application_settings": {
+            "csm_settings": {"rctoken_aud": {}},
+            "access_denied_page_settings": {
+                "access_denied_page_uri": {},
+                "generate_troubleshooting_uri": {},
+                "remediation_token_generation_enabled": {},
+            },
+            "cookie_domain": {},
+            "attribute_propagation_settings": {
+                "expression": "expression_value",
+                "output_credentials": [1],
+                "enable": True,
+            },
+        },
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.IapSettings(
+            name="name_value",
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.IapSettings.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.update_iap_settings(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IapSettings)
+    assert response.name == "name_value"
+
+
+def test_update_iap_settings_rest_required_fields(
+    request_type=service.UpdateIapSettingsRequest,
+):
+    transport_class = transports.IdentityAwareProxyAdminServiceRestTransport
+
+    request_init = {}
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).update_iap_settings._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).update_iap_settings._get_unset_required_fields(jsonified_request)
+    # Check that path parameters and body parameters are not mixing in.
+    assert not set(unset_fields) - set(("update_mask",))
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.IapSettings()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "patch",
+                "query_params": pb_request,
+            }
+            transcode_result["body"] = pb_request
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.IapSettings.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.update_iap_settings(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_update_iap_settings_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.update_iap_settings._get_unset_required_fields({})
+    assert set(unset_fields) == (set(("updateMask",)) & set(("iapSettings",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_update_iap_settings_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyAdminServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "post_update_iap_settings",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "pre_update_iap_settings",
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.UpdateIapSettingsRequest.pb(
+            service.UpdateIapSettingsRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.IapSettings.to_json(service.IapSettings())
+
+        request = service.UpdateIapSettingsRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.IapSettings()
+
+        client.update_iap_settings(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_update_iap_settings_rest_bad_request(
+    transport: str = "rest", request_type=service.UpdateIapSettingsRequest
+):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"iap_settings": {"name": "sample1"}}
+    request_init["iap_settings"] = {
+        "name": "sample1",
+        "access_settings": {
+            "gcip_settings": {
+                "tenant_ids": ["tenant_ids_value1", "tenant_ids_value2"],
+                "login_page_uri": {"value": "value_value"},
+            },
+            "cors_settings": {"allow_http_options": {"value": True}},
+            "oauth_settings": {"login_hint": {}},
+            "reauth_settings": {
+                "method": 1,
+                "max_age": {"seconds": 751, "nanos": 543},
+                "policy_type": 1,
+            },
+            "allowed_domains_settings": {
+                "enable": True,
+                "domains": ["domains_value1", "domains_value2"],
+            },
+        },
+        "application_settings": {
+            "csm_settings": {"rctoken_aud": {}},
+            "access_denied_page_settings": {
+                "access_denied_page_uri": {},
+                "generate_troubleshooting_uri": {},
+                "remediation_token_generation_enabled": {},
+            },
+            "cookie_domain": {},
+            "attribute_propagation_settings": {
+                "expression": "expression_value",
+                "output_credentials": [1],
+                "enable": True,
+            },
+        },
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.update_iap_settings(request)
+
+
+def test_update_iap_settings_rest_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.ListTunnelDestGroupsRequest,
+        dict,
+    ],
+)
+def test_list_tunnel_dest_groups_rest(request_type):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1/iap_tunnel/locations/sample2"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.ListTunnelDestGroupsResponse(
+            next_page_token="next_page_token_value",
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.ListTunnelDestGroupsResponse.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.list_tunnel_dest_groups(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, pagers.ListTunnelDestGroupsPager)
+    assert response.next_page_token == "next_page_token_value"
+
+
+def test_list_tunnel_dest_groups_rest_required_fields(
+    request_type=service.ListTunnelDestGroupsRequest,
+):
+    transport_class = transports.IdentityAwareProxyAdminServiceRestTransport
+
+    request_init = {}
+    request_init["parent"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).list_tunnel_dest_groups._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["parent"] = "parent_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).list_tunnel_dest_groups._get_unset_required_fields(jsonified_request)
+    # Check that path parameters and body parameters are not mixing in.
+    assert not set(unset_fields) - set(
+        (
+            "page_size",
+            "page_token",
+        )
+    )
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "parent" in jsonified_request
+    assert jsonified_request["parent"] == "parent_value"
+
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.ListTunnelDestGroupsResponse()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "get",
+                "query_params": pb_request,
+            }
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.ListTunnelDestGroupsResponse.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.list_tunnel_dest_groups(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_list_tunnel_dest_groups_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.list_tunnel_dest_groups._get_unset_required_fields({})
+    assert set(unset_fields) == (
+        set(
+            (
+                "pageSize",
+                "pageToken",
+            )
+        )
+        & set(("parent",))
+    )
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_list_tunnel_dest_groups_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyAdminServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "post_list_tunnel_dest_groups",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "pre_list_tunnel_dest_groups",
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.ListTunnelDestGroupsRequest.pb(
+            service.ListTunnelDestGroupsRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.ListTunnelDestGroupsResponse.to_json(
+            service.ListTunnelDestGroupsResponse()
+        )
+
+        request = service.ListTunnelDestGroupsRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.ListTunnelDestGroupsResponse()
+
+        client.list_tunnel_dest_groups(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_list_tunnel_dest_groups_rest_bad_request(
+    transport: str = "rest", request_type=service.ListTunnelDestGroupsRequest
+):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1/iap_tunnel/locations/sample2"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.list_tunnel_dest_groups(request)
+
+
+def test_list_tunnel_dest_groups_rest_flattened():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.ListTunnelDestGroupsResponse()
+
+        # get arguments that satisfy an http rule for this method
+        sample_request = {"parent": "projects/sample1/iap_tunnel/locations/sample2"}
+
+        # get truthy value for each flattened field
+        mock_args = dict(
+            parent="parent_value",
+        )
+        mock_args.update(sample_request)
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.ListTunnelDestGroupsResponse.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+
+        client.list_tunnel_dest_groups(**mock_args)
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(req.mock_calls) == 1
+        _, args, _ = req.mock_calls[0]
+        assert path_template.validate(
+            "%s/v1/{parent=projects/*/iap_tunnel/locations/*}/destGroups"
+            % client.transport._host,
+            args[1],
+        )
+
+
+def test_list_tunnel_dest_groups_rest_flattened_error(transport: str = "rest"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        client.list_tunnel_dest_groups(
+            service.ListTunnelDestGroupsRequest(),
+            parent="parent_value",
+        )
+
+
+def test_list_tunnel_dest_groups_rest_pager(transport: str = "rest"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # TODO(kbandes): remove this mock unless there's a good reason for it.
+        # with mock.patch.object(path_template, 'transcode') as transcode:
+        # Set the response as a series of pages
+        response = (
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                ],
+                next_page_token="abc",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[],
+                next_page_token="def",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                ],
+                next_page_token="ghi",
+            ),
+            service.ListTunnelDestGroupsResponse(
+                tunnel_dest_groups=[
+                    service.TunnelDestGroup(),
+                    service.TunnelDestGroup(),
+                ],
+            ),
+        )
+        # Two responses for two calls
+        response = response + response
+
+        # Wrap the values into proper Response objs
+        response = tuple(
+            service.ListTunnelDestGroupsResponse.to_json(x) for x in response
+        )
+        return_values = tuple(Response() for i in response)
+        for return_val, response_val in zip(return_values, response):
+            return_val._content = response_val.encode("UTF-8")
+            return_val.status_code = 200
+        req.side_effect = return_values
+
+        sample_request = {"parent": "projects/sample1/iap_tunnel/locations/sample2"}
+
+        pager = client.list_tunnel_dest_groups(request=sample_request)
+
+        results = list(pager)
+        assert len(results) == 6
+        assert all(isinstance(i, service.TunnelDestGroup) for i in results)
+
+        pages = list(client.list_tunnel_dest_groups(request=sample_request).pages)
+        for page_, token in zip(pages, ["abc", "def", "ghi", ""]):
+            assert page_.raw_page.next_page_token == token
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.CreateTunnelDestGroupRequest,
+        dict,
+    ],
+)
+def test_create_tunnel_dest_group_rest(request_type):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1/iap_tunnel/locations/sample2"}
+    request_init["tunnel_dest_group"] = {
+        "name": "name_value",
+        "cidrs": ["cidrs_value1", "cidrs_value2"],
+        "fqdns": ["fqdns_value1", "fqdns_value2"],
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.TunnelDestGroup(
+            name="name_value",
+            cidrs=["cidrs_value"],
+            fqdns=["fqdns_value"],
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.TunnelDestGroup.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.create_tunnel_dest_group(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.TunnelDestGroup)
+    assert response.name == "name_value"
+    assert response.cidrs == ["cidrs_value"]
+    assert response.fqdns == ["fqdns_value"]
+
+
+def test_create_tunnel_dest_group_rest_required_fields(
+    request_type=service.CreateTunnelDestGroupRequest,
+):
+    transport_class = transports.IdentityAwareProxyAdminServiceRestTransport
+
+    request_init = {}
+    request_init["parent"] = ""
+    request_init["tunnel_dest_group_id"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+    assert "tunnelDestGroupId" not in jsonified_request
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).create_tunnel_dest_group._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+    assert "tunnelDestGroupId" in jsonified_request
+    assert (
+        jsonified_request["tunnelDestGroupId"] == request_init["tunnel_dest_group_id"]
+    )
+
+    jsonified_request["parent"] = "parent_value"
+    jsonified_request["tunnelDestGroupId"] = "tunnel_dest_group_id_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).create_tunnel_dest_group._get_unset_required_fields(jsonified_request)
+    # Check that path parameters and body parameters are not mixing in.
+    assert not set(unset_fields) - set(("tunnel_dest_group_id",))
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "parent" in jsonified_request
+    assert jsonified_request["parent"] == "parent_value"
+    assert "tunnelDestGroupId" in jsonified_request
+    assert jsonified_request["tunnelDestGroupId"] == "tunnel_dest_group_id_value"
+
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.TunnelDestGroup()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "post",
+                "query_params": pb_request,
+            }
+            transcode_result["body"] = pb_request
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.TunnelDestGroup.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.create_tunnel_dest_group(request)
+
+            expected_params = [
+                (
+                    "tunnelDestGroupId",
+                    "",
+                ),
+                ("$alt", "json;enum-encoding=int"),
+            ]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_create_tunnel_dest_group_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.create_tunnel_dest_group._get_unset_required_fields({})
+    assert set(unset_fields) == (
+        set(("tunnelDestGroupId",))
+        & set(
+            (
+                "parent",
+                "tunnelDestGroup",
+                "tunnelDestGroupId",
+            )
+        )
+    )
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_create_tunnel_dest_group_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyAdminServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "post_create_tunnel_dest_group",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "pre_create_tunnel_dest_group",
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.CreateTunnelDestGroupRequest.pb(
+            service.CreateTunnelDestGroupRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.TunnelDestGroup.to_json(
+            service.TunnelDestGroup()
+        )
+
+        request = service.CreateTunnelDestGroupRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.TunnelDestGroup()
+
+        client.create_tunnel_dest_group(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_create_tunnel_dest_group_rest_bad_request(
+    transport: str = "rest", request_type=service.CreateTunnelDestGroupRequest
+):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1/iap_tunnel/locations/sample2"}
+    request_init["tunnel_dest_group"] = {
+        "name": "name_value",
+        "cidrs": ["cidrs_value1", "cidrs_value2"],
+        "fqdns": ["fqdns_value1", "fqdns_value2"],
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.create_tunnel_dest_group(request)
+
+
+def test_create_tunnel_dest_group_rest_flattened():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.TunnelDestGroup()
+
+        # get arguments that satisfy an http rule for this method
+        sample_request = {"parent": "projects/sample1/iap_tunnel/locations/sample2"}
+
+        # get truthy value for each flattened field
+        mock_args = dict(
+            parent="parent_value",
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            tunnel_dest_group_id="tunnel_dest_group_id_value",
+        )
+        mock_args.update(sample_request)
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.TunnelDestGroup.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+
+        client.create_tunnel_dest_group(**mock_args)
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(req.mock_calls) == 1
+        _, args, _ = req.mock_calls[0]
+        assert path_template.validate(
+            "%s/v1/{parent=projects/*/iap_tunnel/locations/*}/destGroups"
+            % client.transport._host,
+            args[1],
+        )
+
+
+def test_create_tunnel_dest_group_rest_flattened_error(transport: str = "rest"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        client.create_tunnel_dest_group(
+            service.CreateTunnelDestGroupRequest(),
+            parent="parent_value",
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            tunnel_dest_group_id="tunnel_dest_group_id_value",
+        )
+
+
+def test_create_tunnel_dest_group_rest_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.GetTunnelDestGroupRequest,
+        dict,
+    ],
+)
+def test_get_tunnel_dest_group_rest(request_type):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3"
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.TunnelDestGroup(
+            name="name_value",
+            cidrs=["cidrs_value"],
+            fqdns=["fqdns_value"],
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.TunnelDestGroup.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.get_tunnel_dest_group(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.TunnelDestGroup)
+    assert response.name == "name_value"
+    assert response.cidrs == ["cidrs_value"]
+    assert response.fqdns == ["fqdns_value"]
+
+
+def test_get_tunnel_dest_group_rest_required_fields(
+    request_type=service.GetTunnelDestGroupRequest,
+):
+    transport_class = transports.IdentityAwareProxyAdminServiceRestTransport
+
+    request_init = {}
+    request_init["name"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).get_tunnel_dest_group._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["name"] = "name_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).get_tunnel_dest_group._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "name" in jsonified_request
+    assert jsonified_request["name"] == "name_value"
+
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.TunnelDestGroup()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "get",
+                "query_params": pb_request,
+            }
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.TunnelDestGroup.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.get_tunnel_dest_group(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_get_tunnel_dest_group_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.get_tunnel_dest_group._get_unset_required_fields({})
+    assert set(unset_fields) == (set(()) & set(("name",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_get_tunnel_dest_group_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyAdminServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "post_get_tunnel_dest_group",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "pre_get_tunnel_dest_group",
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.GetTunnelDestGroupRequest.pb(
+            service.GetTunnelDestGroupRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.TunnelDestGroup.to_json(
+            service.TunnelDestGroup()
+        )
+
+        request = service.GetTunnelDestGroupRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.TunnelDestGroup()
+
+        client.get_tunnel_dest_group(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_get_tunnel_dest_group_rest_bad_request(
+    transport: str = "rest", request_type=service.GetTunnelDestGroupRequest
+):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3"
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.get_tunnel_dest_group(request)
+
+
+def test_get_tunnel_dest_group_rest_flattened():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.TunnelDestGroup()
+
+        # get arguments that satisfy an http rule for this method
+        sample_request = {
+            "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3"
+        }
+
+        # get truthy value for each flattened field
+        mock_args = dict(
+            name="name_value",
+        )
+        mock_args.update(sample_request)
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.TunnelDestGroup.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+
+        client.get_tunnel_dest_group(**mock_args)
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(req.mock_calls) == 1
+        _, args, _ = req.mock_calls[0]
+        assert path_template.validate(
+            "%s/v1/{name=projects/*/iap_tunnel/locations/*/destGroups/*}"
+            % client.transport._host,
+            args[1],
+        )
+
+
+def test_get_tunnel_dest_group_rest_flattened_error(transport: str = "rest"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        client.get_tunnel_dest_group(
+            service.GetTunnelDestGroupRequest(),
+            name="name_value",
+        )
+
+
+def test_get_tunnel_dest_group_rest_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.DeleteTunnelDestGroupRequest,
+        dict,
+    ],
+)
+def test_delete_tunnel_dest_group_rest(request_type):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3"
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = None
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        json_return_value = ""
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.delete_tunnel_dest_group(request)
+
+    # Establish that the response is the type that we expect.
