diff --git a/LICENSE b/LICENSE
new file mode 100644
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,367 @@
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
diff --git a/README.md b/README.md
new file mode 100644
--- /dev/null
+++ b/README.md
@@ -0,0 +1,28 @@
+# gogol-cloudkms
+
+* [Version](#version)
+* [Description](#description)
+* [Contribute](#contribute)
+* [Licence](#licence)
+
+
+## Version
+
+`0.3.0`
+
+
+## Description
+
+A client library for the Google Cloud Key Management Service (KMS).
+
+
+## Contribute
+
+For any problems, comments, or feedback please create an issue [here on GitHub](https://github.com/brendanhay/gogol/issues).
+
+> _Note:_ this library is an auto-generated Haskell package. Please see `gogol-gen` for more information.
+
+
+## Licence
+
+`gogol-cloudkms` is released under the [Mozilla Public License Version 2.0](http://www.mozilla.org/MPL/).
diff --git a/Setup.hs b/Setup.hs
new file mode 100644
--- /dev/null
+++ b/Setup.hs
@@ -0,0 +1,2 @@
+import           Distribution.Simple
+main = defaultMain
diff --git a/gen/Network/Google/CloudKMS.hs b/gen/Network/Google/CloudKMS.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/CloudKMS.hs
@@ -0,0 +1,462 @@
+{-# LANGUAGE DataKinds         #-}
+{-# LANGUAGE NoImplicitPrelude #-}
+{-# LANGUAGE TypeOperators     #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+
+-- |
+-- Module      : Network.Google.CloudKMS
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Manages keys and performs cryptographic operations in a central cloud
+-- service, for direct use by other cloud resources and applications.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference>
+module Network.Google.CloudKMS
+    (
+    -- * Service Configuration
+      cloudKMSService
+
+    -- * OAuth Scopes
+    , cloudPlatformScope
+
+    -- * API Declaration
+    , CloudKMSAPI
+
+    -- * Resources
+
+    -- ** cloudkms.projects.locations.get
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.Get
+
+    -- ** cloudkms.projects.locations.keyRings.create
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.Create
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.create
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Create
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.asymmetricDecrypt
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.AsymmetricDecrypt
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.asymmetricSign
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.AsymmetricSign
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.create
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Create
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.destroy
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Destroy
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.get
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Get
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.getPublicKey
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.GetPublicKey
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.list
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.List
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.patch
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Patch
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.restore
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Restore
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.decrypt
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Decrypt
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.encrypt
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Encrypt
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.get
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Get
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.getIamPolicy
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.GetIAMPolicy
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.list
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.List
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.patch
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Patch
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.setIamPolicy
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.SetIAMPolicy
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.testIamPermissions
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.TestIAMPermissions
+
+    -- ** cloudkms.projects.locations.keyRings.cryptoKeys.updatePrimaryVersion
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.UpdatePrimaryVersion
+
+    -- ** cloudkms.projects.locations.keyRings.get
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.Get
+
+    -- ** cloudkms.projects.locations.keyRings.getIamPolicy
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.GetIAMPolicy
+
+    -- ** cloudkms.projects.locations.keyRings.importJobs.getIamPolicy
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.GetIAMPolicy
+
+    -- ** cloudkms.projects.locations.keyRings.importJobs.setIamPolicy
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.SetIAMPolicy
+
+    -- ** cloudkms.projects.locations.keyRings.importJobs.testIamPermissions
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.TestIAMPermissions
+
+    -- ** cloudkms.projects.locations.keyRings.list
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.List
+
+    -- ** cloudkms.projects.locations.keyRings.setIamPolicy
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.SetIAMPolicy
+
+    -- ** cloudkms.projects.locations.keyRings.testIamPermissions
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.TestIAMPermissions
+
+    -- ** cloudkms.projects.locations.list
+    , module Network.Google.Resource.CloudKMS.Projects.Locations.List
+
+    -- * Types
+
+    -- ** AsymmetricDecryptResponse
+    , AsymmetricDecryptResponse
+    , asymmetricDecryptResponse
+    , adrPlaintext
+
+    -- ** EncryptResponse
+    , EncryptResponse
+    , encryptResponse
+    , erName
+    , erCiphertext
+
+    -- ** LocationSchema
+    , LocationSchema
+    , locationSchema
+    , lsAddtional
+
+    -- ** AuditConfig
+    , AuditConfig
+    , auditConfig
+    , acService
+    , acAuditLogConfigs
+
+    -- ** Expr
+    , Expr
+    , expr
+    , eLocation
+    , eExpression
+    , eTitle
+    , eDescription
+
+    -- ** ListLocationsResponse
+    , ListLocationsResponse
+    , listLocationsResponse
+    , llrNextPageToken
+    , llrLocations
+
+    -- ** ListKeyRingsResponse
+    , ListKeyRingsResponse
+    , listKeyRingsResponse
+    , lkrrNextPageToken
+    , lkrrTotalSize
+    , lkrrKeyRings
+
+    -- ** AsymmetricSignResponse
+    , AsymmetricSignResponse
+    , asymmetricSignResponse
+    , asrSignature
+
+    -- ** CryptoKeyPurpose
+    , CryptoKeyPurpose (..)
+
+    -- ** KeyRing
+    , KeyRing
+    , keyRing
+    , krName
+    , krCreateTime
+
+    -- ** DestroyCryptoKeyVersionRequest
+    , DestroyCryptoKeyVersionRequest
+    , destroyCryptoKeyVersionRequest
+
+    -- ** Location
+    , Location
+    , location
+    , lName
+    , lMetadata
+    , lDisplayName
+    , lLabels
+    , lLocationId
+
+    -- ** AsymmetricSignRequest
+    , AsymmetricSignRequest
+    , asymmetricSignRequest
+    , asrDigest
+
+    -- ** CryptoKeyVersionTemplateProtectionLevel
+    , CryptoKeyVersionTemplateProtectionLevel (..)
+
+    -- ** PublicKey
+    , PublicKey
+    , publicKey
+    , pkPem
+    , pkAlgorithm
+
+    -- ** DecryptResponse
+    , DecryptResponse
+    , decryptResponse
+    , drPlaintext
+
+    -- ** CryptoKeyVersionTemplate
+    , CryptoKeyVersionTemplate
+    , cryptoKeyVersionTemplate
+    , ckvtAlgorithm
+    , ckvtProtectionLevel
+
+    -- ** SetIAMPolicyRequest
+    , SetIAMPolicyRequest
+    , setIAMPolicyRequest
+    , siprUpdateMask
+    , siprPolicy
+
+    -- ** CryptoKeyLabels
+    , CryptoKeyLabels
+    , cryptoKeyLabels
+    , cklAddtional
+
+    -- ** CryptoKeyVersionTemplateAlgorithm
+    , CryptoKeyVersionTemplateAlgorithm (..)
+
+    -- ** PublicKeyAlgorithm
+    , PublicKeyAlgorithm (..)
+
+    -- ** CryptoKeyVersionState
+    , CryptoKeyVersionState (..)
+
+    -- ** CryptoKey
+    , CryptoKey
+    , cryptoKey
+    , ckVersionTemplate
+    , ckPurpose
+    , ckRotationPeriod
+    , ckPrimary
+    , ckName
+    , ckLabels
+    , ckNextRotationTime
+    , ckCreateTime
+
+    -- ** DecryptRequest
+    , DecryptRequest
+    , decryptRequest
+    , drAdditionalAuthenticatedData
+    , drCiphertext
+
+    -- ** KeyOperationAttestation
+    , KeyOperationAttestation
+    , keyOperationAttestation
+    , koaFormat
+    , koaContent
+
+    -- ** ListCryptoKeyVersionsResponse
+    , ListCryptoKeyVersionsResponse
+    , listCryptoKeyVersionsResponse
+    , lckvrNextPageToken
+    , lckvrTotalSize
+    , lckvrCryptoKeyVersions
+
+    -- ** KeyOperationAttestationFormat
+    , KeyOperationAttestationFormat (..)
+
+    -- ** RestoreCryptoKeyVersionRequest
+    , RestoreCryptoKeyVersionRequest
+    , restoreCryptoKeyVersionRequest
+
+    -- ** AuditLogConfigLogType
+    , AuditLogConfigLogType (..)
+
+    -- ** UpdateCryptoKeyPrimaryVersionRequest
+    , UpdateCryptoKeyPrimaryVersionRequest
+    , updateCryptoKeyPrimaryVersionRequest
+    , uckpvrCryptoKeyVersionId
+
+    -- ** Xgafv
+    , Xgafv (..)
+
+    -- ** TestIAMPermissionsRequest
+    , TestIAMPermissionsRequest
+    , testIAMPermissionsRequest
+    , tiprPermissions
+
+    -- ** TestIAMPermissionsResponse
+    , TestIAMPermissionsResponse
+    , testIAMPermissionsResponse
+    , tiamprPermissions
+
+    -- ** Digest
+    , Digest
+    , digest
+    , dSha512
+    , dSha384
+    , dSha256
+
+    -- ** Policy
+    , Policy
+    , policy
+    , pAuditConfigs
+    , pEtag
+    , pVersion
+    , pBindings
+
+    -- ** LocationLabels
+    , LocationLabels
+    , locationLabels
+    , llAddtional
+
+    -- ** LocationMetadata
+    , LocationMetadata
+    , locationMetadata
+    , lmHSMAvailable
+
+    -- ** AuditLogConfig
+    , AuditLogConfig
+    , auditLogConfig
+    , alcLogType
+    , alcExemptedMembers
+
+    -- ** CryptoKeyVersionProtectionLevel
+    , CryptoKeyVersionProtectionLevel (..)
+
+    -- ** ListCryptoKeysResponse
+    , ListCryptoKeysResponse
+    , listCryptoKeysResponse
+    , lckrCryptoKeys
+    , lckrNextPageToken
+    , lckrTotalSize
+
+    -- ** AsymmetricDecryptRequest
+    , AsymmetricDecryptRequest
+    , asymmetricDecryptRequest
+    , adrCiphertext
+
+    -- ** CryptoKeyVersion
+    , CryptoKeyVersion
+    , cryptoKeyVersion
+    , ckvState
+    , ckvAttestation
+    , ckvGenerateTime
+    , ckvName
+    , ckvAlgorithm
+    , ckvDestroyTime
+    , ckvProtectionLevel
+    , ckvDestroyEventTime
+    , ckvCreateTime
+
+    -- ** EncryptRequest
+    , EncryptRequest
+    , encryptRequest
+    , erAdditionalAuthenticatedData
+    , erPlaintext
+
+    -- ** CryptoKeyVersionAlgorithm
+    , CryptoKeyVersionAlgorithm (..)
+
+    -- ** Binding
+    , Binding
+    , binding
+    , bMembers
+    , bRole
+    , bCondition
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+import           Network.Google.Resource.CloudKMS.Projects.Locations.Get
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.Create
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Create
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.AsymmetricDecrypt
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.AsymmetricSign
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Create
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Destroy
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Get
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.GetPublicKey
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.List
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Patch
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Restore
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Decrypt
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Encrypt
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Get
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.GetIAMPolicy
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.List
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Patch
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.SetIAMPolicy
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.TestIAMPermissions
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.UpdatePrimaryVersion
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.Get
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.GetIAMPolicy
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.GetIAMPolicy
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.SetIAMPolicy
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.TestIAMPermissions
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.List
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.SetIAMPolicy
+import           Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.TestIAMPermissions
+import           Network.Google.Resource.CloudKMS.Projects.Locations.List
+
+{- $resources
+TODO
+-}
+
+-- | Represents the entirety of the methods and resources available for the Cloud Key Management Service (KMS) API service.
+type CloudKMSAPI =
+     ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecryptResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsListResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKeyResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestoreResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatchResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSignResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreateResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroyResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysEncryptResource
+       :<|> ProjectsLocationsKeyRingsCryptoKeysListResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicyResource
+       :<|> ProjectsLocationsKeyRingsCryptoKeysPatchResource
+       :<|> ProjectsLocationsKeyRingsCryptoKeysGetResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysCreateResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicyResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersionResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysDecryptResource
+       :<|>
+       ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissionsResource
+       :<|>
+       ProjectsLocationsKeyRingsImportJobsGetIAMPolicyResource
+       :<|>
+       ProjectsLocationsKeyRingsImportJobsSetIAMPolicyResource
+       :<|>
+       ProjectsLocationsKeyRingsImportJobsTestIAMPermissionsResource
+       :<|> ProjectsLocationsKeyRingsListResource
+       :<|> ProjectsLocationsKeyRingsGetIAMPolicyResource
+       :<|> ProjectsLocationsKeyRingsGetResource
+       :<|> ProjectsLocationsKeyRingsCreateResource
+       :<|> ProjectsLocationsKeyRingsSetIAMPolicyResource
+       :<|>
+       ProjectsLocationsKeyRingsTestIAMPermissionsResource
+       :<|> ProjectsLocationsListResource
+       :<|> ProjectsLocationsGetResource
diff --git a/gen/Network/Google/CloudKMS/Types.hs b/gen/Network/Google/CloudKMS/Types.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/CloudKMS/Types.hs
@@ -0,0 +1,287 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- |
+-- Module      : Network.Google.CloudKMS.Types
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+module Network.Google.CloudKMS.Types
+    (
+    -- * Service Configuration
+      cloudKMSService
+
+    -- * OAuth Scopes
+    , cloudPlatformScope
+
+    -- * AsymmetricDecryptResponse
+    , AsymmetricDecryptResponse
+    , asymmetricDecryptResponse
+    , adrPlaintext
+
+    -- * EncryptResponse
+    , EncryptResponse
+    , encryptResponse
+    , erName
+    , erCiphertext
+
+    -- * LocationSchema
+    , LocationSchema
+    , locationSchema
+    , lsAddtional
+
+    -- * AuditConfig
+    , AuditConfig
+    , auditConfig
+    , acService
+    , acAuditLogConfigs
+
+    -- * Expr
+    , Expr
+    , expr
+    , eLocation
+    , eExpression
+    , eTitle
+    , eDescription
+
+    -- * ListLocationsResponse
+    , ListLocationsResponse
+    , listLocationsResponse
+    , llrNextPageToken
+    , llrLocations
+
+    -- * ListKeyRingsResponse
+    , ListKeyRingsResponse
+    , listKeyRingsResponse
+    , lkrrNextPageToken
+    , lkrrTotalSize
+    , lkrrKeyRings
+
+    -- * AsymmetricSignResponse
+    , AsymmetricSignResponse
+    , asymmetricSignResponse
+    , asrSignature
+
+    -- * CryptoKeyPurpose
+    , CryptoKeyPurpose (..)
+
+    -- * KeyRing
+    , KeyRing
+    , keyRing
+    , krName
+    , krCreateTime
+
+    -- * DestroyCryptoKeyVersionRequest
+    , DestroyCryptoKeyVersionRequest
+    , destroyCryptoKeyVersionRequest
+
+    -- * Location
+    , Location
+    , location
+    , lName
+    , lMetadata
+    , lDisplayName
+    , lLabels
+    , lLocationId
+
+    -- * AsymmetricSignRequest
+    , AsymmetricSignRequest
+    , asymmetricSignRequest
+    , asrDigest
+
+    -- * CryptoKeyVersionTemplateProtectionLevel
+    , CryptoKeyVersionTemplateProtectionLevel (..)
+
+    -- * PublicKey
+    , PublicKey
+    , publicKey
+    , pkPem
+    , pkAlgorithm
+
+    -- * DecryptResponse
+    , DecryptResponse
+    , decryptResponse
+    , drPlaintext
+
+    -- * CryptoKeyVersionTemplate
+    , CryptoKeyVersionTemplate
+    , cryptoKeyVersionTemplate
+    , ckvtAlgorithm
+    , ckvtProtectionLevel
+
+    -- * SetIAMPolicyRequest
+    , SetIAMPolicyRequest
+    , setIAMPolicyRequest
+    , siprUpdateMask
+    , siprPolicy
+
+    -- * CryptoKeyLabels
+    , CryptoKeyLabels
+    , cryptoKeyLabels
+    , cklAddtional
+
+    -- * CryptoKeyVersionTemplateAlgorithm
+    , CryptoKeyVersionTemplateAlgorithm (..)
+
+    -- * PublicKeyAlgorithm
+    , PublicKeyAlgorithm (..)
+
+    -- * CryptoKeyVersionState
+    , CryptoKeyVersionState (..)
+
+    -- * CryptoKey
+    , CryptoKey
+    , cryptoKey
+    , ckVersionTemplate
+    , ckPurpose
+    , ckRotationPeriod
+    , ckPrimary
+    , ckName
+    , ckLabels
+    , ckNextRotationTime
+    , ckCreateTime
+
+    -- * DecryptRequest
+    , DecryptRequest
+    , decryptRequest
+    , drAdditionalAuthenticatedData
+    , drCiphertext
+
+    -- * KeyOperationAttestation
+    , KeyOperationAttestation
+    , keyOperationAttestation
+    , koaFormat
+    , koaContent
+
+    -- * ListCryptoKeyVersionsResponse
+    , ListCryptoKeyVersionsResponse
+    , listCryptoKeyVersionsResponse
+    , lckvrNextPageToken
+    , lckvrTotalSize
+    , lckvrCryptoKeyVersions
+
+    -- * KeyOperationAttestationFormat
+    , KeyOperationAttestationFormat (..)
+
+    -- * RestoreCryptoKeyVersionRequest
+    , RestoreCryptoKeyVersionRequest
+    , restoreCryptoKeyVersionRequest
+
+    -- * AuditLogConfigLogType
+    , AuditLogConfigLogType (..)
+
+    -- * UpdateCryptoKeyPrimaryVersionRequest
+    , UpdateCryptoKeyPrimaryVersionRequest
+    , updateCryptoKeyPrimaryVersionRequest
+    , uckpvrCryptoKeyVersionId
+
+    -- * Xgafv
+    , Xgafv (..)
+
+    -- * TestIAMPermissionsRequest
+    , TestIAMPermissionsRequest
+    , testIAMPermissionsRequest
+    , tiprPermissions
+
+    -- * TestIAMPermissionsResponse
+    , TestIAMPermissionsResponse
+    , testIAMPermissionsResponse
+    , tiamprPermissions
+
+    -- * Digest
+    , Digest
+    , digest
+    , dSha512
+    , dSha384
+    , dSha256
+
+    -- * Policy
+    , Policy
+    , policy
+    , pAuditConfigs
+    , pEtag
+    , pVersion
+    , pBindings
+
+    -- * LocationLabels
+    , LocationLabels
+    , locationLabels
+    , llAddtional
+
+    -- * LocationMetadata
+    , LocationMetadata
+    , locationMetadata
+    , lmHSMAvailable
+
+    -- * AuditLogConfig
+    , AuditLogConfig
+    , auditLogConfig
+    , alcLogType
+    , alcExemptedMembers
+
+    -- * CryptoKeyVersionProtectionLevel
+    , CryptoKeyVersionProtectionLevel (..)
+
+    -- * ListCryptoKeysResponse
+    , ListCryptoKeysResponse
+    , listCryptoKeysResponse
+    , lckrCryptoKeys
+    , lckrNextPageToken
+    , lckrTotalSize
+
+    -- * AsymmetricDecryptRequest
+    , AsymmetricDecryptRequest
+    , asymmetricDecryptRequest
+    , adrCiphertext
+
+    -- * CryptoKeyVersion
+    , CryptoKeyVersion
+    , cryptoKeyVersion
+    , ckvState
+    , ckvAttestation
+    , ckvGenerateTime
+    , ckvName
+    , ckvAlgorithm
+    , ckvDestroyTime
+    , ckvProtectionLevel
+    , ckvDestroyEventTime
+    , ckvCreateTime
+
+    -- * EncryptRequest
+    , EncryptRequest
+    , encryptRequest
+    , erAdditionalAuthenticatedData
+    , erPlaintext
+
+    -- * CryptoKeyVersionAlgorithm
+    , CryptoKeyVersionAlgorithm (..)
+
+    -- * Binding
+    , Binding
+    , binding
+    , bMembers
+    , bRole
+    , bCondition
+    ) where
+
+import           Network.Google.CloudKMS.Types.Product
+import           Network.Google.CloudKMS.Types.Sum
+import           Network.Google.Prelude
+
+-- | Default request referring to version 'v1' of the Cloud Key Management Service (KMS) API. This contains the host and root path used as a starting point for constructing service requests.
+cloudKMSService :: ServiceConfig
+cloudKMSService
+  = defaultService (ServiceId "cloudkms:v1")
+      "cloudkms.googleapis.com"
+
+-- | View and manage your data across Google Cloud Platform services
+cloudPlatformScope :: Proxy '["https://www.googleapis.com/auth/cloud-platform"]
+cloudPlatformScope = Proxy;
diff --git a/gen/Network/Google/CloudKMS/Types/Product.hs b/gen/Network/Google/CloudKMS/Types/Product.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/CloudKMS/Types/Product.hs
@@ -0,0 +1,1974 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-binds   #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- |
+-- Module      : Network.Google.CloudKMS.Types.Product
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+module Network.Google.CloudKMS.Types.Product where
+
+import           Network.Google.CloudKMS.Types.Sum
+import           Network.Google.Prelude
+
+-- | Response message for KeyManagementService.AsymmetricDecrypt.
+--
+-- /See:/ 'asymmetricDecryptResponse' smart constructor.
+newtype AsymmetricDecryptResponse = AsymmetricDecryptResponse'
+    { _adrPlaintext :: Maybe Bytes
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'AsymmetricDecryptResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'adrPlaintext'
+asymmetricDecryptResponse
+    :: AsymmetricDecryptResponse
+asymmetricDecryptResponse =
+    AsymmetricDecryptResponse'
+    { _adrPlaintext = Nothing
+    }
+
+-- | The decrypted data originally encrypted with the matching public key.
+adrPlaintext :: Lens' AsymmetricDecryptResponse (Maybe ByteString)
+adrPlaintext
+  = lens _adrPlaintext (\ s a -> s{_adrPlaintext = a})
+      . mapping _Bytes
+
+instance FromJSON AsymmetricDecryptResponse where
+        parseJSON
+          = withObject "AsymmetricDecryptResponse"
+              (\ o ->
+                 AsymmetricDecryptResponse' <$> (o .:? "plaintext"))
+
+instance ToJSON AsymmetricDecryptResponse where
+        toJSON AsymmetricDecryptResponse'{..}
+          = object
+              (catMaybes [("plaintext" .=) <$> _adrPlaintext])
+
+-- | Response message for KeyManagementService.Encrypt.
+--
+-- /See:/ 'encryptResponse' smart constructor.
+data EncryptResponse = EncryptResponse'
+    { _erName       :: !(Maybe Text)
+    , _erCiphertext :: !(Maybe Bytes)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'EncryptResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'erName'
+--
+-- * 'erCiphertext'
+encryptResponse
+    :: EncryptResponse
+encryptResponse =
+    EncryptResponse'
+    { _erName = Nothing
+    , _erCiphertext = Nothing
+    }
+
+-- | The resource name of the CryptoKeyVersion used in encryption.
+erName :: Lens' EncryptResponse (Maybe Text)
+erName = lens _erName (\ s a -> s{_erName = a})
+
+-- | The encrypted data.
+erCiphertext :: Lens' EncryptResponse (Maybe ByteString)
+erCiphertext
+  = lens _erCiphertext (\ s a -> s{_erCiphertext = a})
+      . mapping _Bytes
+
+instance FromJSON EncryptResponse where
+        parseJSON
+          = withObject "EncryptResponse"
+              (\ o ->
+                 EncryptResponse' <$>
+                   (o .:? "name") <*> (o .:? "ciphertext"))
+
+instance ToJSON EncryptResponse where
+        toJSON EncryptResponse'{..}
+          = object
+              (catMaybes
+                 [("name" .=) <$> _erName,
+                  ("ciphertext" .=) <$> _erCiphertext])
+
+-- | Service-specific metadata. For example the available capacity at the
+-- given location.
+--
+-- /See:/ 'locationSchema' smart constructor.
+newtype LocationSchema = LocationSchema'
+    { _lsAddtional :: HashMap Text JSONValue
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'LocationSchema' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'lsAddtional'
+locationSchema
+    :: HashMap Text JSONValue -- ^ 'lsAddtional'
+    -> LocationSchema
+locationSchema pLsAddtional_ =
+    LocationSchema'
+    { _lsAddtional = _Coerce # pLsAddtional_
+    }
+
+-- | Properties of the object. Contains field \'type with type URL.
+lsAddtional :: Lens' LocationSchema (HashMap Text JSONValue)
+lsAddtional
+  = lens _lsAddtional (\ s a -> s{_lsAddtional = a}) .
+      _Coerce
+
+instance FromJSON LocationSchema where
+        parseJSON
+          = withObject "LocationSchema"
+              (\ o -> LocationSchema' <$> (parseJSONObject o))
+
+instance ToJSON LocationSchema where
+        toJSON = toJSON . _lsAddtional
+
+-- | Specifies the audit configuration for a service. The configuration
+-- determines which permission types are logged, and what identities, if
+-- any, are exempted from logging. An AuditConfig must have one or more
+-- AuditLogConfigs. If there are AuditConfigs for both \`allServices\` and
+-- a specific service, the union of the two AuditConfigs is used for that
+-- service: the log_types specified in each AuditConfig are enabled, and
+-- the exempted_members in each AuditLogConfig are exempted. Example Policy
+-- with multiple AuditConfigs: { \"audit_configs\": [ { \"service\":
+-- \"allServices\" \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\",
+-- \"exempted_members\": [ \"user:foo\'gmail.com\" ] }, { \"log_type\":
+-- \"DATA_WRITE\", }, { \"log_type\": \"ADMIN_READ\", } ] }, { \"service\":
+-- \"fooservice.googleapis.com\" \"audit_log_configs\": [ { \"log_type\":
+-- \"DATA_READ\", }, { \"log_type\": \"DATA_WRITE\", \"exempted_members\":
+-- [ \"user:bar\'gmail.com\" ] } ] } ] } For fooservice, this policy
+-- enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts
+-- foo\'gmail.com from DATA_READ logging, and bar\'gmail.com from
+-- DATA_WRITE logging.
+--
+-- /See:/ 'auditConfig' smart constructor.
+data AuditConfig = AuditConfig'
+    { _acService         :: !(Maybe Text)
+    , _acAuditLogConfigs :: !(Maybe [AuditLogConfig])
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'AuditConfig' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'acService'
+--
+-- * 'acAuditLogConfigs'
+auditConfig
+    :: AuditConfig
+auditConfig =
+    AuditConfig'
+    { _acService = Nothing
+    , _acAuditLogConfigs = Nothing
+    }
+
+-- | Specifies a service that will be enabled for audit logging. For example,
+-- \`storage.googleapis.com\`, \`cloudsql.googleapis.com\`. \`allServices\`
+-- is a special value that covers all services.
+acService :: Lens' AuditConfig (Maybe Text)
+acService
+  = lens _acService (\ s a -> s{_acService = a})
+
+-- | The configuration for logging of each type of permission.
+acAuditLogConfigs :: Lens' AuditConfig [AuditLogConfig]
+acAuditLogConfigs
+  = lens _acAuditLogConfigs
+      (\ s a -> s{_acAuditLogConfigs = a})
+      . _Default
+      . _Coerce
+
+instance FromJSON AuditConfig where
+        parseJSON
+          = withObject "AuditConfig"
+              (\ o ->
+                 AuditConfig' <$>
+                   (o .:? "service") <*>
+                     (o .:? "auditLogConfigs" .!= mempty))
+
+instance ToJSON AuditConfig where
+        toJSON AuditConfig'{..}
+          = object
+              (catMaybes
+                 [("service" .=) <$> _acService,
+                  ("auditLogConfigs" .=) <$> _acAuditLogConfigs])
+
+-- | Represents an expression text. Example: title: \"User account presence\"
+-- description: \"Determines whether the request has a user account\"
+-- expression: \"size(request.user) > 0\"
+--
+-- /See:/ 'expr' smart constructor.
+data Expr = Expr'
+    { _eLocation    :: !(Maybe Text)
+    , _eExpression  :: !(Maybe Text)
+    , _eTitle       :: !(Maybe Text)
+    , _eDescription :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'Expr' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'eLocation'
+--
+-- * 'eExpression'
+--
+-- * 'eTitle'
+--
+-- * 'eDescription'
+expr
+    :: Expr
+expr =
+    Expr'
+    { _eLocation = Nothing
+    , _eExpression = Nothing
+    , _eTitle = Nothing
+    , _eDescription = Nothing
+    }
+
+-- | An optional string indicating the location of the expression for error
+-- reporting, e.g. a file name and a position in the file.
+eLocation :: Lens' Expr (Maybe Text)
+eLocation
+  = lens _eLocation (\ s a -> s{_eLocation = a})
+
+-- | Textual representation of an expression in Common Expression Language
+-- syntax. The application context of the containing message determines
+-- which well-known feature set of CEL is supported.
+eExpression :: Lens' Expr (Maybe Text)
+eExpression
+  = lens _eExpression (\ s a -> s{_eExpression = a})
+
+-- | An optional title for the expression, i.e. a short string describing its
+-- purpose. This can be used e.g. in UIs which allow to enter the
+-- expression.
+eTitle :: Lens' Expr (Maybe Text)
+eTitle = lens _eTitle (\ s a -> s{_eTitle = a})
+
+-- | An optional description of the expression. This is a longer text which
+-- describes the expression, e.g. when hovered over it in a UI.
+eDescription :: Lens' Expr (Maybe Text)
+eDescription
+  = lens _eDescription (\ s a -> s{_eDescription = a})
+
+instance FromJSON Expr where
+        parseJSON
+          = withObject "Expr"
+              (\ o ->
+                 Expr' <$>
+                   (o .:? "location") <*> (o .:? "expression") <*>
+                     (o .:? "title")
+                     <*> (o .:? "description"))
+
+instance ToJSON Expr where
+        toJSON Expr'{..}
+          = object
+              (catMaybes
+                 [("location" .=) <$> _eLocation,
+                  ("expression" .=) <$> _eExpression,
+                  ("title" .=) <$> _eTitle,
+                  ("description" .=) <$> _eDescription])
+
+-- | The response message for Locations.ListLocations.
+--
+-- /See:/ 'listLocationsResponse' smart constructor.
+data ListLocationsResponse = ListLocationsResponse'
+    { _llrNextPageToken :: !(Maybe Text)
+    , _llrLocations     :: !(Maybe [Location])
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ListLocationsResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'llrNextPageToken'
+--
+-- * 'llrLocations'
+listLocationsResponse
+    :: ListLocationsResponse
+listLocationsResponse =
+    ListLocationsResponse'
+    { _llrNextPageToken = Nothing
+    , _llrLocations = Nothing
+    }
+
+-- | The standard List next-page token.
+llrNextPageToken :: Lens' ListLocationsResponse (Maybe Text)
+llrNextPageToken
+  = lens _llrNextPageToken
+      (\ s a -> s{_llrNextPageToken = a})
+
+-- | A list of locations that matches the specified filter in the request.
+llrLocations :: Lens' ListLocationsResponse [Location]
+llrLocations
+  = lens _llrLocations (\ s a -> s{_llrLocations = a})
+      . _Default
+      . _Coerce
+
+instance FromJSON ListLocationsResponse where
+        parseJSON
+          = withObject "ListLocationsResponse"
+              (\ o ->
+                 ListLocationsResponse' <$>
+                   (o .:? "nextPageToken") <*>
+                     (o .:? "locations" .!= mempty))
+
+instance ToJSON ListLocationsResponse where
+        toJSON ListLocationsResponse'{..}
+          = object
+              (catMaybes
+                 [("nextPageToken" .=) <$> _llrNextPageToken,
+                  ("locations" .=) <$> _llrLocations])
+
+-- | Response message for KeyManagementService.ListKeyRings.
+--
+-- /See:/ 'listKeyRingsResponse' smart constructor.
+data ListKeyRingsResponse = ListKeyRingsResponse'
+    { _lkrrNextPageToken :: !(Maybe Text)
+    , _lkrrTotalSize     :: !(Maybe (Textual Int32))
+    , _lkrrKeyRings      :: !(Maybe [KeyRing])
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ListKeyRingsResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'lkrrNextPageToken'
+--
+-- * 'lkrrTotalSize'
+--
+-- * 'lkrrKeyRings'
+listKeyRingsResponse
+    :: ListKeyRingsResponse
+listKeyRingsResponse =
+    ListKeyRingsResponse'
+    { _lkrrNextPageToken = Nothing
+    , _lkrrTotalSize = Nothing
+    , _lkrrKeyRings = Nothing
+    }
+
+-- | A token to retrieve next page of results. Pass this value in
+-- ListKeyRingsRequest.page_token to retrieve the next page of results.
+lkrrNextPageToken :: Lens' ListKeyRingsResponse (Maybe Text)
+lkrrNextPageToken
+  = lens _lkrrNextPageToken
+      (\ s a -> s{_lkrrNextPageToken = a})
+
+-- | The total number of KeyRings that matched the query.
+lkrrTotalSize :: Lens' ListKeyRingsResponse (Maybe Int32)
+lkrrTotalSize
+  = lens _lkrrTotalSize
+      (\ s a -> s{_lkrrTotalSize = a})
+      . mapping _Coerce
+
+-- | The list of KeyRings.
+lkrrKeyRings :: Lens' ListKeyRingsResponse [KeyRing]
+lkrrKeyRings
+  = lens _lkrrKeyRings (\ s a -> s{_lkrrKeyRings = a})
+      . _Default
+      . _Coerce
+
+instance FromJSON ListKeyRingsResponse where
+        parseJSON
+          = withObject "ListKeyRingsResponse"
+              (\ o ->
+                 ListKeyRingsResponse' <$>
+                   (o .:? "nextPageToken") <*> (o .:? "totalSize") <*>
+                     (o .:? "keyRings" .!= mempty))
+
+instance ToJSON ListKeyRingsResponse where
+        toJSON ListKeyRingsResponse'{..}
+          = object
+              (catMaybes
+                 [("nextPageToken" .=) <$> _lkrrNextPageToken,
+                  ("totalSize" .=) <$> _lkrrTotalSize,
+                  ("keyRings" .=) <$> _lkrrKeyRings])
+
+-- | Response message for KeyManagementService.AsymmetricSign.
+--
+-- /See:/ 'asymmetricSignResponse' smart constructor.
