- [JSON representation](https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#SCHEMA_REPRESENTATION)
- [GcpWrappedKeyInfo](https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#GcpWrappedKeyInfo)
  - [JSON representation](https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#GcpWrappedKeyInfo.SCHEMA_REPRESENTATION)
- [KeyType](https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#KeyType)
- [AwsWrappedKeyInfo](https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#AwsWrappedKeyInfo)
  - [JSON representation](https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#AwsWrappedKeyInfo.SCHEMA_REPRESENTATION)
- [KeyType](https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#KeyType_1)
- [CoordinatorKeyInfo](https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#CoordinatorKeyInfo)
  - [JSON representation](https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#CoordinatorKeyInfo.SCHEMA_REPRESENTATION)

Encryption information for the data being ingested.

| JSON representation |
|---|
| ``` { // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "gcpWrappedKeyInfo": { object (`https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#GcpWrappedKeyInfo`) }, "awsWrappedKeyInfo": { object (`https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#AwsWrappedKeyInfo`) }, "coordinatorKeyInfo": { object (`https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#CoordinatorKeyInfo`) } // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| The [wrapped key](https://cloud.google.com/kms/docs/key-wrapping) used to encrypt the data. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `gcpWrappedKeyInfo` | ``object (`https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#GcpWrappedKeyInfo`)`` Google Cloud Platform wrapped key information. |
| `awsWrappedKeyInfo` | ``object (`https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#AwsWrappedKeyInfo`)`` Amazon Web Services wrapped key information. |
| `coordinatorKeyInfo` | ``object (`https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#CoordinatorKeyInfo`)`` Key information for the chosen coordinator key. This is not supported for the `https://developers.google.com/data-manager/api/reference/rest/v1/events/ingest#google.ads.datamanager.v1.IngestionService.IngestEvents`, `https://developers.google.com/data-manager/api/reference/rest/v1/audienceMembers/ingest#google.ads.datamanager.v1.IngestionService.IngestAudienceMembers`, and `https://developers.google.com/data-manager/api/reference/rest/v1/audienceMembers/remove#google.ads.datamanager.v1.IngestionService.RemoveAudienceMembers` methods. |
| End of mutually exclusive fields. ||

## GcpWrappedKeyInfo

Information about the Google Cloud Platform wrapped key.

| JSON representation |
|---|
| ``` { "keyType": enum (`https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#KeyType`), "wipProvider": string, "kekUri": string, "encryptedDek": string } ``` |

| Fields ||
|---|---|
| `keyType` | ``enum (`https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#KeyType`)`` Required. The type of algorithm used to encrypt the data. |
| `wipProvider` | `string` Required. The [Workload Identity](https://cloud.google.com/iam/docs/workload-identity-federation) pool provider required to use KEK. |
| `kekUri` | `string` Required. Google Cloud Platform [Cloud Key Management Service resource ID](https://cloud.google.com/kms/docs/getting-resource-ids). Should be in the format of `projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{key}` or `gcp-kms://projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{key}` |
| `encryptedDek` | `string` Required. The base64 encoded encrypted data encryption key. |

## KeyType

The type of algorithm used to encrypt the data.

| Enums ||
|---|---|
| `KEY_TYPE_UNSPECIFIED` | Unspecified key type. Should never be used. |
| `XCHACHA20_POLY1305` | Algorithm XChaCha20-Poly1305 |

## AwsWrappedKeyInfo

A data encryption key wrapped by an AWS KMS key.

| JSON representation |
|---|
| ``` { "keyType": enum (`https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#KeyType_1`), "roleArn": string, "kekUri": string, "encryptedDek": string } ``` |

| Fields ||
|---|---|
| `keyType` | ``enum (`https://developers.google.com/data-manager/api/reference/rest/v1/EncryptionInfo#KeyType_1`)`` Required. The type of algorithm used to encrypt the data. |
| `roleArn` | `string` Required. The Amazon Resource Name of the IAM Role to assume for KMS decryption access. Should be in the format of `arn:{partition}:iam::{accountId}:role/{role_name}` |
| `kekUri` | `string` Required. The URI of the AWS KMS key used to decrypt the DEK. Should be in the format of `arn:{partition}:kms:{region}:{accountId}:key/{keyId}` or `aws-kms://arn:{partition}:kms:{region}:{accountId}:key/{keyId}` |
| `encryptedDek` | `string` Required. The base64 encoded encrypted data encryption key. |

## KeyType

The type of algorithm used to encrypt the data.

| Enums ||
|---|---|
| `KEY_TYPE_UNSPECIFIED` | Unspecified key type. Should never be used. |
| `XCHACHA20_POLY1305` | Algorithm XChaCha20-Poly1305 |

## CoordinatorKeyInfo

Information about the coordinator key.

| JSON representation |
|---|
| ``` { "keyId": string } ``` |

| Fields ||
|---|---|
| `keyId` | `string` Required. The ID of the chosen coordinator key. |