+    assert response is None
+
+
+def test_delete_tunnel_dest_group_rest_required_fields(
+    request_type=service.DeleteTunnelDestGroupRequest,
+):
+    transport_class = transports.IdentityAwareProxyAdminServiceRestTransport
+
+    request_init = {}
+    request_init["name"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).delete_tunnel_dest_group._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["name"] = "name_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).delete_tunnel_dest_group._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "name" in jsonified_request
+    assert jsonified_request["name"] == "name_value"
+
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = None
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "delete",
+                "query_params": pb_request,
+            }
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+            json_return_value = ""
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.delete_tunnel_dest_group(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_delete_tunnel_dest_group_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.delete_tunnel_dest_group._get_unset_required_fields({})
+    assert set(unset_fields) == (set(()) & set(("name",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_delete_tunnel_dest_group_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyAdminServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "pre_delete_tunnel_dest_group",
+    ) as pre:
+        pre.assert_not_called()
+        pb_message = service.DeleteTunnelDestGroupRequest.pb(
+            service.DeleteTunnelDestGroupRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+
+        request = service.DeleteTunnelDestGroupRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+
+        client.delete_tunnel_dest_group(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+
+
+def test_delete_tunnel_dest_group_rest_bad_request(
+    transport: str = "rest", request_type=service.DeleteTunnelDestGroupRequest
+):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3"
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.delete_tunnel_dest_group(request)
+
+
+def test_delete_tunnel_dest_group_rest_flattened():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = None
+
+        # get arguments that satisfy an http rule for this method
+        sample_request = {
+            "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3"
+        }
+
+        # get truthy value for each flattened field
+        mock_args = dict(
+            name="name_value",
+        )
+        mock_args.update(sample_request)
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        json_return_value = ""
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+
+        client.delete_tunnel_dest_group(**mock_args)
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(req.mock_calls) == 1
+        _, args, _ = req.mock_calls[0]
+        assert path_template.validate(
+            "%s/v1/{name=projects/*/iap_tunnel/locations/*/destGroups/*}"
+            % client.transport._host,
+            args[1],
+        )
+
+
+def test_delete_tunnel_dest_group_rest_flattened_error(transport: str = "rest"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        client.delete_tunnel_dest_group(
+            service.DeleteTunnelDestGroupRequest(),
+            name="name_value",
+        )
+
+
+def test_delete_tunnel_dest_group_rest_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.UpdateTunnelDestGroupRequest,
+        dict,
+    ],
+)
+def test_update_tunnel_dest_group_rest(request_type):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "tunnel_dest_group": {
+            "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3"
+        }
+    }
+    request_init["tunnel_dest_group"] = {
+        "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3",
+        "cidrs": ["cidrs_value1", "cidrs_value2"],
+        "fqdns": ["fqdns_value1", "fqdns_value2"],
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.TunnelDestGroup(
+            name="name_value",
+            cidrs=["cidrs_value"],
+            fqdns=["fqdns_value"],
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.TunnelDestGroup.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.update_tunnel_dest_group(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.TunnelDestGroup)
+    assert response.name == "name_value"
+    assert response.cidrs == ["cidrs_value"]
+    assert response.fqdns == ["fqdns_value"]
+
+
+def test_update_tunnel_dest_group_rest_required_fields(
+    request_type=service.UpdateTunnelDestGroupRequest,
+):
+    transport_class = transports.IdentityAwareProxyAdminServiceRestTransport
+
+    request_init = {}
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).update_tunnel_dest_group._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).update_tunnel_dest_group._get_unset_required_fields(jsonified_request)
+    # Check that path parameters and body parameters are not mixing in.
+    assert not set(unset_fields) - set(("update_mask",))
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.TunnelDestGroup()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "patch",
+                "query_params": pb_request,
+            }
+            transcode_result["body"] = pb_request
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.TunnelDestGroup.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.update_tunnel_dest_group(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_update_tunnel_dest_group_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.update_tunnel_dest_group._get_unset_required_fields({})
+    assert set(unset_fields) == (set(("updateMask",)) & set(("tunnelDestGroup",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_update_tunnel_dest_group_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyAdminServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyAdminServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "post_update_tunnel_dest_group",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceRestInterceptor,
+        "pre_update_tunnel_dest_group",
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.UpdateTunnelDestGroupRequest.pb(
+            service.UpdateTunnelDestGroupRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.TunnelDestGroup.to_json(
+            service.TunnelDestGroup()
+        )
+
+        request = service.UpdateTunnelDestGroupRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.TunnelDestGroup()
+
+        client.update_tunnel_dest_group(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_update_tunnel_dest_group_rest_bad_request(
+    transport: str = "rest", request_type=service.UpdateTunnelDestGroupRequest
+):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "tunnel_dest_group": {
+            "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3"
+        }
+    }
+    request_init["tunnel_dest_group"] = {
+        "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3",
+        "cidrs": ["cidrs_value1", "cidrs_value2"],
+        "fqdns": ["fqdns_value1", "fqdns_value2"],
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.update_tunnel_dest_group(request)
+
+
+def test_update_tunnel_dest_group_rest_flattened():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.TunnelDestGroup()
+
+        # get arguments that satisfy an http rule for this method
+        sample_request = {
+            "tunnel_dest_group": {
+                "name": "projects/sample1/iap_tunnel/locations/sample2/destGroups/sample3"
+            }
+        }
+
+        # get truthy value for each flattened field
+        mock_args = dict(
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            update_mask=field_mask_pb2.FieldMask(paths=["paths_value"]),
+        )
+        mock_args.update(sample_request)
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.TunnelDestGroup.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+
+        client.update_tunnel_dest_group(**mock_args)
+
+        # Establish that the underlying call was made with the expected
+        # request object values.
+        assert len(req.mock_calls) == 1
+        _, args, _ = req.mock_calls[0]
+        assert path_template.validate(
+            "%s/v1/{tunnel_dest_group.name=projects/*/iap_tunnel/locations/*/destGroups/*}"
+            % client.transport._host,
+            args[1],
+        )
+
+
+def test_update_tunnel_dest_group_rest_flattened_error(transport: str = "rest"):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Attempting to call a method with both a request object and flattened
+    # fields is an error.
+    with pytest.raises(ValueError):
+        client.update_tunnel_dest_group(
+            service.UpdateTunnelDestGroupRequest(),
+            tunnel_dest_group=service.TunnelDestGroup(name="name_value"),
+            update_mask=field_mask_pb2.FieldMask(paths=["paths_value"]),
+        )
+
+
+def test_update_tunnel_dest_group_rest_error():
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+def test_credentials_transport_error():
+    # It is an error to provide credentials and a transport instance.
+    transport = transports.IdentityAwareProxyAdminServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    with pytest.raises(ValueError):
+        client = IdentityAwareProxyAdminServiceClient(
+            credentials=ga_credentials.AnonymousCredentials(),
+            transport=transport,
+        )
+
+    # It is an error to provide a credentials file and a transport instance.
+    transport = transports.IdentityAwareProxyAdminServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    with pytest.raises(ValueError):
+        client = IdentityAwareProxyAdminServiceClient(
+            client_options={"credentials_file": "credentials.json"},
+            transport=transport,
+        )
+
+    # It is an error to provide an api_key and a transport instance.
+    transport = transports.IdentityAwareProxyAdminServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    options = client_options.ClientOptions()
+    options.api_key = "api_key"
+    with pytest.raises(ValueError):
+        client = IdentityAwareProxyAdminServiceClient(
+            client_options=options,
+            transport=transport,
+        )
+
+    # It is an error to provide an api_key and a credential.
+    options = mock.Mock()
+    options.api_key = "api_key"
+    with pytest.raises(ValueError):
+        client = IdentityAwareProxyAdminServiceClient(
+            client_options=options, credentials=ga_credentials.AnonymousCredentials()
+        )
+
+    # It is an error to provide scopes and a transport instance.
+    transport = transports.IdentityAwareProxyAdminServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    with pytest.raises(ValueError):
+        client = IdentityAwareProxyAdminServiceClient(
+            client_options={"scopes": ["1", "2"]},
+            transport=transport,
+        )
+
+
+def test_transport_instance():
+    # A client may be instantiated with a custom transport instance.
+    transport = transports.IdentityAwareProxyAdminServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    client = IdentityAwareProxyAdminServiceClient(transport=transport)
+    assert client.transport is transport
+
+
+def test_transport_get_channel():
+    # A client may be instantiated with a custom transport instance.
+    transport = transports.IdentityAwareProxyAdminServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    channel = transport.grpc_channel
+    assert channel
+
+    transport = transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    channel = transport.grpc_channel
+    assert channel
+
+
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyAdminServiceGrpcTransport,
+        transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+        transports.IdentityAwareProxyAdminServiceRestTransport,
+    ],
+)
+def test_transport_adc(transport_class):
+    # Test default credentials are used if not provided.
+    with mock.patch.object(google.auth, "default") as adc:
+        adc.return_value = (ga_credentials.AnonymousCredentials(), None)
+        transport_class()
+        adc.assert_called_once()
+
+
+@pytest.mark.parametrize(
+    "transport_name",
+    [
+        "grpc",
+        "rest",
+    ],
+)
+def test_transport_kind(transport_name):
+    transport = IdentityAwareProxyAdminServiceClient.get_transport_class(
+        transport_name
+    )(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    assert transport.kind == transport_name
+
+
+def test_transport_grpc_default():
+    # A client should use the gRPC transport by default.
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    assert isinstance(
+        client.transport,
+        transports.IdentityAwareProxyAdminServiceGrpcTransport,
+    )
+
+
+def test_identity_aware_proxy_admin_service_base_transport_error():
+    # Passing both a credentials object and credentials_file should raise an error
+    with pytest.raises(core_exceptions.DuplicateCredentialArgs):
+        transport = transports.IdentityAwareProxyAdminServiceTransport(
+            credentials=ga_credentials.AnonymousCredentials(),
+            credentials_file="credentials.json",
+        )
+
+
+def test_identity_aware_proxy_admin_service_base_transport():
+    # Instantiate the base transport.
+    with mock.patch(
+        "google.cloud.iap_v1.services.identity_aware_proxy_admin_service.transports.IdentityAwareProxyAdminServiceTransport.__init__"
+    ) as Transport:
+        Transport.return_value = None
+        transport = transports.IdentityAwareProxyAdminServiceTransport(
+            credentials=ga_credentials.AnonymousCredentials(),
+        )
+
+    # Every method on the transport should just blindly
+    # raise NotImplementedError.
+    methods = (
+        "set_iam_policy",
+        "get_iam_policy",
+        "test_iam_permissions",
+        "get_iap_settings",
+        "update_iap_settings",
+        "list_tunnel_dest_groups",
+        "create_tunnel_dest_group",
+        "get_tunnel_dest_group",
+        "delete_tunnel_dest_group",
+        "update_tunnel_dest_group",
+    )
+    for method in methods:
+        with pytest.raises(NotImplementedError):
+            getattr(transport, method)(request=object())
+
+    with pytest.raises(NotImplementedError):
+        transport.close()
+
+    # Catch all for all remaining methods and properties
+    remainder = [
+        "kind",
+    ]
+    for r in remainder:
+        with pytest.raises(NotImplementedError):
+            getattr(transport, r)()
+
+
+def test_identity_aware_proxy_admin_service_base_transport_with_credentials_file():
+    # Instantiate the base transport with a credentials file
+    with mock.patch.object(
+        google.auth, "load_credentials_from_file", autospec=True
+    ) as load_creds, mock.patch(
+        "google.cloud.iap_v1.services.identity_aware_proxy_admin_service.transports.IdentityAwareProxyAdminServiceTransport._prep_wrapped_messages"
+    ) as Transport:
+        Transport.return_value = None
+        load_creds.return_value = (ga_credentials.AnonymousCredentials(), None)
+        transport = transports.IdentityAwareProxyAdminServiceTransport(
+            credentials_file="credentials.json",
+            quota_project_id="octopus",
+        )
+        load_creds.assert_called_once_with(
+            "credentials.json",
+            scopes=None,
+            default_scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            quota_project_id="octopus",
+        )
+
+
+def test_identity_aware_proxy_admin_service_base_transport_with_adc():
+    # Test the default credentials are used if credentials and credentials_file are None.
+    with mock.patch.object(google.auth, "default", autospec=True) as adc, mock.patch(
+        "google.cloud.iap_v1.services.identity_aware_proxy_admin_service.transports.IdentityAwareProxyAdminServiceTransport._prep_wrapped_messages"
+    ) as Transport:
+        Transport.return_value = None
+        adc.return_value = (ga_credentials.AnonymousCredentials(), None)
+        transport = transports.IdentityAwareProxyAdminServiceTransport()
+        adc.assert_called_once()
+
+
+def test_identity_aware_proxy_admin_service_auth_adc():
+    # If no credentials are provided, we should use ADC credentials.
+    with mock.patch.object(google.auth, "default", autospec=True) as adc:
+        adc.return_value = (ga_credentials.AnonymousCredentials(), None)
+        IdentityAwareProxyAdminServiceClient()
+        adc.assert_called_once_with(
+            scopes=None,
+            default_scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            quota_project_id=None,
+        )
+
+
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyAdminServiceGrpcTransport,
+        transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+    ],
+)
+def test_identity_aware_proxy_admin_service_transport_auth_adc(transport_class):
+    # If credentials and host are not provided, the transport class should use
+    # ADC credentials.
+    with mock.patch.object(google.auth, "default", autospec=True) as adc:
+        adc.return_value = (ga_credentials.AnonymousCredentials(), None)
+        transport_class(quota_project_id="octopus", scopes=["1", "2"])
+        adc.assert_called_once_with(
+            scopes=["1", "2"],
+            default_scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            quota_project_id="octopus",
+        )
+
+
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyAdminServiceGrpcTransport,
+        transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+        transports.IdentityAwareProxyAdminServiceRestTransport,
+    ],
+)
+def test_identity_aware_proxy_admin_service_transport_auth_gdch_credentials(
+    transport_class,
+):
+    host = "https://language.com"
+    api_audience_tests = [None, "https://language2.com"]
+    api_audience_expect = [host, "https://language2.com"]
+    for t, e in zip(api_audience_tests, api_audience_expect):
+        with mock.patch.object(google.auth, "default", autospec=True) as adc:
+            gdch_mock = mock.MagicMock()
+            type(gdch_mock).with_gdch_audience = mock.PropertyMock(
+                return_value=gdch_mock
+            )
+            adc.return_value = (gdch_mock, None)
+            transport_class(host=host, api_audience=t)
+            gdch_mock.with_gdch_audience.assert_called_once_with(e)
+
+
+@pytest.mark.parametrize(
+    "transport_class,grpc_helpers",
+    [
+        (transports.IdentityAwareProxyAdminServiceGrpcTransport, grpc_helpers),
+        (
+            transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+            grpc_helpers_async,
+        ),
+    ],
+)
+def test_identity_aware_proxy_admin_service_transport_create_channel(
+    transport_class, grpc_helpers
+):
+    # If credentials and host are not provided, the transport class should use
+    # ADC credentials.
+    with mock.patch.object(
+        google.auth, "default", autospec=True
+    ) as adc, mock.patch.object(
+        grpc_helpers, "create_channel", autospec=True
+    ) as create_channel:
+        creds = ga_credentials.AnonymousCredentials()
+        adc.return_value = (creds, None)
+        transport_class(quota_project_id="octopus", scopes=["1", "2"])
+
+        create_channel.assert_called_with(
+            "iap.googleapis.com:443",
+            credentials=creds,
+            credentials_file=None,
+            quota_project_id="octopus",
+            default_scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            scopes=["1", "2"],
+            default_host="iap.googleapis.com",
+            ssl_credentials=None,
+            options=[
+                ("grpc.max_send_message_length", -1),
+                ("grpc.max_receive_message_length", -1),
+            ],
+        )
+
+
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyAdminServiceGrpcTransport,
+        transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+    ],
+)
+def test_identity_aware_proxy_admin_service_grpc_transport_client_cert_source_for_mtls(
+    transport_class,
+):
+    cred = ga_credentials.AnonymousCredentials()
+
+    # Check ssl_channel_credentials is used if provided.
+    with mock.patch.object(transport_class, "create_channel") as mock_create_channel:
+        mock_ssl_channel_creds = mock.Mock()
+        transport_class(
+            host="squid.clam.whelk",
+            credentials=cred,
+            ssl_channel_credentials=mock_ssl_channel_creds,
+        )
+        mock_create_channel.assert_called_once_with(
+            "squid.clam.whelk:443",
+            credentials=cred,
+            credentials_file=None,
+            scopes=None,
+            ssl_credentials=mock_ssl_channel_creds,
+            quota_project_id=None,
+            options=[
+                ("grpc.max_send_message_length", -1),
+                ("grpc.max_receive_message_length", -1),
+            ],
+        )
+
+    # Check if ssl_channel_credentials is not provided, then client_cert_source_for_mtls
+    # is used.