+newtype AsymmetricSignResponse = AsymmetricSignResponse'
+    { _asrSignature :: Maybe Bytes
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'AsymmetricSignResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'asrSignature'
+asymmetricSignResponse
+    :: AsymmetricSignResponse
+asymmetricSignResponse =
+    AsymmetricSignResponse'
+    { _asrSignature = Nothing
+    }
+
+-- | The created signature.
+asrSignature :: Lens' AsymmetricSignResponse (Maybe ByteString)
+asrSignature
+  = lens _asrSignature (\ s a -> s{_asrSignature = a})
+      . mapping _Bytes
+
+instance FromJSON AsymmetricSignResponse where
+        parseJSON
+          = withObject "AsymmetricSignResponse"
+              (\ o ->
+                 AsymmetricSignResponse' <$> (o .:? "signature"))
+
+instance ToJSON AsymmetricSignResponse where
+        toJSON AsymmetricSignResponse'{..}
+          = object
+              (catMaybes [("signature" .=) <$> _asrSignature])
+
+-- | A KeyRing is a toplevel logical grouping of CryptoKeys.
+--
+-- /See:/ 'keyRing' smart constructor.
+data KeyRing = KeyRing'
+    { _krName       :: !(Maybe Text)
+    , _krCreateTime :: !(Maybe DateTime')
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'KeyRing' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'krName'
+--
+-- * 'krCreateTime'
+keyRing
+    :: KeyRing
+keyRing =
+    KeyRing'
+    { _krName = Nothing
+    , _krCreateTime = Nothing
+    }
+
+-- | Output only. The resource name for the KeyRing in the format
+-- \`projects\/*\/locations\/*\/keyRings\/*\`.
+krName :: Lens' KeyRing (Maybe Text)
+krName = lens _krName (\ s a -> s{_krName = a})
+
+-- | Output only. The time at which this KeyRing was created.
+krCreateTime :: Lens' KeyRing (Maybe UTCTime)
+krCreateTime
+  = lens _krCreateTime (\ s a -> s{_krCreateTime = a})
+      . mapping _DateTime
+
+instance FromJSON KeyRing where
+        parseJSON
+          = withObject "KeyRing"
+              (\ o ->
+                 KeyRing' <$> (o .:? "name") <*> (o .:? "createTime"))
+
+instance ToJSON KeyRing where
+        toJSON KeyRing'{..}
+          = object
+              (catMaybes
+                 [("name" .=) <$> _krName,
+                  ("createTime" .=) <$> _krCreateTime])
+
+-- | Request message for KeyManagementService.DestroyCryptoKeyVersion.
+--
+-- /See:/ 'destroyCryptoKeyVersionRequest' smart constructor.
+data DestroyCryptoKeyVersionRequest =
+    DestroyCryptoKeyVersionRequest'
+    deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'DestroyCryptoKeyVersionRequest' with the minimum fields required to make a request.
+--
+destroyCryptoKeyVersionRequest
+    :: DestroyCryptoKeyVersionRequest
+destroyCryptoKeyVersionRequest = DestroyCryptoKeyVersionRequest'
+
+instance FromJSON DestroyCryptoKeyVersionRequest
+         where
+        parseJSON
+          = withObject "DestroyCryptoKeyVersionRequest"
+              (\ o -> pure DestroyCryptoKeyVersionRequest')
+
+instance ToJSON DestroyCryptoKeyVersionRequest where
+        toJSON = const emptyObject
+
+-- | A resource that represents Google Cloud Platform location.
+--
+-- /See:/ 'location' smart constructor.
+data Location = Location'
+    { _lName        :: !(Maybe Text)
+    , _lMetadata    :: !(Maybe LocationSchema)
+    , _lDisplayName :: !(Maybe Text)
+    , _lLabels      :: !(Maybe LocationLabels)
+    , _lLocationId  :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'Location' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'lName'
+--
+-- * 'lMetadata'
+--
+-- * 'lDisplayName'
+--
+-- * 'lLabels'
+--
+-- * 'lLocationId'
+location
+    :: Location
+location =
+    Location'
+    { _lName = Nothing
+    , _lMetadata = Nothing
+    , _lDisplayName = Nothing
+    , _lLabels = Nothing
+    , _lLocationId = Nothing
+    }
+
+-- | Resource name for the location, which may vary between implementations.
+-- For example: \`\"projects\/example-project\/locations\/us-east1\"\`
+lName :: Lens' Location (Maybe Text)
+lName = lens _lName (\ s a -> s{_lName = a})
+
+-- | Service-specific metadata. For example the available capacity at the
+-- given location.
+lMetadata :: Lens' Location (Maybe LocationSchema)
+lMetadata
+  = lens _lMetadata (\ s a -> s{_lMetadata = a})
+
+-- | The friendly name for this location, typically a nearby city name. For
+-- example, \"Tokyo\".
+lDisplayName :: Lens' Location (Maybe Text)
+lDisplayName
+  = lens _lDisplayName (\ s a -> s{_lDisplayName = a})
+
+-- | Cross-service attributes for the location. For example
+-- {\"cloud.googleapis.com\/region\": \"us-east1\"}
+lLabels :: Lens' Location (Maybe LocationLabels)
+lLabels = lens _lLabels (\ s a -> s{_lLabels = a})
+
+-- | The canonical id for this location. For example: \`\"us-east1\"\`.
+lLocationId :: Lens' Location (Maybe Text)
+lLocationId
+  = lens _lLocationId (\ s a -> s{_lLocationId = a})
+
+instance FromJSON Location where
+        parseJSON
+          = withObject "Location"
+              (\ o ->
+                 Location' <$>
+                   (o .:? "name") <*> (o .:? "metadata") <*>
+                     (o .:? "displayName")
+                     <*> (o .:? "labels")
+                     <*> (o .:? "locationId"))
+
+instance ToJSON Location where
+        toJSON Location'{..}
+          = object
+              (catMaybes
+                 [("name" .=) <$> _lName,
+                  ("metadata" .=) <$> _lMetadata,
+                  ("displayName" .=) <$> _lDisplayName,
+                  ("labels" .=) <$> _lLabels,
+                  ("locationId" .=) <$> _lLocationId])
+
+-- | Request message for KeyManagementService.AsymmetricSign.
+--
+-- /See:/ 'asymmetricSignRequest' smart constructor.
+newtype AsymmetricSignRequest = AsymmetricSignRequest'
+    { _asrDigest :: Maybe Digest
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'AsymmetricSignRequest' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'asrDigest'
+asymmetricSignRequest
+    :: AsymmetricSignRequest
+asymmetricSignRequest =
+    AsymmetricSignRequest'
+    { _asrDigest = Nothing
+    }
+
+-- | Required. The digest of the data to sign. The digest must be produced
+-- with the same digest algorithm as specified by the key version\'s
+-- algorithm.
+asrDigest :: Lens' AsymmetricSignRequest (Maybe Digest)
+asrDigest
+  = lens _asrDigest (\ s a -> s{_asrDigest = a})
+
+instance FromJSON AsymmetricSignRequest where
+        parseJSON
+          = withObject "AsymmetricSignRequest"
+              (\ o -> AsymmetricSignRequest' <$> (o .:? "digest"))
+
+instance ToJSON AsymmetricSignRequest where
+        toJSON AsymmetricSignRequest'{..}
+          = object (catMaybes [("digest" .=) <$> _asrDigest])
+
+-- | The public key for a given CryptoKeyVersion. Obtained via GetPublicKey.
+--
+-- /See:/ 'publicKey' smart constructor.
+data PublicKey = PublicKey'
+    { _pkPem       :: !(Maybe Text)
+    , _pkAlgorithm :: !(Maybe PublicKeyAlgorithm)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'PublicKey' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'pkPem'
+--
+-- * 'pkAlgorithm'
+publicKey
+    :: PublicKey
+publicKey =
+    PublicKey'
+    { _pkPem = Nothing
+    , _pkAlgorithm = Nothing
+    }
+
+-- | The public key, encoded in PEM format. For more information, see the
+-- [RFC 7468](https:\/\/tools.ietf.org\/html\/rfc7468) sections for
+-- [General
+-- Considerations](https:\/\/tools.ietf.org\/html\/rfc7468#section-2) and
+-- [Textual Encoding of Subject Public Key Info]
+-- (https:\/\/tools.ietf.org\/html\/rfc7468#section-13).
+pkPem :: Lens' PublicKey (Maybe Text)
+pkPem = lens _pkPem (\ s a -> s{_pkPem = a})
+
+-- | The Algorithm associated with this key.
+pkAlgorithm :: Lens' PublicKey (Maybe PublicKeyAlgorithm)
+pkAlgorithm
+  = lens _pkAlgorithm (\ s a -> s{_pkAlgorithm = a})
+
+instance FromJSON PublicKey where
+        parseJSON
+          = withObject "PublicKey"
+              (\ o ->
+                 PublicKey' <$> (o .:? "pem") <*> (o .:? "algorithm"))
+
+instance ToJSON PublicKey where
+        toJSON PublicKey'{..}
+          = object
+              (catMaybes
+                 [("pem" .=) <$> _pkPem,
+                  ("algorithm" .=) <$> _pkAlgorithm])
+
+-- | Response message for KeyManagementService.Decrypt.
+--
+-- /See:/ 'decryptResponse' smart constructor.
+newtype DecryptResponse = DecryptResponse'
+    { _drPlaintext :: Maybe Bytes
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'DecryptResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'drPlaintext'
+decryptResponse
+    :: DecryptResponse
+decryptResponse =
+    DecryptResponse'
+    { _drPlaintext = Nothing
+    }
+
+-- | The decrypted data originally supplied in EncryptRequest.plaintext.
+drPlaintext :: Lens' DecryptResponse (Maybe ByteString)
+drPlaintext
+  = lens _drPlaintext (\ s a -> s{_drPlaintext = a}) .
+      mapping _Bytes
+
+instance FromJSON DecryptResponse where
+        parseJSON
+          = withObject "DecryptResponse"
+              (\ o -> DecryptResponse' <$> (o .:? "plaintext"))
+
+instance ToJSON DecryptResponse where
+        toJSON DecryptResponse'{..}
+          = object
+              (catMaybes [("plaintext" .=) <$> _drPlaintext])
+
+-- | A CryptoKeyVersionTemplate specifies the properties to use when creating
+-- a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or
+-- automatically as a result of auto-rotation.
+--
+-- /See:/ 'cryptoKeyVersionTemplate' smart constructor.
+data CryptoKeyVersionTemplate = CryptoKeyVersionTemplate'
+    { _ckvtAlgorithm       :: !(Maybe CryptoKeyVersionTemplateAlgorithm)
+    , _ckvtProtectionLevel :: !(Maybe CryptoKeyVersionTemplateProtectionLevel)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'CryptoKeyVersionTemplate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'ckvtAlgorithm'
+--
+-- * 'ckvtProtectionLevel'
+cryptoKeyVersionTemplate
+    :: CryptoKeyVersionTemplate
+cryptoKeyVersionTemplate =
+    CryptoKeyVersionTemplate'
+    { _ckvtAlgorithm = Nothing
+    , _ckvtProtectionLevel = Nothing
+    }
+
+-- | Required. Algorithm to use when creating a CryptoKeyVersion based on
+-- this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION
+-- is implied if both this field is omitted and CryptoKey.purpose is
+-- ENCRYPT_DECRYPT.
+ckvtAlgorithm :: Lens' CryptoKeyVersionTemplate (Maybe CryptoKeyVersionTemplateAlgorithm)
+ckvtAlgorithm
+  = lens _ckvtAlgorithm
+      (\ s a -> s{_ckvtAlgorithm = a})
+
+-- | ProtectionLevel to use when creating a CryptoKeyVersion based on this
+-- template. Immutable. Defaults to SOFTWARE.
+ckvtProtectionLevel :: Lens' CryptoKeyVersionTemplate (Maybe CryptoKeyVersionTemplateProtectionLevel)
+ckvtProtectionLevel
+  = lens _ckvtProtectionLevel
+      (\ s a -> s{_ckvtProtectionLevel = a})
+
+instance FromJSON CryptoKeyVersionTemplate where
+        parseJSON
+          = withObject "CryptoKeyVersionTemplate"
+              (\ o ->
+                 CryptoKeyVersionTemplate' <$>
+                   (o .:? "algorithm") <*> (o .:? "protectionLevel"))
+
+instance ToJSON CryptoKeyVersionTemplate where
+        toJSON CryptoKeyVersionTemplate'{..}
+          = object
+              (catMaybes
+                 [("algorithm" .=) <$> _ckvtAlgorithm,
+                  ("protectionLevel" .=) <$> _ckvtProtectionLevel])
+
+-- | Request message for \`SetIamPolicy\` method.
+--
+-- /See:/ 'setIAMPolicyRequest' smart constructor.
+data SetIAMPolicyRequest = SetIAMPolicyRequest'
+    { _siprUpdateMask :: !(Maybe GFieldMask)
+    , _siprPolicy     :: !(Maybe Policy)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'SetIAMPolicyRequest' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'siprUpdateMask'
+--
+-- * 'siprPolicy'
+setIAMPolicyRequest
+    :: SetIAMPolicyRequest
+setIAMPolicyRequest =
+    SetIAMPolicyRequest'
+    { _siprUpdateMask = Nothing
+    , _siprPolicy = Nothing
+    }
+
+-- | OPTIONAL: A FieldMask specifying which fields of the policy to modify.
+-- Only the fields in the mask will be modified. If no mask is provided,
+-- the following default mask is used: paths: \"bindings, etag\" This field
+-- is only used by Cloud IAM.
+siprUpdateMask :: Lens' SetIAMPolicyRequest (Maybe GFieldMask)
+siprUpdateMask
+  = lens _siprUpdateMask
+      (\ s a -> s{_siprUpdateMask = a})
+
+-- | REQUIRED: The complete policy to be applied to the \`resource\`. The
+-- size of the policy is limited to a few 10s of KB. An empty policy is a
+-- valid policy but certain Cloud Platform services (such as Projects)
+-- might reject them.
+siprPolicy :: Lens' SetIAMPolicyRequest (Maybe Policy)
+siprPolicy
+  = lens _siprPolicy (\ s a -> s{_siprPolicy = a})
+
+instance FromJSON SetIAMPolicyRequest where
+        parseJSON
+          = withObject "SetIAMPolicyRequest"
+              (\ o ->
+                 SetIAMPolicyRequest' <$>
+                   (o .:? "updateMask") <*> (o .:? "policy"))
+
+instance ToJSON SetIAMPolicyRequest where
+        toJSON SetIAMPolicyRequest'{..}
+          = object
+              (catMaybes
+                 [("updateMask" .=) <$> _siprUpdateMask,
+                  ("policy" .=) <$> _siprPolicy])
+
+-- | Labels with user-defined metadata. For more information, see [Labeling
+-- Keys](\/kms\/docs\/labeling-keys).
+--
+-- /See:/ 'cryptoKeyLabels' smart constructor.
+newtype CryptoKeyLabels = CryptoKeyLabels'
+    { _cklAddtional :: HashMap Text Text
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'CryptoKeyLabels' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'cklAddtional'
+cryptoKeyLabels
+    :: HashMap Text Text -- ^ 'cklAddtional'
+    -> CryptoKeyLabels
+cryptoKeyLabels pCklAddtional_ =
+    CryptoKeyLabels'
+    { _cklAddtional = _Coerce # pCklAddtional_
+    }
+
+cklAddtional :: Lens' CryptoKeyLabels (HashMap Text Text)
+cklAddtional
+  = lens _cklAddtional (\ s a -> s{_cklAddtional = a})
+      . _Coerce
+
+instance FromJSON CryptoKeyLabels where
+        parseJSON
+          = withObject "CryptoKeyLabels"
+              (\ o -> CryptoKeyLabels' <$> (parseJSONObject o))
+
+instance ToJSON CryptoKeyLabels where
+        toJSON = toJSON . _cklAddtional
+
+-- | A CryptoKey represents a logical key that can be used for cryptographic
+-- operations. A CryptoKey is made up of one or more versions, which
+-- represent the actual key material used in cryptographic operations.
+--
+-- /See:/ 'cryptoKey' smart constructor.
+data CryptoKey = CryptoKey'
+    { _ckVersionTemplate  :: !(Maybe CryptoKeyVersionTemplate)
+    , _ckPurpose          :: !(Maybe CryptoKeyPurpose)
+    , _ckRotationPeriod   :: !(Maybe GDuration)
+    , _ckPrimary          :: !(Maybe CryptoKeyVersion)
+    , _ckName             :: !(Maybe Text)
+    , _ckLabels           :: !(Maybe CryptoKeyLabels)
+    , _ckNextRotationTime :: !(Maybe DateTime')
+    , _ckCreateTime       :: !(Maybe DateTime')
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'CryptoKey' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'ckVersionTemplate'
+--
+-- * 'ckPurpose'
+--
+-- * 'ckRotationPeriod'
+--
+-- * 'ckPrimary'
+--
+-- * 'ckName'
+--
+-- * 'ckLabels'
+--
+-- * 'ckNextRotationTime'
+--
+-- * 'ckCreateTime'
+cryptoKey
+    :: CryptoKey
+cryptoKey =
+    CryptoKey'
+    { _ckVersionTemplate = Nothing
+    , _ckPurpose = Nothing
+    , _ckRotationPeriod = Nothing
+    , _ckPrimary = Nothing
+    , _ckName = Nothing
+    , _ckLabels = Nothing
+    , _ckNextRotationTime = Nothing
+    , _ckCreateTime = Nothing
+    }
+
+-- | A template describing settings for new CryptoKeyVersion instances. The
+-- properties of new CryptoKeyVersion instances created by either
+-- CreateCryptoKeyVersion or auto-rotation are controlled by this template.
+ckVersionTemplate :: Lens' CryptoKey (Maybe CryptoKeyVersionTemplate)
+ckVersionTemplate
+  = lens _ckVersionTemplate
+      (\ s a -> s{_ckVersionTemplate = a})
+
+-- | The immutable purpose of this CryptoKey.
+ckPurpose :: Lens' CryptoKey (Maybe CryptoKeyPurpose)
+ckPurpose
+  = lens _ckPurpose (\ s a -> s{_ckPurpose = a})
+
+-- | next_rotation_time will be advanced by this period when the service
+-- automatically rotates a key. Must be at least one day. If
+-- rotation_period is set, next_rotation_time must also be set. Keys with
+-- purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this
+-- field must be omitted.
+ckRotationPeriod :: Lens' CryptoKey (Maybe Scientific)
+ckRotationPeriod
+  = lens _ckRotationPeriod
+      (\ s a -> s{_ckRotationPeriod = a})
+      . mapping _GDuration
+
+-- | Output only. A copy of the \"primary\" CryptoKeyVersion that will be
+-- used by Encrypt when this CryptoKey is given in EncryptRequest.name. The
+-- CryptoKey\'s primary version can be updated via
+-- UpdateCryptoKeyPrimaryVersion. All keys with purpose ENCRYPT_DECRYPT
+-- have a primary. For other keys, this field will be omitted.
+ckPrimary :: Lens' CryptoKey (Maybe CryptoKeyVersion)
+ckPrimary
+  = lens _ckPrimary (\ s a -> s{_ckPrimary = a})
+
+-- | Output only. The resource name for this CryptoKey in the format
+-- \`projects\/*\/locations\/*\/keyRings\/*\/cryptoKeys\/*\`.
+ckName :: Lens' CryptoKey (Maybe Text)
+ckName = lens _ckName (\ s a -> s{_ckName = a})
+
+-- | Labels with user-defined metadata. For more information, see [Labeling
+-- Keys](\/kms\/docs\/labeling-keys).
+ckLabels :: Lens' CryptoKey (Maybe CryptoKeyLabels)
+ckLabels = lens _ckLabels (\ s a -> s{_ckLabels = a})
+
+-- | At next_rotation_time, the Key Management Service will automatically: 1.
+-- Create a new version of this CryptoKey. 2. Mark the new version as
+-- primary. Key rotations performed manually via CreateCryptoKeyVersion and
+-- UpdateCryptoKeyPrimaryVersion do not affect next_rotation_time. Keys
+-- with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys,
+-- this field must be omitted.
+ckNextRotationTime :: Lens' CryptoKey (Maybe UTCTime)
+ckNextRotationTime
+  = lens _ckNextRotationTime
+      (\ s a -> s{_ckNextRotationTime = a})
+      . mapping _DateTime
+
+-- | Output only. The time at which this CryptoKey was created.
+ckCreateTime :: Lens' CryptoKey (Maybe UTCTime)
+ckCreateTime
+  = lens _ckCreateTime (\ s a -> s{_ckCreateTime = a})
+      . mapping _DateTime
+
+instance FromJSON CryptoKey where
+        parseJSON
+          = withObject "CryptoKey"
+              (\ o ->
+                 CryptoKey' <$>
+                   (o .:? "versionTemplate") <*> (o .:? "purpose") <*>
+                     (o .:? "rotationPeriod")
+                     <*> (o .:? "primary")
+                     <*> (o .:? "name")
+                     <*> (o .:? "labels")
+                     <*> (o .:? "nextRotationTime")
+                     <*> (o .:? "createTime"))
+
+instance ToJSON CryptoKey where
+        toJSON CryptoKey'{..}
+          = object
+              (catMaybes
+                 [("versionTemplate" .=) <$> _ckVersionTemplate,
+                  ("purpose" .=) <$> _ckPurpose,
+                  ("rotationPeriod" .=) <$> _ckRotationPeriod,
+                  ("primary" .=) <$> _ckPrimary,
+                  ("name" .=) <$> _ckName, ("labels" .=) <$> _ckLabels,
+                  ("nextRotationTime" .=) <$> _ckNextRotationTime,
+                  ("createTime" .=) <$> _ckCreateTime])
+
+-- | Request message for KeyManagementService.Decrypt.
+--
+-- /See:/ 'decryptRequest' smart constructor.
+data DecryptRequest = DecryptRequest'
+    { _drAdditionalAuthenticatedData :: !(Maybe Bytes)
+    , _drCiphertext                  :: !(Maybe Bytes)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'DecryptRequest' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'drAdditionalAuthenticatedData'
+--
+-- * 'drCiphertext'
+decryptRequest
+    :: DecryptRequest
+decryptRequest =
+    DecryptRequest'
+    { _drAdditionalAuthenticatedData = Nothing
+    , _drCiphertext = Nothing
+    }
+
+-- | Optional data that must match the data originally supplied in
+-- EncryptRequest.additional_authenticated_data.
+drAdditionalAuthenticatedData :: Lens' DecryptRequest (Maybe ByteString)
+drAdditionalAuthenticatedData
+  = lens _drAdditionalAuthenticatedData
+      (\ s a -> s{_drAdditionalAuthenticatedData = a})
+      . mapping _Bytes
+
+-- | Required. The encrypted data originally returned in
+-- EncryptResponse.ciphertext.
+drCiphertext :: Lens' DecryptRequest (Maybe ByteString)
+drCiphertext
+  = lens _drCiphertext (\ s a -> s{_drCiphertext = a})
+      . mapping _Bytes
+
+instance FromJSON DecryptRequest where
+        parseJSON
+          = withObject "DecryptRequest"
+              (\ o ->
+                 DecryptRequest' <$>
+                   (o .:? "additionalAuthenticatedData") <*>
+                     (o .:? "ciphertext"))
+
+instance ToJSON DecryptRequest where
+        toJSON DecryptRequest'{..}
+          = object
+              (catMaybes
+                 [("additionalAuthenticatedData" .=) <$>
+                    _drAdditionalAuthenticatedData,
+                  ("ciphertext" .=) <$> _drCiphertext])
+
+-- | Contains an HSM-generated attestation about a key operation.
+--
+-- /See:/ 'keyOperationAttestation' smart constructor.
+data KeyOperationAttestation = KeyOperationAttestation'
+    { _koaFormat  :: !(Maybe KeyOperationAttestationFormat)
+    , _koaContent :: !(Maybe Bytes)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'KeyOperationAttestation' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'koaFormat'
+--
+-- * 'koaContent'
+keyOperationAttestation
+    :: KeyOperationAttestation
+keyOperationAttestation =
+    KeyOperationAttestation'
+    { _koaFormat = Nothing
+    , _koaContent = Nothing
+    }
+
+-- | Output only. The format of the attestation data.
+koaFormat :: Lens' KeyOperationAttestation (Maybe KeyOperationAttestationFormat)
+koaFormat
+  = lens _koaFormat (\ s a -> s{_koaFormat = a})
+
+-- | Output only. The attestation data provided by the HSM when the key
+-- operation was performed.
+koaContent :: Lens' KeyOperationAttestation (Maybe ByteString)
+koaContent
+  = lens _koaContent (\ s a -> s{_koaContent = a}) .
+      mapping _Bytes
+
+instance FromJSON KeyOperationAttestation where
+        parseJSON
+          = withObject "KeyOperationAttestation"
+              (\ o ->
+                 KeyOperationAttestation' <$>
+                   (o .:? "format") <*> (o .:? "content"))
+
+instance ToJSON KeyOperationAttestation where
+        toJSON KeyOperationAttestation'{..}
+          = object
+              (catMaybes
+                 [("format" .=) <$> _koaFormat,
+                  ("content" .=) <$> _koaContent])
+
+-- | Response message for KeyManagementService.ListCryptoKeyVersions.
+--
+-- /See:/ 'listCryptoKeyVersionsResponse' smart constructor.
+data ListCryptoKeyVersionsResponse = ListCryptoKeyVersionsResponse'
+    { _lckvrNextPageToken     :: !(Maybe Text)
+    , _lckvrTotalSize         :: !(Maybe (Textual Int32))
+    , _lckvrCryptoKeyVersions :: !(Maybe [CryptoKeyVersion])
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ListCryptoKeyVersionsResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'lckvrNextPageToken'
+--
+-- * 'lckvrTotalSize'
+--
+-- * 'lckvrCryptoKeyVersions'
+listCryptoKeyVersionsResponse
+    :: ListCryptoKeyVersionsResponse
+listCryptoKeyVersionsResponse =
+    ListCryptoKeyVersionsResponse'
+    { _lckvrNextPageToken = Nothing
+    , _lckvrTotalSize = Nothing
+    , _lckvrCryptoKeyVersions = Nothing
+    }
+
+-- | A token to retrieve next page of results. Pass this value in
+-- ListCryptoKeyVersionsRequest.page_token to retrieve the next page of
+-- results.
+lckvrNextPageToken :: Lens' ListCryptoKeyVersionsResponse (Maybe Text)
+lckvrNextPageToken
+  = lens _lckvrNextPageToken
+      (\ s a -> s{_lckvrNextPageToken = a})
+
+-- | The total number of CryptoKeyVersions that matched the query.
+lckvrTotalSize :: Lens' ListCryptoKeyVersionsResponse (Maybe Int32)
+lckvrTotalSize
+  = lens _lckvrTotalSize
+      (\ s a -> s{_lckvrTotalSize = a})
+      . mapping _Coerce
+
+-- | The list of CryptoKeyVersions.
+lckvrCryptoKeyVersions :: Lens' ListCryptoKeyVersionsResponse [CryptoKeyVersion]
+lckvrCryptoKeyVersions
+  = lens _lckvrCryptoKeyVersions
+      (\ s a -> s{_lckvrCryptoKeyVersions = a})
+      . _Default
+      . _Coerce
+
+instance FromJSON ListCryptoKeyVersionsResponse where
+        parseJSON
+          = withObject "ListCryptoKeyVersionsResponse"
+              (\ o ->
+                 ListCryptoKeyVersionsResponse' <$>
+                   (o .:? "nextPageToken") <*> (o .:? "totalSize") <*>
+                     (o .:? "cryptoKeyVersions" .!= mempty))
+
+instance ToJSON ListCryptoKeyVersionsResponse where
+        toJSON ListCryptoKeyVersionsResponse'{..}
+          = object
+              (catMaybes
+                 [("nextPageToken" .=) <$> _lckvrNextPageToken,
+                  ("totalSize" .=) <$> _lckvrTotalSize,
+                  ("cryptoKeyVersions" .=) <$>
+                    _lckvrCryptoKeyVersions])
+
+-- | Request message for KeyManagementService.RestoreCryptoKeyVersion.
+--
+-- /See:/ 'restoreCryptoKeyVersionRequest' smart constructor.
+data RestoreCryptoKeyVersionRequest =
+    RestoreCryptoKeyVersionRequest'
+    deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'RestoreCryptoKeyVersionRequest' with the minimum fields required to make a request.
+--
+restoreCryptoKeyVersionRequest
+    :: RestoreCryptoKeyVersionRequest
+restoreCryptoKeyVersionRequest = RestoreCryptoKeyVersionRequest'
+
+instance FromJSON RestoreCryptoKeyVersionRequest
+         where
+        parseJSON
+          = withObject "RestoreCryptoKeyVersionRequest"
+              (\ o -> pure RestoreCryptoKeyVersionRequest')
+
+instance ToJSON RestoreCryptoKeyVersionRequest where
+        toJSON = const emptyObject
+
+-- | Request message for KeyManagementService.UpdateCryptoKeyPrimaryVersion.
+--
+-- /See:/ 'updateCryptoKeyPrimaryVersionRequest' smart constructor.
+newtype UpdateCryptoKeyPrimaryVersionRequest = UpdateCryptoKeyPrimaryVersionRequest'
+    { _uckpvrCryptoKeyVersionId :: Maybe Text
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'UpdateCryptoKeyPrimaryVersionRequest' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'uckpvrCryptoKeyVersionId'
+updateCryptoKeyPrimaryVersionRequest
+    :: UpdateCryptoKeyPrimaryVersionRequest
+updateCryptoKeyPrimaryVersionRequest =
+    UpdateCryptoKeyPrimaryVersionRequest'
+    { _uckpvrCryptoKeyVersionId = Nothing
+    }
+
+-- | The id of the child CryptoKeyVersion to use as primary.
+uckpvrCryptoKeyVersionId :: Lens' UpdateCryptoKeyPrimaryVersionRequest (Maybe Text)
+uckpvrCryptoKeyVersionId
+  = lens _uckpvrCryptoKeyVersionId
+      (\ s a -> s{_uckpvrCryptoKeyVersionId = a})
+
+instance FromJSON
+         UpdateCryptoKeyPrimaryVersionRequest where
+        parseJSON
+          = withObject "UpdateCryptoKeyPrimaryVersionRequest"
+              (\ o ->
+                 UpdateCryptoKeyPrimaryVersionRequest' <$>
+                   (o .:? "cryptoKeyVersionId"))
+
+instance ToJSON UpdateCryptoKeyPrimaryVersionRequest
+         where
+        toJSON UpdateCryptoKeyPrimaryVersionRequest'{..}
+          = object
+              (catMaybes
+                 [("cryptoKeyVersionId" .=) <$>
+                    _uckpvrCryptoKeyVersionId])
+
+-- | Request message for \`TestIamPermissions\` method.
+--
+-- /See:/ 'testIAMPermissionsRequest' smart constructor.
+newtype TestIAMPermissionsRequest = TestIAMPermissionsRequest'
+    { _tiprPermissions :: Maybe [Text]
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'TestIAMPermissionsRequest' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'tiprPermissions'
+testIAMPermissionsRequest
+    :: TestIAMPermissionsRequest
+testIAMPermissionsRequest =
+    TestIAMPermissionsRequest'
+    { _tiprPermissions = Nothing
+    }
+
+-- | The set of permissions to check for the \`resource\`. Permissions with
+-- wildcards (such as \'*\' or \'storage.*\') are not allowed. For more
+-- information see [IAM
+-- Overview](https:\/\/cloud.google.com\/iam\/docs\/overview#permissions).
+tiprPermissions :: Lens' TestIAMPermissionsRequest [Text]
+tiprPermissions
+  = lens _tiprPermissions
+      (\ s a -> s{_tiprPermissions = a})
+      . _Default
+      . _Coerce
+
+instance FromJSON TestIAMPermissionsRequest where
+        parseJSON
+          = withObject "TestIAMPermissionsRequest"
+              (\ o ->
+                 TestIAMPermissionsRequest' <$>
+                   (o .:? "permissions" .!= mempty))
+
+instance ToJSON TestIAMPermissionsRequest where
+        toJSON TestIAMPermissionsRequest'{..}
+          = object
+              (catMaybes [("permissions" .=) <$> _tiprPermissions])
+
+-- | Response message for \`TestIamPermissions\` method.
+--
+-- /See:/ 'testIAMPermissionsResponse' smart constructor.
+newtype TestIAMPermissionsResponse = TestIAMPermissionsResponse'
+    { _tiamprPermissions :: Maybe [Text]
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'TestIAMPermissionsResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'tiamprPermissions'
+testIAMPermissionsResponse
+    :: TestIAMPermissionsResponse
+testIAMPermissionsResponse =
+    TestIAMPermissionsResponse'
+    { _tiamprPermissions = Nothing
+    }
+
+-- | A subset of \`TestPermissionsRequest.permissions\` that the caller is
+-- allowed.
+tiamprPermissions :: Lens' TestIAMPermissionsResponse [Text]
+tiamprPermissions
+  = lens _tiamprPermissions
+      (\ s a -> s{_tiamprPermissions = a})
+      . _Default
+      . _Coerce
+
+instance FromJSON TestIAMPermissionsResponse where
+        parseJSON
+          = withObject "TestIAMPermissionsResponse"
+              (\ o ->
+                 TestIAMPermissionsResponse' <$>
+                   (o .:? "permissions" .!= mempty))
+
+instance ToJSON TestIAMPermissionsResponse where
+        toJSON TestIAMPermissionsResponse'{..}
+          = object
+              (catMaybes
+                 [("permissions" .=) <$> _tiamprPermissions])
+
+-- | A Digest holds a cryptographic message digest.
+--
+-- /See:/ 'digest' smart constructor.
+data Digest = Digest'
+    { _dSha512 :: !(Maybe Bytes)
+    , _dSha384 :: !(Maybe Bytes)
+    , _dSha256 :: !(Maybe Bytes)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'Digest' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'dSha512'
+--
+-- * 'dSha384'
+--
+-- * 'dSha256'
+digest
+    :: Digest
+digest =
+    Digest'
+    { _dSha512 = Nothing
+    , _dSha384 = Nothing
+    , _dSha256 = Nothing
+    }
+
+-- | A message digest produced with the SHA-512 algorithm.
+dSha512 :: Lens' Digest (Maybe ByteString)
+dSha512
+  = lens _dSha512 (\ s a -> s{_dSha512 = a}) .
+      mapping _Bytes
+
+-- | A message digest produced with the SHA-384 algorithm.
+dSha384 :: Lens' Digest (Maybe ByteString)
+dSha384
+  = lens _dSha384 (\ s a -> s{_dSha384 = a}) .
+      mapping _Bytes
+
+-- | A message digest produced with the SHA-256 algorithm.
+dSha256 :: Lens' Digest (Maybe ByteString)
+dSha256
+  = lens _dSha256 (\ s a -> s{_dSha256 = a}) .
+      mapping _Bytes
+
+instance FromJSON Digest where
+        parseJSON
+          = withObject "Digest"
+              (\ o ->
+                 Digest' <$>
+                   (o .:? "sha512") <*> (o .:? "sha384") <*>
+                     (o .:? "sha256"))
+
+instance ToJSON Digest where
+        toJSON Digest'{..}
+          = object
+              (catMaybes
+                 [("sha512" .=) <$> _dSha512,
+                  ("sha384" .=) <$> _dSha384,
+                  ("sha256" .=) <$> _dSha256])
+
+-- | Defines an Identity and Access Management (IAM) policy. It is used to
+-- specify access control policies for Cloud Platform resources. A
+-- \`Policy\` consists of a list of \`bindings\`. A \`binding\` binds a
+-- list of \`members\` to a \`role\`, where the members can be user
+-- accounts, Google groups, Google domains, and service accounts. A
+-- \`role\` is a named list of permissions defined by IAM. **JSON Example**
+-- { \"bindings\": [ { \"role\": \"roles\/owner\", \"members\": [
+-- \"user:mike\'example.com\", \"group:admins\'example.com\",
+-- \"domain:google.com\",
+-- \"serviceAccount:my-other-app\'appspot.gserviceaccount.com\" ] }, {
+-- \"role\": \"roles\/viewer\", \"members\": [\"user:sean\'example.com\"] }
+-- ] } **YAML Example** bindings: - members: - user:mike\'example.com -
+-- group:admins\'example.com - domain:google.com -
+-- serviceAccount:my-other-app\'appspot.gserviceaccount.com role:
+-- roles\/owner - members: - user:sean\'example.com role: roles\/viewer For
+-- a description of IAM and its features, see the [IAM developer\'s
+-- guide](https:\/\/cloud.google.com\/iam\/docs).
+--
+-- /See:/ 'policy' smart constructor.
+data Policy = Policy'
+    { _pAuditConfigs :: !(Maybe [AuditConfig])
+    , _pEtag         :: !(Maybe Bytes)
+    , _pVersion      :: !(Maybe (Textual Int32))
+    , _pBindings     :: !(Maybe [Binding])
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'Policy' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'pAuditConfigs'
+--
+-- * 'pEtag'
+--
+-- * 'pVersion'
+--
+-- * 'pBindings'
+policy
+    :: Policy
+policy =
+    Policy'
+    { _pAuditConfigs = Nothing
+    , _pEtag = Nothing
+    , _pVersion = Nothing
+    , _pBindings = Nothing
+    }
+
+-- | Specifies cloud audit logging configuration for this policy.
+pAuditConfigs :: Lens' Policy [AuditConfig]
+pAuditConfigs
+  = lens _pAuditConfigs
+      (\ s a -> s{_pAuditConfigs = a})
+      . _Default
+      . _Coerce
+
+-- | \`etag\` is used for optimistic concurrency control as a way to help
+-- prevent simultaneous updates of a policy from overwriting each other. It
+-- is strongly suggested that systems make use of the \`etag\` in the
+-- read-modify-write cycle to perform policy updates in order to avoid race
+-- conditions: An \`etag\` is returned in the response to \`getIamPolicy\`,
+-- and systems are expected to put that etag in the request to
+-- \`setIamPolicy\` to ensure that their change will be applied to the same
+-- version of the policy. If no \`etag\` is provided in the call to
+-- \`setIamPolicy\`, then the existing policy is overwritten blindly.
+pEtag :: Lens' Policy (Maybe ByteString)
+pEtag
+  = lens _pEtag (\ s a -> s{_pEtag = a}) .
+      mapping _Bytes
+
+-- | Deprecated.
+pVersion :: Lens' Policy (Maybe Int32)
+pVersion
+  = lens _pVersion (\ s a -> s{_pVersion = a}) .
+      mapping _Coerce
+
+-- | Associates a list of \`members\` to a \`role\`. \`bindings\` with no
+-- members will result in an error.
+pBindings :: Lens' Policy [Binding]
+pBindings
+  = lens _pBindings (\ s a -> s{_pBindings = a}) .
+      _Default
+      . _Coerce
+
+instance FromJSON Policy where
+        parseJSON
+          = withObject "Policy"
+              (\ o ->
+                 Policy' <$>
+                   (o .:? "auditConfigs" .!= mempty) <*> (o .:? "etag")
+                     <*> (o .:? "version")
+                     <*> (o .:? "bindings" .!= mempty))
+
+instance ToJSON Policy where
+        toJSON Policy'{..}
+          = object
+              (catMaybes
+                 [("auditConfigs" .=) <$> _pAuditConfigs,
+                  ("etag" .=) <$> _pEtag, ("version" .=) <$> _pVersion,
+                  ("bindings" .=) <$> _pBindings])
+
+-- | Cross-service attributes for the location. For example
+-- {\"cloud.googleapis.com\/region\": \"us-east1\"}
+--
+-- /See:/ 'locationLabels' smart constructor.
+newtype LocationLabels = LocationLabels'
+    { _llAddtional :: HashMap Text Text
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'LocationLabels' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'llAddtional'
+locationLabels
+    :: HashMap Text Text -- ^ 'llAddtional'
+    -> LocationLabels
+locationLabels pLlAddtional_ =
+    LocationLabels'
+    { _llAddtional = _Coerce # pLlAddtional_
+    }
+
+llAddtional :: Lens' LocationLabels (HashMap Text Text)
+llAddtional
+  = lens _llAddtional (\ s a -> s{_llAddtional = a}) .
+      _Coerce
+
+instance FromJSON LocationLabels where
+        parseJSON
+          = withObject "LocationLabels"
+              (\ o -> LocationLabels' <$> (parseJSONObject o))
+
+instance ToJSON LocationLabels where
+        toJSON = toJSON . _llAddtional
+
+-- | Cloud KMS metadata for the given google.cloud.location.Location.
+--
+-- /See:/ 'locationMetadata' smart constructor.
+newtype LocationMetadata = LocationMetadata'
+    { _lmHSMAvailable :: Maybe Bool
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'LocationMetadata' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'lmHSMAvailable'
+locationMetadata
+    :: LocationMetadata
+locationMetadata =
+    LocationMetadata'
+    { _lmHSMAvailable = Nothing
+    }
+
+-- | Indicates whether CryptoKeys with protection_level HSM can be created in
+-- this location.
+lmHSMAvailable :: Lens' LocationMetadata (Maybe Bool)
+lmHSMAvailable
+  = lens _lmHSMAvailable
+      (\ s a -> s{_lmHSMAvailable = a})
+
+instance FromJSON LocationMetadata where
+        parseJSON
+          = withObject "LocationMetadata"
+              (\ o -> LocationMetadata' <$> (o .:? "hsmAvailable"))
+
+instance ToJSON LocationMetadata where
+        toJSON LocationMetadata'{..}
+          = object
+              (catMaybes [("hsmAvailable" .=) <$> _lmHSMAvailable])
+
+-- | Provides the configuration for logging a type of permissions. Example: {
+-- \"audit_log_configs\": [ { \"log_type\": \"DATA_READ\",
+-- \"exempted_members\": [ \"user:foo\'gmail.com\" ] }, { \"log_type\":
+-- \"DATA_WRITE\", } ] } This enables \'DATA_READ\' and \'DATA_WRITE\'
+-- logging, while exempting foo\'gmail.com from DATA_READ logging.
+--
+-- /See:/ 'auditLogConfig' smart constructor.
+data AuditLogConfig = AuditLogConfig'
+    { _alcLogType         :: !(Maybe AuditLogConfigLogType)
+    , _alcExemptedMembers :: !(Maybe [Text])
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'AuditLogConfig' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'alcLogType'
+--
+-- * 'alcExemptedMembers'
+auditLogConfig
+    :: AuditLogConfig
+auditLogConfig =
+    AuditLogConfig'
+    { _alcLogType = Nothing
+    , _alcExemptedMembers = Nothing
+    }
+
+-- | The log type that this config enables.
+alcLogType :: Lens' AuditLogConfig (Maybe AuditLogConfigLogType)
+alcLogType
+  = lens _alcLogType (\ s a -> s{_alcLogType = a})
+
+-- | Specifies the identities that do not cause logging for this type of
+-- permission. Follows the same format of Binding.members.
+alcExemptedMembers :: Lens' AuditLogConfig [Text]
+alcExemptedMembers
+  = lens _alcExemptedMembers
+      (\ s a -> s{_alcExemptedMembers = a})
+      . _Default
+      . _Coerce
+
+instance FromJSON AuditLogConfig where
+        parseJSON
+          = withObject "AuditLogConfig"
+              (\ o ->
+                 AuditLogConfig' <$>
+                   (o .:? "logType") <*>
+                     (o .:? "exemptedMembers" .!= mempty))
+
+instance ToJSON AuditLogConfig where
+        toJSON AuditLogConfig'{..}
+          = object
+              (catMaybes
+                 [("logType" .=) <$> _alcLogType,
+                  ("exemptedMembers" .=) <$> _alcExemptedMembers])
+
+-- | Response message for KeyManagementService.ListCryptoKeys.
+--
+-- /See:/ 'listCryptoKeysResponse' smart constructor.
+data ListCryptoKeysResponse = ListCryptoKeysResponse'
+    { _lckrCryptoKeys    :: !(Maybe [CryptoKey])
+    , _lckrNextPageToken :: !(Maybe Text)
+    , _lckrTotalSize     :: !(Maybe (Textual Int32))
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ListCryptoKeysResponse' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'lckrCryptoKeys'
+--
+-- * 'lckrNextPageToken'
+--
+-- * 'lckrTotalSize'
+listCryptoKeysResponse
+    :: ListCryptoKeysResponse
+listCryptoKeysResponse =
+    ListCryptoKeysResponse'
+    { _lckrCryptoKeys = Nothing
+    , _lckrNextPageToken = Nothing
+    , _lckrTotalSize = Nothing
+    }
+
+-- | The list of CryptoKeys.
+lckrCryptoKeys :: Lens' ListCryptoKeysResponse [CryptoKey]
+lckrCryptoKeys
+  = lens _lckrCryptoKeys
+      (\ s a -> s{_lckrCryptoKeys = a})
+      . _Default
+      . _Coerce
+
+-- | A token to retrieve next page of results. Pass this value in
+-- ListCryptoKeysRequest.page_token to retrieve the next page of results.
+lckrNextPageToken :: Lens' ListCryptoKeysResponse (Maybe Text)
+lckrNextPageToken
+  = lens _lckrNextPageToken
+      (\ s a -> s{_lckrNextPageToken = a})
+
+-- | The total number of CryptoKeys that matched the query.
+lckrTotalSize :: Lens' ListCryptoKeysResponse (Maybe Int32)
+lckrTotalSize
+  = lens _lckrTotalSize
+      (\ s a -> s{_lckrTotalSize = a})
+      . mapping _Coerce
+
+instance FromJSON ListCryptoKeysResponse where
+        parseJSON
+          = withObject "ListCryptoKeysResponse"
+              (\ o ->
+                 ListCryptoKeysResponse' <$>
+                   (o .:? "cryptoKeys" .!= mempty) <*>
+                     (o .:? "nextPageToken")
+                     <*> (o .:? "totalSize"))
+
+instance ToJSON ListCryptoKeysResponse where
+        toJSON ListCryptoKeysResponse'{..}
+          = object
+              (catMaybes
+                 [("cryptoKeys" .=) <$> _lckrCryptoKeys,
+                  ("nextPageToken" .=) <$> _lckrNextPageToken,
+                  ("totalSize" .=) <$> _lckrTotalSize])
+
+-- | Request message for KeyManagementService.AsymmetricDecrypt.
+--
+-- /See:/ 'asymmetricDecryptRequest' smart constructor.
+newtype AsymmetricDecryptRequest = AsymmetricDecryptRequest'
+    { _adrCiphertext :: Maybe Bytes
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'AsymmetricDecryptRequest' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'adrCiphertext'
+asymmetricDecryptRequest
+    :: AsymmetricDecryptRequest
+asymmetricDecryptRequest =
+    AsymmetricDecryptRequest'
+    { _adrCiphertext = Nothing
+    }
+
+-- | Required. The data encrypted with the named CryptoKeyVersion\'s public
+-- key using OAEP.
+adrCiphertext :: Lens' AsymmetricDecryptRequest (Maybe ByteString)
+adrCiphertext
+  = lens _adrCiphertext
+      (\ s a -> s{_adrCiphertext = a})
+      . mapping _Bytes
+
+instance FromJSON AsymmetricDecryptRequest where
+        parseJSON
+          = withObject "AsymmetricDecryptRequest"
+              (\ o ->
+                 AsymmetricDecryptRequest' <$> (o .:? "ciphertext"))
+
+instance ToJSON AsymmetricDecryptRequest where
+        toJSON AsymmetricDecryptRequest'{..}
+          = object
+              (catMaybes [("ciphertext" .=) <$> _adrCiphertext])
+
+-- | A CryptoKeyVersion represents an individual cryptographic key, and the
+-- associated key material. An ENABLED version can be used for
+-- cryptographic operations. For security reasons, the raw cryptographic
+-- key material represented by a CryptoKeyVersion can never be viewed or
+-- exported. It can only be used to encrypt, decrypt, or sign data when an
+-- authorized user or application invokes Cloud KMS.
+--
+-- /See:/ 'cryptoKeyVersion' smart constructor.
+data CryptoKeyVersion = CryptoKeyVersion'
+    { _ckvState            :: !(Maybe CryptoKeyVersionState)
+    , _ckvAttestation      :: !(Maybe KeyOperationAttestation)
+    , _ckvGenerateTime     :: !(Maybe DateTime')
+    , _ckvName             :: !(Maybe Text)
+    , _ckvAlgorithm        :: !(Maybe CryptoKeyVersionAlgorithm)
+    , _ckvDestroyTime      :: !(Maybe DateTime')
+    , _ckvProtectionLevel  :: !(Maybe CryptoKeyVersionProtectionLevel)
+    , _ckvDestroyEventTime :: !(Maybe DateTime')
+    , _ckvCreateTime       :: !(Maybe DateTime')
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'CryptoKeyVersion' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'ckvState'
+--
+-- * 'ckvAttestation'
+--
+-- * 'ckvGenerateTime'
+--
+-- * 'ckvName'
+--
+-- * 'ckvAlgorithm'
+--
+-- * 'ckvDestroyTime'
+--
+-- * 'ckvProtectionLevel'
+--
+-- * 'ckvDestroyEventTime'
+--
+-- * 'ckvCreateTime'
+cryptoKeyVersion
+    :: CryptoKeyVersion
+cryptoKeyVersion =
+    CryptoKeyVersion'
+    { _ckvState = Nothing
+    , _ckvAttestation = Nothing
+    , _ckvGenerateTime = Nothing
+    , _ckvName = Nothing
+    , _ckvAlgorithm = Nothing
+    , _ckvDestroyTime = Nothing
+    , _ckvProtectionLevel = Nothing
+    , _ckvDestroyEventTime = Nothing
+    , _ckvCreateTime = Nothing
+    }
+
+-- | The current state of the CryptoKeyVersion.
+ckvState :: Lens' CryptoKeyVersion (Maybe CryptoKeyVersionState)
+ckvState = lens _ckvState (\ s a -> s{_ckvState = a})
+
+-- | Output only. Statement that was generated and signed by the HSM at key
+-- creation time. Use this statement to verify attributes of the key as
+-- stored on the HSM, independently of Google. Only provided for key
+-- versions with protection_level HSM.
+ckvAttestation :: Lens' CryptoKeyVersion (Maybe KeyOperationAttestation)
+ckvAttestation
+  = lens _ckvAttestation
+      (\ s a -> s{_ckvAttestation = a})
+
+-- | Output only. The time this CryptoKeyVersion\'s key material was
+-- generated.
+ckvGenerateTime :: Lens' CryptoKeyVersion (Maybe UTCTime)
+ckvGenerateTime
+  = lens _ckvGenerateTime
+      (\ s a -> s{_ckvGenerateTime = a})
+      . mapping _DateTime
+
+-- | Output only. The resource name for this CryptoKeyVersion in the format
+-- \`projects\/*\/locations\/*\/keyRings\/*\/cryptoKeys\/*\/cryptoKeyVersions\/*\`.
+ckvName :: Lens' CryptoKeyVersion (Maybe Text)
+ckvName = lens _ckvName (\ s a -> s{_ckvName = a})
+
+-- | Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion
+-- supports.
+ckvAlgorithm :: Lens' CryptoKeyVersion (Maybe CryptoKeyVersionAlgorithm)
+ckvAlgorithm
+  = lens _ckvAlgorithm (\ s a -> s{_ckvAlgorithm = a})
+
+-- | Output only. The time this CryptoKeyVersion\'s key material is scheduled
+-- for destruction. Only present if state is DESTROY_SCHEDULED.
+ckvDestroyTime :: Lens' CryptoKeyVersion (Maybe UTCTime)
+ckvDestroyTime
+  = lens _ckvDestroyTime
+      (\ s a -> s{_ckvDestroyTime = a})
+      . mapping _DateTime
+
+-- | Output only. The ProtectionLevel describing how crypto operations are
+-- performed with this CryptoKeyVersion.
+ckvProtectionLevel :: Lens' CryptoKeyVersion (Maybe CryptoKeyVersionProtectionLevel)
+ckvProtectionLevel
+  = lens _ckvProtectionLevel
+      (\ s a -> s{_ckvProtectionLevel = a})
+
+-- | Output only. The time this CryptoKeyVersion\'s key material was
+-- destroyed. Only present if state is DESTROYED.
+ckvDestroyEventTime :: Lens' CryptoKeyVersion (Maybe UTCTime)
+ckvDestroyEventTime
+  = lens _ckvDestroyEventTime
+      (\ s a -> s{_ckvDestroyEventTime = a})
+      . mapping _DateTime
+
+-- | Output only. The time at which this CryptoKeyVersion was created.
+ckvCreateTime :: Lens' CryptoKeyVersion (Maybe UTCTime)
+ckvCreateTime
+  = lens _ckvCreateTime
+      (\ s a -> s{_ckvCreateTime = a})
+      . mapping _DateTime
+
+instance FromJSON CryptoKeyVersion where
+        parseJSON
+          = withObject "CryptoKeyVersion"
+              (\ o ->
+                 CryptoKeyVersion' <$>
+                   (o .:? "state") <*> (o .:? "attestation") <*>
+                     (o .:? "generateTime")
+                     <*> (o .:? "name")
+                     <*> (o .:? "algorithm")
+                     <*> (o .:? "destroyTime")
+                     <*> (o .:? "protectionLevel")
+                     <*> (o .:? "destroyEventTime")
+                     <*> (o .:? "createTime"))
+
+instance ToJSON CryptoKeyVersion where
+        toJSON CryptoKeyVersion'{..}
+          = object
+              (catMaybes
+                 [("state" .=) <$> _ckvState,
+                  ("attestation" .=) <$> _ckvAttestation,
+                  ("generateTime" .=) <$> _ckvGenerateTime,
+                  ("name" .=) <$> _ckvName,
+                  ("algorithm" .=) <$> _ckvAlgorithm,
+                  ("destroyTime" .=) <$> _ckvDestroyTime,
+                  ("protectionLevel" .=) <$> _ckvProtectionLevel,
+                  ("destroyEventTime" .=) <$> _ckvDestroyEventTime,
+                  ("createTime" .=) <$> _ckvCreateTime])
+
+-- | Request message for KeyManagementService.Encrypt.
+--
+-- /See:/ 'encryptRequest' smart constructor.
+data EncryptRequest = EncryptRequest'
+    { _erAdditionalAuthenticatedData :: !(Maybe Bytes)
+    , _erPlaintext                   :: !(Maybe Bytes)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'EncryptRequest' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'erAdditionalAuthenticatedData'
+--
+-- * 'erPlaintext'
+encryptRequest
+    :: EncryptRequest
+encryptRequest =
+    EncryptRequest'
+    { _erAdditionalAuthenticatedData = Nothing
+    , _erPlaintext = Nothing
+    }
+
+-- | Optional data that, if specified, must also be provided during
+-- decryption through DecryptRequest.additional_authenticated_data. The
+-- maximum size depends on the key version\'s protection_level. For
+-- SOFTWARE keys, the AAD must be no larger than 64KiB. For HSM keys, the
+-- combined length of the plaintext and additional_authenticated_data
+-- fields must be no larger than 8KiB.
+erAdditionalAuthenticatedData :: Lens' EncryptRequest (Maybe ByteString)
+erAdditionalAuthenticatedData
+  = lens _erAdditionalAuthenticatedData
+      (\ s a -> s{_erAdditionalAuthenticatedData = a})
+      . mapping _Bytes
+
+-- | Required. The data to encrypt. Must be no larger than 64KiB. The maximum
+-- size depends on the key version\'s protection_level. For SOFTWARE keys,
+-- the plaintext must be no larger than 64KiB. For HSM keys, the combined
+-- length of the plaintext and additional_authenticated_data fields must be
+-- no larger than 8KiB.
+erPlaintext :: Lens' EncryptRequest (Maybe ByteString)
+erPlaintext
+  = lens _erPlaintext (\ s a -> s{_erPlaintext = a}) .
+      mapping _Bytes
+
+instance FromJSON EncryptRequest where
+        parseJSON
+          = withObject "EncryptRequest"
+              (\ o ->
+                 EncryptRequest' <$>
+                   (o .:? "additionalAuthenticatedData") <*>
+                     (o .:? "plaintext"))
+
+instance ToJSON EncryptRequest where
+        toJSON EncryptRequest'{..}
+          = object
+              (catMaybes
+                 [("additionalAuthenticatedData" .=) <$>
+                    _erAdditionalAuthenticatedData,
+                  ("plaintext" .=) <$> _erPlaintext])
+
+-- | Associates \`members\` with a \`role\`.
+--
+-- /See:/ 'binding' smart constructor.
+data Binding = Binding'
+    { _bMembers   :: !(Maybe [Text])
+    , _bRole      :: !(Maybe Text)
+    , _bCondition :: !(Maybe Expr)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'Binding' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'bMembers'
+--
+-- * 'bRole'
+--
+-- * 'bCondition'
+binding
+    :: Binding
+binding =
+    Binding'
+    { _bMembers = Nothing
+    , _bRole = Nothing
+    , _bCondition = Nothing
+    }
+
+-- | Specifies the identities requesting access for a Cloud Platform
+-- resource. \`members\` can have the following values: * \`allUsers\`: A
+-- special identifier that represents anyone who is on the internet; with
+-- or without a Google account. * \`allAuthenticatedUsers\`: A special
+-- identifier that represents anyone who is authenticated with a Google
+-- account or a service account. * \`user:{emailid}\`: An email address
+-- that represents a specific Google account. For example,
+-- \`alice\'gmail.com\` . * \`serviceAccount:{emailid}\`: An email address
+-- that represents a service account. For example,
+-- \`my-other-app\'appspot.gserviceaccount.com\`. * \`group:{emailid}\`: An
+-- email address that represents a Google group. For example,
+-- \`admins\'example.com\`. * \`domain:{domain}\`: A Google Apps domain
+-- name that represents all the users of that domain. For example,
+-- \`google.com\` or \`example.com\`.
+bMembers :: Lens' Binding [Text]
+bMembers
+  = lens _bMembers (\ s a -> s{_bMembers = a}) .
+      _Default
+      . _Coerce
+
+-- | Role that is assigned to \`members\`. For example, \`roles\/viewer\`,
+-- \`roles\/editor\`, or \`roles\/owner\`.
+bRole :: Lens' Binding (Maybe Text)
+bRole = lens _bRole (\ s a -> s{_bRole = a})
+
+-- | Unimplemented. The condition that is associated with this binding. NOTE:
+-- an unsatisfied condition will not allow user access via current binding.
+-- Different bindings, including their conditions, are examined
+-- independently.
+bCondition :: Lens' Binding (Maybe Expr)
+bCondition
+  = lens _bCondition (\ s a -> s{_bCondition = a})
+
+instance FromJSON Binding where
+        parseJSON
+          = withObject "Binding"
+              (\ o ->
+                 Binding' <$>
+                   (o .:? "members" .!= mempty) <*> (o .:? "role") <*>
+                     (o .:? "condition"))
+
+instance ToJSON Binding where
+        toJSON Binding'{..}
+          = object
+              (catMaybes
+                 [("members" .=) <$> _bMembers,
+                  ("role" .=) <$> _bRole,
+                  ("condition" .=) <$> _bCondition])
diff --git a/gen/Network/Google/CloudKMS/Types/Sum.hs b/gen/Network/Google/CloudKMS/Types/Sum.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/CloudKMS/Types/Sum.hs
@@ -0,0 +1,583 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE LambdaCase         #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+
+{-# OPTIONS_GHC -fno-warn-unused-imports #-}
+
+-- |
+-- Module      : Network.Google.CloudKMS.Types.Sum
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+module Network.Google.CloudKMS.Types.Sum where
+
+import           Network.Google.Prelude hiding (Bytes)
+
+-- | The immutable purpose of this CryptoKey.
+data CryptoKeyPurpose
+    = CryptoKeyPurposeUnspecified
+      -- ^ @CRYPTO_KEY_PURPOSE_UNSPECIFIED@
+      -- Not specified.
+    | EncryptDecrypt
+      -- ^ @ENCRYPT_DECRYPT@
+      -- CryptoKeys with this purpose may be used with Encrypt and Decrypt.
+    | AsymmetricSign
+      -- ^ @ASYMMETRIC_SIGN@
+      -- CryptoKeys with this purpose may be used with AsymmetricSign and
+      -- GetPublicKey.
+    | AsymmetricDecrypt
+      -- ^ @ASYMMETRIC_DECRYPT@
+      -- CryptoKeys with this purpose may be used with AsymmetricDecrypt and
+      -- GetPublicKey.
+      deriving (Eq, Ord, Enum, Read, Show, Data, Typeable, Generic)
+
+instance Hashable CryptoKeyPurpose
+
+instance FromHttpApiData CryptoKeyPurpose where
+    parseQueryParam = \case
+        "CRYPTO_KEY_PURPOSE_UNSPECIFIED" -> Right CryptoKeyPurposeUnspecified
+        "ENCRYPT_DECRYPT" -> Right EncryptDecrypt
+        "ASYMMETRIC_SIGN" -> Right AsymmetricSign
+        "ASYMMETRIC_DECRYPT" -> Right AsymmetricDecrypt
+        x -> Left ("Unable to parse CryptoKeyPurpose from: " <> x)
+
+instance ToHttpApiData CryptoKeyPurpose where
+    toQueryParam = \case
+        CryptoKeyPurposeUnspecified -> "CRYPTO_KEY_PURPOSE_UNSPECIFIED"
+        EncryptDecrypt -> "ENCRYPT_DECRYPT"
+        AsymmetricSign -> "ASYMMETRIC_SIGN"
+        AsymmetricDecrypt -> "ASYMMETRIC_DECRYPT"
+
+instance FromJSON CryptoKeyPurpose where
+    parseJSON = parseJSONText "CryptoKeyPurpose"
+
+instance ToJSON CryptoKeyPurpose where
+    toJSON = toJSONText
+
+-- | ProtectionLevel to use when creating a CryptoKeyVersion based on this
+-- template. Immutable. Defaults to SOFTWARE.
+data CryptoKeyVersionTemplateProtectionLevel
+    = ProtectionLevelUnspecified
+      -- ^ @PROTECTION_LEVEL_UNSPECIFIED@
+      -- Not specified.
+    | Software
+      -- ^ @SOFTWARE@
+      -- Crypto operations are performed in software.
+    | HSM
+      -- ^ @HSM@
+      -- Crypto operations are performed in a Hardware Security Module.
+      deriving (Eq, Ord, Enum, Read, Show, Data, Typeable, Generic)
+
+instance Hashable CryptoKeyVersionTemplateProtectionLevel
+
+instance FromHttpApiData CryptoKeyVersionTemplateProtectionLevel where
+    parseQueryParam = \case
+        "PROTECTION_LEVEL_UNSPECIFIED" -> Right ProtectionLevelUnspecified
+        "SOFTWARE" -> Right Software
+        "HSM" -> Right HSM
+        x -> Left ("Unable to parse CryptoKeyVersionTemplateProtectionLevel from: " <> x)
+
+instance ToHttpApiData CryptoKeyVersionTemplateProtectionLevel where
+    toQueryParam = \case
+        ProtectionLevelUnspecified -> "PROTECTION_LEVEL_UNSPECIFIED"
+        Software -> "SOFTWARE"
+        HSM -> "HSM"
+
+instance FromJSON CryptoKeyVersionTemplateProtectionLevel where
+    parseJSON = parseJSONText "CryptoKeyVersionTemplateProtectionLevel"
+
+instance ToJSON CryptoKeyVersionTemplateProtectionLevel where
+    toJSON = toJSONText
+
+-- | Required. Algorithm to use when creating a CryptoKeyVersion based on
+-- this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION
+-- is implied if both this field is omitted and CryptoKey.purpose is
+-- ENCRYPT_DECRYPT.
+data CryptoKeyVersionTemplateAlgorithm
+    = CryptoKeyVersionAlgorithmUnspecified
+      -- ^ @CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED@
+      -- Not specified.
+    | GoogleSymmetricEncryption
+      -- ^ @GOOGLE_SYMMETRIC_ENCRYPTION@
+      -- Creates symmetric encryption keys.
+    | RsaSignPss2048SHA256
+      -- ^ @RSA_SIGN_PSS_2048_SHA256@
+      -- RSASSA-PSS 2048 bit key with a SHA256 digest.
+    | RsaSignPss3072SHA256
+      -- ^ @RSA_SIGN_PSS_3072_SHA256@
+      -- RSASSA-PSS 3072 bit key with a SHA256 digest.
+    | RsaSignPss4096SHA256
+      -- ^ @RSA_SIGN_PSS_4096_SHA256@
+      -- RSASSA-PSS 4096 bit key with a SHA256 digest.
+    | RsaSignPss4096SHA512
+      -- ^ @RSA_SIGN_PSS_4096_SHA512@
+      -- RSASSA-PSS 4096 bit key with a SHA512 digest.
+    | RsaSignPKCS12048SHA256
+      -- ^ @RSA_SIGN_PKCS1_2048_SHA256@
+      -- RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
+    | RsaSignPKCS13072SHA256
+      -- ^ @RSA_SIGN_PKCS1_3072_SHA256@
+      -- RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.
+    | RsaSignPKCS14096SHA256
+      -- ^ @RSA_SIGN_PKCS1_4096_SHA256@
+      -- RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
+    | RsaSignPKCS14096SHA512
+      -- ^ @RSA_SIGN_PKCS1_4096_SHA512@
+      -- RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.
+    | RsaDecryptOaep2048SHA256
+      -- ^ @RSA_DECRYPT_OAEP_2048_SHA256@
+      -- RSAES-OAEP 2048 bit key with a SHA256 digest.
+    | RsaDecryptOaep3072SHA256
+      -- ^ @RSA_DECRYPT_OAEP_3072_SHA256@
+      -- RSAES-OAEP 3072 bit key with a SHA256 digest.
+    | RsaDecryptOaep4096SHA256
+      -- ^ @RSA_DECRYPT_OAEP_4096_SHA256@
+      -- RSAES-OAEP 4096 bit key with a SHA256 digest.
+    | RsaDecryptOaep4096SHA512
+      -- ^ @RSA_DECRYPT_OAEP_4096_SHA512@
+      -- RSAES-OAEP 4096 bit key with a SHA512 digest.
+    | EcSignP256SHA256
+      -- ^ @EC_SIGN_P256_SHA256@
+      -- ECDSA on the NIST P-256 curve with a SHA256 digest.
+    | EcSignP384SHA384
+      -- ^ @EC_SIGN_P384_SHA384@
+      -- ECDSA on the NIST P-384 curve with a SHA384 digest.
+      deriving (Eq, Ord, Enum, Read, Show, Data, Typeable, Generic)
+
+instance Hashable CryptoKeyVersionTemplateAlgorithm
+
+instance FromHttpApiData CryptoKeyVersionTemplateAlgorithm where
+    parseQueryParam = \case
+        "CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED" -> Right CryptoKeyVersionAlgorithmUnspecified
+        "GOOGLE_SYMMETRIC_ENCRYPTION" -> Right GoogleSymmetricEncryption
+        "RSA_SIGN_PSS_2048_SHA256" -> Right RsaSignPss2048SHA256
+        "RSA_SIGN_PSS_3072_SHA256" -> Right RsaSignPss3072SHA256
+        "RSA_SIGN_PSS_4096_SHA256" -> Right RsaSignPss4096SHA256
+        "RSA_SIGN_PSS_4096_SHA512" -> Right RsaSignPss4096SHA512
+        "RSA_SIGN_PKCS1_2048_SHA256" -> Right RsaSignPKCS12048SHA256
+        "RSA_SIGN_PKCS1_3072_SHA256" -> Right RsaSignPKCS13072SHA256
+        "RSA_SIGN_PKCS1_4096_SHA256" -> Right RsaSignPKCS14096SHA256
+        "RSA_SIGN_PKCS1_4096_SHA512" -> Right RsaSignPKCS14096SHA512
+        "RSA_DECRYPT_OAEP_2048_SHA256" -> Right RsaDecryptOaep2048SHA256
+        "RSA_DECRYPT_OAEP_3072_SHA256" -> Right RsaDecryptOaep3072SHA256
+        "RSA_DECRYPT_OAEP_4096_SHA256" -> Right RsaDecryptOaep4096SHA256
+        "RSA_DECRYPT_OAEP_4096_SHA512" -> Right RsaDecryptOaep4096SHA512
+        "EC_SIGN_P256_SHA256" -> Right EcSignP256SHA256
+        "EC_SIGN_P384_SHA384" -> Right EcSignP384SHA384
+        x -> Left ("Unable to parse CryptoKeyVersionTemplateAlgorithm from: " <> x)
+
+instance ToHttpApiData CryptoKeyVersionTemplateAlgorithm where
+    toQueryParam = \case
+        CryptoKeyVersionAlgorithmUnspecified -> "CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED"
+        GoogleSymmetricEncryption -> "GOOGLE_SYMMETRIC_ENCRYPTION"
+        RsaSignPss2048SHA256 -> "RSA_SIGN_PSS_2048_SHA256"
+        RsaSignPss3072SHA256 -> "RSA_SIGN_PSS_3072_SHA256"
+        RsaSignPss4096SHA256 -> "RSA_SIGN_PSS_4096_SHA256"
+        RsaSignPss4096SHA512 -> "RSA_SIGN_PSS_4096_SHA512"
+        RsaSignPKCS12048SHA256 -> "RSA_SIGN_PKCS1_2048_SHA256"
+        RsaSignPKCS13072SHA256 -> "RSA_SIGN_PKCS1_3072_SHA256"
+        RsaSignPKCS14096SHA256 -> "RSA_SIGN_PKCS1_4096_SHA256"
+        RsaSignPKCS14096SHA512 -> "RSA_SIGN_PKCS1_4096_SHA512"
+        RsaDecryptOaep2048SHA256 -> "RSA_DECRYPT_OAEP_2048_SHA256"
+        RsaDecryptOaep3072SHA256 -> "RSA_DECRYPT_OAEP_3072_SHA256"
+        RsaDecryptOaep4096SHA256 -> "RSA_DECRYPT_OAEP_4096_SHA256"
+        RsaDecryptOaep4096SHA512 -> "RSA_DECRYPT_OAEP_4096_SHA512"
+        EcSignP256SHA256 -> "EC_SIGN_P256_SHA256"
+        EcSignP384SHA384 -> "EC_SIGN_P384_SHA384"
+
+instance FromJSON CryptoKeyVersionTemplateAlgorithm where
+    parseJSON = parseJSONText "CryptoKeyVersionTemplateAlgorithm"
+
+instance ToJSON CryptoKeyVersionTemplateAlgorithm where
+    toJSON = toJSONText
+
+-- | The Algorithm associated with this key.