+    with mock.patch.object(transport_class, "create_channel", return_value=mock.Mock()):
+        with mock.patch("grpc.ssl_channel_credentials") as mock_ssl_cred:
+            transport_class(
+                credentials=cred,
+                client_cert_source_for_mtls=client_cert_source_callback,
+            )
+            expected_cert, expected_key = client_cert_source_callback()
+            mock_ssl_cred.assert_called_once_with(
+                certificate_chain=expected_cert, private_key=expected_key
+            )
+
+
+def test_identity_aware_proxy_admin_service_http_transport_client_cert_source_for_mtls():
+    cred = ga_credentials.AnonymousCredentials()
+    with mock.patch(
+        "google.auth.transport.requests.AuthorizedSession.configure_mtls_channel"
+    ) as mock_configure_mtls_channel:
+        transports.IdentityAwareProxyAdminServiceRestTransport(
+            credentials=cred, client_cert_source_for_mtls=client_cert_source_callback
+        )
+        mock_configure_mtls_channel.assert_called_once_with(client_cert_source_callback)
+
+
+@pytest.mark.parametrize(
+    "transport_name",
+    [
+        "grpc",
+        "grpc_asyncio",
+        "rest",
+    ],
+)
+def test_identity_aware_proxy_admin_service_host_no_port(transport_name):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        client_options=client_options.ClientOptions(api_endpoint="iap.googleapis.com"),
+        transport=transport_name,
+    )
+    assert client.transport._host == (
+        "iap.googleapis.com:443"
+        if transport_name in ["grpc", "grpc_asyncio"]
+        else "https://iap.googleapis.com"
+    )
+
+
+@pytest.mark.parametrize(
+    "transport_name",
+    [
+        "grpc",
+        "grpc_asyncio",
+        "rest",
+    ],
+)
+def test_identity_aware_proxy_admin_service_host_with_port(transport_name):
+    client = IdentityAwareProxyAdminServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        client_options=client_options.ClientOptions(
+            api_endpoint="iap.googleapis.com:8000"
+        ),
+        transport=transport_name,
+    )
+    assert client.transport._host == (
+        "iap.googleapis.com:8000"
+        if transport_name in ["grpc", "grpc_asyncio"]
+        else "https://iap.googleapis.com:8000"
+    )
+
+
+@pytest.mark.parametrize(
+    "transport_name",
+    [
+        "rest",
+    ],
+)
+def test_identity_aware_proxy_admin_service_client_transport_session_collision(
+    transport_name,
+):
+    creds1 = ga_credentials.AnonymousCredentials()
+    creds2 = ga_credentials.AnonymousCredentials()
+    client1 = IdentityAwareProxyAdminServiceClient(
+        credentials=creds1,
+        transport=transport_name,
+    )
+    client2 = IdentityAwareProxyAdminServiceClient(
+        credentials=creds2,
+        transport=transport_name,
+    )
+    session1 = client1.transport.set_iam_policy._session
+    session2 = client2.transport.set_iam_policy._session
+    assert session1 != session2
+    session1 = client1.transport.get_iam_policy._session
+    session2 = client2.transport.get_iam_policy._session
+    assert session1 != session2
+    session1 = client1.transport.test_iam_permissions._session
+    session2 = client2.transport.test_iam_permissions._session
+    assert session1 != session2
+    session1 = client1.transport.get_iap_settings._session
+    session2 = client2.transport.get_iap_settings._session
+    assert session1 != session2
+    session1 = client1.transport.update_iap_settings._session
+    session2 = client2.transport.update_iap_settings._session
+    assert session1 != session2
+    session1 = client1.transport.list_tunnel_dest_groups._session
+    session2 = client2.transport.list_tunnel_dest_groups._session
+    assert session1 != session2
+    session1 = client1.transport.create_tunnel_dest_group._session
+    session2 = client2.transport.create_tunnel_dest_group._session
+    assert session1 != session2
+    session1 = client1.transport.get_tunnel_dest_group._session
+    session2 = client2.transport.get_tunnel_dest_group._session
+    assert session1 != session2
+    session1 = client1.transport.delete_tunnel_dest_group._session
+    session2 = client2.transport.delete_tunnel_dest_group._session
+    assert session1 != session2
+    session1 = client1.transport.update_tunnel_dest_group._session
+    session2 = client2.transport.update_tunnel_dest_group._session
+    assert session1 != session2
+
+
+def test_identity_aware_proxy_admin_service_grpc_transport_channel():
+    channel = grpc.secure_channel("http://localhost/", grpc.local_channel_credentials())
+
+    # Check that channel is used if provided.
+    transport = transports.IdentityAwareProxyAdminServiceGrpcTransport(
+        host="squid.clam.whelk",
+        channel=channel,
+    )
+    assert transport.grpc_channel == channel
+    assert transport._host == "squid.clam.whelk:443"
+    assert transport._ssl_channel_credentials == None
+
+
+def test_identity_aware_proxy_admin_service_grpc_asyncio_transport_channel():
+    channel = aio.secure_channel("http://localhost/", grpc.local_channel_credentials())
+
+    # Check that channel is used if provided.
+    transport = transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport(
+        host="squid.clam.whelk",
+        channel=channel,
+    )
+    assert transport.grpc_channel == channel
+    assert transport._host == "squid.clam.whelk:443"
+    assert transport._ssl_channel_credentials == None
+
+
+# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are
+# removed from grpc/grpc_asyncio transport constructor.
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyAdminServiceGrpcTransport,
+        transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+    ],
+)
+def test_identity_aware_proxy_admin_service_transport_channel_mtls_with_client_cert_source(
+    transport_class,
+):
+    with mock.patch(
+        "grpc.ssl_channel_credentials", autospec=True
+    ) as grpc_ssl_channel_cred:
+        with mock.patch.object(
+            transport_class, "create_channel"
+        ) as grpc_create_channel:
+            mock_ssl_cred = mock.Mock()
+            grpc_ssl_channel_cred.return_value = mock_ssl_cred
+
+            mock_grpc_channel = mock.Mock()
+            grpc_create_channel.return_value = mock_grpc_channel
+
+            cred = ga_credentials.AnonymousCredentials()
+            with pytest.warns(DeprecationWarning):
+                with mock.patch.object(google.auth, "default") as adc:
+                    adc.return_value = (cred, None)
+                    transport = transport_class(
+                        host="squid.clam.whelk",
+                        api_mtls_endpoint="mtls.squid.clam.whelk",
+                        client_cert_source=client_cert_source_callback,
+                    )
+                    adc.assert_called_once()
+
+            grpc_ssl_channel_cred.assert_called_once_with(
+                certificate_chain=b"cert bytes", private_key=b"key bytes"
+            )
+            grpc_create_channel.assert_called_once_with(
+                "mtls.squid.clam.whelk:443",
+                credentials=cred,
+                credentials_file=None,
+                scopes=None,
+                ssl_credentials=mock_ssl_cred,
+                quota_project_id=None,
+                options=[
+                    ("grpc.max_send_message_length", -1),
+                    ("grpc.max_receive_message_length", -1),
+                ],
+            )
+            assert transport.grpc_channel == mock_grpc_channel
+            assert transport._ssl_channel_credentials == mock_ssl_cred
+
+
+# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are
+# removed from grpc/grpc_asyncio transport constructor.
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyAdminServiceGrpcTransport,
+        transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+    ],
+)
+def test_identity_aware_proxy_admin_service_transport_channel_mtls_with_adc(
+    transport_class,
+):
+    mock_ssl_cred = mock.Mock()
+    with mock.patch.multiple(
+        "google.auth.transport.grpc.SslCredentials",
+        __init__=mock.Mock(return_value=None),
+        ssl_credentials=mock.PropertyMock(return_value=mock_ssl_cred),
+    ):
+        with mock.patch.object(
+            transport_class, "create_channel"
+        ) as grpc_create_channel:
+            mock_grpc_channel = mock.Mock()
+            grpc_create_channel.return_value = mock_grpc_channel
+            mock_cred = mock.Mock()
+
+            with pytest.warns(DeprecationWarning):
+                transport = transport_class(
+                    host="squid.clam.whelk",
+                    credentials=mock_cred,
+                    api_mtls_endpoint="mtls.squid.clam.whelk",
+                    client_cert_source=None,
+                )
+
+            grpc_create_channel.assert_called_once_with(
+                "mtls.squid.clam.whelk:443",
+                credentials=mock_cred,
+                credentials_file=None,
+                scopes=None,
+                ssl_credentials=mock_ssl_cred,
+                quota_project_id=None,
+                options=[
+                    ("grpc.max_send_message_length", -1),
+                    ("grpc.max_receive_message_length", -1),
+                ],
+            )
+            assert transport.grpc_channel == mock_grpc_channel
+
+
+def test_tunnel_dest_group_path():
+    project = "squid"
+    location = "clam"
+    dest_group = "whelk"
+    expected = "projects/{project}/iap_tunnel/locations/{location}/destGroups/{dest_group}".format(
+        project=project,
+        location=location,
+        dest_group=dest_group,
+    )
+    actual = IdentityAwareProxyAdminServiceClient.tunnel_dest_group_path(
+        project, location, dest_group
+    )
+    assert expected == actual
+
+
+def test_parse_tunnel_dest_group_path():
+    expected = {
+        "project": "octopus",
+        "location": "oyster",
+        "dest_group": "nudibranch",
+    }
+    path = IdentityAwareProxyAdminServiceClient.tunnel_dest_group_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyAdminServiceClient.parse_tunnel_dest_group_path(path)
+    assert expected == actual
+
+
+def test_tunnel_location_path():
+    project = "cuttlefish"
+    location = "mussel"
+    expected = "projects/{project}/iap_tunnel/locations/{location}".format(
+        project=project,
+        location=location,
+    )
+    actual = IdentityAwareProxyAdminServiceClient.tunnel_location_path(
+        project, location
+    )
+    assert expected == actual
+
+
+def test_parse_tunnel_location_path():
+    expected = {
+        "project": "winkle",
+        "location": "nautilus",
+    }
+    path = IdentityAwareProxyAdminServiceClient.tunnel_location_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyAdminServiceClient.parse_tunnel_location_path(path)
+    assert expected == actual
+
+
+def test_common_billing_account_path():
+    billing_account = "scallop"
+    expected = "billingAccounts/{billing_account}".format(
+        billing_account=billing_account,
+    )
+    actual = IdentityAwareProxyAdminServiceClient.common_billing_account_path(
+        billing_account
+    )
+    assert expected == actual
+
+
+def test_parse_common_billing_account_path():
+    expected = {
+        "billing_account": "abalone",
+    }
+    path = IdentityAwareProxyAdminServiceClient.common_billing_account_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyAdminServiceClient.parse_common_billing_account_path(
+        path
+    )
+    assert expected == actual
+
+
+def test_common_folder_path():
+    folder = "squid"
+    expected = "folders/{folder}".format(
+        folder=folder,
+    )
+    actual = IdentityAwareProxyAdminServiceClient.common_folder_path(folder)
+    assert expected == actual
+
+
+def test_parse_common_folder_path():
+    expected = {
+        "folder": "clam",
+    }
+    path = IdentityAwareProxyAdminServiceClient.common_folder_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyAdminServiceClient.parse_common_folder_path(path)
+    assert expected == actual
+
+
+def test_common_organization_path():
+    organization = "whelk"
+    expected = "organizations/{organization}".format(
+        organization=organization,
+    )
+    actual = IdentityAwareProxyAdminServiceClient.common_organization_path(organization)
+    assert expected == actual
+
+
+def test_parse_common_organization_path():
+    expected = {
+        "organization": "octopus",
+    }
+    path = IdentityAwareProxyAdminServiceClient.common_organization_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyAdminServiceClient.parse_common_organization_path(path)
+    assert expected == actual
+
+
+def test_common_project_path():
+    project = "oyster"
+    expected = "projects/{project}".format(
+        project=project,
+    )
+    actual = IdentityAwareProxyAdminServiceClient.common_project_path(project)
+    assert expected == actual
+
+
+def test_parse_common_project_path():
+    expected = {
+        "project": "nudibranch",
+    }
+    path = IdentityAwareProxyAdminServiceClient.common_project_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyAdminServiceClient.parse_common_project_path(path)
+    assert expected == actual
+
+
+def test_common_location_path():
+    project = "cuttlefish"
+    location = "mussel"
+    expected = "projects/{project}/locations/{location}".format(
+        project=project,
+        location=location,
+    )
+    actual = IdentityAwareProxyAdminServiceClient.common_location_path(
+        project, location
+    )
+    assert expected == actual
+
+
+def test_parse_common_location_path():
+    expected = {
+        "project": "winkle",
+        "location": "nautilus",
+    }
+    path = IdentityAwareProxyAdminServiceClient.common_location_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyAdminServiceClient.parse_common_location_path(path)
+    assert expected == actual
+
+
+def test_client_with_default_client_info():
+    client_info = gapic_v1.client_info.ClientInfo()
+
+    with mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceTransport, "_prep_wrapped_messages"
+    ) as prep:
+        client = IdentityAwareProxyAdminServiceClient(
+            credentials=ga_credentials.AnonymousCredentials(),
+            client_info=client_info,
+        )
+        prep.assert_called_once_with(client_info)
+
+    with mock.patch.object(
+        transports.IdentityAwareProxyAdminServiceTransport, "_prep_wrapped_messages"
+    ) as prep:
+        transport_class = IdentityAwareProxyAdminServiceClient.get_transport_class()
+        transport = transport_class(
+            credentials=ga_credentials.AnonymousCredentials(),
+            client_info=client_info,
+        )
+        prep.assert_called_once_with(client_info)
+
+
+@pytest.mark.asyncio
+async def test_transport_close_async():
+    client = IdentityAwareProxyAdminServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc_asyncio",
+    )
+    with mock.patch.object(
+        type(getattr(client.transport, "grpc_channel")), "close"
+    ) as close:
+        async with client:
+            close.assert_not_called()
+        close.assert_called_once()
+
+
+def test_transport_close():
+    transports = {
+        "rest": "_session",
+        "grpc": "_grpc_channel",
+    }
+
+    for transport, close_name in transports.items():
+        client = IdentityAwareProxyAdminServiceClient(
+            credentials=ga_credentials.AnonymousCredentials(), transport=transport
+        )
+        with mock.patch.object(
+            type(getattr(client.transport, close_name)), "close"
+        ) as close:
+            with client:
+                close.assert_not_called()
+            close.assert_called_once()
+
+
+def test_client_ctx():
+    transports = [
+        "rest",
+        "grpc",
+    ]
+    for transport in transports:
+        client = IdentityAwareProxyAdminServiceClient(
+            credentials=ga_credentials.AnonymousCredentials(), transport=transport
+        )
+        # Test client calls underlying transport.
+        with mock.patch.object(type(client.transport), "close") as close:
+            close.assert_not_called()
+            with client:
+                pass
+            close.assert_called()
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class",
+    [
+        (
+            IdentityAwareProxyAdminServiceClient,
+            transports.IdentityAwareProxyAdminServiceGrpcTransport,
+        ),
+        (
+            IdentityAwareProxyAdminServiceAsyncClient,
+            transports.IdentityAwareProxyAdminServiceGrpcAsyncIOTransport,
+        ),
+    ],
+)
+def test_api_key_credentials(client_class, transport_class):
+    with mock.patch.object(
+        google.auth._default, "get_api_key_credentials", create=True
+    ) as get_api_key_credentials:
+        mock_cred = mock.Mock()
+        get_api_key_credentials.return_value = mock_cred
+        options = client_options.ClientOptions()
+        options.api_key = "api_key"
+        with mock.patch.object(transport_class, "__init__") as patched:
+            patched.return_value = None
+            client = client_class(client_options=options)
+            patched.assert_called_once_with(
+                credentials=mock_cred,
+                credentials_file=None,
+                host=client.DEFAULT_ENDPOINT,
+                scopes=None,
+                client_cert_source_for_mtls=None,
+                quota_project_id=None,
+                client_info=transports.base.DEFAULT_CLIENT_INFO,
+                always_use_jwt_access=True,
+                api_audience=None,
+            )
diff --git a/packages/google-cloud-iap/tests/unit/gapic/iap_v1/test_identity_aware_proxy_o_auth_service.py b/packages/google-cloud-iap/tests/unit/gapic/iap_v1/test_identity_aware_proxy_o_auth_service.py
new file mode 100644
index 000000000000..b246966534b8
--- /dev/null
+++ b/packages/google-cloud-iap/tests/unit/gapic/iap_v1/test_identity_aware_proxy_o_auth_service.py
@@ -0,0 +1,4874 @@
+# -*- coding: utf-8 -*-
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+import os
+
+# try/except added for compatibility with python < 3.8
+try:
+    from unittest import mock
+    from unittest.mock import AsyncMock  # pragma: NO COVER
+except ImportError:  # pragma: NO COVER
+    import mock
+
+from collections.abc import Iterable
+import json
+import math
+
+from google.api_core import gapic_v1, grpc_helpers, grpc_helpers_async, path_template
+from google.api_core import client_options
+from google.api_core import exceptions as core_exceptions
+import google.auth
+from google.auth import credentials as ga_credentials
+from google.auth.exceptions import MutualTLSChannelError
+from google.oauth2 import service_account
+from google.protobuf import json_format
+import grpc
+from grpc.experimental import aio
+from proto.marshal.rules import wrappers
+from proto.marshal.rules.dates import DurationRule, TimestampRule
+import pytest
+from requests import PreparedRequest, Request, Response
+from requests.sessions import Session
+
+from google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service import (
+    IdentityAwareProxyOAuthServiceAsyncClient,
+    IdentityAwareProxyOAuthServiceClient,
+    pagers,
+    transports,
+)
+from google.cloud.iap_v1.types import service
+
+
+def client_cert_source_callback():
+    return b"cert bytes", b"key bytes"
+
+
+# If default endpoint is localhost, then default mtls endpoint will be the same.
+# This method modifies the default endpoint so the client can produce a different
+# mtls endpoint for endpoint testing purposes.