+data PublicKeyAlgorithm
+    = PKACryptoKeyVersionAlgorithmUnspecified
+      -- ^ @CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED@
+      -- Not specified.
+    | PKAGoogleSymmetricEncryption
+      -- ^ @GOOGLE_SYMMETRIC_ENCRYPTION@
+      -- Creates symmetric encryption keys.
+    | PKARsaSignPss2048SHA256
+      -- ^ @RSA_SIGN_PSS_2048_SHA256@
+      -- RSASSA-PSS 2048 bit key with a SHA256 digest.
+    | PKARsaSignPss3072SHA256
+      -- ^ @RSA_SIGN_PSS_3072_SHA256@
+      -- RSASSA-PSS 3072 bit key with a SHA256 digest.
+    | PKARsaSignPss4096SHA256
+      -- ^ @RSA_SIGN_PSS_4096_SHA256@
+      -- RSASSA-PSS 4096 bit key with a SHA256 digest.
+    | PKARsaSignPss4096SHA512
+      -- ^ @RSA_SIGN_PSS_4096_SHA512@
+      -- RSASSA-PSS 4096 bit key with a SHA512 digest.
+    | PKARsaSignPKCS12048SHA256
+      -- ^ @RSA_SIGN_PKCS1_2048_SHA256@
+      -- RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
+    | PKARsaSignPKCS13072SHA256
+      -- ^ @RSA_SIGN_PKCS1_3072_SHA256@
+      -- RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.
+    | PKARsaSignPKCS14096SHA256
+      -- ^ @RSA_SIGN_PKCS1_4096_SHA256@
+      -- RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
+    | PKARsaSignPKCS14096SHA512
+      -- ^ @RSA_SIGN_PKCS1_4096_SHA512@
+      -- RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.
+    | PKARsaDecryptOaep2048SHA256
+      -- ^ @RSA_DECRYPT_OAEP_2048_SHA256@
+      -- RSAES-OAEP 2048 bit key with a SHA256 digest.
+    | PKARsaDecryptOaep3072SHA256
+      -- ^ @RSA_DECRYPT_OAEP_3072_SHA256@
+      -- RSAES-OAEP 3072 bit key with a SHA256 digest.
+    | PKARsaDecryptOaep4096SHA256
+      -- ^ @RSA_DECRYPT_OAEP_4096_SHA256@
+      -- RSAES-OAEP 4096 bit key with a SHA256 digest.
+    | PKARsaDecryptOaep4096SHA512
+      -- ^ @RSA_DECRYPT_OAEP_4096_SHA512@
+      -- RSAES-OAEP 4096 bit key with a SHA512 digest.
+    | PKAEcSignP256SHA256
+      -- ^ @EC_SIGN_P256_SHA256@
+      -- ECDSA on the NIST P-256 curve with a SHA256 digest.
+    | PKAEcSignP384SHA384
+      -- ^ @EC_SIGN_P384_SHA384@
+      -- ECDSA on the NIST P-384 curve with a SHA384 digest.
+      deriving (Eq, Ord, Enum, Read, Show, Data, Typeable, Generic)
+
+instance Hashable PublicKeyAlgorithm
+
+instance FromHttpApiData PublicKeyAlgorithm where
+    parseQueryParam = \case
+        "CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED" -> Right PKACryptoKeyVersionAlgorithmUnspecified
+        "GOOGLE_SYMMETRIC_ENCRYPTION" -> Right PKAGoogleSymmetricEncryption
+        "RSA_SIGN_PSS_2048_SHA256" -> Right PKARsaSignPss2048SHA256
+        "RSA_SIGN_PSS_3072_SHA256" -> Right PKARsaSignPss3072SHA256
+        "RSA_SIGN_PSS_4096_SHA256" -> Right PKARsaSignPss4096SHA256
+        "RSA_SIGN_PSS_4096_SHA512" -> Right PKARsaSignPss4096SHA512
+        "RSA_SIGN_PKCS1_2048_SHA256" -> Right PKARsaSignPKCS12048SHA256
+        "RSA_SIGN_PKCS1_3072_SHA256" -> Right PKARsaSignPKCS13072SHA256
+        "RSA_SIGN_PKCS1_4096_SHA256" -> Right PKARsaSignPKCS14096SHA256
+        "RSA_SIGN_PKCS1_4096_SHA512" -> Right PKARsaSignPKCS14096SHA512
+        "RSA_DECRYPT_OAEP_2048_SHA256" -> Right PKARsaDecryptOaep2048SHA256
+        "RSA_DECRYPT_OAEP_3072_SHA256" -> Right PKARsaDecryptOaep3072SHA256
+        "RSA_DECRYPT_OAEP_4096_SHA256" -> Right PKARsaDecryptOaep4096SHA256
+        "RSA_DECRYPT_OAEP_4096_SHA512" -> Right PKARsaDecryptOaep4096SHA512
+        "EC_SIGN_P256_SHA256" -> Right PKAEcSignP256SHA256
+        "EC_SIGN_P384_SHA384" -> Right PKAEcSignP384SHA384
+        x -> Left ("Unable to parse PublicKeyAlgorithm from: " <> x)
+
+instance ToHttpApiData PublicKeyAlgorithm where
+    toQueryParam = \case
+        PKACryptoKeyVersionAlgorithmUnspecified -> "CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED"
+        PKAGoogleSymmetricEncryption -> "GOOGLE_SYMMETRIC_ENCRYPTION"
+        PKARsaSignPss2048SHA256 -> "RSA_SIGN_PSS_2048_SHA256"
+        PKARsaSignPss3072SHA256 -> "RSA_SIGN_PSS_3072_SHA256"
+        PKARsaSignPss4096SHA256 -> "RSA_SIGN_PSS_4096_SHA256"
+        PKARsaSignPss4096SHA512 -> "RSA_SIGN_PSS_4096_SHA512"
+        PKARsaSignPKCS12048SHA256 -> "RSA_SIGN_PKCS1_2048_SHA256"
+        PKARsaSignPKCS13072SHA256 -> "RSA_SIGN_PKCS1_3072_SHA256"
+        PKARsaSignPKCS14096SHA256 -> "RSA_SIGN_PKCS1_4096_SHA256"
+        PKARsaSignPKCS14096SHA512 -> "RSA_SIGN_PKCS1_4096_SHA512"
+        PKARsaDecryptOaep2048SHA256 -> "RSA_DECRYPT_OAEP_2048_SHA256"
+        PKARsaDecryptOaep3072SHA256 -> "RSA_DECRYPT_OAEP_3072_SHA256"
+        PKARsaDecryptOaep4096SHA256 -> "RSA_DECRYPT_OAEP_4096_SHA256"
+        PKARsaDecryptOaep4096SHA512 -> "RSA_DECRYPT_OAEP_4096_SHA512"
+        PKAEcSignP256SHA256 -> "EC_SIGN_P256_SHA256"
+        PKAEcSignP384SHA384 -> "EC_SIGN_P384_SHA384"
+
+instance FromJSON PublicKeyAlgorithm where
+    parseJSON = parseJSONText "PublicKeyAlgorithm"
+
+instance ToJSON PublicKeyAlgorithm where
+    toJSON = toJSONText
+
+-- | The current state of the CryptoKeyVersion.
+data CryptoKeyVersionState
+    = CryptoKeyVersionStateUnspecified
+      -- ^ @CRYPTO_KEY_VERSION_STATE_UNSPECIFIED@
+      -- Not specified.
+    | PendingGeneration
+      -- ^ @PENDING_GENERATION@
+      -- This version is still being generated. It may not be used, enabled,
+      -- disabled, or destroyed yet. Cloud KMS will automatically mark this
+      -- version ENABLED as soon as the version is ready.
+    | Enabled
+      -- ^ @ENABLED@
+      -- This version may be used for cryptographic operations.
+    | Disabled
+      -- ^ @DISABLED@
+      -- This version may not be used, but the key material is still available,
+      -- and the version can be placed back into the ENABLED state.
+    | Destroyed
+      -- ^ @DESTROYED@
+      -- This version is destroyed, and the key material is no longer stored. A
+      -- version may not leave this state once entered.
+    | DestroyScheduled
+      -- ^ @DESTROY_SCHEDULED@
+      -- This version is scheduled for destruction, and will be destroyed soon.
+      -- Call RestoreCryptoKeyVersion to put it back into the DISABLED state.
+      deriving (Eq, Ord, Enum, Read, Show, Data, Typeable, Generic)
+
+instance Hashable CryptoKeyVersionState
+
+instance FromHttpApiData CryptoKeyVersionState where
+    parseQueryParam = \case
+        "CRYPTO_KEY_VERSION_STATE_UNSPECIFIED" -> Right CryptoKeyVersionStateUnspecified
+        "PENDING_GENERATION" -> Right PendingGeneration
+        "ENABLED" -> Right Enabled
+        "DISABLED" -> Right Disabled
+        "DESTROYED" -> Right Destroyed
+        "DESTROY_SCHEDULED" -> Right DestroyScheduled
+        x -> Left ("Unable to parse CryptoKeyVersionState from: " <> x)
+
+instance ToHttpApiData CryptoKeyVersionState where
+    toQueryParam = \case
+        CryptoKeyVersionStateUnspecified -> "CRYPTO_KEY_VERSION_STATE_UNSPECIFIED"
+        PendingGeneration -> "PENDING_GENERATION"
+        Enabled -> "ENABLED"
+        Disabled -> "DISABLED"
+        Destroyed -> "DESTROYED"
+        DestroyScheduled -> "DESTROY_SCHEDULED"
+
+instance FromJSON CryptoKeyVersionState where
+    parseJSON = parseJSONText "CryptoKeyVersionState"
+
+instance ToJSON CryptoKeyVersionState where
+    toJSON = toJSONText
+
+-- | Output only. The format of the attestation data.
+data KeyOperationAttestationFormat
+    = AttestationFormatUnspecified
+      -- ^ @ATTESTATION_FORMAT_UNSPECIFIED@
+      -- Not specified.
+    | CaviumV1Compressed
+      -- ^ @CAVIUM_V1_COMPRESSED@
+      -- Cavium HSM attestation compressed with gzip. Note that this format is
+      -- defined by Cavium and subject to change at any time.
+      deriving (Eq, Ord, Enum, Read, Show, Data, Typeable, Generic)
+
+instance Hashable KeyOperationAttestationFormat
+
+instance FromHttpApiData KeyOperationAttestationFormat where
+    parseQueryParam = \case
+        "ATTESTATION_FORMAT_UNSPECIFIED" -> Right AttestationFormatUnspecified
+        "CAVIUM_V1_COMPRESSED" -> Right CaviumV1Compressed
+        x -> Left ("Unable to parse KeyOperationAttestationFormat from: " <> x)
+
+instance ToHttpApiData KeyOperationAttestationFormat where
+    toQueryParam = \case
+        AttestationFormatUnspecified -> "ATTESTATION_FORMAT_UNSPECIFIED"
+        CaviumV1Compressed -> "CAVIUM_V1_COMPRESSED"
+
+instance FromJSON KeyOperationAttestationFormat where
+    parseJSON = parseJSONText "KeyOperationAttestationFormat"
+
+instance ToJSON KeyOperationAttestationFormat where
+    toJSON = toJSONText
+
+-- | The log type that this config enables.
+data AuditLogConfigLogType
+    = LogTypeUnspecified
+      -- ^ @LOG_TYPE_UNSPECIFIED@
+      -- Default case. Should never be this.
+    | AdminRead
+      -- ^ @ADMIN_READ@
+      -- Admin reads. Example: CloudIAM getIamPolicy
+    | DataWrite
+      -- ^ @DATA_WRITE@
+      -- Data writes. Example: CloudSQL Users create
+    | DataRead
+      -- ^ @DATA_READ@
+      -- Data reads. Example: CloudSQL Users list
+      deriving (Eq, Ord, Enum, Read, Show, Data, Typeable, Generic)
+
+instance Hashable AuditLogConfigLogType
+
+instance FromHttpApiData AuditLogConfigLogType where
+    parseQueryParam = \case
+        "LOG_TYPE_UNSPECIFIED" -> Right LogTypeUnspecified
+        "ADMIN_READ" -> Right AdminRead
+        "DATA_WRITE" -> Right DataWrite
+        "DATA_READ" -> Right DataRead
+        x -> Left ("Unable to parse AuditLogConfigLogType from: " <> x)
+
+instance ToHttpApiData AuditLogConfigLogType where
+    toQueryParam = \case
+        LogTypeUnspecified -> "LOG_TYPE_UNSPECIFIED"
+        AdminRead -> "ADMIN_READ"
+        DataWrite -> "DATA_WRITE"
+        DataRead -> "DATA_READ"
+
+instance FromJSON AuditLogConfigLogType where
+    parseJSON = parseJSONText "AuditLogConfigLogType"
+
+instance ToJSON AuditLogConfigLogType where
+    toJSON = toJSONText
+
+-- | V1 error format.
+data Xgafv
+    = X1
+      -- ^ @1@
+      -- v1 error format
+    | X2
+      -- ^ @2@
+      -- v2 error format
+      deriving (Eq, Ord, Enum, Read, Show, Data, Typeable, Generic)
+
+instance Hashable Xgafv
+
+instance FromHttpApiData Xgafv where
+    parseQueryParam = \case
+        "1" -> Right X1
+        "2" -> Right X2
+        x -> Left ("Unable to parse Xgafv from: " <> x)
+
+instance ToHttpApiData Xgafv where
+    toQueryParam = \case
+        X1 -> "1"
+        X2 -> "2"
+
+instance FromJSON Xgafv where
+    parseJSON = parseJSONText "Xgafv"
+
+instance ToJSON Xgafv where
+    toJSON = toJSONText
+
+-- | Output only. The ProtectionLevel describing how crypto operations are
+-- performed with this CryptoKeyVersion.
+data CryptoKeyVersionProtectionLevel
+    = CKVPLProtectionLevelUnspecified
+      -- ^ @PROTECTION_LEVEL_UNSPECIFIED@
+      -- Not specified.
+    | CKVPLSoftware
+      -- ^ @SOFTWARE@
+      -- Crypto operations are performed in software.
+    | CKVPLHSM
+      -- ^ @HSM@
+      -- Crypto operations are performed in a Hardware Security Module.
+      deriving (Eq, Ord, Enum, Read, Show, Data, Typeable, Generic)
+
+instance Hashable CryptoKeyVersionProtectionLevel
+
+instance FromHttpApiData CryptoKeyVersionProtectionLevel where
+    parseQueryParam = \case
+        "PROTECTION_LEVEL_UNSPECIFIED" -> Right CKVPLProtectionLevelUnspecified
+        "SOFTWARE" -> Right CKVPLSoftware
+        "HSM" -> Right CKVPLHSM
+        x -> Left ("Unable to parse CryptoKeyVersionProtectionLevel from: " <> x)
+
+instance ToHttpApiData CryptoKeyVersionProtectionLevel where
+    toQueryParam = \case
+        CKVPLProtectionLevelUnspecified -> "PROTECTION_LEVEL_UNSPECIFIED"
+        CKVPLSoftware -> "SOFTWARE"
+        CKVPLHSM -> "HSM"
+
+instance FromJSON CryptoKeyVersionProtectionLevel where
+    parseJSON = parseJSONText "CryptoKeyVersionProtectionLevel"
+
+instance ToJSON CryptoKeyVersionProtectionLevel where
+    toJSON = toJSONText
+
+-- | Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion
+-- supports.
+data CryptoKeyVersionAlgorithm
+    = CKVACryptoKeyVersionAlgorithmUnspecified
+      -- ^ @CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED@
+      -- Not specified.
+    | CKVAGoogleSymmetricEncryption
+      -- ^ @GOOGLE_SYMMETRIC_ENCRYPTION@
+      -- Creates symmetric encryption keys.
+    | CKVARsaSignPss2048SHA256
+      -- ^ @RSA_SIGN_PSS_2048_SHA256@
+      -- RSASSA-PSS 2048 bit key with a SHA256 digest.
+    | CKVARsaSignPss3072SHA256
+      -- ^ @RSA_SIGN_PSS_3072_SHA256@
+      -- RSASSA-PSS 3072 bit key with a SHA256 digest.
+    | CKVARsaSignPss4096SHA256
+      -- ^ @RSA_SIGN_PSS_4096_SHA256@
+      -- RSASSA-PSS 4096 bit key with a SHA256 digest.
+    | CKVARsaSignPss4096SHA512
+      -- ^ @RSA_SIGN_PSS_4096_SHA512@
+      -- RSASSA-PSS 4096 bit key with a SHA512 digest.
+    | CKVARsaSignPKCS12048SHA256
+      -- ^ @RSA_SIGN_PKCS1_2048_SHA256@
+      -- RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
+    | CKVARsaSignPKCS13072SHA256
+      -- ^ @RSA_SIGN_PKCS1_3072_SHA256@
+      -- RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.
+    | CKVARsaSignPKCS14096SHA256
+      -- ^ @RSA_SIGN_PKCS1_4096_SHA256@
+      -- RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
+    | CKVARsaSignPKCS14096SHA512
+      -- ^ @RSA_SIGN_PKCS1_4096_SHA512@
+      -- RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.
+    | CKVARsaDecryptOaep2048SHA256
+      -- ^ @RSA_DECRYPT_OAEP_2048_SHA256@
+      -- RSAES-OAEP 2048 bit key with a SHA256 digest.
+    | CKVARsaDecryptOaep3072SHA256
+      -- ^ @RSA_DECRYPT_OAEP_3072_SHA256@
+      -- RSAES-OAEP 3072 bit key with a SHA256 digest.
+    | CKVARsaDecryptOaep4096SHA256
+      -- ^ @RSA_DECRYPT_OAEP_4096_SHA256@
+      -- RSAES-OAEP 4096 bit key with a SHA256 digest.
+    | CKVARsaDecryptOaep4096SHA512
+      -- ^ @RSA_DECRYPT_OAEP_4096_SHA512@
+      -- RSAES-OAEP 4096 bit key with a SHA512 digest.
+    | CKVAEcSignP256SHA256
+      -- ^ @EC_SIGN_P256_SHA256@
+      -- ECDSA on the NIST P-256 curve with a SHA256 digest.
+    | CKVAEcSignP384SHA384
+      -- ^ @EC_SIGN_P384_SHA384@
+      -- ECDSA on the NIST P-384 curve with a SHA384 digest.
+      deriving (Eq, Ord, Enum, Read, Show, Data, Typeable, Generic)
+
+instance Hashable CryptoKeyVersionAlgorithm
+
+instance FromHttpApiData CryptoKeyVersionAlgorithm where
+    parseQueryParam = \case
+        "CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED" -> Right CKVACryptoKeyVersionAlgorithmUnspecified
+        "GOOGLE_SYMMETRIC_ENCRYPTION" -> Right CKVAGoogleSymmetricEncryption
+        "RSA_SIGN_PSS_2048_SHA256" -> Right CKVARsaSignPss2048SHA256
+        "RSA_SIGN_PSS_3072_SHA256" -> Right CKVARsaSignPss3072SHA256
+        "RSA_SIGN_PSS_4096_SHA256" -> Right CKVARsaSignPss4096SHA256
+        "RSA_SIGN_PSS_4096_SHA512" -> Right CKVARsaSignPss4096SHA512
+        "RSA_SIGN_PKCS1_2048_SHA256" -> Right CKVARsaSignPKCS12048SHA256
+        "RSA_SIGN_PKCS1_3072_SHA256" -> Right CKVARsaSignPKCS13072SHA256
+        "RSA_SIGN_PKCS1_4096_SHA256" -> Right CKVARsaSignPKCS14096SHA256
+        "RSA_SIGN_PKCS1_4096_SHA512" -> Right CKVARsaSignPKCS14096SHA512
+        "RSA_DECRYPT_OAEP_2048_SHA256" -> Right CKVARsaDecryptOaep2048SHA256
+        "RSA_DECRYPT_OAEP_3072_SHA256" -> Right CKVARsaDecryptOaep3072SHA256
+        "RSA_DECRYPT_OAEP_4096_SHA256" -> Right CKVARsaDecryptOaep4096SHA256
+        "RSA_DECRYPT_OAEP_4096_SHA512" -> Right CKVARsaDecryptOaep4096SHA512
+        "EC_SIGN_P256_SHA256" -> Right CKVAEcSignP256SHA256
+        "EC_SIGN_P384_SHA384" -> Right CKVAEcSignP384SHA384
+        x -> Left ("Unable to parse CryptoKeyVersionAlgorithm from: " <> x)
+
+instance ToHttpApiData CryptoKeyVersionAlgorithm where
+    toQueryParam = \case
+        CKVACryptoKeyVersionAlgorithmUnspecified -> "CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED"
+        CKVAGoogleSymmetricEncryption -> "GOOGLE_SYMMETRIC_ENCRYPTION"
+        CKVARsaSignPss2048SHA256 -> "RSA_SIGN_PSS_2048_SHA256"
+        CKVARsaSignPss3072SHA256 -> "RSA_SIGN_PSS_3072_SHA256"
+        CKVARsaSignPss4096SHA256 -> "RSA_SIGN_PSS_4096_SHA256"
+        CKVARsaSignPss4096SHA512 -> "RSA_SIGN_PSS_4096_SHA512"
+        CKVARsaSignPKCS12048SHA256 -> "RSA_SIGN_PKCS1_2048_SHA256"
+        CKVARsaSignPKCS13072SHA256 -> "RSA_SIGN_PKCS1_3072_SHA256"
+        CKVARsaSignPKCS14096SHA256 -> "RSA_SIGN_PKCS1_4096_SHA256"
+        CKVARsaSignPKCS14096SHA512 -> "RSA_SIGN_PKCS1_4096_SHA512"
+        CKVARsaDecryptOaep2048SHA256 -> "RSA_DECRYPT_OAEP_2048_SHA256"
+        CKVARsaDecryptOaep3072SHA256 -> "RSA_DECRYPT_OAEP_3072_SHA256"
+        CKVARsaDecryptOaep4096SHA256 -> "RSA_DECRYPT_OAEP_4096_SHA256"
+        CKVARsaDecryptOaep4096SHA512 -> "RSA_DECRYPT_OAEP_4096_SHA512"
+        CKVAEcSignP256SHA256 -> "EC_SIGN_P256_SHA256"
+        CKVAEcSignP384SHA384 -> "EC_SIGN_P384_SHA384"
+
+instance FromJSON CryptoKeyVersionAlgorithm where
+    parseJSON = parseJSONText "CryptoKeyVersionAlgorithm"
+
+instance ToJSON CryptoKeyVersionAlgorithm where
+    toJSON = toJSONText
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/Get.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/Get.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/Get.hs
@@ -0,0 +1,144 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.Get
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Gets information about a location.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.get@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.Get
+    (
+    -- * REST Resource
+      ProjectsLocationsGetResource
+
+    -- * Creating a Request
+    , projectsLocationsGet
+    , ProjectsLocationsGet
+
+    -- * Request Lenses
+    , plgXgafv
+    , plgUploadProtocol
+    , plgAccessToken
+    , plgUploadType
+    , plgName
+    , plgCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.get@ method which the
+-- 'ProjectsLocationsGet' request conforms to.
+type ProjectsLocationsGetResource =
+     "v1" :>
+       Capture "name" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :> Get '[JSON] Location
+
+-- | Gets information about a location.
+--
+-- /See:/ 'projectsLocationsGet' smart constructor.
+data ProjectsLocationsGet = ProjectsLocationsGet'
+    { _plgXgafv          :: !(Maybe Xgafv)
+    , _plgUploadProtocol :: !(Maybe Text)
+    , _plgAccessToken    :: !(Maybe Text)
+    , _plgUploadType     :: !(Maybe Text)
+    , _plgName           :: !Text
+    , _plgCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsGet' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plgXgafv'
+--
+-- * 'plgUploadProtocol'
+--
+-- * 'plgAccessToken'
+--
+-- * 'plgUploadType'
+--
+-- * 'plgName'
+--
+-- * 'plgCallback'
+projectsLocationsGet
+    :: Text -- ^ 'plgName'
+    -> ProjectsLocationsGet
+projectsLocationsGet pPlgName_ =
+    ProjectsLocationsGet'
+    { _plgXgafv = Nothing
+    , _plgUploadProtocol = Nothing
+    , _plgAccessToken = Nothing
+    , _plgUploadType = Nothing
+    , _plgName = pPlgName_
+    , _plgCallback = Nothing
+    }
+
+-- | V1 error format.
+plgXgafv :: Lens' ProjectsLocationsGet (Maybe Xgafv)
+plgXgafv = lens _plgXgafv (\ s a -> s{_plgXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plgUploadProtocol :: Lens' ProjectsLocationsGet (Maybe Text)
+plgUploadProtocol
+  = lens _plgUploadProtocol
+      (\ s a -> s{_plgUploadProtocol = a})
+
+-- | OAuth access token.
+plgAccessToken :: Lens' ProjectsLocationsGet (Maybe Text)
+plgAccessToken
+  = lens _plgAccessToken
+      (\ s a -> s{_plgAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plgUploadType :: Lens' ProjectsLocationsGet (Maybe Text)
+plgUploadType
+  = lens _plgUploadType
+      (\ s a -> s{_plgUploadType = a})
+
+-- | Resource name for the location.
+plgName :: Lens' ProjectsLocationsGet Text
+plgName = lens _plgName (\ s a -> s{_plgName = a})
+
+-- | JSONP
+plgCallback :: Lens' ProjectsLocationsGet (Maybe Text)
+plgCallback
+  = lens _plgCallback (\ s a -> s{_plgCallback = a})
+
+instance GoogleRequest ProjectsLocationsGet where
+        type Rs ProjectsLocationsGet = Location
+        type Scopes ProjectsLocationsGet =
+             '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient ProjectsLocationsGet'{..}
+          = go _plgName _plgXgafv _plgUploadProtocol
+              _plgAccessToken
+              _plgUploadType
+              _plgCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy :: Proxy ProjectsLocationsGetResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/Create.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/Create.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/Create.hs
@@ -0,0 +1,178 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.Create
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Create a new KeyRing in a given Project and Location.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.create@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.Create
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCreateResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCreate
+    , ProjectsLocationsKeyRingsCreate
+
+    -- * Request Lenses
+    , plkrcParent
+    , plkrcXgafv
+    , plkrcUploadProtocol
+    , plkrcAccessToken
+    , plkrcUploadType
+    , plkrcPayload
+    , plkrcKeyRingId
+    , plkrcCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.create@ method which the
+-- 'ProjectsLocationsKeyRingsCreate' request conforms to.
+type ProjectsLocationsKeyRingsCreateResource =
+     "v1" :>
+       Capture "parent" Text :>
+         "keyRings" :>
+           QueryParam "$.xgafv" Xgafv :>
+             QueryParam "upload_protocol" Text :>
+               QueryParam "access_token" Text :>
+                 QueryParam "uploadType" Text :>
+                   QueryParam "keyRingId" Text :>
+                     QueryParam "callback" Text :>
+                       QueryParam "alt" AltJSON :>
+                         ReqBody '[JSON] KeyRing :> Post '[JSON] KeyRing
+
+-- | Create a new KeyRing in a given Project and Location.
+--
+-- /See:/ 'projectsLocationsKeyRingsCreate' smart constructor.
+data ProjectsLocationsKeyRingsCreate = ProjectsLocationsKeyRingsCreate'
+    { _plkrcParent         :: !Text
+    , _plkrcXgafv          :: !(Maybe Xgafv)
+    , _plkrcUploadProtocol :: !(Maybe Text)
+    , _plkrcAccessToken    :: !(Maybe Text)
+    , _plkrcUploadType     :: !(Maybe Text)
+    , _plkrcPayload        :: !KeyRing
+    , _plkrcKeyRingId      :: !(Maybe Text)
+    , _plkrcCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCreate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrcParent'
+--
+-- * 'plkrcXgafv'
+--
+-- * 'plkrcUploadProtocol'
+--
+-- * 'plkrcAccessToken'
+--
+-- * 'plkrcUploadType'
+--
+-- * 'plkrcPayload'
+--
+-- * 'plkrcKeyRingId'
+--
+-- * 'plkrcCallback'
+projectsLocationsKeyRingsCreate
+    :: Text -- ^ 'plkrcParent'
+    -> KeyRing -- ^ 'plkrcPayload'
+    -> ProjectsLocationsKeyRingsCreate
+projectsLocationsKeyRingsCreate pPlkrcParent_ pPlkrcPayload_ =
+    ProjectsLocationsKeyRingsCreate'
+    { _plkrcParent = pPlkrcParent_
+    , _plkrcXgafv = Nothing
+    , _plkrcUploadProtocol = Nothing
+    , _plkrcAccessToken = Nothing
+    , _plkrcUploadType = Nothing
+    , _plkrcPayload = pPlkrcPayload_
+    , _plkrcKeyRingId = Nothing
+    , _plkrcCallback = Nothing
+    }
+
+-- | Required. The resource name of the location associated with the
+-- KeyRings, in the format \`projects\/*\/locations\/*\`.
+plkrcParent :: Lens' ProjectsLocationsKeyRingsCreate Text
+plkrcParent
+  = lens _plkrcParent (\ s a -> s{_plkrcParent = a})
+
+-- | V1 error format.
+plkrcXgafv :: Lens' ProjectsLocationsKeyRingsCreate (Maybe Xgafv)
+plkrcXgafv
+  = lens _plkrcXgafv (\ s a -> s{_plkrcXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrcUploadProtocol :: Lens' ProjectsLocationsKeyRingsCreate (Maybe Text)
+plkrcUploadProtocol
+  = lens _plkrcUploadProtocol
+      (\ s a -> s{_plkrcUploadProtocol = a})
+
+-- | OAuth access token.
+plkrcAccessToken :: Lens' ProjectsLocationsKeyRingsCreate (Maybe Text)
+plkrcAccessToken
+  = lens _plkrcAccessToken
+      (\ s a -> s{_plkrcAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrcUploadType :: Lens' ProjectsLocationsKeyRingsCreate (Maybe Text)
+plkrcUploadType
+  = lens _plkrcUploadType
+      (\ s a -> s{_plkrcUploadType = a})
+
+-- | Multipart request metadata.
+plkrcPayload :: Lens' ProjectsLocationsKeyRingsCreate KeyRing
+plkrcPayload
+  = lens _plkrcPayload (\ s a -> s{_plkrcPayload = a})
+
+-- | Required. It must be unique within a location and match the regular
+-- expression \`[a-zA-Z0-9_-]{1,63}\`
+plkrcKeyRingId :: Lens' ProjectsLocationsKeyRingsCreate (Maybe Text)
+plkrcKeyRingId
+  = lens _plkrcKeyRingId
+      (\ s a -> s{_plkrcKeyRingId = a})
+
+-- | JSONP
+plkrcCallback :: Lens' ProjectsLocationsKeyRingsCreate (Maybe Text)
+plkrcCallback
+  = lens _plkrcCallback
+      (\ s a -> s{_plkrcCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCreate where
+        type Rs ProjectsLocationsKeyRingsCreate = KeyRing
+        type Scopes ProjectsLocationsKeyRingsCreate =
+             '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient ProjectsLocationsKeyRingsCreate'{..}
+          = go _plkrcParent _plkrcXgafv _plkrcUploadProtocol
+              _plkrcAccessToken
+              _plkrcUploadType
+              _plkrcKeyRingId
+              _plkrcCallback
+              (Just AltJSON)
+              _plkrcPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy ProjectsLocationsKeyRingsCreateResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Create.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Create.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Create.hs
@@ -0,0 +1,186 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Create
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Create a new CryptoKey within a KeyRing. CryptoKey.purpose and
+-- CryptoKey.version_template.algorithm are required.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.create@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Create
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysCreateResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysCreate
+    , ProjectsLocationsKeyRingsCryptoKeysCreate
+
+    -- * Request Lenses
+    , plkrckcParent
+    , plkrckcXgafv
+    , plkrckcUploadProtocol
+    , plkrckcAccessToken
+    , plkrckcUploadType
+    , plkrckcPayload
+    , plkrckcCryptoKeyId
+    , plkrckcCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.create@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysCreate' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysCreateResource
+     =
+     "v1" :>
+       Capture "parent" Text :>
+         "cryptoKeys" :>
+           QueryParam "$.xgafv" Xgafv :>
+             QueryParam "upload_protocol" Text :>
+               QueryParam "access_token" Text :>
+                 QueryParam "uploadType" Text :>
+                   QueryParam "cryptoKeyId" Text :>
+                     QueryParam "callback" Text :>
+                       QueryParam "alt" AltJSON :>
+                         ReqBody '[JSON] CryptoKey :> Post '[JSON] CryptoKey
+
+-- | Create a new CryptoKey within a KeyRing. CryptoKey.purpose and
+-- CryptoKey.version_template.algorithm are required.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysCreate' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysCreate = ProjectsLocationsKeyRingsCryptoKeysCreate'
+    { _plkrckcParent         :: !Text
+    , _plkrckcXgafv          :: !(Maybe Xgafv)
+    , _plkrckcUploadProtocol :: !(Maybe Text)
+    , _plkrckcAccessToken    :: !(Maybe Text)
+    , _plkrckcUploadType     :: !(Maybe Text)
+    , _plkrckcPayload        :: !CryptoKey
+    , _plkrckcCryptoKeyId    :: !(Maybe Text)
+    , _plkrckcCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysCreate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckcParent'
+--
+-- * 'plkrckcXgafv'
+--
+-- * 'plkrckcUploadProtocol'
+--
+-- * 'plkrckcAccessToken'
+--
+-- * 'plkrckcUploadType'
+--
+-- * 'plkrckcPayload'
+--
+-- * 'plkrckcCryptoKeyId'
+--
+-- * 'plkrckcCallback'
+projectsLocationsKeyRingsCryptoKeysCreate
+    :: Text -- ^ 'plkrckcParent'
+    -> CryptoKey -- ^ 'plkrckcPayload'
+    -> ProjectsLocationsKeyRingsCryptoKeysCreate
+projectsLocationsKeyRingsCryptoKeysCreate pPlkrckcParent_ pPlkrckcPayload_ =
+    ProjectsLocationsKeyRingsCryptoKeysCreate'
+    { _plkrckcParent = pPlkrckcParent_
+    , _plkrckcXgafv = Nothing
+    , _plkrckcUploadProtocol = Nothing
+    , _plkrckcAccessToken = Nothing
+    , _plkrckcUploadType = Nothing
+    , _plkrckcPayload = pPlkrckcPayload_
+    , _plkrckcCryptoKeyId = Nothing
+    , _plkrckcCallback = Nothing
+    }
+
+-- | Required. The name of the KeyRing associated with the CryptoKeys.
+plkrckcParent :: Lens' ProjectsLocationsKeyRingsCryptoKeysCreate Text
+plkrckcParent
+  = lens _plkrckcParent
+      (\ s a -> s{_plkrckcParent = a})
+
+-- | V1 error format.
+plkrckcXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysCreate (Maybe Xgafv)
+plkrckcXgafv
+  = lens _plkrckcXgafv (\ s a -> s{_plkrckcXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckcUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysCreate (Maybe Text)
+plkrckcUploadProtocol
+  = lens _plkrckcUploadProtocol
+      (\ s a -> s{_plkrckcUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckcAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCreate (Maybe Text)
+plkrckcAccessToken
+  = lens _plkrckcAccessToken
+      (\ s a -> s{_plkrckcAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckcUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysCreate (Maybe Text)
+plkrckcUploadType
+  = lens _plkrckcUploadType
+      (\ s a -> s{_plkrckcUploadType = a})
+
+-- | Multipart request metadata.
+plkrckcPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysCreate CryptoKey
+plkrckcPayload
+  = lens _plkrckcPayload
+      (\ s a -> s{_plkrckcPayload = a})
+
+-- | Required. It must be unique within a KeyRing and match the regular
+-- expression \`[a-zA-Z0-9_-]{1,63}\`
+plkrckcCryptoKeyId :: Lens' ProjectsLocationsKeyRingsCryptoKeysCreate (Maybe Text)
+plkrckcCryptoKeyId
+  = lens _plkrckcCryptoKeyId
+      (\ s a -> s{_plkrckcCryptoKeyId = a})
+
+-- | JSONP
+plkrckcCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysCreate (Maybe Text)
+plkrckcCallback
+  = lens _plkrckcCallback
+      (\ s a -> s{_plkrckcCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysCreate where
+        type Rs ProjectsLocationsKeyRingsCryptoKeysCreate =
+             CryptoKey
+        type Scopes ProjectsLocationsKeyRingsCryptoKeysCreate
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysCreate'{..}
+          = go _plkrckcParent _plkrckcXgafv
+              _plkrckcUploadProtocol
+              _plkrckcAccessToken
+              _plkrckcUploadType
+              _plkrckcCryptoKeyId
+              _plkrckcCallback
+              (Just AltJSON)
+              _plkrckcPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysCreateResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/AsymmetricDecrypt.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/AsymmetricDecrypt.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/AsymmetricDecrypt.hs
@@ -0,0 +1,179 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.AsymmetricDecrypt
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Decrypts data that was encrypted with a public key retrieved from
+-- GetPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose
+-- ASYMMETRIC_DECRYPT.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.asymmetricDecrypt@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.AsymmetricDecrypt
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecryptResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt
+    , ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt
+
+    -- * Request Lenses
+    , plkrckckvadXgafv
+    , plkrckckvadUploadProtocol
+    , plkrckckvadAccessToken
+    , plkrckckvadUploadType
+    , plkrckckvadPayload
+    , plkrckckvadName
+    , plkrckckvadCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.asymmetricDecrypt@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecryptResource
+     =
+     "v1" :>
+       CaptureMode "name" "asymmetricDecrypt" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] AsymmetricDecryptRequest :>
+                       Post '[JSON] AsymmetricDecryptResponse
+
+-- | Decrypts data that was encrypted with a public key retrieved from
+-- GetPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose
+-- ASYMMETRIC_DECRYPT.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt = ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt'
+    { _plkrckckvadXgafv          :: !(Maybe Xgafv)
+    , _plkrckckvadUploadProtocol :: !(Maybe Text)
+    , _plkrckckvadAccessToken    :: !(Maybe Text)
+    , _plkrckckvadUploadType     :: !(Maybe Text)
+    , _plkrckckvadPayload        :: !AsymmetricDecryptRequest
+    , _plkrckckvadName           :: !Text
+    , _plkrckckvadCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckckvadXgafv'
+--
+-- * 'plkrckckvadUploadProtocol'
+--
+-- * 'plkrckckvadAccessToken'
+--
+-- * 'plkrckckvadUploadType'
+--
+-- * 'plkrckckvadPayload'
+--
+-- * 'plkrckckvadName'
+--
+-- * 'plkrckckvadCallback'
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt
+    :: AsymmetricDecryptRequest -- ^ 'plkrckckvadPayload'
+    -> Text -- ^ 'plkrckckvadName'
+    -> ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt pPlkrckckvadPayload_ pPlkrckckvadName_ =
+    ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt'
+    { _plkrckckvadXgafv = Nothing
+    , _plkrckckvadUploadProtocol = Nothing
+    , _plkrckckvadAccessToken = Nothing
+    , _plkrckckvadUploadType = Nothing
+    , _plkrckckvadPayload = pPlkrckckvadPayload_
+    , _plkrckckvadName = pPlkrckckvadName_
+    , _plkrckckvadCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckckvadXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt (Maybe Xgafv)
+plkrckckvadXgafv
+  = lens _plkrckckvadXgafv
+      (\ s a -> s{_plkrckckvadXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckckvadUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt (Maybe Text)
+plkrckckvadUploadProtocol
+  = lens _plkrckckvadUploadProtocol
+      (\ s a -> s{_plkrckckvadUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckckvadAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt (Maybe Text)
+plkrckckvadAccessToken
+  = lens _plkrckckvadAccessToken
+      (\ s a -> s{_plkrckckvadAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckckvadUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt (Maybe Text)
+plkrckckvadUploadType
+  = lens _plkrckckvadUploadType
+      (\ s a -> s{_plkrckckvadUploadType = a})
+
+-- | Multipart request metadata.
+plkrckckvadPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt AsymmetricDecryptRequest
+plkrckckvadPayload
+  = lens _plkrckckvadPayload
+      (\ s a -> s{_plkrckckvadPayload = a})
+
+-- | Required. The resource name of the CryptoKeyVersion to use for
+-- decryption.
+plkrckckvadName :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt Text
+plkrckckvadName
+  = lens _plkrckckvadName
+      (\ s a -> s{_plkrckckvadName = a})
+
+-- | JSONP
+plkrckckvadCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt (Maybe Text)
+plkrckckvadCallback
+  = lens _plkrckckvadCallback
+      (\ s a -> s{_plkrckckvadCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt
+             = AsymmetricDecryptResponse
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecrypt'{..}
+          = go _plkrckckvadName _plkrckckvadXgafv
+              _plkrckckvadUploadProtocol
+              _plkrckckvadAccessToken
+              _plkrckckvadUploadType
+              _plkrckckvadCallback
+              (Just AltJSON)
+              _plkrckckvadPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricDecryptResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/AsymmetricSign.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/AsymmetricSign.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/AsymmetricSign.hs
@@ -0,0 +1,178 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.AsymmetricSign
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Signs data using a CryptoKeyVersion with CryptoKey.purpose
+-- ASYMMETRIC_SIGN, producing a signature that can be verified with the
+-- public key retrieved from GetPublicKey.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.asymmetricSign@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.AsymmetricSign
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSignResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign
+    , ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign
+
+    -- * Request Lenses
+    , plkrckckvasXgafv
+    , plkrckckvasUploadProtocol
+    , plkrckckvasAccessToken
+    , plkrckckvasUploadType
+    , plkrckckvasPayload
+    , plkrckckvasName
+    , plkrckckvasCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.asymmetricSign@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSignResource
+     =
+     "v1" :>
+       CaptureMode "name" "asymmetricSign" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] AsymmetricSignRequest :>
+                       Post '[JSON] AsymmetricSignResponse
+
+-- | Signs data using a CryptoKeyVersion with CryptoKey.purpose
+-- ASYMMETRIC_SIGN, producing a signature that can be verified with the
+-- public key retrieved from GetPublicKey.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign = ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign'
+    { _plkrckckvasXgafv          :: !(Maybe Xgafv)
+    , _plkrckckvasUploadProtocol :: !(Maybe Text)
+    , _plkrckckvasAccessToken    :: !(Maybe Text)
+    , _plkrckckvasUploadType     :: !(Maybe Text)
+    , _plkrckckvasPayload        :: !AsymmetricSignRequest
+    , _plkrckckvasName           :: !Text
+    , _plkrckckvasCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckckvasXgafv'
+--
+-- * 'plkrckckvasUploadProtocol'
+--
+-- * 'plkrckckvasAccessToken'
+--
+-- * 'plkrckckvasUploadType'
+--
+-- * 'plkrckckvasPayload'
+--
+-- * 'plkrckckvasName'
+--
+-- * 'plkrckckvasCallback'
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign
+    :: AsymmetricSignRequest -- ^ 'plkrckckvasPayload'
+    -> Text -- ^ 'plkrckckvasName'
+    -> ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign pPlkrckckvasPayload_ pPlkrckckvasName_ =
+    ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign'
+    { _plkrckckvasXgafv = Nothing
+    , _plkrckckvasUploadProtocol = Nothing
+    , _plkrckckvasAccessToken = Nothing
+    , _plkrckckvasUploadType = Nothing
+    , _plkrckckvasPayload = pPlkrckckvasPayload_
+    , _plkrckckvasName = pPlkrckckvasName_
+    , _plkrckckvasCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckckvasXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign (Maybe Xgafv)
+plkrckckvasXgafv
+  = lens _plkrckckvasXgafv
+      (\ s a -> s{_plkrckckvasXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckckvasUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign (Maybe Text)
+plkrckckvasUploadProtocol
+  = lens _plkrckckvasUploadProtocol
+      (\ s a -> s{_plkrckckvasUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckckvasAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign (Maybe Text)
+plkrckckvasAccessToken
+  = lens _plkrckckvasAccessToken
+      (\ s a -> s{_plkrckckvasAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckckvasUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign (Maybe Text)
+plkrckckvasUploadType
+  = lens _plkrckckvasUploadType
+      (\ s a -> s{_plkrckckvasUploadType = a})
+
+-- | Multipart request metadata.
+plkrckckvasPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign AsymmetricSignRequest
+plkrckckvasPayload
+  = lens _plkrckckvasPayload
+      (\ s a -> s{_plkrckckvasPayload = a})
+
+-- | Required. The resource name of the CryptoKeyVersion to use for signing.
+plkrckckvasName :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign Text
+plkrckckvasName
+  = lens _plkrckckvasName
+      (\ s a -> s{_plkrckckvasName = a})
+
+-- | JSONP
+plkrckckvasCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign (Maybe Text)
+plkrckckvasCallback
+  = lens _plkrckckvasCallback
+      (\ s a -> s{_plkrckckvasCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign
+             = AsymmetricSignResponse
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSign'{..}
+          = go _plkrckckvasName _plkrckckvasXgafv
+              _plkrckckvasUploadProtocol
+              _plkrckckvasAccessToken
+              _plkrckckvasUploadType
+              _plkrckckvasCallback
+              (Just AltJSON)
+              _plkrckckvasPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsAsymmetricSignResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Create.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Create.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Create.hs
@@ -0,0 +1,178 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Create
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Create a new CryptoKeyVersion in a CryptoKey. The server will assign the
+-- next sequential id. If unset, state will be set to ENABLED.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.create@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Create
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreateResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate
+    , ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate
+
+    -- * Request Lenses
+    , plkrckckvcParent
+    , plkrckckvcXgafv
+    , plkrckckvcUploadProtocol
+    , plkrckckvcAccessToken
+    , plkrckckvcUploadType
+    , plkrckckvcPayload
+    , plkrckckvcCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.create@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreateResource
+     =
+     "v1" :>
+       Capture "parent" Text :>
+         "cryptoKeyVersions" :>
+           QueryParam "$.xgafv" Xgafv :>
+             QueryParam "upload_protocol" Text :>
+               QueryParam "access_token" Text :>
+                 QueryParam "uploadType" Text :>
+                   QueryParam "callback" Text :>
+                     QueryParam "alt" AltJSON :>
+                       ReqBody '[JSON] CryptoKeyVersion :>
+                         Post '[JSON] CryptoKeyVersion
+
+-- | Create a new CryptoKeyVersion in a CryptoKey. The server will assign the
+-- next sequential id. If unset, state will be set to ENABLED.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate = ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate'
+    { _plkrckckvcParent         :: !Text
+    , _plkrckckvcXgafv          :: !(Maybe Xgafv)
+    , _plkrckckvcUploadProtocol :: !(Maybe Text)
+    , _plkrckckvcAccessToken    :: !(Maybe Text)
+    , _plkrckckvcUploadType     :: !(Maybe Text)
+    , _plkrckckvcPayload        :: !CryptoKeyVersion
+    , _plkrckckvcCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckckvcParent'
+--
+-- * 'plkrckckvcXgafv'
+--
+-- * 'plkrckckvcUploadProtocol'
+--
+-- * 'plkrckckvcAccessToken'
+--
+-- * 'plkrckckvcUploadType'
+--
+-- * 'plkrckckvcPayload'
+--
+-- * 'plkrckckvcCallback'
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate
+    :: Text -- ^ 'plkrckckvcParent'
+    -> CryptoKeyVersion -- ^ 'plkrckckvcPayload'
+    -> ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate pPlkrckckvcParent_ pPlkrckckvcPayload_ =
+    ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate'
+    { _plkrckckvcParent = pPlkrckckvcParent_
+    , _plkrckckvcXgafv = Nothing
+    , _plkrckckvcUploadProtocol = Nothing
+    , _plkrckckvcAccessToken = Nothing
+    , _plkrckckvcUploadType = Nothing
+    , _plkrckckvcPayload = pPlkrckckvcPayload_
+    , _plkrckckvcCallback = Nothing
+    }
+
+-- | Required. The name of the CryptoKey associated with the
+-- CryptoKeyVersions.
+plkrckckvcParent :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate Text
+plkrckckvcParent
+  = lens _plkrckckvcParent
+      (\ s a -> s{_plkrckckvcParent = a})
+
+-- | V1 error format.
+plkrckckvcXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate (Maybe Xgafv)
+plkrckckvcXgafv
+  = lens _plkrckckvcXgafv
+      (\ s a -> s{_plkrckckvcXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckckvcUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate (Maybe Text)
+plkrckckvcUploadProtocol
+  = lens _plkrckckvcUploadProtocol
+      (\ s a -> s{_plkrckckvcUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckckvcAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate (Maybe Text)
+plkrckckvcAccessToken
+  = lens _plkrckckvcAccessToken
+      (\ s a -> s{_plkrckckvcAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckckvcUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate (Maybe Text)
+plkrckckvcUploadType
+  = lens _plkrckckvcUploadType
+      (\ s a -> s{_plkrckckvcUploadType = a})
+
+-- | Multipart request metadata.
+plkrckckvcPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate CryptoKeyVersion
+plkrckckvcPayload
+  = lens _plkrckckvcPayload
+      (\ s a -> s{_plkrckckvcPayload = a})
+
+-- | JSONP
+plkrckckvcCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate (Maybe Text)
+plkrckckvcCallback
+  = lens _plkrckckvcCallback
+      (\ s a -> s{_plkrckckvcCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate
+             = CryptoKeyVersion
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreate'{..}
+          = go _plkrckckvcParent _plkrckckvcXgafv
+              _plkrckckvcUploadProtocol
+              _plkrckckvcAccessToken
+              _plkrckckvcUploadType
+              _plkrckckvcCallback
+              (Just AltJSON)
+              _plkrckckvcPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsCreateResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Destroy.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Destroy.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Destroy.hs
@@ -0,0 +1,184 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Destroy
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Schedule a CryptoKeyVersion for destruction. Upon calling this method,
+-- CryptoKeyVersion.state will be set to DESTROY_SCHEDULED and destroy_time
+-- will be set to a time 24 hours in the future, at which point the state
+-- will be changed to DESTROYED, and the key material will be irrevocably
+-- destroyed. Before the destroy_time is reached, RestoreCryptoKeyVersion
+-- may be called to reverse the process.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.destroy@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Destroy
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroyResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy
+    , ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy
+
+    -- * Request Lenses
+    , plkrckckvdXgafv
+    , plkrckckvdUploadProtocol
+    , plkrckckvdAccessToken
+    , plkrckckvdUploadType
+    , plkrckckvdPayload
+    , plkrckckvdName
+    , plkrckckvdCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.destroy@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroyResource
+     =
+     "v1" :>
+       CaptureMode "name" "destroy" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] DestroyCryptoKeyVersionRequest :>
+                       Post '[JSON] CryptoKeyVersion
+
+-- | Schedule a CryptoKeyVersion for destruction. Upon calling this method,
+-- CryptoKeyVersion.state will be set to DESTROY_SCHEDULED and destroy_time
+-- will be set to a time 24 hours in the future, at which point the state
+-- will be changed to DESTROYED, and the key material will be irrevocably
+-- destroyed. Before the destroy_time is reached, RestoreCryptoKeyVersion
+-- may be called to reverse the process.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy = ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy'
+    { _plkrckckvdXgafv          :: !(Maybe Xgafv)
+    , _plkrckckvdUploadProtocol :: !(Maybe Text)
+    , _plkrckckvdAccessToken    :: !(Maybe Text)
+    , _plkrckckvdUploadType     :: !(Maybe Text)
+    , _plkrckckvdPayload        :: !DestroyCryptoKeyVersionRequest
+    , _plkrckckvdName           :: !Text
+    , _plkrckckvdCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckckvdXgafv'
+--
+-- * 'plkrckckvdUploadProtocol'
+--
+-- * 'plkrckckvdAccessToken'
+--
+-- * 'plkrckckvdUploadType'
+--
+-- * 'plkrckckvdPayload'
+--
+-- * 'plkrckckvdName'
+--
+-- * 'plkrckckvdCallback'
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy
+    :: DestroyCryptoKeyVersionRequest -- ^ 'plkrckckvdPayload'
+    -> Text -- ^ 'plkrckckvdName'
+    -> ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy pPlkrckckvdPayload_ pPlkrckckvdName_ =
+    ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy'
+    { _plkrckckvdXgafv = Nothing
+    , _plkrckckvdUploadProtocol = Nothing
+    , _plkrckckvdAccessToken = Nothing
+    , _plkrckckvdUploadType = Nothing
+    , _plkrckckvdPayload = pPlkrckckvdPayload_
+    , _plkrckckvdName = pPlkrckckvdName_
+    , _plkrckckvdCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckckvdXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy (Maybe Xgafv)
+plkrckckvdXgafv
+  = lens _plkrckckvdXgafv
+      (\ s a -> s{_plkrckckvdXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckckvdUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy (Maybe Text)
+plkrckckvdUploadProtocol
+  = lens _plkrckckvdUploadProtocol
+      (\ s a -> s{_plkrckckvdUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckckvdAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy (Maybe Text)
+plkrckckvdAccessToken
+  = lens _plkrckckvdAccessToken
+      (\ s a -> s{_plkrckckvdAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckckvdUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy (Maybe Text)
+plkrckckvdUploadType
+  = lens _plkrckckvdUploadType
+      (\ s a -> s{_plkrckckvdUploadType = a})
+
+-- | Multipart request metadata.
+plkrckckvdPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy DestroyCryptoKeyVersionRequest
+plkrckckvdPayload
+  = lens _plkrckckvdPayload
+      (\ s a -> s{_plkrckckvdPayload = a})
+
+-- | The resource name of the CryptoKeyVersion to destroy.
+plkrckckvdName :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy Text
+plkrckckvdName
+  = lens _plkrckckvdName
+      (\ s a -> s{_plkrckckvdName = a})
+
+-- | JSONP
+plkrckckvdCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy (Maybe Text)
+plkrckckvdCallback
+  = lens _plkrckckvdCallback
+      (\ s a -> s{_plkrckckvdCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy
+             = CryptoKeyVersion
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroy'{..}
+          = go _plkrckckvdName _plkrckckvdXgafv
+              _plkrckckvdUploadProtocol
+              _plkrckckvdAccessToken
+              _plkrckckvdUploadType
+              _plkrckckvdCallback
+              (Just AltJSON)
+              _plkrckckvdPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsDestroyResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Get.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Get.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Get.hs
@@ -0,0 +1,160 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Get
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Returns metadata for a given CryptoKeyVersion.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.get@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Get
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet
+    , ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet
+
+    -- * Request Lenses
+    , plkrckckvgXgafv
+    , plkrckckvgUploadProtocol
+    , plkrckckvgAccessToken
+    , plkrckckvgUploadType
+    , plkrckckvgName
+    , plkrckckvgCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.get@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetResource
+     =
+     "v1" :>
+       Capture "name" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     Get '[JSON] CryptoKeyVersion
+
+-- | Returns metadata for a given CryptoKeyVersion.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet = ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet'
+    { _plkrckckvgXgafv          :: !(Maybe Xgafv)
+    , _plkrckckvgUploadProtocol :: !(Maybe Text)
+    , _plkrckckvgAccessToken    :: !(Maybe Text)
+    , _plkrckckvgUploadType     :: !(Maybe Text)
+    , _plkrckckvgName           :: !Text
+    , _plkrckckvgCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckckvgXgafv'
+--
+-- * 'plkrckckvgUploadProtocol'
+--
+-- * 'plkrckckvgAccessToken'
+--
+-- * 'plkrckckvgUploadType'
+--
+-- * 'plkrckckvgName'
+--
+-- * 'plkrckckvgCallback'
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet
+    :: Text -- ^ 'plkrckckvgName'
+    -> ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet pPlkrckckvgName_ =
+    ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet'
+    { _plkrckckvgXgafv = Nothing
+    , _plkrckckvgUploadProtocol = Nothing
+    , _plkrckckvgAccessToken = Nothing
+    , _plkrckckvgUploadType = Nothing
+    , _plkrckckvgName = pPlkrckckvgName_
+    , _plkrckckvgCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckckvgXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet (Maybe Xgafv)
+plkrckckvgXgafv
+  = lens _plkrckckvgXgafv
+      (\ s a -> s{_plkrckckvgXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckckvgUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet (Maybe Text)
+plkrckckvgUploadProtocol
+  = lens _plkrckckvgUploadProtocol
+      (\ s a -> s{_plkrckckvgUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckckvgAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet (Maybe Text)
+plkrckckvgAccessToken
+  = lens _plkrckckvgAccessToken
+      (\ s a -> s{_plkrckckvgAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckckvgUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet (Maybe Text)
+plkrckckvgUploadType
+  = lens _plkrckckvgUploadType
+      (\ s a -> s{_plkrckckvgUploadType = a})
+
+-- | The name of the CryptoKeyVersion to get.
+plkrckckvgName :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet Text
+plkrckckvgName
+  = lens _plkrckckvgName
+      (\ s a -> s{_plkrckckvgName = a})
+
+-- | JSONP
+plkrckckvgCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet (Maybe Text)
+plkrckckvgCallback
+  = lens _plkrckckvgCallback
+      (\ s a -> s{_plkrckckvgCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet
+             = CryptoKeyVersion
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGet'{..}
+          = go _plkrckckvgName _plkrckckvgXgafv
+              _plkrckckvgUploadProtocol
+              _plkrckckvgAccessToken
+              _plkrckckvgUploadType
+              _plkrckckvgCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/GetPublicKey.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/GetPublicKey.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/GetPublicKey.hs
@@ -0,0 +1,162 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.GetPublicKey
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Returns the public key for the given CryptoKeyVersion. The
+-- CryptoKey.purpose must be ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.getPublicKey@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.GetPublicKey
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKeyResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey
+    , ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey
+
+    -- * Request Lenses
+    , plkrckckvgpkXgafv
+    , plkrckckvgpkUploadProtocol
+    , plkrckckvgpkAccessToken
+    , plkrckckvgpkUploadType
+    , plkrckckvgpkName
+    , plkrckckvgpkCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.getPublicKey@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKeyResource
+     =
+     "v1" :>
+       Capture "name" Text :>
+         "publicKey" :>
+           QueryParam "$.xgafv" Xgafv :>
+             QueryParam "upload_protocol" Text :>
+               QueryParam "access_token" Text :>
+                 QueryParam "uploadType" Text :>
+                   QueryParam "callback" Text :>
+                     QueryParam "alt" AltJSON :> Get '[JSON] PublicKey
+
+-- | Returns the public key for the given CryptoKeyVersion. The
+-- CryptoKey.purpose must be ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey = ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey'
+    { _plkrckckvgpkXgafv          :: !(Maybe Xgafv)
+    , _plkrckckvgpkUploadProtocol :: !(Maybe Text)
+    , _plkrckckvgpkAccessToken    :: !(Maybe Text)
+    , _plkrckckvgpkUploadType     :: !(Maybe Text)
+    , _plkrckckvgpkName           :: !Text
+    , _plkrckckvgpkCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckckvgpkXgafv'
+--
+-- * 'plkrckckvgpkUploadProtocol'
+--
+-- * 'plkrckckvgpkAccessToken'
+--
+-- * 'plkrckckvgpkUploadType'
+--
+-- * 'plkrckckvgpkName'
+--
+-- * 'plkrckckvgpkCallback'
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey
+    :: Text -- ^ 'plkrckckvgpkName'
+    -> ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey pPlkrckckvgpkName_ =
+    ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey'
+    { _plkrckckvgpkXgafv = Nothing
+    , _plkrckckvgpkUploadProtocol = Nothing
+    , _plkrckckvgpkAccessToken = Nothing
+    , _plkrckckvgpkUploadType = Nothing
+    , _plkrckckvgpkName = pPlkrckckvgpkName_
+    , _plkrckckvgpkCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckckvgpkXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey (Maybe Xgafv)
+plkrckckvgpkXgafv
+  = lens _plkrckckvgpkXgafv
+      (\ s a -> s{_plkrckckvgpkXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckckvgpkUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey (Maybe Text)
+plkrckckvgpkUploadProtocol
+  = lens _plkrckckvgpkUploadProtocol
+      (\ s a -> s{_plkrckckvgpkUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckckvgpkAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey (Maybe Text)
+plkrckckvgpkAccessToken
+  = lens _plkrckckvgpkAccessToken
+      (\ s a -> s{_plkrckckvgpkAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckckvgpkUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey (Maybe Text)
+plkrckckvgpkUploadType
+  = lens _plkrckckvgpkUploadType
+      (\ s a -> s{_plkrckckvgpkUploadType = a})
+
+-- | The name of the CryptoKeyVersion public key to get.
+plkrckckvgpkName :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey Text
+plkrckckvgpkName
+  = lens _plkrckckvgpkName
+      (\ s a -> s{_plkrckckvgpkName = a})
+
+-- | JSONP
+plkrckckvgpkCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey (Maybe Text)
+plkrckckvgpkCallback
+  = lens _plkrckckvgpkCallback
+      (\ s a -> s{_plkrckckvgpkCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey
+             = PublicKey
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKey'{..}
+          = go _plkrckckvgpkName _plkrckckvgpkXgafv
+              _plkrckckvgpkUploadProtocol
+              _plkrckckvgpkAccessToken
+              _plkrckckvgpkUploadType
+              _plkrckckvgpkCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsGetPublicKeyResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/List.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/List.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/List.hs
@@ -0,0 +1,207 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.List
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Lists CryptoKeyVersions.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.list@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.List
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsListResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList
+    , ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList
+
+    -- * Request Lenses
+    , plkrckckvlParent
+    , plkrckckvlXgafv
+    , plkrckckvlUploadProtocol
+    , plkrckckvlAccessToken
+    , plkrckckvlUploadType
+    , plkrckckvlView
+    , plkrckckvlPageToken
+    , plkrckckvlPageSize
+    , plkrckckvlCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.list@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsListResource
+     =
+     "v1" :>
+       Capture "parent" Text :>
+         "cryptoKeyVersions" :>
+           QueryParam "$.xgafv" Xgafv :>
+             QueryParam "upload_protocol" Text :>
+               QueryParam "access_token" Text :>
+                 QueryParam "uploadType" Text :>
+                   QueryParam "view" Text :>
+                     QueryParam "pageToken" Text :>
+                       QueryParam "pageSize" (Textual Int32) :>
+                         QueryParam "callback" Text :>
+                           QueryParam "alt" AltJSON :>
+                             Get '[JSON] ListCryptoKeyVersionsResponse
+
+-- | Lists CryptoKeyVersions.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList = ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList'
+    { _plkrckckvlParent         :: !Text
+    , _plkrckckvlXgafv          :: !(Maybe Xgafv)
+    , _plkrckckvlUploadProtocol :: !(Maybe Text)
+    , _plkrckckvlAccessToken    :: !(Maybe Text)
+    , _plkrckckvlUploadType     :: !(Maybe Text)
+    , _plkrckckvlView           :: !(Maybe Text)
+    , _plkrckckvlPageToken      :: !(Maybe Text)
+    , _plkrckckvlPageSize       :: !(Maybe (Textual Int32))
+    , _plkrckckvlCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckckvlParent'
+--
+-- * 'plkrckckvlXgafv'
+--
+-- * 'plkrckckvlUploadProtocol'
+--
+-- * 'plkrckckvlAccessToken'
+--
+-- * 'plkrckckvlUploadType'
+--
+-- * 'plkrckckvlView'
+--
+-- * 'plkrckckvlPageToken'
+--
+-- * 'plkrckckvlPageSize'
+--
+-- * 'plkrckckvlCallback'
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList
+    :: Text -- ^ 'plkrckckvlParent'
+    -> ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList pPlkrckckvlParent_ =
+    ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList'
+    { _plkrckckvlParent = pPlkrckckvlParent_
+    , _plkrckckvlXgafv = Nothing
+    , _plkrckckvlUploadProtocol = Nothing
+    , _plkrckckvlAccessToken = Nothing
+    , _plkrckckvlUploadType = Nothing
+    , _plkrckckvlView = Nothing
+    , _plkrckckvlPageToken = Nothing
+    , _plkrckckvlPageSize = Nothing
+    , _plkrckckvlCallback = Nothing
+    }
+
+-- | Required. The resource name of the CryptoKey to list, in the format
+-- \`projects\/*\/locations\/*\/keyRings\/*\/cryptoKeys\/*\`.
+plkrckckvlParent :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList Text
+plkrckckvlParent
+  = lens _plkrckckvlParent
+      (\ s a -> s{_plkrckckvlParent = a})
+
+-- | V1 error format.
+plkrckckvlXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList (Maybe Xgafv)
+plkrckckvlXgafv
+  = lens _plkrckckvlXgafv
+      (\ s a -> s{_plkrckckvlXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckckvlUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList (Maybe Text)
+plkrckckvlUploadProtocol
+  = lens _plkrckckvlUploadProtocol
+      (\ s a -> s{_plkrckckvlUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckckvlAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList (Maybe Text)
+plkrckckvlAccessToken
+  = lens _plkrckckvlAccessToken
+      (\ s a -> s{_plkrckckvlAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckckvlUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList (Maybe Text)
+plkrckckvlUploadType
+  = lens _plkrckckvlUploadType
+      (\ s a -> s{_plkrckckvlUploadType = a})
+
+-- | The fields to include in the response.
+plkrckckvlView :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList (Maybe Text)
+plkrckckvlView
+  = lens _plkrckckvlView
+      (\ s a -> s{_plkrckckvlView = a})
+
+-- | Optional pagination token, returned earlier via
+-- ListCryptoKeyVersionsResponse.next_page_token.
+plkrckckvlPageToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList (Maybe Text)
+plkrckckvlPageToken
+  = lens _plkrckckvlPageToken
+      (\ s a -> s{_plkrckckvlPageToken = a})
+
+-- | Optional limit on the number of CryptoKeyVersions to include in the
+-- response. Further CryptoKeyVersions can subsequently be obtained by
+-- including the ListCryptoKeyVersionsResponse.next_page_token in a
+-- subsequent request. If unspecified, the server will pick an appropriate
+-- default.