+def modify_default_endpoint(client):
+    return (
+        "foo.googleapis.com"
+        if ("localhost" in client.DEFAULT_ENDPOINT)
+        else client.DEFAULT_ENDPOINT
+    )
+
+
+def test__get_default_mtls_endpoint():
+    api_endpoint = "example.googleapis.com"
+    api_mtls_endpoint = "example.mtls.googleapis.com"
+    sandbox_endpoint = "example.sandbox.googleapis.com"
+    sandbox_mtls_endpoint = "example.mtls.sandbox.googleapis.com"
+    non_googleapi = "api.example.com"
+
+    assert IdentityAwareProxyOAuthServiceClient._get_default_mtls_endpoint(None) is None
+    assert (
+        IdentityAwareProxyOAuthServiceClient._get_default_mtls_endpoint(api_endpoint)
+        == api_mtls_endpoint
+    )
+    assert (
+        IdentityAwareProxyOAuthServiceClient._get_default_mtls_endpoint(
+            api_mtls_endpoint
+        )
+        == api_mtls_endpoint
+    )
+    assert (
+        IdentityAwareProxyOAuthServiceClient._get_default_mtls_endpoint(
+            sandbox_endpoint
+        )
+        == sandbox_mtls_endpoint
+    )
+    assert (
+        IdentityAwareProxyOAuthServiceClient._get_default_mtls_endpoint(
+            sandbox_mtls_endpoint
+        )
+        == sandbox_mtls_endpoint
+    )
+    assert (
+        IdentityAwareProxyOAuthServiceClient._get_default_mtls_endpoint(non_googleapi)
+        == non_googleapi
+    )
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_name",
+    [
+        (IdentityAwareProxyOAuthServiceClient, "grpc"),
+        (IdentityAwareProxyOAuthServiceAsyncClient, "grpc_asyncio"),
+        (IdentityAwareProxyOAuthServiceClient, "rest"),
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_client_from_service_account_info(
+    client_class, transport_name
+):
+    creds = ga_credentials.AnonymousCredentials()
+    with mock.patch.object(
+        service_account.Credentials, "from_service_account_info"
+    ) as factory:
+        factory.return_value = creds
+        info = {"valid": True}
+        client = client_class.from_service_account_info(info, transport=transport_name)
+        assert client.transport._credentials == creds
+        assert isinstance(client, client_class)
+
+        assert client.transport._host == (
+            "iap.googleapis.com:443"
+            if transport_name in ["grpc", "grpc_asyncio"]
+            else "https://iap.googleapis.com"
+        )
+
+
+@pytest.mark.parametrize(
+    "transport_class,transport_name",
+    [
+        (transports.IdentityAwareProxyOAuthServiceGrpcTransport, "grpc"),
+        (transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport, "grpc_asyncio"),
+        (transports.IdentityAwareProxyOAuthServiceRestTransport, "rest"),
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_client_service_account_always_use_jwt(
+    transport_class, transport_name
+):
+    with mock.patch.object(
+        service_account.Credentials, "with_always_use_jwt_access", create=True
+    ) as use_jwt:
+        creds = service_account.Credentials(None, None, None)
+        transport = transport_class(credentials=creds, always_use_jwt_access=True)
+        use_jwt.assert_called_once_with(True)
+
+    with mock.patch.object(
+        service_account.Credentials, "with_always_use_jwt_access", create=True
+    ) as use_jwt:
+        creds = service_account.Credentials(None, None, None)
+        transport = transport_class(credentials=creds, always_use_jwt_access=False)
+        use_jwt.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_name",
+    [
+        (IdentityAwareProxyOAuthServiceClient, "grpc"),
+        (IdentityAwareProxyOAuthServiceAsyncClient, "grpc_asyncio"),
+        (IdentityAwareProxyOAuthServiceClient, "rest"),
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_client_from_service_account_file(
+    client_class, transport_name
+):
+    creds = ga_credentials.AnonymousCredentials()
+    with mock.patch.object(
+        service_account.Credentials, "from_service_account_file"
+    ) as factory:
+        factory.return_value = creds
+        client = client_class.from_service_account_file(
+            "dummy/file/path.json", transport=transport_name
+        )
+        assert client.transport._credentials == creds
+        assert isinstance(client, client_class)
+
+        client = client_class.from_service_account_json(
+            "dummy/file/path.json", transport=transport_name
+        )
+        assert client.transport._credentials == creds
+        assert isinstance(client, client_class)
+
+        assert client.transport._host == (
+            "iap.googleapis.com:443"
+            if transport_name in ["grpc", "grpc_asyncio"]
+            else "https://iap.googleapis.com"
+        )
+
+
+def test_identity_aware_proxy_o_auth_service_client_get_transport_class():
+    transport = IdentityAwareProxyOAuthServiceClient.get_transport_class()
+    available_transports = [
+        transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+        transports.IdentityAwareProxyOAuthServiceRestTransport,
+    ]
+    assert transport in available_transports
+
+    transport = IdentityAwareProxyOAuthServiceClient.get_transport_class("grpc")
+    assert transport == transports.IdentityAwareProxyOAuthServiceGrpcTransport
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class,transport_name",
+    [
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+            "grpc",
+        ),
+        (
+            IdentityAwareProxyOAuthServiceAsyncClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+        ),
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceRestTransport,
+            "rest",
+        ),
+    ],
+)
+@mock.patch.object(
+    IdentityAwareProxyOAuthServiceClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyOAuthServiceClient),
+)
+@mock.patch.object(
+    IdentityAwareProxyOAuthServiceAsyncClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyOAuthServiceAsyncClient),
+)
+def test_identity_aware_proxy_o_auth_service_client_client_options(
+    client_class, transport_class, transport_name
+):
+    # Check that if channel is provided we won't create a new one.
+    with mock.patch.object(
+        IdentityAwareProxyOAuthServiceClient, "get_transport_class"
+    ) as gtc:
+        transport = transport_class(credentials=ga_credentials.AnonymousCredentials())
+        client = client_class(transport=transport)
+        gtc.assert_not_called()
+
+    # Check that if channel is provided via str we will create a new one.
+    with mock.patch.object(
+        IdentityAwareProxyOAuthServiceClient, "get_transport_class"
+    ) as gtc:
+        client = client_class(transport=transport_name)
+        gtc.assert_called()
+
+    # Check the case api_endpoint is provided.
+    options = client_options.ClientOptions(api_endpoint="squid.clam.whelk")
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(transport=transport_name, client_options=options)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file=None,
+            host="squid.clam.whelk",
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+
+    # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is
+    # "never".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}):
+        with mock.patch.object(transport_class, "__init__") as patched:
+            patched.return_value = None
+            client = client_class(transport=transport_name)
+            patched.assert_called_once_with(
+                credentials=None,
+                credentials_file=None,
+                host=client.DEFAULT_ENDPOINT,
+                scopes=None,
+                client_cert_source_for_mtls=None,
+                quota_project_id=None,
+                client_info=transports.base.DEFAULT_CLIENT_INFO,
+                always_use_jwt_access=True,
+                api_audience=None,
+            )
+
+    # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT is
+    # "always".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}):
+        with mock.patch.object(transport_class, "__init__") as patched:
+            patched.return_value = None
+            client = client_class(transport=transport_name)
+            patched.assert_called_once_with(
+                credentials=None,
+                credentials_file=None,
+                host=client.DEFAULT_MTLS_ENDPOINT,
+                scopes=None,
+                client_cert_source_for_mtls=None,
+                quota_project_id=None,
+                client_info=transports.base.DEFAULT_CLIENT_INFO,
+                always_use_jwt_access=True,
+                api_audience=None,
+            )
+
+    # Check the case api_endpoint is not provided and GOOGLE_API_USE_MTLS_ENDPOINT has
+    # unsupported value.
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "Unsupported"}):
+        with pytest.raises(MutualTLSChannelError):
+            client = client_class(transport=transport_name)
+
+    # Check the case GOOGLE_API_USE_CLIENT_CERTIFICATE has unsupported value.
+    with mock.patch.dict(
+        os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "Unsupported"}
+    ):
+        with pytest.raises(ValueError):
+            client = client_class(transport=transport_name)
+
+    # Check the case quota_project_id is provided
+    options = client_options.ClientOptions(quota_project_id="octopus")
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(client_options=options, transport=transport_name)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file=None,
+            host=client.DEFAULT_ENDPOINT,
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id="octopus",
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+    # Check the case api_endpoint is provided
+    options = client_options.ClientOptions(
+        api_audience="https://language.googleapis.com"
+    )
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(client_options=options, transport=transport_name)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file=None,
+            host=client.DEFAULT_ENDPOINT,
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience="https://language.googleapis.com",
+        )
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class,transport_name,use_client_cert_env",
+    [
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+            "grpc",
+            "true",
+        ),
+        (
+            IdentityAwareProxyOAuthServiceAsyncClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+            "true",
+        ),
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+            "grpc",
+            "false",
+        ),
+        (
+            IdentityAwareProxyOAuthServiceAsyncClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+            "false",
+        ),
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceRestTransport,
+            "rest",
+            "true",
+        ),
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceRestTransport,
+            "rest",
+            "false",
+        ),
+    ],
+)
+@mock.patch.object(
+    IdentityAwareProxyOAuthServiceClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyOAuthServiceClient),
+)
+@mock.patch.object(
+    IdentityAwareProxyOAuthServiceAsyncClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyOAuthServiceAsyncClient),
+)
+@mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "auto"})
+def test_identity_aware_proxy_o_auth_service_client_mtls_env_auto(
+    client_class, transport_class, transport_name, use_client_cert_env
+):
+    # This tests the endpoint autoswitch behavior. Endpoint is autoswitched to the default
+    # mtls endpoint, if GOOGLE_API_USE_CLIENT_CERTIFICATE is "true" and client cert exists.
+
+    # Check the case client_cert_source is provided. Whether client cert is used depends on
+    # GOOGLE_API_USE_CLIENT_CERTIFICATE value.
+    with mock.patch.dict(
+        os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}
+    ):
+        options = client_options.ClientOptions(
+            client_cert_source=client_cert_source_callback
+        )
+        with mock.patch.object(transport_class, "__init__") as patched:
+            patched.return_value = None
+            client = client_class(client_options=options, transport=transport_name)
+
+            if use_client_cert_env == "false":
+                expected_client_cert_source = None
+                expected_host = client.DEFAULT_ENDPOINT
+            else:
+                expected_client_cert_source = client_cert_source_callback
+                expected_host = client.DEFAULT_MTLS_ENDPOINT
+
+            patched.assert_called_once_with(
+                credentials=None,
+                credentials_file=None,
+                host=expected_host,
+                scopes=None,
+                client_cert_source_for_mtls=expected_client_cert_source,
+                quota_project_id=None,
+                client_info=transports.base.DEFAULT_CLIENT_INFO,
+                always_use_jwt_access=True,
+                api_audience=None,
+            )
+
+    # Check the case ADC client cert is provided. Whether client cert is used depends on
+    # GOOGLE_API_USE_CLIENT_CERTIFICATE value.
+    with mock.patch.dict(
+        os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}
+    ):
+        with mock.patch.object(transport_class, "__init__") as patched:
+            with mock.patch(
+                "google.auth.transport.mtls.has_default_client_cert_source",
+                return_value=True,
+            ):
+                with mock.patch(
+                    "google.auth.transport.mtls.default_client_cert_source",
+                    return_value=client_cert_source_callback,
+                ):
+                    if use_client_cert_env == "false":
+                        expected_host = client.DEFAULT_ENDPOINT
+                        expected_client_cert_source = None
+                    else:
+                        expected_host = client.DEFAULT_MTLS_ENDPOINT
+                        expected_client_cert_source = client_cert_source_callback
+
+                    patched.return_value = None
+                    client = client_class(transport=transport_name)
+                    patched.assert_called_once_with(
+                        credentials=None,
+                        credentials_file=None,
+                        host=expected_host,
+                        scopes=None,
+                        client_cert_source_for_mtls=expected_client_cert_source,
+                        quota_project_id=None,
+                        client_info=transports.base.DEFAULT_CLIENT_INFO,
+                        always_use_jwt_access=True,
+                        api_audience=None,
+                    )
+
+    # Check the case client_cert_source and ADC client cert are not provided.
+    with mock.patch.dict(
+        os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": use_client_cert_env}
+    ):
+        with mock.patch.object(transport_class, "__init__") as patched:
+            with mock.patch(
+                "google.auth.transport.mtls.has_default_client_cert_source",
+                return_value=False,
+            ):
+                patched.return_value = None
+                client = client_class(transport=transport_name)
+                patched.assert_called_once_with(
+                    credentials=None,
+                    credentials_file=None,
+                    host=client.DEFAULT_ENDPOINT,
+                    scopes=None,
+                    client_cert_source_for_mtls=None,
+                    quota_project_id=None,
+                    client_info=transports.base.DEFAULT_CLIENT_INFO,
+                    always_use_jwt_access=True,
+                    api_audience=None,
+                )
+
+
+@pytest.mark.parametrize(
+    "client_class",
+    [IdentityAwareProxyOAuthServiceClient, IdentityAwareProxyOAuthServiceAsyncClient],
+)
+@mock.patch.object(
+    IdentityAwareProxyOAuthServiceClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyOAuthServiceClient),
+)
+@mock.patch.object(
+    IdentityAwareProxyOAuthServiceAsyncClient,
+    "DEFAULT_ENDPOINT",
+    modify_default_endpoint(IdentityAwareProxyOAuthServiceAsyncClient),
+)
+def test_identity_aware_proxy_o_auth_service_client_get_mtls_endpoint_and_cert_source(
+    client_class,
+):
+    mock_client_cert_source = mock.Mock()
+
+    # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "true".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}):
+        mock_api_endpoint = "foo"
+        options = client_options.ClientOptions(
+            client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint
+        )
+        api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(
+            options
+        )
+        assert api_endpoint == mock_api_endpoint
+        assert cert_source == mock_client_cert_source
+
+    # Test the case GOOGLE_API_USE_CLIENT_CERTIFICATE is "false".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "false"}):
+        mock_client_cert_source = mock.Mock()
+        mock_api_endpoint = "foo"
+        options = client_options.ClientOptions(
+            client_cert_source=mock_client_cert_source, api_endpoint=mock_api_endpoint
+        )
+        api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source(
+            options
+        )
+        assert api_endpoint == mock_api_endpoint
+        assert cert_source is None
+
+    # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "never".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "never"}):
+        api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source()
+        assert api_endpoint == client_class.DEFAULT_ENDPOINT
+        assert cert_source is None
+
+    # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "always".
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_MTLS_ENDPOINT": "always"}):
+        api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source()
+        assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT
+        assert cert_source is None
+
+    # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert doesn't exist.
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}):
+        with mock.patch(
+            "google.auth.transport.mtls.has_default_client_cert_source",
+            return_value=False,
+        ):
+            api_endpoint, cert_source = client_class.get_mtls_endpoint_and_cert_source()
+            assert api_endpoint == client_class.DEFAULT_ENDPOINT
+            assert cert_source is None
+
+    # Test the case GOOGLE_API_USE_MTLS_ENDPOINT is "auto" and default cert exists.
+    with mock.patch.dict(os.environ, {"GOOGLE_API_USE_CLIENT_CERTIFICATE": "true"}):
+        with mock.patch(
+            "google.auth.transport.mtls.has_default_client_cert_source",
+            return_value=True,
+        ):
+            with mock.patch(
+                "google.auth.transport.mtls.default_client_cert_source",
+                return_value=mock_client_cert_source,
+            ):
+                (
+                    api_endpoint,
+                    cert_source,
+                ) = client_class.get_mtls_endpoint_and_cert_source()
+                assert api_endpoint == client_class.DEFAULT_MTLS_ENDPOINT
+                assert cert_source == mock_client_cert_source
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class,transport_name",
+    [
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+            "grpc",
+        ),
+        (
+            IdentityAwareProxyOAuthServiceAsyncClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+        ),
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceRestTransport,
+            "rest",
+        ),
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_client_client_options_scopes(
+    client_class, transport_class, transport_name
+):
+    # Check the case scopes are provided.
+    options = client_options.ClientOptions(
+        scopes=["1", "2"],
+    )
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(client_options=options, transport=transport_name)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file=None,
+            host=client.DEFAULT_ENDPOINT,
+            scopes=["1", "2"],
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class,transport_name,grpc_helpers",
+    [
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+            "grpc",
+            grpc_helpers,
+        ),
+        (
+            IdentityAwareProxyOAuthServiceAsyncClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+            grpc_helpers_async,
+        ),
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceRestTransport,
+            "rest",
+            None,
+        ),
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_client_client_options_credentials_file(
+    client_class, transport_class, transport_name, grpc_helpers
+):
+    # Check the case credentials file is provided.
+    options = client_options.ClientOptions(credentials_file="credentials.json")
+
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(client_options=options, transport=transport_name)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file="credentials.json",
+            host=client.DEFAULT_ENDPOINT,
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+
+
+def test_identity_aware_proxy_o_auth_service_client_client_options_from_dict():
+    with mock.patch(
+        "google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service.transports.IdentityAwareProxyOAuthServiceGrpcTransport.__init__"
+    ) as grpc_transport:
+        grpc_transport.return_value = None
+        client = IdentityAwareProxyOAuthServiceClient(
+            client_options={"api_endpoint": "squid.clam.whelk"}
+        )
+        grpc_transport.assert_called_once_with(
+            credentials=None,
+            credentials_file=None,
+            host="squid.clam.whelk",
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class,transport_name,grpc_helpers",
+    [
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+            "grpc",
+            grpc_helpers,
+        ),
+        (
+            IdentityAwareProxyOAuthServiceAsyncClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+            "grpc_asyncio",
+            grpc_helpers_async,
+        ),
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_client_create_channel_credentials_file(
+    client_class, transport_class, transport_name, grpc_helpers
+):
+    # Check the case credentials file is provided.