+plkrckckvlPageSize :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList (Maybe Int32)
+plkrckckvlPageSize
+  = lens _plkrckckvlPageSize
+      (\ s a -> s{_plkrckckvlPageSize = a})
+      . mapping _Coerce
+
+-- | JSONP
+plkrckckvlCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList (Maybe Text)
+plkrckckvlCallback
+  = lens _plkrckckvlCallback
+      (\ s a -> s{_plkrckckvlCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList
+             = ListCryptoKeyVersionsResponse
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsList'{..}
+          = go _plkrckckvlParent _plkrckckvlXgafv
+              _plkrckckvlUploadProtocol
+              _plkrckckvlAccessToken
+              _plkrckckvlUploadType
+              _plkrckckvlView
+              _plkrckckvlPageToken
+              _plkrckckvlPageSize
+              _plkrckckvlCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsListResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Patch.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Patch.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Patch.hs
@@ -0,0 +1,192 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Patch
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Update a CryptoKeyVersion\'s metadata. state may be changed between
+-- ENABLED and DISABLED using this method. See DestroyCryptoKeyVersion and
+-- RestoreCryptoKeyVersion to move between other states.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.patch@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Patch
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatchResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch
+    , ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch
+
+    -- * Request Lenses
+    , plkrckckvpXgafv
+    , plkrckckvpUploadProtocol
+    , plkrckckvpUpdateMask
+    , plkrckckvpAccessToken
+    , plkrckckvpUploadType
+    , plkrckckvpPayload
+    , plkrckckvpName
+    , plkrckckvpCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.patch@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatchResource
+     =
+     "v1" :>
+       Capture "name" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "updateMask" GFieldMask :>
+               QueryParam "access_token" Text :>
+                 QueryParam "uploadType" Text :>
+                   QueryParam "callback" Text :>
+                     QueryParam "alt" AltJSON :>
+                       ReqBody '[JSON] CryptoKeyVersion :>
+                         Patch '[JSON] CryptoKeyVersion
+
+-- | Update a CryptoKeyVersion\'s metadata. state may be changed between
+-- ENABLED and DISABLED using this method. See DestroyCryptoKeyVersion and
+-- RestoreCryptoKeyVersion to move between other states.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch = ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch'
+    { _plkrckckvpXgafv          :: !(Maybe Xgafv)
+    , _plkrckckvpUploadProtocol :: !(Maybe Text)
+    , _plkrckckvpUpdateMask     :: !(Maybe GFieldMask)
+    , _plkrckckvpAccessToken    :: !(Maybe Text)
+    , _plkrckckvpUploadType     :: !(Maybe Text)
+    , _plkrckckvpPayload        :: !CryptoKeyVersion
+    , _plkrckckvpName           :: !Text
+    , _plkrckckvpCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckckvpXgafv'
+--
+-- * 'plkrckckvpUploadProtocol'
+--
+-- * 'plkrckckvpUpdateMask'
+--
+-- * 'plkrckckvpAccessToken'
+--
+-- * 'plkrckckvpUploadType'
+--
+-- * 'plkrckckvpPayload'
+--
+-- * 'plkrckckvpName'
+--
+-- * 'plkrckckvpCallback'
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch
+    :: CryptoKeyVersion -- ^ 'plkrckckvpPayload'
+    -> Text -- ^ 'plkrckckvpName'
+    -> ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch pPlkrckckvpPayload_ pPlkrckckvpName_ =
+    ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch'
+    { _plkrckckvpXgafv = Nothing
+    , _plkrckckvpUploadProtocol = Nothing
+    , _plkrckckvpUpdateMask = Nothing
+    , _plkrckckvpAccessToken = Nothing
+    , _plkrckckvpUploadType = Nothing
+    , _plkrckckvpPayload = pPlkrckckvpPayload_
+    , _plkrckckvpName = pPlkrckckvpName_
+    , _plkrckckvpCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckckvpXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch (Maybe Xgafv)
+plkrckckvpXgafv
+  = lens _plkrckckvpXgafv
+      (\ s a -> s{_plkrckckvpXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckckvpUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch (Maybe Text)
+plkrckckvpUploadProtocol
+  = lens _plkrckckvpUploadProtocol
+      (\ s a -> s{_plkrckckvpUploadProtocol = a})
+
+-- | Required list of fields to be updated in this request.
+plkrckckvpUpdateMask :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch (Maybe GFieldMask)
+plkrckckvpUpdateMask
+  = lens _plkrckckvpUpdateMask
+      (\ s a -> s{_plkrckckvpUpdateMask = a})
+
+-- | OAuth access token.
+plkrckckvpAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch (Maybe Text)
+plkrckckvpAccessToken
+  = lens _plkrckckvpAccessToken
+      (\ s a -> s{_plkrckckvpAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckckvpUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch (Maybe Text)
+plkrckckvpUploadType
+  = lens _plkrckckvpUploadType
+      (\ s a -> s{_plkrckckvpUploadType = a})
+
+-- | Multipart request metadata.
+plkrckckvpPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch CryptoKeyVersion
+plkrckckvpPayload
+  = lens _plkrckckvpPayload
+      (\ s a -> s{_plkrckckvpPayload = a})
+
+-- | Output only. The resource name for this CryptoKeyVersion in the format
+-- \`projects\/*\/locations\/*\/keyRings\/*\/cryptoKeys\/*\/cryptoKeyVersions\/*\`.
+plkrckckvpName :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch Text
+plkrckckvpName
+  = lens _plkrckckvpName
+      (\ s a -> s{_plkrckckvpName = a})
+
+-- | JSONP
+plkrckckvpCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch (Maybe Text)
+plkrckckvpCallback
+  = lens _plkrckckvpCallback
+      (\ s a -> s{_plkrckckvpCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch
+             = CryptoKeyVersion
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatch'{..}
+          = go _plkrckckvpName _plkrckckvpXgafv
+              _plkrckckvpUploadProtocol
+              _plkrckckvpUpdateMask
+              _plkrckckvpAccessToken
+              _plkrckckvpUploadType
+              _plkrckckvpCallback
+              (Just AltJSON)
+              _plkrckckvpPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsPatchResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Restore.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Restore.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/CryptoKeyVersions/Restore.hs
@@ -0,0 +1,178 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Restore
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Restore a CryptoKeyVersion in the DESTROY_SCHEDULED state. Upon
+-- restoration of the CryptoKeyVersion, state will be set to DISABLED, and
+-- destroy_time will be cleared.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.restore@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Restore
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestoreResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore
+    , ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore
+
+    -- * Request Lenses
+    , plkrckckvrXgafv
+    , plkrckckvrUploadProtocol
+    , plkrckckvrAccessToken
+    , plkrckckvrUploadType
+    , plkrckckvrPayload
+    , plkrckckvrName
+    , plkrckckvrCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.restore@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestoreResource
+     =
+     "v1" :>
+       CaptureMode "name" "restore" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] RestoreCryptoKeyVersionRequest :>
+                       Post '[JSON] CryptoKeyVersion
+
+-- | Restore a CryptoKeyVersion in the DESTROY_SCHEDULED state. Upon
+-- restoration of the CryptoKeyVersion, state will be set to DISABLED, and
+-- destroy_time will be cleared.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore = ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore'
+    { _plkrckckvrXgafv          :: !(Maybe Xgafv)
+    , _plkrckckvrUploadProtocol :: !(Maybe Text)
+    , _plkrckckvrAccessToken    :: !(Maybe Text)
+    , _plkrckckvrUploadType     :: !(Maybe Text)
+    , _plkrckckvrPayload        :: !RestoreCryptoKeyVersionRequest
+    , _plkrckckvrName           :: !Text
+    , _plkrckckvrCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckckvrXgafv'
+--
+-- * 'plkrckckvrUploadProtocol'
+--
+-- * 'plkrckckvrAccessToken'
+--
+-- * 'plkrckckvrUploadType'
+--
+-- * 'plkrckckvrPayload'
+--
+-- * 'plkrckckvrName'
+--
+-- * 'plkrckckvrCallback'
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore
+    :: RestoreCryptoKeyVersionRequest -- ^ 'plkrckckvrPayload'
+    -> Text -- ^ 'plkrckckvrName'
+    -> ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore
+projectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore pPlkrckckvrPayload_ pPlkrckckvrName_ =
+    ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore'
+    { _plkrckckvrXgafv = Nothing
+    , _plkrckckvrUploadProtocol = Nothing
+    , _plkrckckvrAccessToken = Nothing
+    , _plkrckckvrUploadType = Nothing
+    , _plkrckckvrPayload = pPlkrckckvrPayload_
+    , _plkrckckvrName = pPlkrckckvrName_
+    , _plkrckckvrCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckckvrXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore (Maybe Xgafv)
+plkrckckvrXgafv
+  = lens _plkrckckvrXgafv
+      (\ s a -> s{_plkrckckvrXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckckvrUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore (Maybe Text)
+plkrckckvrUploadProtocol
+  = lens _plkrckckvrUploadProtocol
+      (\ s a -> s{_plkrckckvrUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckckvrAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore (Maybe Text)
+plkrckckvrAccessToken
+  = lens _plkrckckvrAccessToken
+      (\ s a -> s{_plkrckckvrAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckckvrUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore (Maybe Text)
+plkrckckvrUploadType
+  = lens _plkrckckvrUploadType
+      (\ s a -> s{_plkrckckvrUploadType = a})
+
+-- | Multipart request metadata.
+plkrckckvrPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore RestoreCryptoKeyVersionRequest
+plkrckckvrPayload
+  = lens _plkrckckvrPayload
+      (\ s a -> s{_plkrckckvrPayload = a})
+
+-- | The resource name of the CryptoKeyVersion to restore.
+plkrckckvrName :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore Text
+plkrckckvrName
+  = lens _plkrckckvrName
+      (\ s a -> s{_plkrckckvrName = a})
+
+-- | JSONP
+plkrckckvrCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore (Maybe Text)
+plkrckckvrCallback
+  = lens _plkrckckvrCallback
+      (\ s a -> s{_plkrckckvrCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore
+             = CryptoKeyVersion
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestore'{..}
+          = go _plkrckckvrName _plkrckckvrXgafv
+              _plkrckckvrUploadProtocol
+              _plkrckckvrAccessToken
+              _plkrckckvrUploadType
+              _plkrckckvrCallback
+              (Just AltJSON)
+              _plkrckckvrPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysCryptoKeyVersionsRestoreResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Decrypt.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Decrypt.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Decrypt.hs
@@ -0,0 +1,173 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Decrypt
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Decrypts data that was protected by Encrypt. The CryptoKey.purpose must
+-- be ENCRYPT_DECRYPT.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.decrypt@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Decrypt
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysDecryptResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysDecrypt
+    , ProjectsLocationsKeyRingsCryptoKeysDecrypt
+
+    -- * Request Lenses
+    , plkrckdXgafv
+    , plkrckdUploadProtocol
+    , plkrckdAccessToken
+    , plkrckdUploadType
+    , plkrckdPayload
+    , plkrckdName
+    , plkrckdCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.decrypt@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysDecrypt' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysDecryptResource
+     =
+     "v1" :>
+       CaptureMode "name" "decrypt" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] DecryptRequest :>
+                       Post '[JSON] DecryptResponse
+
+-- | Decrypts data that was protected by Encrypt. The CryptoKey.purpose must
+-- be ENCRYPT_DECRYPT.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysDecrypt' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysDecrypt = ProjectsLocationsKeyRingsCryptoKeysDecrypt'
+    { _plkrckdXgafv          :: !(Maybe Xgafv)
+    , _plkrckdUploadProtocol :: !(Maybe Text)
+    , _plkrckdAccessToken    :: !(Maybe Text)
+    , _plkrckdUploadType     :: !(Maybe Text)
+    , _plkrckdPayload        :: !DecryptRequest
+    , _plkrckdName           :: !Text
+    , _plkrckdCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysDecrypt' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckdXgafv'
+--
+-- * 'plkrckdUploadProtocol'
+--
+-- * 'plkrckdAccessToken'
+--
+-- * 'plkrckdUploadType'
+--
+-- * 'plkrckdPayload'
+--
+-- * 'plkrckdName'
+--
+-- * 'plkrckdCallback'
+projectsLocationsKeyRingsCryptoKeysDecrypt
+    :: DecryptRequest -- ^ 'plkrckdPayload'
+    -> Text -- ^ 'plkrckdName'
+    -> ProjectsLocationsKeyRingsCryptoKeysDecrypt
+projectsLocationsKeyRingsCryptoKeysDecrypt pPlkrckdPayload_ pPlkrckdName_ =
+    ProjectsLocationsKeyRingsCryptoKeysDecrypt'
+    { _plkrckdXgafv = Nothing
+    , _plkrckdUploadProtocol = Nothing
+    , _plkrckdAccessToken = Nothing
+    , _plkrckdUploadType = Nothing
+    , _plkrckdPayload = pPlkrckdPayload_
+    , _plkrckdName = pPlkrckdName_
+    , _plkrckdCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckdXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysDecrypt (Maybe Xgafv)
+plkrckdXgafv
+  = lens _plkrckdXgafv (\ s a -> s{_plkrckdXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckdUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysDecrypt (Maybe Text)
+plkrckdUploadProtocol
+  = lens _plkrckdUploadProtocol
+      (\ s a -> s{_plkrckdUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckdAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysDecrypt (Maybe Text)
+plkrckdAccessToken
+  = lens _plkrckdAccessToken
+      (\ s a -> s{_plkrckdAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckdUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysDecrypt (Maybe Text)
+plkrckdUploadType
+  = lens _plkrckdUploadType
+      (\ s a -> s{_plkrckdUploadType = a})
+
+-- | Multipart request metadata.
+plkrckdPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysDecrypt DecryptRequest
+plkrckdPayload
+  = lens _plkrckdPayload
+      (\ s a -> s{_plkrckdPayload = a})
+
+-- | Required. The resource name of the CryptoKey to use for decryption. The
+-- server will choose the appropriate version.
+plkrckdName :: Lens' ProjectsLocationsKeyRingsCryptoKeysDecrypt Text
+plkrckdName
+  = lens _plkrckdName (\ s a -> s{_plkrckdName = a})
+
+-- | JSONP
+plkrckdCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysDecrypt (Maybe Text)
+plkrckdCallback
+  = lens _plkrckdCallback
+      (\ s a -> s{_plkrckdCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysDecrypt where
+        type Rs ProjectsLocationsKeyRingsCryptoKeysDecrypt =
+             DecryptResponse
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysDecrypt
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysDecrypt'{..}
+          = go _plkrckdName _plkrckdXgafv
+              _plkrckdUploadProtocol
+              _plkrckdAccessToken
+              _plkrckdUploadType
+              _plkrckdCallback
+              (Just AltJSON)
+              _plkrckdPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysDecryptResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Encrypt.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Encrypt.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Encrypt.hs
@@ -0,0 +1,174 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Encrypt
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Encrypts data, so that it can only be recovered by a call to Decrypt.
+-- The CryptoKey.purpose must be ENCRYPT_DECRYPT.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.encrypt@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Encrypt
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysEncryptResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysEncrypt
+    , ProjectsLocationsKeyRingsCryptoKeysEncrypt
+
+    -- * Request Lenses
+    , plkrckeXgafv
+    , plkrckeUploadProtocol
+    , plkrckeAccessToken
+    , plkrckeUploadType
+    , plkrckePayload
+    , plkrckeName
+    , plkrckeCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.encrypt@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysEncrypt' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysEncryptResource
+     =
+     "v1" :>
+       CaptureMode "name" "encrypt" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] EncryptRequest :>
+                       Post '[JSON] EncryptResponse
+
+-- | Encrypts data, so that it can only be recovered by a call to Decrypt.
+-- The CryptoKey.purpose must be ENCRYPT_DECRYPT.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysEncrypt' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysEncrypt = ProjectsLocationsKeyRingsCryptoKeysEncrypt'
+    { _plkrckeXgafv          :: !(Maybe Xgafv)
+    , _plkrckeUploadProtocol :: !(Maybe Text)
+    , _plkrckeAccessToken    :: !(Maybe Text)
+    , _plkrckeUploadType     :: !(Maybe Text)
+    , _plkrckePayload        :: !EncryptRequest
+    , _plkrckeName           :: !Text
+    , _plkrckeCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysEncrypt' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckeXgafv'
+--
+-- * 'plkrckeUploadProtocol'
+--
+-- * 'plkrckeAccessToken'
+--
+-- * 'plkrckeUploadType'
+--
+-- * 'plkrckePayload'
+--
+-- * 'plkrckeName'
+--
+-- * 'plkrckeCallback'
+projectsLocationsKeyRingsCryptoKeysEncrypt
+    :: EncryptRequest -- ^ 'plkrckePayload'
+    -> Text -- ^ 'plkrckeName'
+    -> ProjectsLocationsKeyRingsCryptoKeysEncrypt
+projectsLocationsKeyRingsCryptoKeysEncrypt pPlkrckePayload_ pPlkrckeName_ =
+    ProjectsLocationsKeyRingsCryptoKeysEncrypt'
+    { _plkrckeXgafv = Nothing
+    , _plkrckeUploadProtocol = Nothing
+    , _plkrckeAccessToken = Nothing
+    , _plkrckeUploadType = Nothing
+    , _plkrckePayload = pPlkrckePayload_
+    , _plkrckeName = pPlkrckeName_
+    , _plkrckeCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckeXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysEncrypt (Maybe Xgafv)
+plkrckeXgafv
+  = lens _plkrckeXgafv (\ s a -> s{_plkrckeXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckeUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysEncrypt (Maybe Text)
+plkrckeUploadProtocol
+  = lens _plkrckeUploadProtocol
+      (\ s a -> s{_plkrckeUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckeAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysEncrypt (Maybe Text)
+plkrckeAccessToken
+  = lens _plkrckeAccessToken
+      (\ s a -> s{_plkrckeAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckeUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysEncrypt (Maybe Text)
+plkrckeUploadType
+  = lens _plkrckeUploadType
+      (\ s a -> s{_plkrckeUploadType = a})
+
+-- | Multipart request metadata.
+plkrckePayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysEncrypt EncryptRequest
+plkrckePayload
+  = lens _plkrckePayload
+      (\ s a -> s{_plkrckePayload = a})
+
+-- | Required. The resource name of the CryptoKey or CryptoKeyVersion to use
+-- for encryption. If a CryptoKey is specified, the server will use its
+-- primary version.
+plkrckeName :: Lens' ProjectsLocationsKeyRingsCryptoKeysEncrypt Text
+plkrckeName
+  = lens _plkrckeName (\ s a -> s{_plkrckeName = a})
+
+-- | JSONP
+plkrckeCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysEncrypt (Maybe Text)
+plkrckeCallback
+  = lens _plkrckeCallback
+      (\ s a -> s{_plkrckeCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysEncrypt where
+        type Rs ProjectsLocationsKeyRingsCryptoKeysEncrypt =
+             EncryptResponse
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysEncrypt
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysEncrypt'{..}
+          = go _plkrckeName _plkrckeXgafv
+              _plkrckeUploadProtocol
+              _plkrckeAccessToken
+              _plkrckeUploadType
+              _plkrckeCallback
+              (Just AltJSON)
+              _plkrckePayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysEncryptResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Get.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Get.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Get.hs
@@ -0,0 +1,154 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Get
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Returns metadata for a given CryptoKey, as well as its primary
+-- CryptoKeyVersion.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.get@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Get
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysGetResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysGet
+    , ProjectsLocationsKeyRingsCryptoKeysGet
+
+    -- * Request Lenses
+    , plkrckgXgafv
+    , plkrckgUploadProtocol
+    , plkrckgAccessToken
+    , plkrckgUploadType
+    , plkrckgName
+    , plkrckgCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.get@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysGet' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysGetResource =
+     "v1" :>
+       Capture "name" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :> Get '[JSON] CryptoKey
+
+-- | Returns metadata for a given CryptoKey, as well as its primary
+-- CryptoKeyVersion.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysGet' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysGet = ProjectsLocationsKeyRingsCryptoKeysGet'
+    { _plkrckgXgafv          :: !(Maybe Xgafv)
+    , _plkrckgUploadProtocol :: !(Maybe Text)
+    , _plkrckgAccessToken    :: !(Maybe Text)
+    , _plkrckgUploadType     :: !(Maybe Text)
+    , _plkrckgName           :: !Text
+    , _plkrckgCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysGet' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckgXgafv'
+--
+-- * 'plkrckgUploadProtocol'
+--
+-- * 'plkrckgAccessToken'
+--
+-- * 'plkrckgUploadType'
+--
+-- * 'plkrckgName'
+--
+-- * 'plkrckgCallback'
+projectsLocationsKeyRingsCryptoKeysGet
+    :: Text -- ^ 'plkrckgName'
+    -> ProjectsLocationsKeyRingsCryptoKeysGet
+projectsLocationsKeyRingsCryptoKeysGet pPlkrckgName_ =
+    ProjectsLocationsKeyRingsCryptoKeysGet'
+    { _plkrckgXgafv = Nothing
+    , _plkrckgUploadProtocol = Nothing
+    , _plkrckgAccessToken = Nothing
+    , _plkrckgUploadType = Nothing
+    , _plkrckgName = pPlkrckgName_
+    , _plkrckgCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckgXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysGet (Maybe Xgafv)
+plkrckgXgafv
+  = lens _plkrckgXgafv (\ s a -> s{_plkrckgXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckgUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysGet (Maybe Text)
+plkrckgUploadProtocol
+  = lens _plkrckgUploadProtocol
+      (\ s a -> s{_plkrckgUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckgAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysGet (Maybe Text)
+plkrckgAccessToken
+  = lens _plkrckgAccessToken
+      (\ s a -> s{_plkrckgAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckgUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysGet (Maybe Text)
+plkrckgUploadType
+  = lens _plkrckgUploadType
+      (\ s a -> s{_plkrckgUploadType = a})
+
+-- | The name of the CryptoKey to get.
+plkrckgName :: Lens' ProjectsLocationsKeyRingsCryptoKeysGet Text
+plkrckgName
+  = lens _plkrckgName (\ s a -> s{_plkrckgName = a})
+
+-- | JSONP
+plkrckgCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysGet (Maybe Text)
+plkrckgCallback
+  = lens _plkrckgCallback
+      (\ s a -> s{_plkrckgCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysGet where
+        type Rs ProjectsLocationsKeyRingsCryptoKeysGet =
+             CryptoKey
+        type Scopes ProjectsLocationsKeyRingsCryptoKeysGet =
+             '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysGet'{..}
+          = go _plkrckgName _plkrckgXgafv
+              _plkrckgUploadProtocol
+              _plkrckgAccessToken
+              _plkrckgUploadType
+              _plkrckgCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy ProjectsLocationsKeyRingsCryptoKeysGetResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/GetIAMPolicy.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/GetIAMPolicy.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/GetIAMPolicy.hs
@@ -0,0 +1,161 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.GetIAMPolicy
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Gets the access control policy for a resource. Returns an empty policy
+-- if the resource exists and does not have a policy set.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.getIamPolicy@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.GetIAMPolicy
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicyResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysGetIAMPolicy
+    , ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy
+
+    -- * Request Lenses
+    , plkrckgipXgafv
+    , plkrckgipUploadProtocol
+    , plkrckgipAccessToken
+    , plkrckgipUploadType
+    , plkrckgipResource
+    , plkrckgipCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.getIamPolicy@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicyResource
+     =
+     "v1" :>
+       CaptureMode "resource" "getIamPolicy" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :> Get '[JSON] Policy
+
+-- | Gets the access control policy for a resource. Returns an empty policy
+-- if the resource exists and does not have a policy set.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysGetIAMPolicy' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy = ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy'
+    { _plkrckgipXgafv          :: !(Maybe Xgafv)
+    , _plkrckgipUploadProtocol :: !(Maybe Text)
+    , _plkrckgipAccessToken    :: !(Maybe Text)
+    , _plkrckgipUploadType     :: !(Maybe Text)
+    , _plkrckgipResource       :: !Text
+    , _plkrckgipCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckgipXgafv'
+--
+-- * 'plkrckgipUploadProtocol'
+--
+-- * 'plkrckgipAccessToken'
+--
+-- * 'plkrckgipUploadType'
+--
+-- * 'plkrckgipResource'
+--
+-- * 'plkrckgipCallback'
+projectsLocationsKeyRingsCryptoKeysGetIAMPolicy
+    :: Text -- ^ 'plkrckgipResource'
+    -> ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy
+projectsLocationsKeyRingsCryptoKeysGetIAMPolicy pPlkrckgipResource_ =
+    ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy'
+    { _plkrckgipXgafv = Nothing
+    , _plkrckgipUploadProtocol = Nothing
+    , _plkrckgipAccessToken = Nothing
+    , _plkrckgipUploadType = Nothing
+    , _plkrckgipResource = pPlkrckgipResource_
+    , _plkrckgipCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckgipXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy (Maybe Xgafv)
+plkrckgipXgafv
+  = lens _plkrckgipXgafv
+      (\ s a -> s{_plkrckgipXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckgipUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy (Maybe Text)
+plkrckgipUploadProtocol
+  = lens _plkrckgipUploadProtocol
+      (\ s a -> s{_plkrckgipUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckgipAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy (Maybe Text)
+plkrckgipAccessToken
+  = lens _plkrckgipAccessToken
+      (\ s a -> s{_plkrckgipAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckgipUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy (Maybe Text)
+plkrckgipUploadType
+  = lens _plkrckgipUploadType
+      (\ s a -> s{_plkrckgipUploadType = a})
+
+-- | REQUIRED: The resource for which the policy is being requested. See the
+-- operation documentation for the appropriate value for this field.
+plkrckgipResource :: Lens' ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy Text
+plkrckgipResource
+  = lens _plkrckgipResource
+      (\ s a -> s{_plkrckgipResource = a})
+
+-- | JSONP
+plkrckgipCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy (Maybe Text)
+plkrckgipCallback
+  = lens _plkrckgipCallback
+      (\ s a -> s{_plkrckgipCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy
+             = Policy
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicy'{..}
+          = go _plkrckgipResource _plkrckgipXgafv
+              _plkrckgipUploadProtocol
+              _plkrckgipAccessToken
+              _plkrckgipUploadType
+              _plkrckgipCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysGetIAMPolicyResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/List.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/List.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/List.hs
@@ -0,0 +1,201 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.List
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Lists CryptoKeys.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.list@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.List
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysListResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysList
+    , ProjectsLocationsKeyRingsCryptoKeysList
+
+    -- * Request Lenses
+    , plkrcklParent
+    , plkrcklXgafv
+    , plkrcklVersionView
+    , plkrcklUploadProtocol
+    , plkrcklAccessToken
+    , plkrcklUploadType
+    , plkrcklPageToken
+    , plkrcklPageSize
+    , plkrcklCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.list@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysList' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysListResource
+     =
+     "v1" :>
+       Capture "parent" Text :>
+         "cryptoKeys" :>
+           QueryParam "$.xgafv" Xgafv :>
+             QueryParam "versionView" Text :>
+               QueryParam "upload_protocol" Text :>
+                 QueryParam "access_token" Text :>
+                   QueryParam "uploadType" Text :>
+                     QueryParam "pageToken" Text :>
+                       QueryParam "pageSize" (Textual Int32) :>
+                         QueryParam "callback" Text :>
+                           QueryParam "alt" AltJSON :>
+                             Get '[JSON] ListCryptoKeysResponse
+
+-- | Lists CryptoKeys.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysList' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysList = ProjectsLocationsKeyRingsCryptoKeysList'
+    { _plkrcklParent         :: !Text
+    , _plkrcklXgafv          :: !(Maybe Xgafv)
+    , _plkrcklVersionView    :: !(Maybe Text)
+    , _plkrcklUploadProtocol :: !(Maybe Text)
+    , _plkrcklAccessToken    :: !(Maybe Text)
+    , _plkrcklUploadType     :: !(Maybe Text)
+    , _plkrcklPageToken      :: !(Maybe Text)
+    , _plkrcklPageSize       :: !(Maybe (Textual Int32))
+    , _plkrcklCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysList' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrcklParent'
+--
+-- * 'plkrcklXgafv'
+--
+-- * 'plkrcklVersionView'
+--
+-- * 'plkrcklUploadProtocol'
+--
+-- * 'plkrcklAccessToken'
+--
+-- * 'plkrcklUploadType'
+--
+-- * 'plkrcklPageToken'
+--
+-- * 'plkrcklPageSize'
+--
+-- * 'plkrcklCallback'
+projectsLocationsKeyRingsCryptoKeysList
+    :: Text -- ^ 'plkrcklParent'
+    -> ProjectsLocationsKeyRingsCryptoKeysList
+projectsLocationsKeyRingsCryptoKeysList pPlkrcklParent_ =
+    ProjectsLocationsKeyRingsCryptoKeysList'
+    { _plkrcklParent = pPlkrcklParent_
+    , _plkrcklXgafv = Nothing
+    , _plkrcklVersionView = Nothing
+    , _plkrcklUploadProtocol = Nothing
+    , _plkrcklAccessToken = Nothing
+    , _plkrcklUploadType = Nothing
+    , _plkrcklPageToken = Nothing
+    , _plkrcklPageSize = Nothing
+    , _plkrcklCallback = Nothing
+    }
+
+-- | Required. The resource name of the KeyRing to list, in the format
+-- \`projects\/*\/locations\/*\/keyRings\/*\`.
+plkrcklParent :: Lens' ProjectsLocationsKeyRingsCryptoKeysList Text
+plkrcklParent
+  = lens _plkrcklParent
+      (\ s a -> s{_plkrcklParent = a})
+
+-- | V1 error format.
+plkrcklXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysList (Maybe Xgafv)
+plkrcklXgafv
+  = lens _plkrcklXgafv (\ s a -> s{_plkrcklXgafv = a})
+
+-- | The fields of the primary version to include in the response.
+plkrcklVersionView :: Lens' ProjectsLocationsKeyRingsCryptoKeysList (Maybe Text)
+plkrcklVersionView
+  = lens _plkrcklVersionView
+      (\ s a -> s{_plkrcklVersionView = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrcklUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysList (Maybe Text)
+plkrcklUploadProtocol
+  = lens _plkrcklUploadProtocol
+      (\ s a -> s{_plkrcklUploadProtocol = a})
+
+-- | OAuth access token.
+plkrcklAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysList (Maybe Text)
+plkrcklAccessToken
+  = lens _plkrcklAccessToken
+      (\ s a -> s{_plkrcklAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrcklUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysList (Maybe Text)
+plkrcklUploadType
+  = lens _plkrcklUploadType
+      (\ s a -> s{_plkrcklUploadType = a})
+
+-- | Optional pagination token, returned earlier via
+-- ListCryptoKeysResponse.next_page_token.
+plkrcklPageToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysList (Maybe Text)
+plkrcklPageToken
+  = lens _plkrcklPageToken
+      (\ s a -> s{_plkrcklPageToken = a})
+
+-- | Optional limit on the number of CryptoKeys to include in the response.
+-- Further CryptoKeys can subsequently be obtained by including the
+-- ListCryptoKeysResponse.next_page_token in a subsequent request. If
+-- unspecified, the server will pick an appropriate default.
+plkrcklPageSize :: Lens' ProjectsLocationsKeyRingsCryptoKeysList (Maybe Int32)
+plkrcklPageSize
+  = lens _plkrcklPageSize
+      (\ s a -> s{_plkrcklPageSize = a})
+      . mapping _Coerce
+
+-- | JSONP
+plkrcklCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysList (Maybe Text)
+plkrcklCallback
+  = lens _plkrcklCallback
+      (\ s a -> s{_plkrcklCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysList where
+        type Rs ProjectsLocationsKeyRingsCryptoKeysList =
+             ListCryptoKeysResponse
+        type Scopes ProjectsLocationsKeyRingsCryptoKeysList =
+             '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysList'{..}
+          = go _plkrcklParent _plkrcklXgafv _plkrcklVersionView
+              _plkrcklUploadProtocol
+              _plkrcklAccessToken
+              _plkrcklUploadType
+              _plkrcklPageToken
+              _plkrcklPageSize
+              _plkrcklCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysListResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Patch.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Patch.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/Patch.hs
@@ -0,0 +1,182 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Patch
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Update a CryptoKey.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.patch@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Patch
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysPatchResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysPatch
+    , ProjectsLocationsKeyRingsCryptoKeysPatch
+
+    -- * Request Lenses
+    , plkrckpXgafv
+    , plkrckpUploadProtocol
+    , plkrckpUpdateMask
+    , plkrckpAccessToken
+    , plkrckpUploadType
+    , plkrckpPayload
+    , plkrckpName
+    , plkrckpCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.patch@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysPatch' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysPatchResource
+     =
+     "v1" :>
+       Capture "name" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "updateMask" GFieldMask :>
+               QueryParam "access_token" Text :>
+                 QueryParam "uploadType" Text :>
+                   QueryParam "callback" Text :>
+                     QueryParam "alt" AltJSON :>
+                       ReqBody '[JSON] CryptoKey :> Patch '[JSON] CryptoKey
+
+-- | Update a CryptoKey.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysPatch' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysPatch = ProjectsLocationsKeyRingsCryptoKeysPatch'
+    { _plkrckpXgafv          :: !(Maybe Xgafv)
+    , _plkrckpUploadProtocol :: !(Maybe Text)
+    , _plkrckpUpdateMask     :: !(Maybe GFieldMask)
+    , _plkrckpAccessToken    :: !(Maybe Text)
+    , _plkrckpUploadType     :: !(Maybe Text)
+    , _plkrckpPayload        :: !CryptoKey
+    , _plkrckpName           :: !Text
+    , _plkrckpCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysPatch' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckpXgafv'
+--
+-- * 'plkrckpUploadProtocol'
+--
+-- * 'plkrckpUpdateMask'
+--
+-- * 'plkrckpAccessToken'
+--
+-- * 'plkrckpUploadType'
+--
+-- * 'plkrckpPayload'
+--
+-- * 'plkrckpName'
+--
+-- * 'plkrckpCallback'
+projectsLocationsKeyRingsCryptoKeysPatch
+    :: CryptoKey -- ^ 'plkrckpPayload'
+    -> Text -- ^ 'plkrckpName'
+    -> ProjectsLocationsKeyRingsCryptoKeysPatch
+projectsLocationsKeyRingsCryptoKeysPatch pPlkrckpPayload_ pPlkrckpName_ =
+    ProjectsLocationsKeyRingsCryptoKeysPatch'
+    { _plkrckpXgafv = Nothing
+    , _plkrckpUploadProtocol = Nothing
+    , _plkrckpUpdateMask = Nothing
+    , _plkrckpAccessToken = Nothing
+    , _plkrckpUploadType = Nothing
+    , _plkrckpPayload = pPlkrckpPayload_
+    , _plkrckpName = pPlkrckpName_
+    , _plkrckpCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckpXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysPatch (Maybe Xgafv)
+plkrckpXgafv
+  = lens _plkrckpXgafv (\ s a -> s{_plkrckpXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckpUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysPatch (Maybe Text)
+plkrckpUploadProtocol
+  = lens _plkrckpUploadProtocol
+      (\ s a -> s{_plkrckpUploadProtocol = a})
+
+-- | Required list of fields to be updated in this request.
+plkrckpUpdateMask :: Lens' ProjectsLocationsKeyRingsCryptoKeysPatch (Maybe GFieldMask)
+plkrckpUpdateMask
+  = lens _plkrckpUpdateMask
+      (\ s a -> s{_plkrckpUpdateMask = a})
+
+-- | OAuth access token.
+plkrckpAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysPatch (Maybe Text)
+plkrckpAccessToken
+  = lens _plkrckpAccessToken
+      (\ s a -> s{_plkrckpAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckpUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysPatch (Maybe Text)
+plkrckpUploadType
+  = lens _plkrckpUploadType
+      (\ s a -> s{_plkrckpUploadType = a})
+
+-- | Multipart request metadata.
+plkrckpPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysPatch CryptoKey
+plkrckpPayload
+  = lens _plkrckpPayload
+      (\ s a -> s{_plkrckpPayload = a})
+
+-- | Output only. The resource name for this CryptoKey in the format
+-- \`projects\/*\/locations\/*\/keyRings\/*\/cryptoKeys\/*\`.
+plkrckpName :: Lens' ProjectsLocationsKeyRingsCryptoKeysPatch Text
+plkrckpName
+  = lens _plkrckpName (\ s a -> s{_plkrckpName = a})
+
+-- | JSONP
+plkrckpCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysPatch (Maybe Text)
+plkrckpCallback
+  = lens _plkrckpCallback
+      (\ s a -> s{_plkrckpCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysPatch where
+        type Rs ProjectsLocationsKeyRingsCryptoKeysPatch =
+             CryptoKey
+        type Scopes ProjectsLocationsKeyRingsCryptoKeysPatch
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysPatch'{..}
+          = go _plkrckpName _plkrckpXgafv
+              _plkrckpUploadProtocol
+              _plkrckpUpdateMask
+              _plkrckpAccessToken
+              _plkrckpUploadType
+              _plkrckpCallback
+              (Just AltJSON)
+              _plkrckpPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysPatchResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/SetIAMPolicy.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/SetIAMPolicy.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/SetIAMPolicy.hs
@@ -0,0 +1,176 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.SetIAMPolicy
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Sets the access control policy on the specified resource. Replaces any
+-- existing policy.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.setIamPolicy@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.SetIAMPolicy
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicyResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysSetIAMPolicy
+    , ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy
+
+    -- * Request Lenses
+    , plkrcksipXgafv
+    , plkrcksipUploadProtocol
+    , plkrcksipAccessToken
+    , plkrcksipUploadType
+    , plkrcksipPayload
+    , plkrcksipResource
+    , plkrcksipCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.setIamPolicy@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicyResource
+     =
+     "v1" :>
+       CaptureMode "resource" "setIamPolicy" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] SetIAMPolicyRequest :>
+                       Post '[JSON] Policy
+
+-- | Sets the access control policy on the specified resource. Replaces any
+-- existing policy.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysSetIAMPolicy' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy = ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy'
+    { _plkrcksipXgafv          :: !(Maybe Xgafv)
+    , _plkrcksipUploadProtocol :: !(Maybe Text)
+    , _plkrcksipAccessToken    :: !(Maybe Text)
+    , _plkrcksipUploadType     :: !(Maybe Text)
+    , _plkrcksipPayload        :: !SetIAMPolicyRequest
+    , _plkrcksipResource       :: !Text
+    , _plkrcksipCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrcksipXgafv'
+--
+-- * 'plkrcksipUploadProtocol'
+--
+-- * 'plkrcksipAccessToken'
+--
+-- * 'plkrcksipUploadType'
+--
+-- * 'plkrcksipPayload'
+--
+-- * 'plkrcksipResource'
+--
+-- * 'plkrcksipCallback'
+projectsLocationsKeyRingsCryptoKeysSetIAMPolicy
+    :: SetIAMPolicyRequest -- ^ 'plkrcksipPayload'
+    -> Text -- ^ 'plkrcksipResource'
+    -> ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy
+projectsLocationsKeyRingsCryptoKeysSetIAMPolicy pPlkrcksipPayload_ pPlkrcksipResource_ =
+    ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy'
+    { _plkrcksipXgafv = Nothing
+    , _plkrcksipUploadProtocol = Nothing
+    , _plkrcksipAccessToken = Nothing
+    , _plkrcksipUploadType = Nothing
+    , _plkrcksipPayload = pPlkrcksipPayload_
+    , _plkrcksipResource = pPlkrcksipResource_
+    , _plkrcksipCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrcksipXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy (Maybe Xgafv)
+plkrcksipXgafv
+  = lens _plkrcksipXgafv
+      (\ s a -> s{_plkrcksipXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrcksipUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy (Maybe Text)
+plkrcksipUploadProtocol
+  = lens _plkrcksipUploadProtocol
+      (\ s a -> s{_plkrcksipUploadProtocol = a})
+
+-- | OAuth access token.
+plkrcksipAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy (Maybe Text)
+plkrcksipAccessToken
+  = lens _plkrcksipAccessToken
+      (\ s a -> s{_plkrcksipAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrcksipUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy (Maybe Text)
+plkrcksipUploadType
+  = lens _plkrcksipUploadType
+      (\ s a -> s{_plkrcksipUploadType = a})
+
+-- | Multipart request metadata.
+plkrcksipPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy SetIAMPolicyRequest
+plkrcksipPayload
+  = lens _plkrcksipPayload
+      (\ s a -> s{_plkrcksipPayload = a})
+
+-- | REQUIRED: The resource for which the policy is being specified. See the
+-- operation documentation for the appropriate value for this field.
+plkrcksipResource :: Lens' ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy Text
+plkrcksipResource
+  = lens _plkrcksipResource
+      (\ s a -> s{_plkrcksipResource = a})
+
+-- | JSONP
+plkrcksipCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy (Maybe Text)
+plkrcksipCallback
+  = lens _plkrcksipCallback
+      (\ s a -> s{_plkrcksipCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy
+             = Policy
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicy'{..}
+          = go _plkrcksipResource _plkrcksipXgafv
+              _plkrcksipUploadProtocol
+              _plkrcksipAccessToken
+              _plkrcksipUploadType
+              _plkrcksipCallback
+              (Just AltJSON)
+              _plkrcksipPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysSetIAMPolicyResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/TestIAMPermissions.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/TestIAMPermissions.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/TestIAMPermissions.hs
@@ -0,0 +1,186 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.TestIAMPermissions
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Returns permissions that a caller has on the specified resource. If the
+-- resource does not exist, this will return an empty set of permissions,
+-- not a NOT_FOUND error. Note: This operation is designed to be used for
+-- building permission-aware UIs and command-line tools, not for
+-- authorization checking. This operation may \"fail open\" without
+-- warning.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.testIamPermissions@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.TestIAMPermissions
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissionsResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysTestIAMPermissions
+    , ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions
+
+    -- * Request Lenses
+    , plkrcktipXgafv
+    , plkrcktipUploadProtocol
+    , plkrcktipAccessToken
+    , plkrcktipUploadType
+    , plkrcktipPayload
+    , plkrcktipResource
+    , plkrcktipCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.testIamPermissions@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissionsResource
+     =
+     "v1" :>
+       CaptureMode "resource" "testIamPermissions" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] TestIAMPermissionsRequest :>
+                       Post '[JSON] TestIAMPermissionsResponse
+
+-- | Returns permissions that a caller has on the specified resource. If the
+-- resource does not exist, this will return an empty set of permissions,
+-- not a NOT_FOUND error. Note: This operation is designed to be used for
+-- building permission-aware UIs and command-line tools, not for
+-- authorization checking. This operation may \"fail open\" without
+-- warning.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysTestIAMPermissions' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions = ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions'
+    { _plkrcktipXgafv          :: !(Maybe Xgafv)
+    , _plkrcktipUploadProtocol :: !(Maybe Text)
+    , _plkrcktipAccessToken    :: !(Maybe Text)
+    , _plkrcktipUploadType     :: !(Maybe Text)
+    , _plkrcktipPayload        :: !TestIAMPermissionsRequest
+    , _plkrcktipResource       :: !Text
+    , _plkrcktipCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrcktipXgafv'
+--
+-- * 'plkrcktipUploadProtocol'
+--
+-- * 'plkrcktipAccessToken'
+--
+-- * 'plkrcktipUploadType'
+--
+-- * 'plkrcktipPayload'
+--
+-- * 'plkrcktipResource'
+--
+-- * 'plkrcktipCallback'
+projectsLocationsKeyRingsCryptoKeysTestIAMPermissions
+    :: TestIAMPermissionsRequest -- ^ 'plkrcktipPayload'
+    -> Text -- ^ 'plkrcktipResource'
+    -> ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions
+projectsLocationsKeyRingsCryptoKeysTestIAMPermissions pPlkrcktipPayload_ pPlkrcktipResource_ =
+    ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions'
+    { _plkrcktipXgafv = Nothing
+    , _plkrcktipUploadProtocol = Nothing
+    , _plkrcktipAccessToken = Nothing
+    , _plkrcktipUploadType = Nothing
+    , _plkrcktipPayload = pPlkrcktipPayload_
+    , _plkrcktipResource = pPlkrcktipResource_
+    , _plkrcktipCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrcktipXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions (Maybe Xgafv)
+plkrcktipXgafv
+  = lens _plkrcktipXgafv
+      (\ s a -> s{_plkrcktipXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrcktipUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions (Maybe Text)
+plkrcktipUploadProtocol
+  = lens _plkrcktipUploadProtocol
+      (\ s a -> s{_plkrcktipUploadProtocol = a})
+
+-- | OAuth access token.
+plkrcktipAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions (Maybe Text)
+plkrcktipAccessToken
+  = lens _plkrcktipAccessToken
+      (\ s a -> s{_plkrcktipAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrcktipUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions (Maybe Text)
+plkrcktipUploadType
+  = lens _plkrcktipUploadType
+      (\ s a -> s{_plkrcktipUploadType = a})
+
+-- | Multipart request metadata.
+plkrcktipPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions TestIAMPermissionsRequest
+plkrcktipPayload
+  = lens _plkrcktipPayload
+      (\ s a -> s{_plkrcktipPayload = a})
+
+-- | REQUIRED: The resource for which the policy detail is being requested.
+-- See the operation documentation for the appropriate value for this
+-- field.
+plkrcktipResource :: Lens' ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions Text
+plkrcktipResource
+  = lens _plkrcktipResource
+      (\ s a -> s{_plkrcktipResource = a})
+
+-- | JSONP
+plkrcktipCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions (Maybe Text)
+plkrcktipCallback
+  = lens _plkrcktipCallback
+      (\ s a -> s{_plkrcktipCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions
+             = TestIAMPermissionsResponse
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissions'{..}
+          = go _plkrcktipResource _plkrcktipXgafv
+              _plkrcktipUploadProtocol
+              _plkrcktipAccessToken
+              _plkrcktipUploadType
+              _plkrcktipCallback
+              (Just AltJSON)
+              _plkrcktipPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysTestIAMPermissionsResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/UpdatePrimaryVersion.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/UpdatePrimaryVersion.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/CryptoKeys/UpdatePrimaryVersion.hs
@@ -0,0 +1,176 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.UpdatePrimaryVersion
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Update the version of a CryptoKey that will be used in Encrypt. Returns
+-- an error if called on an asymmetric key.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.cryptoKeys.updatePrimaryVersion@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.UpdatePrimaryVersion
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersionResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion
+    , ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion
+
+    -- * Request Lenses
+    , plkrckupvXgafv
+    , plkrckupvUploadProtocol
+    , plkrckupvAccessToken
+    , plkrckupvUploadType
+    , plkrckupvPayload
+    , plkrckupvName
+    , plkrckupvCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.cryptoKeys.updatePrimaryVersion@ method which the
+-- 'ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion' request conforms to.
+type ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersionResource
+     =
+     "v1" :>
+       CaptureMode "name" "updatePrimaryVersion" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] UpdateCryptoKeyPrimaryVersionRequest
+                       :> Post '[JSON] CryptoKey
+
+-- | Update the version of a CryptoKey that will be used in Encrypt. Returns
+-- an error if called on an asymmetric key.
+--
+-- /See:/ 'projectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion' smart constructor.
+data ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion = ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion'
+    { _plkrckupvXgafv          :: !(Maybe Xgafv)
+    , _plkrckupvUploadProtocol :: !(Maybe Text)
+    , _plkrckupvAccessToken    :: !(Maybe Text)
+    , _plkrckupvUploadType     :: !(Maybe Text)
+    , _plkrckupvPayload        :: !UpdateCryptoKeyPrimaryVersionRequest
+    , _plkrckupvName           :: !Text
+    , _plkrckupvCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrckupvXgafv'
+--
+-- * 'plkrckupvUploadProtocol'
+--
+-- * 'plkrckupvAccessToken'
+--
+-- * 'plkrckupvUploadType'
+--
+-- * 'plkrckupvPayload'
+--
+-- * 'plkrckupvName'
+--
+-- * 'plkrckupvCallback'
+projectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion
+    :: UpdateCryptoKeyPrimaryVersionRequest -- ^ 'plkrckupvPayload'
+    -> Text -- ^ 'plkrckupvName'
+    -> ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion
+projectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion pPlkrckupvPayload_ pPlkrckupvName_ =
+    ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion'
+    { _plkrckupvXgafv = Nothing
+    , _plkrckupvUploadProtocol = Nothing
+    , _plkrckupvAccessToken = Nothing
+    , _plkrckupvUploadType = Nothing
+    , _plkrckupvPayload = pPlkrckupvPayload_
+    , _plkrckupvName = pPlkrckupvName_
+    , _plkrckupvCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrckupvXgafv :: Lens' ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion (Maybe Xgafv)
+plkrckupvXgafv
+  = lens _plkrckupvXgafv
+      (\ s a -> s{_plkrckupvXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrckupvUploadProtocol :: Lens' ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion (Maybe Text)
+plkrckupvUploadProtocol
+  = lens _plkrckupvUploadProtocol
+      (\ s a -> s{_plkrckupvUploadProtocol = a})
+
+-- | OAuth access token.
+plkrckupvAccessToken :: Lens' ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion (Maybe Text)
+plkrckupvAccessToken
+  = lens _plkrckupvAccessToken
+      (\ s a -> s{_plkrckupvAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrckupvUploadType :: Lens' ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion (Maybe Text)
+plkrckupvUploadType
+  = lens _plkrckupvUploadType
+      (\ s a -> s{_plkrckupvUploadType = a})
+
+-- | Multipart request metadata.
+plkrckupvPayload :: Lens' ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion UpdateCryptoKeyPrimaryVersionRequest
+plkrckupvPayload
+  = lens _plkrckupvPayload
+      (\ s a -> s{_plkrckupvPayload = a})
+
+-- | The resource name of the CryptoKey to update.
+plkrckupvName :: Lens' ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion Text
+plkrckupvName
+  = lens _plkrckupvName
+      (\ s a -> s{_plkrckupvName = a})
+
+-- | JSONP
+plkrckupvCallback :: Lens' ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion (Maybe Text)
+plkrckupvCallback
+  = lens _plkrckupvCallback
+      (\ s a -> s{_plkrckupvCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion
+         where
+        type Rs
+               ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion
+             = CryptoKey
+        type Scopes
+               ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersion'{..}
+          = go _plkrckupvName _plkrckupvXgafv
+              _plkrckupvUploadProtocol
+              _plkrckupvAccessToken
+              _plkrckupvUploadType
+              _plkrckupvCallback
+              (Just AltJSON)
+              _plkrckupvPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsCryptoKeysUpdatePrimaryVersionResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/Get.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/Get.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/Get.hs
@@ -0,0 +1,148 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.Get
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Returns metadata for a given KeyRing.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.get@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.Get
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsGetResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsGet
+    , ProjectsLocationsKeyRingsGet
+
+    -- * Request Lenses
+    , plkrgXgafv
+    , plkrgUploadProtocol
+    , plkrgAccessToken
+    , plkrgUploadType
+    , plkrgName
+    , plkrgCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.get@ method which the
+-- 'ProjectsLocationsKeyRingsGet' request conforms to.
+type ProjectsLocationsKeyRingsGetResource =
+     "v1" :>
+       Capture "name" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :> Get '[JSON] KeyRing
+
+-- | Returns metadata for a given KeyRing.
+--
+-- /See:/ 'projectsLocationsKeyRingsGet' smart constructor.
+data ProjectsLocationsKeyRingsGet = ProjectsLocationsKeyRingsGet'
+    { _plkrgXgafv          :: !(Maybe Xgafv)
+    , _plkrgUploadProtocol :: !(Maybe Text)
+    , _plkrgAccessToken    :: !(Maybe Text)
+    , _plkrgUploadType     :: !(Maybe Text)
+    , _plkrgName           :: !Text
+    , _plkrgCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsGet' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrgXgafv'
+--
+-- * 'plkrgUploadProtocol'
+--
+-- * 'plkrgAccessToken'
+--
+-- * 'plkrgUploadType'
+--
+-- * 'plkrgName'
+--
+-- * 'plkrgCallback'
+projectsLocationsKeyRingsGet
+    :: Text -- ^ 'plkrgName'
+    -> ProjectsLocationsKeyRingsGet
+projectsLocationsKeyRingsGet pPlkrgName_ =
+    ProjectsLocationsKeyRingsGet'
+    { _plkrgXgafv = Nothing
+    , _plkrgUploadProtocol = Nothing
+    , _plkrgAccessToken = Nothing
+    , _plkrgUploadType = Nothing
+    , _plkrgName = pPlkrgName_
+    , _plkrgCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrgXgafv :: Lens' ProjectsLocationsKeyRingsGet (Maybe Xgafv)
+plkrgXgafv
+  = lens _plkrgXgafv (\ s a -> s{_plkrgXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrgUploadProtocol :: Lens' ProjectsLocationsKeyRingsGet (Maybe Text)
+plkrgUploadProtocol
+  = lens _plkrgUploadProtocol
+      (\ s a -> s{_plkrgUploadProtocol = a})
+
+-- | OAuth access token.
+plkrgAccessToken :: Lens' ProjectsLocationsKeyRingsGet (Maybe Text)
+plkrgAccessToken
+  = lens _plkrgAccessToken
+      (\ s a -> s{_plkrgAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrgUploadType :: Lens' ProjectsLocationsKeyRingsGet (Maybe Text)
+plkrgUploadType
+  = lens _plkrgUploadType
+      (\ s a -> s{_plkrgUploadType = a})
+
+-- | The name of the KeyRing to get.
+plkrgName :: Lens' ProjectsLocationsKeyRingsGet Text
+plkrgName
+  = lens _plkrgName (\ s a -> s{_plkrgName = a})
+
+-- | JSONP
+plkrgCallback :: Lens' ProjectsLocationsKeyRingsGet (Maybe Text)
+plkrgCallback
+  = lens _plkrgCallback
+      (\ s a -> s{_plkrgCallback = a})
+
+instance GoogleRequest ProjectsLocationsKeyRingsGet
+         where
+        type Rs ProjectsLocationsKeyRingsGet = KeyRing
+        type Scopes ProjectsLocationsKeyRingsGet =
+             '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient ProjectsLocationsKeyRingsGet'{..}
+          = go _plkrgName _plkrgXgafv _plkrgUploadProtocol
+              _plkrgAccessToken
+              _plkrgUploadType
+              _plkrgCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy :: Proxy ProjectsLocationsKeyRingsGetResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/GetIAMPolicy.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/GetIAMPolicy.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/GetIAMPolicy.hs
@@ -0,0 +1,156 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.GetIAMPolicy
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Gets the access control policy for a resource. Returns an empty policy
+-- if the resource exists and does not have a policy set.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.getIamPolicy@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.GetIAMPolicy
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsGetIAMPolicyResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsGetIAMPolicy
+    , ProjectsLocationsKeyRingsGetIAMPolicy
+
+    -- * Request Lenses
+    , plkrgipXgafv
+    , plkrgipUploadProtocol
+    , plkrgipAccessToken
+    , plkrgipUploadType
+    , plkrgipResource
+    , plkrgipCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.getIamPolicy@ method which the
+-- 'ProjectsLocationsKeyRingsGetIAMPolicy' request conforms to.
+type ProjectsLocationsKeyRingsGetIAMPolicyResource =
+     "v1" :>
+       CaptureMode "resource" "getIamPolicy" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :> Get '[JSON] Policy
+
+-- | Gets the access control policy for a resource. Returns an empty policy
+-- if the resource exists and does not have a policy set.
+--
+-- /See:/ 'projectsLocationsKeyRingsGetIAMPolicy' smart constructor.
+data ProjectsLocationsKeyRingsGetIAMPolicy = ProjectsLocationsKeyRingsGetIAMPolicy'
+    { _plkrgipXgafv          :: !(Maybe Xgafv)
+    , _plkrgipUploadProtocol :: !(Maybe Text)
+    , _plkrgipAccessToken    :: !(Maybe Text)
+    , _plkrgipUploadType     :: !(Maybe Text)
+    , _plkrgipResource       :: !Text
+    , _plkrgipCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsGetIAMPolicy' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrgipXgafv'
+--
+-- * 'plkrgipUploadProtocol'
+--
+-- * 'plkrgipAccessToken'
+--
+-- * 'plkrgipUploadType'
+--
+-- * 'plkrgipResource'
+--
+-- * 'plkrgipCallback'
+projectsLocationsKeyRingsGetIAMPolicy
+    :: Text -- ^ 'plkrgipResource'
+    -> ProjectsLocationsKeyRingsGetIAMPolicy
+projectsLocationsKeyRingsGetIAMPolicy pPlkrgipResource_ =
+    ProjectsLocationsKeyRingsGetIAMPolicy'
+    { _plkrgipXgafv = Nothing
+    , _plkrgipUploadProtocol = Nothing
+    , _plkrgipAccessToken = Nothing
+    , _plkrgipUploadType = Nothing
+    , _plkrgipResource = pPlkrgipResource_
+    , _plkrgipCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrgipXgafv :: Lens' ProjectsLocationsKeyRingsGetIAMPolicy (Maybe Xgafv)
+plkrgipXgafv
+  = lens _plkrgipXgafv (\ s a -> s{_plkrgipXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrgipUploadProtocol :: Lens' ProjectsLocationsKeyRingsGetIAMPolicy (Maybe Text)
+plkrgipUploadProtocol
+  = lens _plkrgipUploadProtocol
+      (\ s a -> s{_plkrgipUploadProtocol = a})
+
+-- | OAuth access token.
+plkrgipAccessToken :: Lens' ProjectsLocationsKeyRingsGetIAMPolicy (Maybe Text)
+plkrgipAccessToken
+  = lens _plkrgipAccessToken
+      (\ s a -> s{_plkrgipAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrgipUploadType :: Lens' ProjectsLocationsKeyRingsGetIAMPolicy (Maybe Text)
+plkrgipUploadType
+  = lens _plkrgipUploadType
+      (\ s a -> s{_plkrgipUploadType = a})
+
+-- | REQUIRED: The resource for which the policy is being requested. See the
+-- operation documentation for the appropriate value for this field.
+plkrgipResource :: Lens' ProjectsLocationsKeyRingsGetIAMPolicy Text
+plkrgipResource
+  = lens _plkrgipResource
+      (\ s a -> s{_plkrgipResource = a})
+
+-- | JSONP
+plkrgipCallback :: Lens' ProjectsLocationsKeyRingsGetIAMPolicy (Maybe Text)
+plkrgipCallback
+  = lens _plkrgipCallback
+      (\ s a -> s{_plkrgipCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsGetIAMPolicy where
+        type Rs ProjectsLocationsKeyRingsGetIAMPolicy =
+             Policy
+        type Scopes ProjectsLocationsKeyRingsGetIAMPolicy =
+             '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsGetIAMPolicy'{..}
+          = go _plkrgipResource _plkrgipXgafv
+              _plkrgipUploadProtocol
+              _plkrgipAccessToken
+              _plkrgipUploadType
+              _plkrgipCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy ProjectsLocationsKeyRingsGetIAMPolicyResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/ImportJobs/GetIAMPolicy.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/ImportJobs/GetIAMPolicy.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/ImportJobs/GetIAMPolicy.hs
@@ -0,0 +1,161 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.GetIAMPolicy
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Gets the access control policy for a resource. Returns an empty policy
+-- if the resource exists and does not have a policy set.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.importJobs.getIamPolicy@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.GetIAMPolicy
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsImportJobsGetIAMPolicyResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsImportJobsGetIAMPolicy
+    , ProjectsLocationsKeyRingsImportJobsGetIAMPolicy
+
+    -- * Request Lenses
+    , plkrijgipXgafv
+    , plkrijgipUploadProtocol
+    , plkrijgipAccessToken
+    , plkrijgipUploadType
+    , plkrijgipResource
+    , plkrijgipCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.importJobs.getIamPolicy@ method which the
+-- 'ProjectsLocationsKeyRingsImportJobsGetIAMPolicy' request conforms to.
+type ProjectsLocationsKeyRingsImportJobsGetIAMPolicyResource
+     =
+     "v1" :>
+       CaptureMode "resource" "getIamPolicy" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :> Get '[JSON] Policy
+
+-- | Gets the access control policy for a resource. Returns an empty policy
+-- if the resource exists and does not have a policy set.
+--
+-- /See:/ 'projectsLocationsKeyRingsImportJobsGetIAMPolicy' smart constructor.
+data ProjectsLocationsKeyRingsImportJobsGetIAMPolicy = ProjectsLocationsKeyRingsImportJobsGetIAMPolicy'
+    { _plkrijgipXgafv          :: !(Maybe Xgafv)
+    , _plkrijgipUploadProtocol :: !(Maybe Text)
+    , _plkrijgipAccessToken    :: !(Maybe Text)
+    , _plkrijgipUploadType     :: !(Maybe Text)
+    , _plkrijgipResource       :: !Text
+    , _plkrijgipCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsImportJobsGetIAMPolicy' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrijgipXgafv'
+--
+-- * 'plkrijgipUploadProtocol'
+--
+-- * 'plkrijgipAccessToken'
+--
+-- * 'plkrijgipUploadType'
+--
+-- * 'plkrijgipResource'
+--
+-- * 'plkrijgipCallback'
+projectsLocationsKeyRingsImportJobsGetIAMPolicy
+    :: Text -- ^ 'plkrijgipResource'
+    -> ProjectsLocationsKeyRingsImportJobsGetIAMPolicy
+projectsLocationsKeyRingsImportJobsGetIAMPolicy pPlkrijgipResource_ =
+    ProjectsLocationsKeyRingsImportJobsGetIAMPolicy'
+    { _plkrijgipXgafv = Nothing
+    , _plkrijgipUploadProtocol = Nothing
+    , _plkrijgipAccessToken = Nothing
+    , _plkrijgipUploadType = Nothing
+    , _plkrijgipResource = pPlkrijgipResource_
+    , _plkrijgipCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrijgipXgafv :: Lens' ProjectsLocationsKeyRingsImportJobsGetIAMPolicy (Maybe Xgafv)
+plkrijgipXgafv
+  = lens _plkrijgipXgafv
+      (\ s a -> s{_plkrijgipXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrijgipUploadProtocol :: Lens' ProjectsLocationsKeyRingsImportJobsGetIAMPolicy (Maybe Text)
+plkrijgipUploadProtocol
+  = lens _plkrijgipUploadProtocol
+      (\ s a -> s{_plkrijgipUploadProtocol = a})
+
+-- | OAuth access token.
+plkrijgipAccessToken :: Lens' ProjectsLocationsKeyRingsImportJobsGetIAMPolicy (Maybe Text)
+plkrijgipAccessToken
+  = lens _plkrijgipAccessToken
+      (\ s a -> s{_plkrijgipAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrijgipUploadType :: Lens' ProjectsLocationsKeyRingsImportJobsGetIAMPolicy (Maybe Text)
+plkrijgipUploadType
+  = lens _plkrijgipUploadType
+      (\ s a -> s{_plkrijgipUploadType = a})
+
+-- | REQUIRED: The resource for which the policy is being requested. See the
+-- operation documentation for the appropriate value for this field.
+plkrijgipResource :: Lens' ProjectsLocationsKeyRingsImportJobsGetIAMPolicy Text
+plkrijgipResource
+  = lens _plkrijgipResource
+      (\ s a -> s{_plkrijgipResource = a})
+
+-- | JSONP
+plkrijgipCallback :: Lens' ProjectsLocationsKeyRingsImportJobsGetIAMPolicy (Maybe Text)
+plkrijgipCallback
+  = lens _plkrijgipCallback
+      (\ s a -> s{_plkrijgipCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsImportJobsGetIAMPolicy where
+        type Rs
+               ProjectsLocationsKeyRingsImportJobsGetIAMPolicy
+             = Policy
+        type Scopes
+               ProjectsLocationsKeyRingsImportJobsGetIAMPolicy
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsImportJobsGetIAMPolicy'{..}
+          = go _plkrijgipResource _plkrijgipXgafv
+              _plkrijgipUploadProtocol
+              _plkrijgipAccessToken
+              _plkrijgipUploadType
+              _plkrijgipCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsImportJobsGetIAMPolicyResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/ImportJobs/SetIAMPolicy.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/ImportJobs/SetIAMPolicy.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/ImportJobs/SetIAMPolicy.hs
@@ -0,0 +1,176 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.SetIAMPolicy
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Sets the access control policy on the specified resource. Replaces any
+-- existing policy.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.importJobs.setIamPolicy@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.SetIAMPolicy
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsImportJobsSetIAMPolicyResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsImportJobsSetIAMPolicy
+    , ProjectsLocationsKeyRingsImportJobsSetIAMPolicy
+
+    -- * Request Lenses
+    , plkrijsipXgafv
+    , plkrijsipUploadProtocol
+    , plkrijsipAccessToken
+    , plkrijsipUploadType
+    , plkrijsipPayload
+    , plkrijsipResource
+    , plkrijsipCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.importJobs.setIamPolicy@ method which the
+-- 'ProjectsLocationsKeyRingsImportJobsSetIAMPolicy' request conforms to.
+type ProjectsLocationsKeyRingsImportJobsSetIAMPolicyResource
+     =
+     "v1" :>
+       CaptureMode "resource" "setIamPolicy" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] SetIAMPolicyRequest :>
+                       Post '[JSON] Policy
+
+-- | Sets the access control policy on the specified resource. Replaces any
+-- existing policy.
+--
+-- /See:/ 'projectsLocationsKeyRingsImportJobsSetIAMPolicy' smart constructor.
+data ProjectsLocationsKeyRingsImportJobsSetIAMPolicy = ProjectsLocationsKeyRingsImportJobsSetIAMPolicy'
+    { _plkrijsipXgafv          :: !(Maybe Xgafv)
+    , _plkrijsipUploadProtocol :: !(Maybe Text)
+    , _plkrijsipAccessToken    :: !(Maybe Text)
+    , _plkrijsipUploadType     :: !(Maybe Text)
+    , _plkrijsipPayload        :: !SetIAMPolicyRequest
+    , _plkrijsipResource       :: !Text
+    , _plkrijsipCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsImportJobsSetIAMPolicy' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrijsipXgafv'
+--
+-- * 'plkrijsipUploadProtocol'
+--
+-- * 'plkrijsipAccessToken'
+--
+-- * 'plkrijsipUploadType'
+--
+-- * 'plkrijsipPayload'
+--
+-- * 'plkrijsipResource'
+--
+-- * 'plkrijsipCallback'
+projectsLocationsKeyRingsImportJobsSetIAMPolicy
+    :: SetIAMPolicyRequest -- ^ 'plkrijsipPayload'
+    -> Text -- ^ 'plkrijsipResource'
+    -> ProjectsLocationsKeyRingsImportJobsSetIAMPolicy
+projectsLocationsKeyRingsImportJobsSetIAMPolicy pPlkrijsipPayload_ pPlkrijsipResource_ =
+    ProjectsLocationsKeyRingsImportJobsSetIAMPolicy'
+    { _plkrijsipXgafv = Nothing
+    , _plkrijsipUploadProtocol = Nothing
+    , _plkrijsipAccessToken = Nothing
+    , _plkrijsipUploadType = Nothing
+    , _plkrijsipPayload = pPlkrijsipPayload_
+    , _plkrijsipResource = pPlkrijsipResource_
+    , _plkrijsipCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrijsipXgafv :: Lens' ProjectsLocationsKeyRingsImportJobsSetIAMPolicy (Maybe Xgafv)
+plkrijsipXgafv
+  = lens _plkrijsipXgafv
+      (\ s a -> s{_plkrijsipXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrijsipUploadProtocol :: Lens' ProjectsLocationsKeyRingsImportJobsSetIAMPolicy (Maybe Text)
+plkrijsipUploadProtocol
+  = lens _plkrijsipUploadProtocol
+      (\ s a -> s{_plkrijsipUploadProtocol = a})
+
+-- | OAuth access token.
+plkrijsipAccessToken :: Lens' ProjectsLocationsKeyRingsImportJobsSetIAMPolicy (Maybe Text)
+plkrijsipAccessToken
+  = lens _plkrijsipAccessToken
+      (\ s a -> s{_plkrijsipAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrijsipUploadType :: Lens' ProjectsLocationsKeyRingsImportJobsSetIAMPolicy (Maybe Text)
+plkrijsipUploadType
+  = lens _plkrijsipUploadType
+      (\ s a -> s{_plkrijsipUploadType = a})
+
+-- | Multipart request metadata.
+plkrijsipPayload :: Lens' ProjectsLocationsKeyRingsImportJobsSetIAMPolicy SetIAMPolicyRequest
+plkrijsipPayload
+  = lens _plkrijsipPayload
+      (\ s a -> s{_plkrijsipPayload = a})
+
+-- | REQUIRED: The resource for which the policy is being specified. See the
+-- operation documentation for the appropriate value for this field.