+    options = client_options.ClientOptions(credentials_file="credentials.json")
+
+    with mock.patch.object(transport_class, "__init__") as patched:
+        patched.return_value = None
+        client = client_class(client_options=options, transport=transport_name)
+        patched.assert_called_once_with(
+            credentials=None,
+            credentials_file="credentials.json",
+            host=client.DEFAULT_ENDPOINT,
+            scopes=None,
+            client_cert_source_for_mtls=None,
+            quota_project_id=None,
+            client_info=transports.base.DEFAULT_CLIENT_INFO,
+            always_use_jwt_access=True,
+            api_audience=None,
+        )
+
+    # test that the credentials from file are saved and used as the credentials.
+    with mock.patch.object(
+        google.auth, "load_credentials_from_file", autospec=True
+    ) as load_creds, mock.patch.object(
+        google.auth, "default", autospec=True
+    ) as adc, mock.patch.object(
+        grpc_helpers, "create_channel"
+    ) as create_channel:
+        creds = ga_credentials.AnonymousCredentials()
+        file_creds = ga_credentials.AnonymousCredentials()
+        load_creds.return_value = (file_creds, None)
+        adc.return_value = (creds, None)
+        client = client_class(client_options=options, transport=transport_name)
+        create_channel.assert_called_with(
+            "iap.googleapis.com:443",
+            credentials=file_creds,
+            credentials_file=None,
+            quota_project_id=None,
+            default_scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            scopes=None,
+            default_host="iap.googleapis.com",
+            ssl_credentials=None,
+            options=[
+                ("grpc.max_send_message_length", -1),
+                ("grpc.max_receive_message_length", -1),
+            ],
+        )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.ListBrandsRequest,
+        dict,
+    ],
+)
+def test_list_brands(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.list_brands), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.ListBrandsResponse()
+        response = client.list_brands(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ListBrandsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.ListBrandsResponse)
+
+
+def test_list_brands_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.list_brands), "__call__") as call:
+        client.list_brands()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ListBrandsRequest()
+
+
+@pytest.mark.asyncio
+async def test_list_brands_async(
+    transport: str = "grpc_asyncio", request_type=service.ListBrandsRequest
+):
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.list_brands), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.ListBrandsResponse()
+        )
+        response = await client.list_brands(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ListBrandsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.ListBrandsResponse)
+
+
+@pytest.mark.asyncio
+async def test_list_brands_async_from_dict():
+    await test_list_brands_async(request_type=dict)
+
+
+def test_list_brands_field_headers():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.ListBrandsRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.list_brands), "__call__") as call:
+        call.return_value = service.ListBrandsResponse()
+        client.list_brands(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_list_brands_field_headers_async():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.ListBrandsRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.list_brands), "__call__") as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.ListBrandsResponse()
+        )
+        await client.list_brands(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.CreateBrandRequest,
+        dict,
+    ],
+)
+def test_create_brand(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.create_brand), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.Brand(
+            name="name_value",
+            support_email="support_email_value",
+            application_title="application_title_value",
+            org_internal_only=True,
+        )
+        response = client.create_brand(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.CreateBrandRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.Brand)
+    assert response.name == "name_value"
+    assert response.support_email == "support_email_value"
+    assert response.application_title == "application_title_value"
+    assert response.org_internal_only is True
+
+
+def test_create_brand_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.create_brand), "__call__") as call:
+        client.create_brand()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.CreateBrandRequest()
+
+
+@pytest.mark.asyncio
+async def test_create_brand_async(
+    transport: str = "grpc_asyncio", request_type=service.CreateBrandRequest
+):
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.create_brand), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.Brand(
+                name="name_value",
+                support_email="support_email_value",
+                application_title="application_title_value",
+                org_internal_only=True,
+            )
+        )
+        response = await client.create_brand(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.CreateBrandRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.Brand)
+    assert response.name == "name_value"
+    assert response.support_email == "support_email_value"
+    assert response.application_title == "application_title_value"
+    assert response.org_internal_only is True
+
+
+@pytest.mark.asyncio
+async def test_create_brand_async_from_dict():
+    await test_create_brand_async(request_type=dict)
+
+
+def test_create_brand_field_headers():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.CreateBrandRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.create_brand), "__call__") as call:
+        call.return_value = service.Brand()
+        client.create_brand(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_create_brand_field_headers_async():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.CreateBrandRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.create_brand), "__call__") as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Brand())
+        await client.create_brand(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.GetBrandRequest,
+        dict,
+    ],
+)
+def test_get_brand(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_brand), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.Brand(
+            name="name_value",
+            support_email="support_email_value",
+            application_title="application_title_value",
+            org_internal_only=True,
+        )
+        response = client.get_brand(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetBrandRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.Brand)
+    assert response.name == "name_value"
+    assert response.support_email == "support_email_value"
+    assert response.application_title == "application_title_value"
+    assert response.org_internal_only is True
+
+
+def test_get_brand_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_brand), "__call__") as call:
+        client.get_brand()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetBrandRequest()
+
+
+@pytest.mark.asyncio
+async def test_get_brand_async(
+    transport: str = "grpc_asyncio", request_type=service.GetBrandRequest
+):
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_brand), "__call__") as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.Brand(
+                name="name_value",
+                support_email="support_email_value",
+                application_title="application_title_value",
+                org_internal_only=True,
+            )
+        )
+        response = await client.get_brand(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetBrandRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.Brand)
+    assert response.name == "name_value"
+    assert response.support_email == "support_email_value"
+    assert response.application_title == "application_title_value"
+    assert response.org_internal_only is True
+
+
+@pytest.mark.asyncio
+async def test_get_brand_async_from_dict():
+    await test_get_brand_async(request_type=dict)
+
+
+def test_get_brand_field_headers():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.GetBrandRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_brand), "__call__") as call:
+        call.return_value = service.Brand()
+        client.get_brand(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_get_brand_field_headers_async():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.GetBrandRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(type(client.transport.get_brand), "__call__") as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(service.Brand())
+        await client.get_brand(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.CreateIdentityAwareProxyClientRequest,
+        dict,
+    ],
+)
+def test_create_identity_aware_proxy_client(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_identity_aware_proxy_client), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.IdentityAwareProxyClient(
+            name="name_value",
+            secret="secret_value",
+            display_name="display_name_value",
+        )
+        response = client.create_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.CreateIdentityAwareProxyClientRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IdentityAwareProxyClient)
+    assert response.name == "name_value"
+    assert response.secret == "secret_value"
+    assert response.display_name == "display_name_value"
+
+
+def test_create_identity_aware_proxy_client_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_identity_aware_proxy_client), "__call__"
+    ) as call:
+        client.create_identity_aware_proxy_client()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.CreateIdentityAwareProxyClientRequest()
+
+
+@pytest.mark.asyncio
+async def test_create_identity_aware_proxy_client_async(
+    transport: str = "grpc_asyncio",
+    request_type=service.CreateIdentityAwareProxyClientRequest,
+):
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_identity_aware_proxy_client), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.IdentityAwareProxyClient(
+                name="name_value",
+                secret="secret_value",
+                display_name="display_name_value",
+            )
+        )
+        response = await client.create_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.CreateIdentityAwareProxyClientRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IdentityAwareProxyClient)
+    assert response.name == "name_value"
+    assert response.secret == "secret_value"
+    assert response.display_name == "display_name_value"
+
+
+@pytest.mark.asyncio
+async def test_create_identity_aware_proxy_client_async_from_dict():
+    await test_create_identity_aware_proxy_client_async(request_type=dict)
+
+
+def test_create_identity_aware_proxy_client_field_headers():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.CreateIdentityAwareProxyClientRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_identity_aware_proxy_client), "__call__"
+    ) as call:
+        call.return_value = service.IdentityAwareProxyClient()
+        client.create_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_create_identity_aware_proxy_client_field_headers_async():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.CreateIdentityAwareProxyClientRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.create_identity_aware_proxy_client), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.IdentityAwareProxyClient()
+        )
+        await client.create_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.ListIdentityAwareProxyClientsRequest,
+        dict,
+    ],
+)
+def test_list_identity_aware_proxy_clients(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_identity_aware_proxy_clients), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.ListIdentityAwareProxyClientsResponse(
+            next_page_token="next_page_token_value",
+        )
+        response = client.list_identity_aware_proxy_clients(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ListIdentityAwareProxyClientsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, pagers.ListIdentityAwareProxyClientsPager)
+    assert response.next_page_token == "next_page_token_value"
+
+
+def test_list_identity_aware_proxy_clients_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_identity_aware_proxy_clients), "__call__"
+    ) as call:
+        client.list_identity_aware_proxy_clients()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ListIdentityAwareProxyClientsRequest()
+
+
+@pytest.mark.asyncio
+async def test_list_identity_aware_proxy_clients_async(
+    transport: str = "grpc_asyncio",
+    request_type=service.ListIdentityAwareProxyClientsRequest,
+):
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_identity_aware_proxy_clients), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.ListIdentityAwareProxyClientsResponse(
+                next_page_token="next_page_token_value",
+            )
+        )
+        response = await client.list_identity_aware_proxy_clients(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ListIdentityAwareProxyClientsRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, pagers.ListIdentityAwareProxyClientsAsyncPager)
+    assert response.next_page_token == "next_page_token_value"
+
+
+@pytest.mark.asyncio
+async def test_list_identity_aware_proxy_clients_async_from_dict():
+    await test_list_identity_aware_proxy_clients_async(request_type=dict)
+
+
+def test_list_identity_aware_proxy_clients_field_headers():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.ListIdentityAwareProxyClientsRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_identity_aware_proxy_clients), "__call__"
+    ) as call:
+        call.return_value = service.ListIdentityAwareProxyClientsResponse()
+        client.list_identity_aware_proxy_clients(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_list_identity_aware_proxy_clients_field_headers_async():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.ListIdentityAwareProxyClientsRequest()
+
+    request.parent = "parent_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_identity_aware_proxy_clients), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.ListIdentityAwareProxyClientsResponse()
+        )
+        await client.list_identity_aware_proxy_clients(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "parent=parent_value",
+    ) in kw["metadata"]
+
+
+def test_list_identity_aware_proxy_clients_pager(transport_name: str = "grpc"):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials,
+        transport=transport_name,
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_identity_aware_proxy_clients), "__call__"
+    ) as call:
+        # Set the response to a series of pages.
+        call.side_effect = (
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                ],
+                next_page_token="abc",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[],
+                next_page_token="def",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                ],
+                next_page_token="ghi",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                ],
+            ),
+            RuntimeError,
+        )
+
+        metadata = ()
+        metadata = tuple(metadata) + (
+            gapic_v1.routing_header.to_grpc_metadata((("parent", ""),)),
+        )
+        pager = client.list_identity_aware_proxy_clients(request={})
+
+        assert pager._metadata == metadata
+
+        results = list(pager)
+        assert len(results) == 6
+        assert all(isinstance(i, service.IdentityAwareProxyClient) for i in results)
+
+
+def test_list_identity_aware_proxy_clients_pages(transport_name: str = "grpc"):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials,
+        transport=transport_name,
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_identity_aware_proxy_clients), "__call__"
+    ) as call:
+        # Set the response to a series of pages.
+        call.side_effect = (
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                ],
+                next_page_token="abc",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[],
+                next_page_token="def",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                ],
+                next_page_token="ghi",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                ],
+            ),
+            RuntimeError,
+        )
+        pages = list(client.list_identity_aware_proxy_clients(request={}).pages)
+        for page_, token in zip(pages, ["abc", "def", "ghi", ""]):
+            assert page_.raw_page.next_page_token == token
+
+
+@pytest.mark.asyncio
+async def test_list_identity_aware_proxy_clients_async_pager():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials,
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_identity_aware_proxy_clients),
+        "__call__",
+        new_callable=mock.AsyncMock,
+    ) as call:
+        # Set the response to a series of pages.
+        call.side_effect = (
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                ],
+                next_page_token="abc",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[],
+                next_page_token="def",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                ],
+                next_page_token="ghi",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                ],
+            ),
+            RuntimeError,
+        )
+        async_pager = await client.list_identity_aware_proxy_clients(
+            request={},
+        )
+        assert async_pager.next_page_token == "abc"
+        responses = []
+        async for response in async_pager:  # pragma: no branch
+            responses.append(response)
+
+        assert len(responses) == 6
+        assert all(isinstance(i, service.IdentityAwareProxyClient) for i in responses)
+
+
+@pytest.mark.asyncio
+async def test_list_identity_aware_proxy_clients_async_pages():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials,
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.list_identity_aware_proxy_clients),
+        "__call__",
+        new_callable=mock.AsyncMock,
+    ) as call:
+        # Set the response to a series of pages.
+        call.side_effect = (
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                ],
+                next_page_token="abc",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[],
+                next_page_token="def",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                ],
+                next_page_token="ghi",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                ],
+            ),
+            RuntimeError,
+        )
+        pages = []
+        async for page_ in (
+            await client.list_identity_aware_proxy_clients(request={})
+        ).pages:  # pragma: no branch
+            pages.append(page_)
+        for page_, token in zip(pages, ["abc", "def", "ghi", ""]):
+            assert page_.raw_page.next_page_token == token
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.GetIdentityAwareProxyClientRequest,
+        dict,
+    ],
+)
+def test_get_identity_aware_proxy_client(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_identity_aware_proxy_client), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.IdentityAwareProxyClient(
+            name="name_value",
+            secret="secret_value",
+            display_name="display_name_value",
+        )
+        response = client.get_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetIdentityAwareProxyClientRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IdentityAwareProxyClient)
+    assert response.name == "name_value"
+    assert response.secret == "secret_value"
+    assert response.display_name == "display_name_value"
+
+
+def test_get_identity_aware_proxy_client_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_identity_aware_proxy_client), "__call__"
+    ) as call:
+        client.get_identity_aware_proxy_client()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetIdentityAwareProxyClientRequest()
+
+
+@pytest.mark.asyncio
+async def test_get_identity_aware_proxy_client_async(
+    transport: str = "grpc_asyncio",
+    request_type=service.GetIdentityAwareProxyClientRequest,
+):
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_identity_aware_proxy_client), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.IdentityAwareProxyClient(
+                name="name_value",
+                secret="secret_value",
+                display_name="display_name_value",
+            )
+        )
+        response = await client.get_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.GetIdentityAwareProxyClientRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IdentityAwareProxyClient)
+    assert response.name == "name_value"
+    assert response.secret == "secret_value"
+    assert response.display_name == "display_name_value"
+
+
+@pytest.mark.asyncio
+async def test_get_identity_aware_proxy_client_async_from_dict():
+    await test_get_identity_aware_proxy_client_async(request_type=dict)
+
+
+def test_get_identity_aware_proxy_client_field_headers():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.GetIdentityAwareProxyClientRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_identity_aware_proxy_client), "__call__"
+    ) as call:
+        call.return_value = service.IdentityAwareProxyClient()
+        client.get_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_get_identity_aware_proxy_client_field_headers_async():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.GetIdentityAwareProxyClientRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.get_identity_aware_proxy_client), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.IdentityAwareProxyClient()
+        )
+        await client.get_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.ResetIdentityAwareProxyClientSecretRequest,
+        dict,
+    ],
+)
+def test_reset_identity_aware_proxy_client_secret(
+    request_type, transport: str = "grpc"
+):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.reset_identity_aware_proxy_client_secret), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = service.IdentityAwareProxyClient(
+            name="name_value",
+            secret="secret_value",
+            display_name="display_name_value",
+        )
+        response = client.reset_identity_aware_proxy_client_secret(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ResetIdentityAwareProxyClientSecretRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IdentityAwareProxyClient)
+    assert response.name == "name_value"
+    assert response.secret == "secret_value"
+    assert response.display_name == "display_name_value"
+
+
+def test_reset_identity_aware_proxy_client_secret_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.reset_identity_aware_proxy_client_secret), "__call__"
+    ) as call:
+        client.reset_identity_aware_proxy_client_secret()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ResetIdentityAwareProxyClientSecretRequest()
+
+
+@pytest.mark.asyncio
+async def test_reset_identity_aware_proxy_client_secret_async(
+    transport: str = "grpc_asyncio",
+    request_type=service.ResetIdentityAwareProxyClientSecretRequest,
+):
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.reset_identity_aware_proxy_client_secret), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.IdentityAwareProxyClient(
+                name="name_value",
+                secret="secret_value",
+                display_name="display_name_value",
+            )
+        )
+        response = await client.reset_identity_aware_proxy_client_secret(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.ResetIdentityAwareProxyClientSecretRequest()
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IdentityAwareProxyClient)
+    assert response.name == "name_value"
+    assert response.secret == "secret_value"
+    assert response.display_name == "display_name_value"
+
+
+@pytest.mark.asyncio
+async def test_reset_identity_aware_proxy_client_secret_async_from_dict():
+    await test_reset_identity_aware_proxy_client_secret_async(request_type=dict)
+
+
+def test_reset_identity_aware_proxy_client_secret_field_headers():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.ResetIdentityAwareProxyClientSecretRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.reset_identity_aware_proxy_client_secret), "__call__"
+    ) as call:
+        call.return_value = service.IdentityAwareProxyClient()
+        client.reset_identity_aware_proxy_client_secret(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_reset_identity_aware_proxy_client_secret_field_headers_async():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.ResetIdentityAwareProxyClientSecretRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.reset_identity_aware_proxy_client_secret), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(
+            service.IdentityAwareProxyClient()
+        )
+        await client.reset_identity_aware_proxy_client_secret(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.DeleteIdentityAwareProxyClientRequest,
+        dict,
+    ],
+)
+def test_delete_identity_aware_proxy_client(request_type, transport: str = "grpc"):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_identity_aware_proxy_client), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = None
+        response = client.delete_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.DeleteIdentityAwareProxyClientRequest()
+
+    # Establish that the response is the type that we expect.