+plkrijsipResource :: Lens' ProjectsLocationsKeyRingsImportJobsSetIAMPolicy Text
+plkrijsipResource
+  = lens _plkrijsipResource
+      (\ s a -> s{_plkrijsipResource = a})
+
+-- | JSONP
+plkrijsipCallback :: Lens' ProjectsLocationsKeyRingsImportJobsSetIAMPolicy (Maybe Text)
+plkrijsipCallback
+  = lens _plkrijsipCallback
+      (\ s a -> s{_plkrijsipCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsImportJobsSetIAMPolicy where
+        type Rs
+               ProjectsLocationsKeyRingsImportJobsSetIAMPolicy
+             = Policy
+        type Scopes
+               ProjectsLocationsKeyRingsImportJobsSetIAMPolicy
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsImportJobsSetIAMPolicy'{..}
+          = go _plkrijsipResource _plkrijsipXgafv
+              _plkrijsipUploadProtocol
+              _plkrijsipAccessToken
+              _plkrijsipUploadType
+              _plkrijsipCallback
+              (Just AltJSON)
+              _plkrijsipPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsImportJobsSetIAMPolicyResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/ImportJobs/TestIAMPermissions.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/ImportJobs/TestIAMPermissions.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/ImportJobs/TestIAMPermissions.hs
@@ -0,0 +1,186 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.TestIAMPermissions
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Returns permissions that a caller has on the specified resource. If the
+-- resource does not exist, this will return an empty set of permissions,
+-- not a NOT_FOUND error. Note: This operation is designed to be used for
+-- building permission-aware UIs and command-line tools, not for
+-- authorization checking. This operation may \"fail open\" without
+-- warning.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.importJobs.testIamPermissions@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.TestIAMPermissions
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsImportJobsTestIAMPermissionsResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsImportJobsTestIAMPermissions
+    , ProjectsLocationsKeyRingsImportJobsTestIAMPermissions
+
+    -- * Request Lenses
+    , plkrijtipXgafv
+    , plkrijtipUploadProtocol
+    , plkrijtipAccessToken
+    , plkrijtipUploadType
+    , plkrijtipPayload
+    , plkrijtipResource
+    , plkrijtipCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.importJobs.testIamPermissions@ method which the
+-- 'ProjectsLocationsKeyRingsImportJobsTestIAMPermissions' request conforms to.
+type ProjectsLocationsKeyRingsImportJobsTestIAMPermissionsResource
+     =
+     "v1" :>
+       CaptureMode "resource" "testIamPermissions" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] TestIAMPermissionsRequest :>
+                       Post '[JSON] TestIAMPermissionsResponse
+
+-- | Returns permissions that a caller has on the specified resource. If the
+-- resource does not exist, this will return an empty set of permissions,
+-- not a NOT_FOUND error. Note: This operation is designed to be used for
+-- building permission-aware UIs and command-line tools, not for
+-- authorization checking. This operation may \"fail open\" without
+-- warning.
+--
+-- /See:/ 'projectsLocationsKeyRingsImportJobsTestIAMPermissions' smart constructor.
+data ProjectsLocationsKeyRingsImportJobsTestIAMPermissions = ProjectsLocationsKeyRingsImportJobsTestIAMPermissions'
+    { _plkrijtipXgafv          :: !(Maybe Xgafv)
+    , _plkrijtipUploadProtocol :: !(Maybe Text)
+    , _plkrijtipAccessToken    :: !(Maybe Text)
+    , _plkrijtipUploadType     :: !(Maybe Text)
+    , _plkrijtipPayload        :: !TestIAMPermissionsRequest
+    , _plkrijtipResource       :: !Text
+    , _plkrijtipCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsImportJobsTestIAMPermissions' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrijtipXgafv'
+--
+-- * 'plkrijtipUploadProtocol'
+--
+-- * 'plkrijtipAccessToken'
+--
+-- * 'plkrijtipUploadType'
+--
+-- * 'plkrijtipPayload'
+--
+-- * 'plkrijtipResource'
+--
+-- * 'plkrijtipCallback'
+projectsLocationsKeyRingsImportJobsTestIAMPermissions
+    :: TestIAMPermissionsRequest -- ^ 'plkrijtipPayload'
+    -> Text -- ^ 'plkrijtipResource'
+    -> ProjectsLocationsKeyRingsImportJobsTestIAMPermissions
+projectsLocationsKeyRingsImportJobsTestIAMPermissions pPlkrijtipPayload_ pPlkrijtipResource_ =
+    ProjectsLocationsKeyRingsImportJobsTestIAMPermissions'
+    { _plkrijtipXgafv = Nothing
+    , _plkrijtipUploadProtocol = Nothing
+    , _plkrijtipAccessToken = Nothing
+    , _plkrijtipUploadType = Nothing
+    , _plkrijtipPayload = pPlkrijtipPayload_
+    , _plkrijtipResource = pPlkrijtipResource_
+    , _plkrijtipCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrijtipXgafv :: Lens' ProjectsLocationsKeyRingsImportJobsTestIAMPermissions (Maybe Xgafv)
+plkrijtipXgafv
+  = lens _plkrijtipXgafv
+      (\ s a -> s{_plkrijtipXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrijtipUploadProtocol :: Lens' ProjectsLocationsKeyRingsImportJobsTestIAMPermissions (Maybe Text)
+plkrijtipUploadProtocol
+  = lens _plkrijtipUploadProtocol
+      (\ s a -> s{_plkrijtipUploadProtocol = a})
+
+-- | OAuth access token.
+plkrijtipAccessToken :: Lens' ProjectsLocationsKeyRingsImportJobsTestIAMPermissions (Maybe Text)
+plkrijtipAccessToken
+  = lens _plkrijtipAccessToken
+      (\ s a -> s{_plkrijtipAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrijtipUploadType :: Lens' ProjectsLocationsKeyRingsImportJobsTestIAMPermissions (Maybe Text)
+plkrijtipUploadType
+  = lens _plkrijtipUploadType
+      (\ s a -> s{_plkrijtipUploadType = a})
+
+-- | Multipart request metadata.
+plkrijtipPayload :: Lens' ProjectsLocationsKeyRingsImportJobsTestIAMPermissions TestIAMPermissionsRequest
+plkrijtipPayload
+  = lens _plkrijtipPayload
+      (\ s a -> s{_plkrijtipPayload = a})
+
+-- | REQUIRED: The resource for which the policy detail is being requested.
+-- See the operation documentation for the appropriate value for this
+-- field.
+plkrijtipResource :: Lens' ProjectsLocationsKeyRingsImportJobsTestIAMPermissions Text
+plkrijtipResource
+  = lens _plkrijtipResource
+      (\ s a -> s{_plkrijtipResource = a})
+
+-- | JSONP
+plkrijtipCallback :: Lens' ProjectsLocationsKeyRingsImportJobsTestIAMPermissions (Maybe Text)
+plkrijtipCallback
+  = lens _plkrijtipCallback
+      (\ s a -> s{_plkrijtipCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsImportJobsTestIAMPermissions
+         where
+        type Rs
+               ProjectsLocationsKeyRingsImportJobsTestIAMPermissions
+             = TestIAMPermissionsResponse
+        type Scopes
+               ProjectsLocationsKeyRingsImportJobsTestIAMPermissions
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsImportJobsTestIAMPermissions'{..}
+          = go _plkrijtipResource _plkrijtipXgafv
+              _plkrijtipUploadProtocol
+              _plkrijtipAccessToken
+              _plkrijtipUploadType
+              _plkrijtipCallback
+              (Just AltJSON)
+              _plkrijtipPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsImportJobsTestIAMPermissionsResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/List.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/List.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/List.hs
@@ -0,0 +1,184 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.List
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Lists KeyRings.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.list@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.List
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsListResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsList
+    , ProjectsLocationsKeyRingsList
+
+    -- * Request Lenses
+    , plkrlParent
+    , plkrlXgafv
+    , plkrlUploadProtocol
+    , plkrlAccessToken
+    , plkrlUploadType
+    , plkrlPageToken
+    , plkrlPageSize
+    , plkrlCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.list@ method which the
+-- 'ProjectsLocationsKeyRingsList' request conforms to.
+type ProjectsLocationsKeyRingsListResource =
+     "v1" :>
+       Capture "parent" Text :>
+         "keyRings" :>
+           QueryParam "$.xgafv" Xgafv :>
+             QueryParam "upload_protocol" Text :>
+               QueryParam "access_token" Text :>
+                 QueryParam "uploadType" Text :>
+                   QueryParam "pageToken" Text :>
+                     QueryParam "pageSize" (Textual Int32) :>
+                       QueryParam "callback" Text :>
+                         QueryParam "alt" AltJSON :>
+                           Get '[JSON] ListKeyRingsResponse
+
+-- | Lists KeyRings.
+--
+-- /See:/ 'projectsLocationsKeyRingsList' smart constructor.
+data ProjectsLocationsKeyRingsList = ProjectsLocationsKeyRingsList'
+    { _plkrlParent         :: !Text
+    , _plkrlXgafv          :: !(Maybe Xgafv)
+    , _plkrlUploadProtocol :: !(Maybe Text)
+    , _plkrlAccessToken    :: !(Maybe Text)
+    , _plkrlUploadType     :: !(Maybe Text)
+    , _plkrlPageToken      :: !(Maybe Text)
+    , _plkrlPageSize       :: !(Maybe (Textual Int32))
+    , _plkrlCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsList' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrlParent'
+--
+-- * 'plkrlXgafv'
+--
+-- * 'plkrlUploadProtocol'
+--
+-- * 'plkrlAccessToken'
+--
+-- * 'plkrlUploadType'
+--
+-- * 'plkrlPageToken'
+--
+-- * 'plkrlPageSize'
+--
+-- * 'plkrlCallback'
+projectsLocationsKeyRingsList
+    :: Text -- ^ 'plkrlParent'
+    -> ProjectsLocationsKeyRingsList
+projectsLocationsKeyRingsList pPlkrlParent_ =
+    ProjectsLocationsKeyRingsList'
+    { _plkrlParent = pPlkrlParent_
+    , _plkrlXgafv = Nothing
+    , _plkrlUploadProtocol = Nothing
+    , _plkrlAccessToken = Nothing
+    , _plkrlUploadType = Nothing
+    , _plkrlPageToken = Nothing
+    , _plkrlPageSize = Nothing
+    , _plkrlCallback = Nothing
+    }
+
+-- | Required. The resource name of the location associated with the
+-- KeyRings, in the format \`projects\/*\/locations\/*\`.
+plkrlParent :: Lens' ProjectsLocationsKeyRingsList Text
+plkrlParent
+  = lens _plkrlParent (\ s a -> s{_plkrlParent = a})
+
+-- | V1 error format.
+plkrlXgafv :: Lens' ProjectsLocationsKeyRingsList (Maybe Xgafv)
+plkrlXgafv
+  = lens _plkrlXgafv (\ s a -> s{_plkrlXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrlUploadProtocol :: Lens' ProjectsLocationsKeyRingsList (Maybe Text)
+plkrlUploadProtocol
+  = lens _plkrlUploadProtocol
+      (\ s a -> s{_plkrlUploadProtocol = a})
+
+-- | OAuth access token.
+plkrlAccessToken :: Lens' ProjectsLocationsKeyRingsList (Maybe Text)
+plkrlAccessToken
+  = lens _plkrlAccessToken
+      (\ s a -> s{_plkrlAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrlUploadType :: Lens' ProjectsLocationsKeyRingsList (Maybe Text)
+plkrlUploadType
+  = lens _plkrlUploadType
+      (\ s a -> s{_plkrlUploadType = a})
+
+-- | Optional pagination token, returned earlier via
+-- ListKeyRingsResponse.next_page_token.
+plkrlPageToken :: Lens' ProjectsLocationsKeyRingsList (Maybe Text)
+plkrlPageToken
+  = lens _plkrlPageToken
+      (\ s a -> s{_plkrlPageToken = a})
+
+-- | Optional limit on the number of KeyRings to include in the response.
+-- Further KeyRings can subsequently be obtained by including the
+-- ListKeyRingsResponse.next_page_token in a subsequent request. If
+-- unspecified, the server will pick an appropriate default.
+plkrlPageSize :: Lens' ProjectsLocationsKeyRingsList (Maybe Int32)
+plkrlPageSize
+  = lens _plkrlPageSize
+      (\ s a -> s{_plkrlPageSize = a})
+      . mapping _Coerce
+
+-- | JSONP
+plkrlCallback :: Lens' ProjectsLocationsKeyRingsList (Maybe Text)
+plkrlCallback
+  = lens _plkrlCallback
+      (\ s a -> s{_plkrlCallback = a})
+
+instance GoogleRequest ProjectsLocationsKeyRingsList
+         where
+        type Rs ProjectsLocationsKeyRingsList =
+             ListKeyRingsResponse
+        type Scopes ProjectsLocationsKeyRingsList =
+             '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient ProjectsLocationsKeyRingsList'{..}
+          = go _plkrlParent _plkrlXgafv _plkrlUploadProtocol
+              _plkrlAccessToken
+              _plkrlUploadType
+              _plkrlPageToken
+              _plkrlPageSize
+              _plkrlCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy ProjectsLocationsKeyRingsListResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/SetIAMPolicy.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/SetIAMPolicy.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/SetIAMPolicy.hs
@@ -0,0 +1,171 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.SetIAMPolicy
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Sets the access control policy on the specified resource. Replaces any
+-- existing policy.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.setIamPolicy@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.SetIAMPolicy
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsSetIAMPolicyResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsSetIAMPolicy
+    , ProjectsLocationsKeyRingsSetIAMPolicy
+
+    -- * Request Lenses
+    , plkrsipXgafv
+    , plkrsipUploadProtocol
+    , plkrsipAccessToken
+    , plkrsipUploadType
+    , plkrsipPayload
+    , plkrsipResource
+    , plkrsipCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.setIamPolicy@ method which the
+-- 'ProjectsLocationsKeyRingsSetIAMPolicy' request conforms to.
+type ProjectsLocationsKeyRingsSetIAMPolicyResource =
+     "v1" :>
+       CaptureMode "resource" "setIamPolicy" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] SetIAMPolicyRequest :>
+                       Post '[JSON] Policy
+
+-- | Sets the access control policy on the specified resource. Replaces any
+-- existing policy.
+--
+-- /See:/ 'projectsLocationsKeyRingsSetIAMPolicy' smart constructor.
+data ProjectsLocationsKeyRingsSetIAMPolicy = ProjectsLocationsKeyRingsSetIAMPolicy'
+    { _plkrsipXgafv          :: !(Maybe Xgafv)
+    , _plkrsipUploadProtocol :: !(Maybe Text)
+    , _plkrsipAccessToken    :: !(Maybe Text)
+    , _plkrsipUploadType     :: !(Maybe Text)
+    , _plkrsipPayload        :: !SetIAMPolicyRequest
+    , _plkrsipResource       :: !Text
+    , _plkrsipCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsSetIAMPolicy' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrsipXgafv'
+--
+-- * 'plkrsipUploadProtocol'
+--
+-- * 'plkrsipAccessToken'
+--
+-- * 'plkrsipUploadType'
+--
+-- * 'plkrsipPayload'
+--
+-- * 'plkrsipResource'
+--
+-- * 'plkrsipCallback'
+projectsLocationsKeyRingsSetIAMPolicy
+    :: SetIAMPolicyRequest -- ^ 'plkrsipPayload'
+    -> Text -- ^ 'plkrsipResource'
+    -> ProjectsLocationsKeyRingsSetIAMPolicy
+projectsLocationsKeyRingsSetIAMPolicy pPlkrsipPayload_ pPlkrsipResource_ =
+    ProjectsLocationsKeyRingsSetIAMPolicy'
+    { _plkrsipXgafv = Nothing
+    , _plkrsipUploadProtocol = Nothing
+    , _plkrsipAccessToken = Nothing
+    , _plkrsipUploadType = Nothing
+    , _plkrsipPayload = pPlkrsipPayload_
+    , _plkrsipResource = pPlkrsipResource_
+    , _plkrsipCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrsipXgafv :: Lens' ProjectsLocationsKeyRingsSetIAMPolicy (Maybe Xgafv)
+plkrsipXgafv
+  = lens _plkrsipXgafv (\ s a -> s{_plkrsipXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrsipUploadProtocol :: Lens' ProjectsLocationsKeyRingsSetIAMPolicy (Maybe Text)
+plkrsipUploadProtocol
+  = lens _plkrsipUploadProtocol
+      (\ s a -> s{_plkrsipUploadProtocol = a})
+
+-- | OAuth access token.
+plkrsipAccessToken :: Lens' ProjectsLocationsKeyRingsSetIAMPolicy (Maybe Text)
+plkrsipAccessToken
+  = lens _plkrsipAccessToken
+      (\ s a -> s{_plkrsipAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrsipUploadType :: Lens' ProjectsLocationsKeyRingsSetIAMPolicy (Maybe Text)
+plkrsipUploadType
+  = lens _plkrsipUploadType
+      (\ s a -> s{_plkrsipUploadType = a})
+
+-- | Multipart request metadata.
+plkrsipPayload :: Lens' ProjectsLocationsKeyRingsSetIAMPolicy SetIAMPolicyRequest
+plkrsipPayload
+  = lens _plkrsipPayload
+      (\ s a -> s{_plkrsipPayload = a})
+
+-- | REQUIRED: The resource for which the policy is being specified. See the
+-- operation documentation for the appropriate value for this field.
+plkrsipResource :: Lens' ProjectsLocationsKeyRingsSetIAMPolicy Text
+plkrsipResource
+  = lens _plkrsipResource
+      (\ s a -> s{_plkrsipResource = a})
+
+-- | JSONP
+plkrsipCallback :: Lens' ProjectsLocationsKeyRingsSetIAMPolicy (Maybe Text)
+plkrsipCallback
+  = lens _plkrsipCallback
+      (\ s a -> s{_plkrsipCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsSetIAMPolicy where
+        type Rs ProjectsLocationsKeyRingsSetIAMPolicy =
+             Policy
+        type Scopes ProjectsLocationsKeyRingsSetIAMPolicy =
+             '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsSetIAMPolicy'{..}
+          = go _plkrsipResource _plkrsipXgafv
+              _plkrsipUploadProtocol
+              _plkrsipAccessToken
+              _plkrsipUploadType
+              _plkrsipCallback
+              (Just AltJSON)
+              _plkrsipPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy ProjectsLocationsKeyRingsSetIAMPolicyResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/TestIAMPermissions.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/TestIAMPermissions.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/KeyRings/TestIAMPermissions.hs
@@ -0,0 +1,183 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.TestIAMPermissions
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Returns permissions that a caller has on the specified resource. If the
+-- resource does not exist, this will return an empty set of permissions,
+-- not a NOT_FOUND error. Note: This operation is designed to be used for
+-- building permission-aware UIs and command-line tools, not for
+-- authorization checking. This operation may \"fail open\" without
+-- warning.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.keyRings.testIamPermissions@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.TestIAMPermissions
+    (
+    -- * REST Resource
+      ProjectsLocationsKeyRingsTestIAMPermissionsResource
+
+    -- * Creating a Request
+    , projectsLocationsKeyRingsTestIAMPermissions
+    , ProjectsLocationsKeyRingsTestIAMPermissions
+
+    -- * Request Lenses
+    , plkrtipXgafv
+    , plkrtipUploadProtocol
+    , plkrtipAccessToken
+    , plkrtipUploadType
+    , plkrtipPayload
+    , plkrtipResource
+    , plkrtipCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.keyRings.testIamPermissions@ method which the
+-- 'ProjectsLocationsKeyRingsTestIAMPermissions' request conforms to.
+type ProjectsLocationsKeyRingsTestIAMPermissionsResource
+     =
+     "v1" :>
+       CaptureMode "resource" "testIamPermissions" Text :>
+         QueryParam "$.xgafv" Xgafv :>
+           QueryParam "upload_protocol" Text :>
+             QueryParam "access_token" Text :>
+               QueryParam "uploadType" Text :>
+                 QueryParam "callback" Text :>
+                   QueryParam "alt" AltJSON :>
+                     ReqBody '[JSON] TestIAMPermissionsRequest :>
+                       Post '[JSON] TestIAMPermissionsResponse
+
+-- | Returns permissions that a caller has on the specified resource. If the
+-- resource does not exist, this will return an empty set of permissions,
+-- not a NOT_FOUND error. Note: This operation is designed to be used for
+-- building permission-aware UIs and command-line tools, not for
+-- authorization checking. This operation may \"fail open\" without
+-- warning.
+--
+-- /See:/ 'projectsLocationsKeyRingsTestIAMPermissions' smart constructor.
+data ProjectsLocationsKeyRingsTestIAMPermissions = ProjectsLocationsKeyRingsTestIAMPermissions'
+    { _plkrtipXgafv          :: !(Maybe Xgafv)
+    , _plkrtipUploadProtocol :: !(Maybe Text)
+    , _plkrtipAccessToken    :: !(Maybe Text)
+    , _plkrtipUploadType     :: !(Maybe Text)
+    , _plkrtipPayload        :: !TestIAMPermissionsRequest
+    , _plkrtipResource       :: !Text
+    , _plkrtipCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsKeyRingsTestIAMPermissions' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'plkrtipXgafv'
+--
+-- * 'plkrtipUploadProtocol'
+--
+-- * 'plkrtipAccessToken'
+--
+-- * 'plkrtipUploadType'
+--
+-- * 'plkrtipPayload'
+--
+-- * 'plkrtipResource'
+--
+-- * 'plkrtipCallback'
+projectsLocationsKeyRingsTestIAMPermissions
+    :: TestIAMPermissionsRequest -- ^ 'plkrtipPayload'
+    -> Text -- ^ 'plkrtipResource'
+    -> ProjectsLocationsKeyRingsTestIAMPermissions
+projectsLocationsKeyRingsTestIAMPermissions pPlkrtipPayload_ pPlkrtipResource_ =
+    ProjectsLocationsKeyRingsTestIAMPermissions'
+    { _plkrtipXgafv = Nothing
+    , _plkrtipUploadProtocol = Nothing
+    , _plkrtipAccessToken = Nothing
+    , _plkrtipUploadType = Nothing
+    , _plkrtipPayload = pPlkrtipPayload_
+    , _plkrtipResource = pPlkrtipResource_
+    , _plkrtipCallback = Nothing
+    }
+
+-- | V1 error format.
+plkrtipXgafv :: Lens' ProjectsLocationsKeyRingsTestIAMPermissions (Maybe Xgafv)
+plkrtipXgafv
+  = lens _plkrtipXgafv (\ s a -> s{_plkrtipXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+plkrtipUploadProtocol :: Lens' ProjectsLocationsKeyRingsTestIAMPermissions (Maybe Text)
+plkrtipUploadProtocol
+  = lens _plkrtipUploadProtocol
+      (\ s a -> s{_plkrtipUploadProtocol = a})
+
+-- | OAuth access token.
+plkrtipAccessToken :: Lens' ProjectsLocationsKeyRingsTestIAMPermissions (Maybe Text)
+plkrtipAccessToken
+  = lens _plkrtipAccessToken
+      (\ s a -> s{_plkrtipAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+plkrtipUploadType :: Lens' ProjectsLocationsKeyRingsTestIAMPermissions (Maybe Text)
+plkrtipUploadType
+  = lens _plkrtipUploadType
+      (\ s a -> s{_plkrtipUploadType = a})
+
+-- | Multipart request metadata.
+plkrtipPayload :: Lens' ProjectsLocationsKeyRingsTestIAMPermissions TestIAMPermissionsRequest
+plkrtipPayload
+  = lens _plkrtipPayload
+      (\ s a -> s{_plkrtipPayload = a})
+
+-- | REQUIRED: The resource for which the policy detail is being requested.
+-- See the operation documentation for the appropriate value for this
+-- field.
+plkrtipResource :: Lens' ProjectsLocationsKeyRingsTestIAMPermissions Text
+plkrtipResource
+  = lens _plkrtipResource
+      (\ s a -> s{_plkrtipResource = a})
+
+-- | JSONP
+plkrtipCallback :: Lens' ProjectsLocationsKeyRingsTestIAMPermissions (Maybe Text)
+plkrtipCallback
+  = lens _plkrtipCallback
+      (\ s a -> s{_plkrtipCallback = a})
+
+instance GoogleRequest
+         ProjectsLocationsKeyRingsTestIAMPermissions where
+        type Rs ProjectsLocationsKeyRingsTestIAMPermissions =
+             TestIAMPermissionsResponse
+        type Scopes
+               ProjectsLocationsKeyRingsTestIAMPermissions
+             = '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient
+          ProjectsLocationsKeyRingsTestIAMPermissions'{..}
+          = go _plkrtipResource _plkrtipXgafv
+              _plkrtipUploadProtocol
+              _plkrtipAccessToken
+              _plkrtipUploadType
+              _plkrtipCallback
+              (Just AltJSON)
+              _plkrtipPayload
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy ::
+                         Proxy
+                           ProjectsLocationsKeyRingsTestIAMPermissionsResource)
+                      mempty
diff --git a/gen/Network/Google/Resource/CloudKMS/Projects/Locations/List.hs b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/List.hs
new file mode 100644
--- /dev/null
+++ b/gen/Network/Google/Resource/CloudKMS/Projects/Locations/List.hs
@@ -0,0 +1,183 @@
+{-# LANGUAGE DataKinds          #-}
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE DeriveGeneric      #-}
+{-# LANGUAGE FlexibleInstances  #-}
+{-# LANGUAGE NoImplicitPrelude  #-}
+{-# LANGUAGE OverloadedStrings  #-}
+{-# LANGUAGE RecordWildCards    #-}
+{-# LANGUAGE TypeFamilies       #-}
+{-# LANGUAGE TypeOperators      #-}
+
+{-# OPTIONS_GHC -fno-warn-duplicate-exports #-}
+{-# OPTIONS_GHC -fno-warn-unused-binds      #-}
+{-# OPTIONS_GHC -fno-warn-unused-imports    #-}
+
+-- |
+-- Module      : Network.Google.Resource.CloudKMS.Projects.Locations.List
+-- Copyright   : (c) 2015-2016 Brendan Hay
+-- License     : Mozilla Public License, v. 2.0.
+-- Maintainer  : Brendan Hay <brendan.g.hay@gmail.com>
+-- Stability   : auto-generated
+-- Portability : non-portable (GHC extensions)
+--
+-- Lists information about the supported locations for this service.
+--
+-- /See:/ <https://cloud.google.com/kms/ Cloud Key Management Service (KMS) API Reference> for @cloudkms.projects.locations.list@.
+module Network.Google.Resource.CloudKMS.Projects.Locations.List
+    (
+    -- * REST Resource
+      ProjectsLocationsListResource
+
+    -- * Creating a Request
+    , projectsLocationsList
+    , ProjectsLocationsList
+
+    -- * Request Lenses
+    , pllXgafv
+    , pllUploadProtocol
+    , pllAccessToken
+    , pllUploadType
+    , pllName
+    , pllFilter
+    , pllPageToken
+    , pllPageSize
+    , pllCallback
+    ) where
+
+import           Network.Google.CloudKMS.Types
+import           Network.Google.Prelude
+
+-- | A resource alias for @cloudkms.projects.locations.list@ method which the
+-- 'ProjectsLocationsList' request conforms to.
+type ProjectsLocationsListResource =
+     "v1" :>
+       Capture "name" Text :>
+         "locations" :>
+           QueryParam "$.xgafv" Xgafv :>
+             QueryParam "upload_protocol" Text :>
+               QueryParam "access_token" Text :>
+                 QueryParam "uploadType" Text :>
+                   QueryParam "filter" Text :>
+                     QueryParam "pageToken" Text :>
+                       QueryParam "pageSize" (Textual Int32) :>
+                         QueryParam "callback" Text :>
+                           QueryParam "alt" AltJSON :>
+                             Get '[JSON] ListLocationsResponse
+
+-- | Lists information about the supported locations for this service.
+--
+-- /See:/ 'projectsLocationsList' smart constructor.
+data ProjectsLocationsList = ProjectsLocationsList'
+    { _pllXgafv          :: !(Maybe Xgafv)
+    , _pllUploadProtocol :: !(Maybe Text)
+    , _pllAccessToken    :: !(Maybe Text)
+    , _pllUploadType     :: !(Maybe Text)
+    , _pllName           :: !Text
+    , _pllFilter         :: !(Maybe Text)
+    , _pllPageToken      :: !(Maybe Text)
+    , _pllPageSize       :: !(Maybe (Textual Int32))
+    , _pllCallback       :: !(Maybe Text)
+    } deriving (Eq,Show,Data,Typeable,Generic)
+
+-- | Creates a value of 'ProjectsLocationsList' with the minimum fields required to make a request.
+--
+-- Use one of the following lenses to modify other fields as desired:
+--
+-- * 'pllXgafv'
+--
+-- * 'pllUploadProtocol'
+--
+-- * 'pllAccessToken'
+--
+-- * 'pllUploadType'
+--
+-- * 'pllName'
+--
+-- * 'pllFilter'
+--
+-- * 'pllPageToken'
+--
+-- * 'pllPageSize'
+--
+-- * 'pllCallback'
+projectsLocationsList
+    :: Text -- ^ 'pllName'
+    -> ProjectsLocationsList
+projectsLocationsList pPllName_ =
+    ProjectsLocationsList'
+    { _pllXgafv = Nothing
+    , _pllUploadProtocol = Nothing
+    , _pllAccessToken = Nothing
+    , _pllUploadType = Nothing
+    , _pllName = pPllName_
+    , _pllFilter = Nothing
+    , _pllPageToken = Nothing
+    , _pllPageSize = Nothing
+    , _pllCallback = Nothing
+    }
+
+-- | V1 error format.
+pllXgafv :: Lens' ProjectsLocationsList (Maybe Xgafv)
+pllXgafv = lens _pllXgafv (\ s a -> s{_pllXgafv = a})
+
+-- | Upload protocol for media (e.g. \"raw\", \"multipart\").
+pllUploadProtocol :: Lens' ProjectsLocationsList (Maybe Text)
+pllUploadProtocol
+  = lens _pllUploadProtocol
+      (\ s a -> s{_pllUploadProtocol = a})
+
+-- | OAuth access token.
+pllAccessToken :: Lens' ProjectsLocationsList (Maybe Text)
+pllAccessToken
+  = lens _pllAccessToken
+      (\ s a -> s{_pllAccessToken = a})
+
+-- | Legacy upload protocol for media (e.g. \"media\", \"multipart\").
+pllUploadType :: Lens' ProjectsLocationsList (Maybe Text)
+pllUploadType
+  = lens _pllUploadType
+      (\ s a -> s{_pllUploadType = a})
+
+-- | The resource that owns the locations collection, if applicable.
+pllName :: Lens' ProjectsLocationsList Text
+pllName = lens _pllName (\ s a -> s{_pllName = a})
+
+-- | The standard list filter.
+pllFilter :: Lens' ProjectsLocationsList (Maybe Text)
+pllFilter
+  = lens _pllFilter (\ s a -> s{_pllFilter = a})
+
+-- | The standard list page token.
+pllPageToken :: Lens' ProjectsLocationsList (Maybe Text)
+pllPageToken
+  = lens _pllPageToken (\ s a -> s{_pllPageToken = a})
+
+-- | The standard list page size.
+pllPageSize :: Lens' ProjectsLocationsList (Maybe Int32)
+pllPageSize
+  = lens _pllPageSize (\ s a -> s{_pllPageSize = a}) .
+      mapping _Coerce
+
+-- | JSONP
+pllCallback :: Lens' ProjectsLocationsList (Maybe Text)
+pllCallback
+  = lens _pllCallback (\ s a -> s{_pllCallback = a})
+
+instance GoogleRequest ProjectsLocationsList where
+        type Rs ProjectsLocationsList = ListLocationsResponse
+        type Scopes ProjectsLocationsList =
+             '["https://www.googleapis.com/auth/cloud-platform"]
+        requestClient ProjectsLocationsList'{..}
+          = go _pllName _pllXgafv _pllUploadProtocol
+              _pllAccessToken
+              _pllUploadType
+              _pllFilter
+              _pllPageToken
+              _pllPageSize
+              _pllCallback
+              (Just AltJSON)
+              cloudKMSService
+          where go
+                  = buildClient
+                      (Proxy :: Proxy ProjectsLocationsListResource)
+                      mempty
diff --git a/gogol-cloudkms.cabal b/gogol-cloudkms.cabal
new file mode 100644
--- /dev/null
+++ b/gogol-cloudkms.cabal
@@ -0,0 +1,76 @@
+name:                  gogol-cloudkms
+version:               0.4.0
+synopsis:              Google Cloud Key Management Service (KMS) SDK.
+homepage:              https://github.com/brendanhay/gogol
+bug-reports:           https://github.com/brendanhay/gogol/issues
+license:               OtherLicense
+license-file:          LICENSE
+author:                Brendan Hay
+maintainer:            Brendan Hay <brendan.g.hay@gmail.com>
+copyright:             Copyright (c) 2015-2016 Brendan Hay
+category:              Network, Google, Cloud
+build-type:            Simple
+cabal-version:         >= 1.10
+extra-source-files:    README.md src/.gitkeep
+
+description:
+    Manages keys and performs cryptographic operations in a central cloud
+    service, for direct use by other cloud resources and applications.
+    .
+    /Warning:/ This is an experimental prototype/preview release which is still
+    under exploratory development and not intended for public use, caveat emptor!
+    .
+    This library is compatible with version @v1@
+    of the API.
+
+source-repository head
+    type:     git
+    location: git://github.com/brendanhay/gogol.git
+
+library
+    default-language:  Haskell2010
+    hs-source-dirs:    src gen
+
+    ghc-options:       -Wall
+
+    exposed-modules:
+          Network.Google.CloudKMS
+        , Network.Google.CloudKMS.Types
+        , Network.Google.Resource.CloudKMS.Projects.Locations.Get
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.Create
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Create
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.AsymmetricDecrypt
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.AsymmetricSign
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Create
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Destroy
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Get
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.GetPublicKey
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.List
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Patch
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.CryptoKeyVersions.Restore
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Decrypt
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Encrypt
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Get
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.GetIAMPolicy
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.List
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.Patch
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.SetIAMPolicy
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.TestIAMPermissions
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.CryptoKeys.UpdatePrimaryVersion
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.Get
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.GetIAMPolicy
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.GetIAMPolicy
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.SetIAMPolicy
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.ImportJobs.TestIAMPermissions
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.List
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.SetIAMPolicy
+        , Network.Google.Resource.CloudKMS.Projects.Locations.KeyRings.TestIAMPermissions
+        , Network.Google.Resource.CloudKMS.Projects.Locations.List
+
+    other-modules:
+          Network.Google.CloudKMS.Types.Product
+        , Network.Google.CloudKMS.Types.Sum
+
+    build-depends:
+          gogol-core == 0.4.0.*
+        , base       >= 4.7 && < 5
diff --git a/src/.gitkeep b/src/.gitkeep
new file mode 100644
--- /dev/null
+++ b/src/.gitkeep