+    assert response is None
+
+
+def test_delete_identity_aware_proxy_client_empty_call():
+    # This test is a coverage failsafe to make sure that totally empty calls,
+    # i.e. request == None and no flattened fields passed, work.
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc",
+    )
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_identity_aware_proxy_client), "__call__"
+    ) as call:
+        client.delete_identity_aware_proxy_client()
+        call.assert_called()
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.DeleteIdentityAwareProxyClientRequest()
+
+
+@pytest.mark.asyncio
+async def test_delete_identity_aware_proxy_client_async(
+    transport: str = "grpc_asyncio",
+    request_type=service.DeleteIdentityAwareProxyClientRequest,
+):
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Everything is optional in proto3 as far as the runtime is concerned,
+    # and we are mocking out the actual API, so just send an empty request.
+    request = request_type()
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_identity_aware_proxy_client), "__call__"
+    ) as call:
+        # Designate an appropriate return value for the call.
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(None)
+        response = await client.delete_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == service.DeleteIdentityAwareProxyClientRequest()
+
+    # Establish that the response is the type that we expect.
+    assert response is None
+
+
+@pytest.mark.asyncio
+async def test_delete_identity_aware_proxy_client_async_from_dict():
+    await test_delete_identity_aware_proxy_client_async(request_type=dict)
+
+
+def test_delete_identity_aware_proxy_client_field_headers():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.DeleteIdentityAwareProxyClientRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_identity_aware_proxy_client), "__call__"
+    ) as call:
+        call.return_value = None
+        client.delete_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls) == 1
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.asyncio
+async def test_delete_identity_aware_proxy_client_field_headers_async():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+
+    # Any value that is part of the HTTP/1.1 URI should be sent as
+    # a field header. Set these to a non-empty value.
+    request = service.DeleteIdentityAwareProxyClientRequest()
+
+    request.name = "name_value"
+
+    # Mock the actual call within the gRPC stub, and fake the request.
+    with mock.patch.object(
+        type(client.transport.delete_identity_aware_proxy_client), "__call__"
+    ) as call:
+        call.return_value = grpc_helpers_async.FakeUnaryUnaryCall(None)
+        await client.delete_identity_aware_proxy_client(request)
+
+        # Establish that the underlying gRPC stub method was called.
+        assert len(call.mock_calls)
+        _, args, _ = call.mock_calls[0]
+        assert args[0] == request
+
+    # Establish that the field header was sent.
+    _, _, kw = call.mock_calls[0]
+    assert (
+        "x-goog-request-params",
+        "name=name_value",
+    ) in kw["metadata"]
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.ListBrandsRequest,
+        dict,
+    ],
+)
+def test_list_brands_rest(request_type):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.ListBrandsResponse()
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.ListBrandsResponse.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.list_brands(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.ListBrandsResponse)
+
+
+def test_list_brands_rest_required_fields(request_type=service.ListBrandsRequest):
+    transport_class = transports.IdentityAwareProxyOAuthServiceRestTransport
+
+    request_init = {}
+    request_init["parent"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).list_brands._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["parent"] = "parent_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).list_brands._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "parent" in jsonified_request
+    assert jsonified_request["parent"] == "parent_value"
+
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.ListBrandsResponse()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "get",
+                "query_params": pb_request,
+            }
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.ListBrandsResponse.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.list_brands(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_list_brands_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.list_brands._get_unset_required_fields({})
+    assert set(unset_fields) == (set(()) & set(("parent",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_list_brands_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyOAuthServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyOAuthServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor, "post_list_brands"
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor, "pre_list_brands"
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.ListBrandsRequest.pb(service.ListBrandsRequest())
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.ListBrandsResponse.to_json(
+            service.ListBrandsResponse()
+        )
+
+        request = service.ListBrandsRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.ListBrandsResponse()
+
+        client.list_brands(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_list_brands_rest_bad_request(
+    transport: str = "rest", request_type=service.ListBrandsRequest
+):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.list_brands(request)
+
+
+def test_list_brands_rest_error():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.CreateBrandRequest,
+        dict,
+    ],
+)
+def test_create_brand_rest(request_type):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1"}
+    request_init["brand"] = {
+        "name": "name_value",
+        "support_email": "support_email_value",
+        "application_title": "application_title_value",
+        "org_internal_only": True,
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.Brand(
+            name="name_value",
+            support_email="support_email_value",
+            application_title="application_title_value",
+            org_internal_only=True,
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.Brand.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.create_brand(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.Brand)
+    assert response.name == "name_value"
+    assert response.support_email == "support_email_value"
+    assert response.application_title == "application_title_value"
+    assert response.org_internal_only is True
+
+
+def test_create_brand_rest_required_fields(request_type=service.CreateBrandRequest):
+    transport_class = transports.IdentityAwareProxyOAuthServiceRestTransport
+
+    request_init = {}
+    request_init["parent"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).create_brand._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["parent"] = "parent_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).create_brand._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "parent" in jsonified_request
+    assert jsonified_request["parent"] == "parent_value"
+
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.Brand()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "post",
+                "query_params": pb_request,
+            }
+            transcode_result["body"] = pb_request
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.Brand.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.create_brand(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_create_brand_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.create_brand._get_unset_required_fields({})
+    assert set(unset_fields) == (
+        set(())
+        & set(
+            (
+                "parent",
+                "brand",
+            )
+        )
+    )
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_create_brand_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyOAuthServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyOAuthServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor, "post_create_brand"
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor, "pre_create_brand"
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.CreateBrandRequest.pb(service.CreateBrandRequest())
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.Brand.to_json(service.Brand())
+
+        request = service.CreateBrandRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.Brand()
+
+        client.create_brand(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_create_brand_rest_bad_request(
+    transport: str = "rest", request_type=service.CreateBrandRequest
+):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1"}
+    request_init["brand"] = {
+        "name": "name_value",
+        "support_email": "support_email_value",
+        "application_title": "application_title_value",
+        "org_internal_only": True,
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.create_brand(request)
+
+
+def test_create_brand_rest_error():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.GetBrandRequest,
+        dict,
+    ],
+)
+def test_get_brand_rest(request_type):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"name": "projects/sample1/brands/sample2"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.Brand(
+            name="name_value",
+            support_email="support_email_value",
+            application_title="application_title_value",
+            org_internal_only=True,
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.Brand.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.get_brand(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.Brand)
+    assert response.name == "name_value"
+    assert response.support_email == "support_email_value"
+    assert response.application_title == "application_title_value"
+    assert response.org_internal_only is True
+
+
+def test_get_brand_rest_required_fields(request_type=service.GetBrandRequest):
+    transport_class = transports.IdentityAwareProxyOAuthServiceRestTransport
+
+    request_init = {}
+    request_init["name"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).get_brand._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["name"] = "name_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).get_brand._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "name" in jsonified_request
+    assert jsonified_request["name"] == "name_value"
+
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.Brand()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "get",
+                "query_params": pb_request,
+            }
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.Brand.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.get_brand(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_get_brand_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.get_brand._get_unset_required_fields({})
+    assert set(unset_fields) == (set(()) & set(("name",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_get_brand_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyOAuthServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyOAuthServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor, "post_get_brand"
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor, "pre_get_brand"
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.GetBrandRequest.pb(service.GetBrandRequest())
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.Brand.to_json(service.Brand())
+
+        request = service.GetBrandRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.Brand()
+
+        client.get_brand(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_get_brand_rest_bad_request(
+    transport: str = "rest", request_type=service.GetBrandRequest
+):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"name": "projects/sample1/brands/sample2"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.get_brand(request)
+
+
+def test_get_brand_rest_error():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.CreateIdentityAwareProxyClientRequest,
+        dict,
+    ],
+)
+def test_create_identity_aware_proxy_client_rest(request_type):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1/brands/sample2"}
+    request_init["identity_aware_proxy_client"] = {
+        "name": "name_value",
+        "secret": "secret_value",
+        "display_name": "display_name_value",
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.IdentityAwareProxyClient(
+            name="name_value",
+            secret="secret_value",
+            display_name="display_name_value",
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.IdentityAwareProxyClient.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.create_identity_aware_proxy_client(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IdentityAwareProxyClient)
+    assert response.name == "name_value"
+    assert response.secret == "secret_value"
+    assert response.display_name == "display_name_value"
+
+
+def test_create_identity_aware_proxy_client_rest_required_fields(
+    request_type=service.CreateIdentityAwareProxyClientRequest,
+):
+    transport_class = transports.IdentityAwareProxyOAuthServiceRestTransport
+
+    request_init = {}
+    request_init["parent"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).create_identity_aware_proxy_client._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["parent"] = "parent_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).create_identity_aware_proxy_client._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "parent" in jsonified_request
+    assert jsonified_request["parent"] == "parent_value"
+
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.IdentityAwareProxyClient()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "post",
+                "query_params": pb_request,
+            }
+            transcode_result["body"] = pb_request
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.IdentityAwareProxyClient.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.create_identity_aware_proxy_client(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_create_identity_aware_proxy_client_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = (
+        transport.create_identity_aware_proxy_client._get_unset_required_fields({})
+    )
+    assert set(unset_fields) == (
+        set(())
+        & set(
+            (
+                "parent",
+                "identityAwareProxyClient",
+            )
+        )
+    )
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_create_identity_aware_proxy_client_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyOAuthServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyOAuthServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor,
+        "post_create_identity_aware_proxy_client",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor,
+        "pre_create_identity_aware_proxy_client",
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.CreateIdentityAwareProxyClientRequest.pb(
+            service.CreateIdentityAwareProxyClientRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.IdentityAwareProxyClient.to_json(
+            service.IdentityAwareProxyClient()
+        )
+
+        request = service.CreateIdentityAwareProxyClientRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.IdentityAwareProxyClient()
+
+        client.create_identity_aware_proxy_client(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_create_identity_aware_proxy_client_rest_bad_request(
+    transport: str = "rest", request_type=service.CreateIdentityAwareProxyClientRequest
+):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1/brands/sample2"}
+    request_init["identity_aware_proxy_client"] = {
+        "name": "name_value",
+        "secret": "secret_value",
+        "display_name": "display_name_value",
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.create_identity_aware_proxy_client(request)
+
+
+def test_create_identity_aware_proxy_client_rest_error():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.ListIdentityAwareProxyClientsRequest,
+        dict,
+    ],
+)
+def test_list_identity_aware_proxy_clients_rest(request_type):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1/brands/sample2"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.ListIdentityAwareProxyClientsResponse(
+            next_page_token="next_page_token_value",
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.ListIdentityAwareProxyClientsResponse.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.list_identity_aware_proxy_clients(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, pagers.ListIdentityAwareProxyClientsPager)
+    assert response.next_page_token == "next_page_token_value"
+
+
+def test_list_identity_aware_proxy_clients_rest_required_fields(
+    request_type=service.ListIdentityAwareProxyClientsRequest,
+):
+    transport_class = transports.IdentityAwareProxyOAuthServiceRestTransport
+
+    request_init = {}
+    request_init["parent"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).list_identity_aware_proxy_clients._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["parent"] = "parent_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).list_identity_aware_proxy_clients._get_unset_required_fields(jsonified_request)
+    # Check that path parameters and body parameters are not mixing in.
+    assert not set(unset_fields) - set(
+        (
+            "page_size",
+            "page_token",
+        )
+    )
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "parent" in jsonified_request
+    assert jsonified_request["parent"] == "parent_value"
+
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.ListIdentityAwareProxyClientsResponse()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "get",
+                "query_params": pb_request,
+            }
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.ListIdentityAwareProxyClientsResponse.pb(
+                return_value
+            )
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.list_identity_aware_proxy_clients(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_list_identity_aware_proxy_clients_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = (
+        transport.list_identity_aware_proxy_clients._get_unset_required_fields({})
+    )
+    assert set(unset_fields) == (
+        set(
+            (
+                "pageSize",
+                "pageToken",
+            )
+        )
+        & set(("parent",))
+    )
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_list_identity_aware_proxy_clients_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyOAuthServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyOAuthServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor,
+        "post_list_identity_aware_proxy_clients",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor,
+        "pre_list_identity_aware_proxy_clients",
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.ListIdentityAwareProxyClientsRequest.pb(
+            service.ListIdentityAwareProxyClientsRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = (
+            service.ListIdentityAwareProxyClientsResponse.to_json(
+                service.ListIdentityAwareProxyClientsResponse()
+            )
+        )
+
+        request = service.ListIdentityAwareProxyClientsRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.ListIdentityAwareProxyClientsResponse()
+
+        client.list_identity_aware_proxy_clients(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_list_identity_aware_proxy_clients_rest_bad_request(
+    transport: str = "rest", request_type=service.ListIdentityAwareProxyClientsRequest
+):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {"parent": "projects/sample1/brands/sample2"}
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.list_identity_aware_proxy_clients(request)
+
+
+def test_list_identity_aware_proxy_clients_rest_pager(transport: str = "rest"):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # TODO(kbandes): remove this mock unless there's a good reason for it.
+        # with mock.patch.object(path_template, 'transcode') as transcode:
+        # Set the response as a series of pages
+        response = (
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                ],
+                next_page_token="abc",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[],
+                next_page_token="def",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                ],
+                next_page_token="ghi",
+            ),
+            service.ListIdentityAwareProxyClientsResponse(
+                identity_aware_proxy_clients=[
+                    service.IdentityAwareProxyClient(),
+                    service.IdentityAwareProxyClient(),
+                ],
+            ),
+        )
+        # Two responses for two calls
+        response = response + response
+
+        # Wrap the values into proper Response objs
+        response = tuple(
+            service.ListIdentityAwareProxyClientsResponse.to_json(x) for x in response
+        )
+        return_values = tuple(Response() for i in response)
+        for return_val, response_val in zip(return_values, response):
+            return_val._content = response_val.encode("UTF-8")
+            return_val.status_code = 200
+        req.side_effect = return_values
+
+        sample_request = {"parent": "projects/sample1/brands/sample2"}
+
+        pager = client.list_identity_aware_proxy_clients(request=sample_request)
+
+        results = list(pager)
+        assert len(results) == 6
+        assert all(isinstance(i, service.IdentityAwareProxyClient) for i in results)
+
+        pages = list(
+            client.list_identity_aware_proxy_clients(request=sample_request).pages
+        )
+        for page_, token in zip(pages, ["abc", "def", "ghi", ""]):
+            assert page_.raw_page.next_page_token == token
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.GetIdentityAwareProxyClientRequest,
+        dict,
+    ],
+)
+def test_get_identity_aware_proxy_client_rest(request_type):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "name": "projects/sample1/brands/sample2/identityAwareProxyClients/sample3"
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.IdentityAwareProxyClient(
+            name="name_value",
+            secret="secret_value",
+            display_name="display_name_value",
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.IdentityAwareProxyClient.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.get_identity_aware_proxy_client(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IdentityAwareProxyClient)
+    assert response.name == "name_value"
+    assert response.secret == "secret_value"
+    assert response.display_name == "display_name_value"
+
+
+def test_get_identity_aware_proxy_client_rest_required_fields(
+    request_type=service.GetIdentityAwareProxyClientRequest,
+):
+    transport_class = transports.IdentityAwareProxyOAuthServiceRestTransport
+
+    request_init = {}
+    request_init["name"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).get_identity_aware_proxy_client._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["name"] = "name_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).get_identity_aware_proxy_client._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "name" in jsonified_request
+    assert jsonified_request["name"] == "name_value"
+
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.IdentityAwareProxyClient()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "get",
+                "query_params": pb_request,
+            }
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.IdentityAwareProxyClient.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.get_identity_aware_proxy_client(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_get_identity_aware_proxy_client_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = transport.get_identity_aware_proxy_client._get_unset_required_fields(
+        {}
+    )
+    assert set(unset_fields) == (set(()) & set(("name",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_get_identity_aware_proxy_client_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyOAuthServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyOAuthServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor,
+        "post_get_identity_aware_proxy_client",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor,
+        "pre_get_identity_aware_proxy_client",
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.GetIdentityAwareProxyClientRequest.pb(
+            service.GetIdentityAwareProxyClientRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.IdentityAwareProxyClient.to_json(
+            service.IdentityAwareProxyClient()
+        )
+
+        request = service.GetIdentityAwareProxyClientRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.IdentityAwareProxyClient()
+
+        client.get_identity_aware_proxy_client(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_get_identity_aware_proxy_client_rest_bad_request(
+    transport: str = "rest", request_type=service.GetIdentityAwareProxyClientRequest
+):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "name": "projects/sample1/brands/sample2/identityAwareProxyClients/sample3"
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.get_identity_aware_proxy_client(request)
+
+
+def test_get_identity_aware_proxy_client_rest_error():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.ResetIdentityAwareProxyClientSecretRequest,
+        dict,
+    ],
+)
+def test_reset_identity_aware_proxy_client_secret_rest(request_type):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "name": "projects/sample1/brands/sample2/identityAwareProxyClients/sample3"
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = service.IdentityAwareProxyClient(
+            name="name_value",
+            secret="secret_value",
+            display_name="display_name_value",
+        )
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        pb_return_value = service.IdentityAwareProxyClient.pb(return_value)
+        json_return_value = json_format.MessageToJson(pb_return_value)
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.reset_identity_aware_proxy_client_secret(request)
+
+    # Establish that the response is the type that we expect.
+    assert isinstance(response, service.IdentityAwareProxyClient)
+    assert response.name == "name_value"
+    assert response.secret == "secret_value"
+    assert response.display_name == "display_name_value"
+
+
+def test_reset_identity_aware_proxy_client_secret_rest_required_fields(
+    request_type=service.ResetIdentityAwareProxyClientSecretRequest,
+):
+    transport_class = transports.IdentityAwareProxyOAuthServiceRestTransport
+
+    request_init = {}
+    request_init["name"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).reset_identity_aware_proxy_client_secret._get_unset_required_fields(
+        jsonified_request
+    )
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["name"] = "name_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).reset_identity_aware_proxy_client_secret._get_unset_required_fields(
+        jsonified_request
+    )
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "name" in jsonified_request
+    assert jsonified_request["name"] == "name_value"
+
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = service.IdentityAwareProxyClient()
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "post",
+                "query_params": pb_request,
+            }
+            transcode_result["body"] = pb_request
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+
+            pb_return_value = service.IdentityAwareProxyClient.pb(return_value)
+            json_return_value = json_format.MessageToJson(pb_return_value)
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.reset_identity_aware_proxy_client_secret(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_reset_identity_aware_proxy_client_secret_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = (
+        transport.reset_identity_aware_proxy_client_secret._get_unset_required_fields(
+            {}
+        )
+    )
+    assert set(unset_fields) == (set(()) & set(("name",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_reset_identity_aware_proxy_client_secret_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyOAuthServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyOAuthServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor,
+        "post_reset_identity_aware_proxy_client_secret",
+    ) as post, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor,
+        "pre_reset_identity_aware_proxy_client_secret",
+    ) as pre:
+        pre.assert_not_called()
+        post.assert_not_called()
+        pb_message = service.ResetIdentityAwareProxyClientSecretRequest.pb(
+            service.ResetIdentityAwareProxyClientSecretRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+        req.return_value._content = service.IdentityAwareProxyClient.to_json(
+            service.IdentityAwareProxyClient()
+        )
+
+        request = service.ResetIdentityAwareProxyClientSecretRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+        post.return_value = service.IdentityAwareProxyClient()
+
+        client.reset_identity_aware_proxy_client_secret(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+        post.assert_called_once()
+
+
+def test_reset_identity_aware_proxy_client_secret_rest_bad_request(
+    transport: str = "rest",
+    request_type=service.ResetIdentityAwareProxyClientSecretRequest,
+):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "name": "projects/sample1/brands/sample2/identityAwareProxyClients/sample3"
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.reset_identity_aware_proxy_client_secret(request)
+
+
+def test_reset_identity_aware_proxy_client_secret_rest_error():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+@pytest.mark.parametrize(
+    "request_type",
+    [
+        service.DeleteIdentityAwareProxyClientRequest,
+        dict,
+    ],
+)
+def test_delete_identity_aware_proxy_client_rest(request_type):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "name": "projects/sample1/brands/sample2/identityAwareProxyClients/sample3"
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(type(client.transport._session), "request") as req:
+        # Designate an appropriate value for the returned response.
+        return_value = None
+
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 200
+        json_return_value = ""
+
+        response_value._content = json_return_value.encode("UTF-8")
+        req.return_value = response_value
+        response = client.delete_identity_aware_proxy_client(request)
+
+    # Establish that the response is the type that we expect.
+    assert response is None
+
+
+def test_delete_identity_aware_proxy_client_rest_required_fields(
+    request_type=service.DeleteIdentityAwareProxyClientRequest,
+):
+    transport_class = transports.IdentityAwareProxyOAuthServiceRestTransport
+
+    request_init = {}
+    request_init["name"] = ""
+    request = request_type(**request_init)
+    pb_request = request_type.pb(request)
+    jsonified_request = json.loads(
+        json_format.MessageToJson(
+            pb_request,
+            including_default_value_fields=False,
+            use_integers_for_enums=False,
+        )
+    )
+
+    # verify fields with default values are dropped
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).delete_identity_aware_proxy_client._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with default values are now present
+
+    jsonified_request["name"] = "name_value"
+
+    unset_fields = transport_class(
+        credentials=ga_credentials.AnonymousCredentials()
+    ).delete_identity_aware_proxy_client._get_unset_required_fields(jsonified_request)
+    jsonified_request.update(unset_fields)
+
+    # verify required fields with non-default values are left alone
+    assert "name" in jsonified_request
+    assert jsonified_request["name"] == "name_value"
+
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="rest",
+    )
+    request = request_type(**request_init)
+
+    # Designate an appropriate value for the returned response.
+    return_value = None
+    # Mock the http request call within the method and fake a response.
+    with mock.patch.object(Session, "request") as req:
+        # We need to mock transcode() because providing default values
+        # for required fields will fail the real version if the http_options
+        # expect actual values for those fields.
+        with mock.patch.object(path_template, "transcode") as transcode:
+            # A uri without fields and an empty body will force all the
+            # request fields to show up in the query_params.
+            pb_request = request_type.pb(request)
+            transcode_result = {
+                "uri": "v1/sample_method",
+                "method": "delete",
+                "query_params": pb_request,
+            }
+            transcode.return_value = transcode_result
+
+            response_value = Response()
+            response_value.status_code = 200
+            json_return_value = ""
+
+            response_value._content = json_return_value.encode("UTF-8")
+            req.return_value = response_value
+
+            response = client.delete_identity_aware_proxy_client(request)
+
+            expected_params = [("$alt", "json;enum-encoding=int")]
+            actual_params = req.call_args.kwargs["params"]
+            assert expected_params == actual_params
+
+
+def test_delete_identity_aware_proxy_client_rest_unset_required_fields():
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials
+    )
+
+    unset_fields = (
+        transport.delete_identity_aware_proxy_client._get_unset_required_fields({})
+    )
+    assert set(unset_fields) == (set(()) & set(("name",)))
+
+
+@pytest.mark.parametrize("null_interceptor", [True, False])
+def test_delete_identity_aware_proxy_client_rest_interceptors(null_interceptor):
+    transport = transports.IdentityAwareProxyOAuthServiceRestTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+        interceptor=None
+        if null_interceptor
+        else transports.IdentityAwareProxyOAuthServiceRestInterceptor(),
+    )
+    client = IdentityAwareProxyOAuthServiceClient(transport=transport)
+    with mock.patch.object(
+        type(client.transport._session), "request"
+    ) as req, mock.patch.object(
+        path_template, "transcode"
+    ) as transcode, mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceRestInterceptor,
+        "pre_delete_identity_aware_proxy_client",
+    ) as pre:
+        pre.assert_not_called()
+        pb_message = service.DeleteIdentityAwareProxyClientRequest.pb(
+            service.DeleteIdentityAwareProxyClientRequest()
+        )
+        transcode.return_value = {
+            "method": "post",
+            "uri": "my_uri",
+            "body": pb_message,
+            "query_params": pb_message,
+        }
+
+        req.return_value = Response()
+        req.return_value.status_code = 200
+        req.return_value.request = PreparedRequest()
+
+        request = service.DeleteIdentityAwareProxyClientRequest()
+        metadata = [
+            ("key", "val"),
+            ("cephalopod", "squid"),
+        ]
+        pre.return_value = request, metadata
+
+        client.delete_identity_aware_proxy_client(
+            request,
+            metadata=[
+                ("key", "val"),
+                ("cephalopod", "squid"),
+            ],
+        )
+
+        pre.assert_called_once()
+
+
+def test_delete_identity_aware_proxy_client_rest_bad_request(
+    transport: str = "rest", request_type=service.DeleteIdentityAwareProxyClientRequest
+):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport=transport,
+    )
+
+    # send a request that will satisfy transcoding
+    request_init = {
+        "name": "projects/sample1/brands/sample2/identityAwareProxyClients/sample3"
+    }
+    request = request_type(**request_init)
+
+    # Mock the http request call within the method and fake a BadRequest error.
+    with mock.patch.object(Session, "request") as req, pytest.raises(
+        core_exceptions.BadRequest
+    ):
+        # Wrap the value into a proper Response obj
+        response_value = Response()
+        response_value.status_code = 400
+        response_value.request = Request()
+        req.return_value = response_value
+        client.delete_identity_aware_proxy_client(request)
+
+
+def test_delete_identity_aware_proxy_client_rest_error():
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(), transport="rest"
+    )
+
+
+def test_credentials_transport_error():
+    # It is an error to provide credentials and a transport instance.
+    transport = transports.IdentityAwareProxyOAuthServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    with pytest.raises(ValueError):
+        client = IdentityAwareProxyOAuthServiceClient(
+            credentials=ga_credentials.AnonymousCredentials(),
+            transport=transport,
+        )
+
+    # It is an error to provide a credentials file and a transport instance.
+    transport = transports.IdentityAwareProxyOAuthServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    with pytest.raises(ValueError):
+        client = IdentityAwareProxyOAuthServiceClient(
+            client_options={"credentials_file": "credentials.json"},
+            transport=transport,
+        )
+
+    # It is an error to provide an api_key and a transport instance.
+    transport = transports.IdentityAwareProxyOAuthServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    options = client_options.ClientOptions()
+    options.api_key = "api_key"
+    with pytest.raises(ValueError):
+        client = IdentityAwareProxyOAuthServiceClient(
+            client_options=options,
+            transport=transport,
+        )
+
+    # It is an error to provide an api_key and a credential.
+    options = mock.Mock()
+    options.api_key = "api_key"
+    with pytest.raises(ValueError):
+        client = IdentityAwareProxyOAuthServiceClient(
+            client_options=options, credentials=ga_credentials.AnonymousCredentials()
+        )
+
+    # It is an error to provide scopes and a transport instance.
+    transport = transports.IdentityAwareProxyOAuthServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    with pytest.raises(ValueError):
+        client = IdentityAwareProxyOAuthServiceClient(
+            client_options={"scopes": ["1", "2"]},
+            transport=transport,
+        )
+
+
+def test_transport_instance():
+    # A client may be instantiated with a custom transport instance.
+    transport = transports.IdentityAwareProxyOAuthServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    client = IdentityAwareProxyOAuthServiceClient(transport=transport)
+    assert client.transport is transport
+
+
+def test_transport_get_channel():
+    # A client may be instantiated with a custom transport instance.
+    transport = transports.IdentityAwareProxyOAuthServiceGrpcTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    channel = transport.grpc_channel
+    assert channel
+
+    transport = transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    channel = transport.grpc_channel
+    assert channel
+
+
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+        transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+        transports.IdentityAwareProxyOAuthServiceRestTransport,
+    ],
+)
+def test_transport_adc(transport_class):
+    # Test default credentials are used if not provided.
+    with mock.patch.object(google.auth, "default") as adc:
+        adc.return_value = (ga_credentials.AnonymousCredentials(), None)
+        transport_class()
+        adc.assert_called_once()
+
+
+@pytest.mark.parametrize(
+    "transport_name",
+    [
+        "grpc",
+        "rest",
+    ],
+)
+def test_transport_kind(transport_name):
+    transport = IdentityAwareProxyOAuthServiceClient.get_transport_class(
+        transport_name
+    )(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    assert transport.kind == transport_name
+
+
+def test_transport_grpc_default():
+    # A client should use the gRPC transport by default.
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+    )
+    assert isinstance(
+        client.transport,
+        transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+    )
+
+
+def test_identity_aware_proxy_o_auth_service_base_transport_error():
+    # Passing both a credentials object and credentials_file should raise an error
+    with pytest.raises(core_exceptions.DuplicateCredentialArgs):
+        transport = transports.IdentityAwareProxyOAuthServiceTransport(
+            credentials=ga_credentials.AnonymousCredentials(),
+            credentials_file="credentials.json",
+        )
+
+
+def test_identity_aware_proxy_o_auth_service_base_transport():
+    # Instantiate the base transport.
+    with mock.patch(
+        "google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service.transports.IdentityAwareProxyOAuthServiceTransport.__init__"
+    ) as Transport:
+        Transport.return_value = None
+        transport = transports.IdentityAwareProxyOAuthServiceTransport(
+            credentials=ga_credentials.AnonymousCredentials(),
+        )
+
+    # Every method on the transport should just blindly
+    # raise NotImplementedError.
+    methods = (
+        "list_brands",
+        "create_brand",
+        "get_brand",
+        "create_identity_aware_proxy_client",
+        "list_identity_aware_proxy_clients",
+        "get_identity_aware_proxy_client",
+        "reset_identity_aware_proxy_client_secret",
+        "delete_identity_aware_proxy_client",
+    )
+    for method in methods:
+        with pytest.raises(NotImplementedError):
+            getattr(transport, method)(request=object())
+
+    with pytest.raises(NotImplementedError):
+        transport.close()
+
+    # Catch all for all remaining methods and properties
+    remainder = [
+        "kind",
+    ]
+    for r in remainder:
+        with pytest.raises(NotImplementedError):
+            getattr(transport, r)()
+
+
+def test_identity_aware_proxy_o_auth_service_base_transport_with_credentials_file():
+    # Instantiate the base transport with a credentials file
+    with mock.patch.object(
+        google.auth, "load_credentials_from_file", autospec=True
+    ) as load_creds, mock.patch(
+        "google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service.transports.IdentityAwareProxyOAuthServiceTransport._prep_wrapped_messages"
+    ) as Transport:
+        Transport.return_value = None
+        load_creds.return_value = (ga_credentials.AnonymousCredentials(), None)
+        transport = transports.IdentityAwareProxyOAuthServiceTransport(
+            credentials_file="credentials.json",
+            quota_project_id="octopus",
+        )
+        load_creds.assert_called_once_with(
+            "credentials.json",
+            scopes=None,
+            default_scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            quota_project_id="octopus",
+        )
+
+
+def test_identity_aware_proxy_o_auth_service_base_transport_with_adc():
+    # Test the default credentials are used if credentials and credentials_file are None.
+    with mock.patch.object(google.auth, "default", autospec=True) as adc, mock.patch(
+        "google.cloud.iap_v1.services.identity_aware_proxy_o_auth_service.transports.IdentityAwareProxyOAuthServiceTransport._prep_wrapped_messages"
+    ) as Transport:
+        Transport.return_value = None
+        adc.return_value = (ga_credentials.AnonymousCredentials(), None)
+        transport = transports.IdentityAwareProxyOAuthServiceTransport()
+        adc.assert_called_once()
+
+
+def test_identity_aware_proxy_o_auth_service_auth_adc():
+    # If no credentials are provided, we should use ADC credentials.
+    with mock.patch.object(google.auth, "default", autospec=True) as adc:
+        adc.return_value = (ga_credentials.AnonymousCredentials(), None)
+        IdentityAwareProxyOAuthServiceClient()
+        adc.assert_called_once_with(
+            scopes=None,
+            default_scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            quota_project_id=None,
+        )
+
+
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+        transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_transport_auth_adc(transport_class):
+    # If credentials and host are not provided, the transport class should use
+    # ADC credentials.
+    with mock.patch.object(google.auth, "default", autospec=True) as adc:
+        adc.return_value = (ga_credentials.AnonymousCredentials(), None)
+        transport_class(quota_project_id="octopus", scopes=["1", "2"])
+        adc.assert_called_once_with(
+            scopes=["1", "2"],
+            default_scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            quota_project_id="octopus",
+        )
+
+
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+        transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+        transports.IdentityAwareProxyOAuthServiceRestTransport,
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_transport_auth_gdch_credentials(
+    transport_class,
+):
+    host = "https://language.com"
+    api_audience_tests = [None, "https://language2.com"]
+    api_audience_expect = [host, "https://language2.com"]
+    for t, e in zip(api_audience_tests, api_audience_expect):
+        with mock.patch.object(google.auth, "default", autospec=True) as adc:
+            gdch_mock = mock.MagicMock()
+            type(gdch_mock).with_gdch_audience = mock.PropertyMock(
+                return_value=gdch_mock
+            )
+            adc.return_value = (gdch_mock, None)
+            transport_class(host=host, api_audience=t)
+            gdch_mock.with_gdch_audience.assert_called_once_with(e)
+
+
+@pytest.mark.parametrize(
+    "transport_class,grpc_helpers",
+    [
+        (transports.IdentityAwareProxyOAuthServiceGrpcTransport, grpc_helpers),
+        (
+            transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+            grpc_helpers_async,
+        ),
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_transport_create_channel(
+    transport_class, grpc_helpers
+):
+    # If credentials and host are not provided, the transport class should use
+    # ADC credentials.
+    with mock.patch.object(
+        google.auth, "default", autospec=True
+    ) as adc, mock.patch.object(
+        grpc_helpers, "create_channel", autospec=True
+    ) as create_channel:
+        creds = ga_credentials.AnonymousCredentials()
+        adc.return_value = (creds, None)
+        transport_class(quota_project_id="octopus", scopes=["1", "2"])
+
+        create_channel.assert_called_with(
+            "iap.googleapis.com:443",
+            credentials=creds,
+            credentials_file=None,
+            quota_project_id="octopus",
+            default_scopes=("https://www.googleapis.com/auth/cloud-platform",),
+            scopes=["1", "2"],
+            default_host="iap.googleapis.com",
+            ssl_credentials=None,
+            options=[
+                ("grpc.max_send_message_length", -1),
+                ("grpc.max_receive_message_length", -1),
+            ],
+        )
+
+
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+        transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_grpc_transport_client_cert_source_for_mtls(
+    transport_class,
+):
+    cred = ga_credentials.AnonymousCredentials()
+
+    # Check ssl_channel_credentials is used if provided.
+    with mock.patch.object(transport_class, "create_channel") as mock_create_channel:
+        mock_ssl_channel_creds = mock.Mock()
+        transport_class(
+            host="squid.clam.whelk",
+            credentials=cred,
+            ssl_channel_credentials=mock_ssl_channel_creds,
+        )
+        mock_create_channel.assert_called_once_with(
+            "squid.clam.whelk:443",
+            credentials=cred,
+            credentials_file=None,
+            scopes=None,
+            ssl_credentials=mock_ssl_channel_creds,
+            quota_project_id=None,
+            options=[
+                ("grpc.max_send_message_length", -1),
+                ("grpc.max_receive_message_length", -1),
+            ],
+        )
+
+    # Check if ssl_channel_credentials is not provided, then client_cert_source_for_mtls
+    # is used.
+    with mock.patch.object(transport_class, "create_channel", return_value=mock.Mock()):
+        with mock.patch("grpc.ssl_channel_credentials") as mock_ssl_cred:
+            transport_class(
+                credentials=cred,
+                client_cert_source_for_mtls=client_cert_source_callback,
+            )
+            expected_cert, expected_key = client_cert_source_callback()
+            mock_ssl_cred.assert_called_once_with(
+                certificate_chain=expected_cert, private_key=expected_key
+            )
+
+
+def test_identity_aware_proxy_o_auth_service_http_transport_client_cert_source_for_mtls():
+    cred = ga_credentials.AnonymousCredentials()
+    with mock.patch(
+        "google.auth.transport.requests.AuthorizedSession.configure_mtls_channel"
+    ) as mock_configure_mtls_channel:
+        transports.IdentityAwareProxyOAuthServiceRestTransport(
+            credentials=cred, client_cert_source_for_mtls=client_cert_source_callback
+        )
+        mock_configure_mtls_channel.assert_called_once_with(client_cert_source_callback)
+
+
+@pytest.mark.parametrize(
+    "transport_name",
+    [
+        "grpc",
+        "grpc_asyncio",
+        "rest",
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_host_no_port(transport_name):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        client_options=client_options.ClientOptions(api_endpoint="iap.googleapis.com"),
+        transport=transport_name,
+    )
+    assert client.transport._host == (
+        "iap.googleapis.com:443"
+        if transport_name in ["grpc", "grpc_asyncio"]
+        else "https://iap.googleapis.com"
+    )
+
+
+@pytest.mark.parametrize(
+    "transport_name",
+    [
+        "grpc",
+        "grpc_asyncio",
+        "rest",
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_host_with_port(transport_name):
+    client = IdentityAwareProxyOAuthServiceClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        client_options=client_options.ClientOptions(
+            api_endpoint="iap.googleapis.com:8000"
+        ),
+        transport=transport_name,
+    )
+    assert client.transport._host == (
+        "iap.googleapis.com:8000"
+        if transport_name in ["grpc", "grpc_asyncio"]
+        else "https://iap.googleapis.com:8000"
+    )
+
+
+@pytest.mark.parametrize(
+    "transport_name",
+    [
+        "rest",
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_client_transport_session_collision(
+    transport_name,
+):
+    creds1 = ga_credentials.AnonymousCredentials()
+    creds2 = ga_credentials.AnonymousCredentials()
+    client1 = IdentityAwareProxyOAuthServiceClient(
+        credentials=creds1,
+        transport=transport_name,
+    )
+    client2 = IdentityAwareProxyOAuthServiceClient(
+        credentials=creds2,
+        transport=transport_name,
+    )
+    session1 = client1.transport.list_brands._session
+    session2 = client2.transport.list_brands._session
+    assert session1 != session2
+    session1 = client1.transport.create_brand._session
+    session2 = client2.transport.create_brand._session
+    assert session1 != session2
+    session1 = client1.transport.get_brand._session
+    session2 = client2.transport.get_brand._session
+    assert session1 != session2
+    session1 = client1.transport.create_identity_aware_proxy_client._session
+    session2 = client2.transport.create_identity_aware_proxy_client._session
+    assert session1 != session2
+    session1 = client1.transport.list_identity_aware_proxy_clients._session
+    session2 = client2.transport.list_identity_aware_proxy_clients._session
+    assert session1 != session2
+    session1 = client1.transport.get_identity_aware_proxy_client._session
+    session2 = client2.transport.get_identity_aware_proxy_client._session
+    assert session1 != session2
+    session1 = client1.transport.reset_identity_aware_proxy_client_secret._session
+    session2 = client2.transport.reset_identity_aware_proxy_client_secret._session
+    assert session1 != session2
+    session1 = client1.transport.delete_identity_aware_proxy_client._session
+    session2 = client2.transport.delete_identity_aware_proxy_client._session
+    assert session1 != session2
+
+
+def test_identity_aware_proxy_o_auth_service_grpc_transport_channel():
+    channel = grpc.secure_channel("http://localhost/", grpc.local_channel_credentials())
+
+    # Check that channel is used if provided.
+    transport = transports.IdentityAwareProxyOAuthServiceGrpcTransport(
+        host="squid.clam.whelk",
+        channel=channel,
+    )
+    assert transport.grpc_channel == channel
+    assert transport._host == "squid.clam.whelk:443"
+    assert transport._ssl_channel_credentials == None
+
+
+def test_identity_aware_proxy_o_auth_service_grpc_asyncio_transport_channel():
+    channel = aio.secure_channel("http://localhost/", grpc.local_channel_credentials())
+
+    # Check that channel is used if provided.
+    transport = transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport(
+        host="squid.clam.whelk",
+        channel=channel,
+    )
+    assert transport.grpc_channel == channel
+    assert transport._host == "squid.clam.whelk:443"
+    assert transport._ssl_channel_credentials == None
+
+
+# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are
+# removed from grpc/grpc_asyncio transport constructor.
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+        transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_transport_channel_mtls_with_client_cert_source(
+    transport_class,
+):
+    with mock.patch(
+        "grpc.ssl_channel_credentials", autospec=True
+    ) as grpc_ssl_channel_cred:
+        with mock.patch.object(
+            transport_class, "create_channel"
+        ) as grpc_create_channel:
+            mock_ssl_cred = mock.Mock()
+            grpc_ssl_channel_cred.return_value = mock_ssl_cred
+
+            mock_grpc_channel = mock.Mock()
+            grpc_create_channel.return_value = mock_grpc_channel
+
+            cred = ga_credentials.AnonymousCredentials()
+            with pytest.warns(DeprecationWarning):
+                with mock.patch.object(google.auth, "default") as adc:
+                    adc.return_value = (cred, None)
+                    transport = transport_class(
+                        host="squid.clam.whelk",
+                        api_mtls_endpoint="mtls.squid.clam.whelk",
+                        client_cert_source=client_cert_source_callback,
+                    )
+                    adc.assert_called_once()
+
+            grpc_ssl_channel_cred.assert_called_once_with(
+                certificate_chain=b"cert bytes", private_key=b"key bytes"
+            )
+            grpc_create_channel.assert_called_once_with(
+                "mtls.squid.clam.whelk:443",
+                credentials=cred,
+                credentials_file=None,
+                scopes=None,
+                ssl_credentials=mock_ssl_cred,
+                quota_project_id=None,
+                options=[
+                    ("grpc.max_send_message_length", -1),
+                    ("grpc.max_receive_message_length", -1),
+                ],
+            )
+            assert transport.grpc_channel == mock_grpc_channel
+            assert transport._ssl_channel_credentials == mock_ssl_cred
+
+
+# Remove this test when deprecated arguments (api_mtls_endpoint, client_cert_source) are
+# removed from grpc/grpc_asyncio transport constructor.
+@pytest.mark.parametrize(
+    "transport_class",
+    [
+        transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+        transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+    ],
+)
+def test_identity_aware_proxy_o_auth_service_transport_channel_mtls_with_adc(
+    transport_class,
+):
+    mock_ssl_cred = mock.Mock()
+    with mock.patch.multiple(
+        "google.auth.transport.grpc.SslCredentials",
+        __init__=mock.Mock(return_value=None),
+        ssl_credentials=mock.PropertyMock(return_value=mock_ssl_cred),
+    ):
+        with mock.patch.object(
+            transport_class, "create_channel"
+        ) as grpc_create_channel:
+            mock_grpc_channel = mock.Mock()
+            grpc_create_channel.return_value = mock_grpc_channel
+            mock_cred = mock.Mock()
+
+            with pytest.warns(DeprecationWarning):
+                transport = transport_class(
+                    host="squid.clam.whelk",
+                    credentials=mock_cred,
+                    api_mtls_endpoint="mtls.squid.clam.whelk",
+                    client_cert_source=None,
+                )
+
+            grpc_create_channel.assert_called_once_with(
+                "mtls.squid.clam.whelk:443",
+                credentials=mock_cred,
+                credentials_file=None,
+                scopes=None,
+                ssl_credentials=mock_ssl_cred,
+                quota_project_id=None,
+                options=[
+                    ("grpc.max_send_message_length", -1),
+                    ("grpc.max_receive_message_length", -1),
+                ],
+            )
+            assert transport.grpc_channel == mock_grpc_channel
+
+
+def test_common_billing_account_path():
+    billing_account = "squid"
+    expected = "billingAccounts/{billing_account}".format(
+        billing_account=billing_account,
+    )
+    actual = IdentityAwareProxyOAuthServiceClient.common_billing_account_path(
+        billing_account
+    )
+    assert expected == actual
+
+
+def test_parse_common_billing_account_path():
+    expected = {
+        "billing_account": "clam",
+    }
+    path = IdentityAwareProxyOAuthServiceClient.common_billing_account_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyOAuthServiceClient.parse_common_billing_account_path(
+        path
+    )
+    assert expected == actual
+
+
+def test_common_folder_path():
+    folder = "whelk"
+    expected = "folders/{folder}".format(
+        folder=folder,
+    )
+    actual = IdentityAwareProxyOAuthServiceClient.common_folder_path(folder)
+    assert expected == actual
+
+
+def test_parse_common_folder_path():
+    expected = {
+        "folder": "octopus",
+    }
+    path = IdentityAwareProxyOAuthServiceClient.common_folder_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyOAuthServiceClient.parse_common_folder_path(path)
+    assert expected == actual
+
+
+def test_common_organization_path():
+    organization = "oyster"
+    expected = "organizations/{organization}".format(
+        organization=organization,
+    )
+    actual = IdentityAwareProxyOAuthServiceClient.common_organization_path(organization)
+    assert expected == actual
+
+
+def test_parse_common_organization_path():
+    expected = {
+        "organization": "nudibranch",
+    }
+    path = IdentityAwareProxyOAuthServiceClient.common_organization_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyOAuthServiceClient.parse_common_organization_path(path)
+    assert expected == actual
+
+
+def test_common_project_path():
+    project = "cuttlefish"
+    expected = "projects/{project}".format(
+        project=project,
+    )
+    actual = IdentityAwareProxyOAuthServiceClient.common_project_path(project)
+    assert expected == actual
+
+
+def test_parse_common_project_path():
+    expected = {
+        "project": "mussel",
+    }
+    path = IdentityAwareProxyOAuthServiceClient.common_project_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyOAuthServiceClient.parse_common_project_path(path)
+    assert expected == actual
+
+
+def test_common_location_path():
+    project = "winkle"
+    location = "nautilus"
+    expected = "projects/{project}/locations/{location}".format(
+        project=project,
+        location=location,
+    )
+    actual = IdentityAwareProxyOAuthServiceClient.common_location_path(
+        project, location
+    )
+    assert expected == actual
+
+
+def test_parse_common_location_path():
+    expected = {
+        "project": "scallop",
+        "location": "abalone",
+    }
+    path = IdentityAwareProxyOAuthServiceClient.common_location_path(**expected)
+
+    # Check that the path construction is reversible.
+    actual = IdentityAwareProxyOAuthServiceClient.parse_common_location_path(path)
+    assert expected == actual
+
+
+def test_client_with_default_client_info():
+    client_info = gapic_v1.client_info.ClientInfo()
+
+    with mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceTransport, "_prep_wrapped_messages"
+    ) as prep:
+        client = IdentityAwareProxyOAuthServiceClient(
+            credentials=ga_credentials.AnonymousCredentials(),
+            client_info=client_info,
+        )
+        prep.assert_called_once_with(client_info)
+
+    with mock.patch.object(
+        transports.IdentityAwareProxyOAuthServiceTransport, "_prep_wrapped_messages"
+    ) as prep:
+        transport_class = IdentityAwareProxyOAuthServiceClient.get_transport_class()
+        transport = transport_class(
+            credentials=ga_credentials.AnonymousCredentials(),
+            client_info=client_info,
+        )
+        prep.assert_called_once_with(client_info)
+
+
+@pytest.mark.asyncio
+async def test_transport_close_async():
+    client = IdentityAwareProxyOAuthServiceAsyncClient(
+        credentials=ga_credentials.AnonymousCredentials(),
+        transport="grpc_asyncio",
+    )
+    with mock.patch.object(
+        type(getattr(client.transport, "grpc_channel")), "close"
+    ) as close:
+        async with client:
+            close.assert_not_called()
+        close.assert_called_once()
+
+
+def test_transport_close():
+    transports = {
+        "rest": "_session",
+        "grpc": "_grpc_channel",
+    }
+
+    for transport, close_name in transports.items():
+        client = IdentityAwareProxyOAuthServiceClient(
+            credentials=ga_credentials.AnonymousCredentials(), transport=transport
+        )
+        with mock.patch.object(
+            type(getattr(client.transport, close_name)), "close"
+        ) as close:
+            with client:
+                close.assert_not_called()
+            close.assert_called_once()
+
+
+def test_client_ctx():
+    transports = [
+        "rest",
+        "grpc",
+    ]
+    for transport in transports:
+        client = IdentityAwareProxyOAuthServiceClient(
+            credentials=ga_credentials.AnonymousCredentials(), transport=transport
+        )
+        # Test client calls underlying transport.
+        with mock.patch.object(type(client.transport), "close") as close:
+            close.assert_not_called()
+            with client:
+                pass
+            close.assert_called()
+
+
+@pytest.mark.parametrize(
+    "client_class,transport_class",
+    [
+        (
+            IdentityAwareProxyOAuthServiceClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcTransport,
+        ),
+        (
+            IdentityAwareProxyOAuthServiceAsyncClient,
+            transports.IdentityAwareProxyOAuthServiceGrpcAsyncIOTransport,
+        ),
+    ],
+)
+def test_api_key_credentials(client_class, transport_class):
+    with mock.patch.object(
+        google.auth._default, "get_api_key_credentials", create=True
+    ) as get_api_key_credentials:
+        mock_cred = mock.Mock()
+        get_api_key_credentials.return_value = mock_cred
+        options = client_options.ClientOptions()
+        options.api_key = "api_key"
+        with mock.patch.object(transport_class, "__init__") as patched:
+            patched.return_value = None
+            client = client_class(client_options=options)
+            patched.assert_called_once_with(
+                credentials=mock_cred,
+                credentials_file=None,
+                host=client.DEFAULT_ENDPOINT,
+                scopes=None,
+                client_cert_source_for_mtls=None,
+                quota_project_id=None,
+                client_info=transports.base.DEFAULT_CLIENT_INFO,
+                always_use_jwt_access=True,
+                api_audience=None,
+            )