From d1634f20c728f4beccd266403637c9eb8121941d Mon Sep 17 00:00:00 2001
From: Yoshi Automation Bot <yoshi-automation@google.com>
Date: Mon, 9 Aug 2021 18:48:59 -0700
Subject: [PATCH] feat: add support for HMAC, Variable Key Destruction, and
 GenerateRandom (#566)

PiperOrigin-RevId: 389008671

Source-Author: Google APIs <noreply@google.com>
Source-Date: Thu Aug 5 13:21:02 2021 -0700
Source-Repo: googleapis/googleapis
Source-Sha: 2efb6951f151116fb7b5766fb4e377db465d49e9
Source-Link: https://github.com/googleapis/googleapis/commit/2efb6951f151116fb7b5766fb4e377db465d49e9
---
 .../kms/v1/KeyManagementServiceClient.java    | 1004 +++++++---
 .../kms/v1/KeyManagementServiceSettings.java  |   82 +-
 .../google/cloud/kms/v1/gapic_metadata.json   |    9 +
 .../v1/stub/GrpcKeyManagementServiceStub.java |  246 ++-
 .../kms/v1/stub/KeyManagementServiceStub.java |   39 +-
 .../KeyManagementServiceStubSettings.java     |  199 +-
 .../v1/KeyManagementServiceClientTest.java    |  773 +++++---
 .../kms/v1/MockKeyManagementServiceImpl.java  |   99 +-
 .../kms/v1/KeyManagementServiceGrpc.java      |  862 ++++++---
 .../kms/v1/AsymmetricDecryptRequest.java      |   12 -
 .../v1/AsymmetricDecryptRequestOrBuilder.java |    3 -
 .../kms/v1/AsymmetricDecryptResponse.java     |  168 +-
 .../AsymmetricDecryptResponseOrBuilder.java   |   29 +-
 .../cloud/kms/v1/AsymmetricSignRequest.java   |   12 -
 .../v1/AsymmetricSignRequestOrBuilder.java    |    3 -
 .../cloud/kms/v1/AsymmetricSignResponse.java  |  175 +-
 .../v1/AsymmetricSignResponseOrBuilder.java   |   31 +-
 .../com/google/cloud/kms/v1/CryptoKey.java    |  465 +++++
 .../cloud/kms/v1/CryptoKeyOrBuilder.java      |   66 +
 .../google/cloud/kms/v1/CryptoKeyVersion.java |   28 +-
 .../google/cloud/kms/v1/DecryptRequest.java   |   24 -
 .../cloud/kms/v1/DecryptRequestOrBuilder.java |    6 -
 .../google/cloud/kms/v1/DecryptResponse.java  |  254 ++-
 .../kms/v1/DecryptResponseOrBuilder.java      |   41 +-
 .../google/cloud/kms/v1/EncryptRequest.java   |   24 -
 .../cloud/kms/v1/EncryptRequestOrBuilder.java |    6 -
 .../google/cloud/kms/v1/EncryptResponse.java  |  172 +-
 .../kms/v1/EncryptResponseOrBuilder.java      |   30 +-
 .../kms/v1/GenerateRandomBytesRequest.java    |  896 +++++++++
 .../GenerateRandomBytesRequestOrBuilder.java  |   93 +
 .../kms/v1/GenerateRandomBytesResponse.java   |  945 +++++++++
 .../GenerateRandomBytesResponseOrBuilder.java |  103 +
 .../com/google/cloud/kms/v1/KmsProto.java     |  542 ++++--
 .../cloud/kms/v1/KmsResourcesProto.java       |  221 +--
 .../google/cloud/kms/v1/MacSignRequest.java   | 1175 ++++++++++++
 .../cloud/kms/v1/MacSignRequestOrBuilder.java |  142 ++
 .../google/cloud/kms/v1/MacSignResponse.java  | 1396 ++++++++++++++
 .../kms/v1/MacSignResponseOrBuilder.java      |  175 ++
 .../google/cloud/kms/v1/MacVerifyRequest.java | 1697 +++++++++++++++++
 .../kms/v1/MacVerifyRequestOrBuilder.java     |  229 +++
 .../cloud/kms/v1/MacVerifyResponse.java       | 1232 ++++++++++++
 .../kms/v1/MacVerifyResponseOrBuilder.java    |  149 ++
 .../com/google/cloud/kms/v1/PublicKey.java    |  152 ++
 .../cloud/kms/v1/PublicKeyOrBuilder.java      |   25 +
 .../proto/google/cloud/kms/v1/resources.proto |   27 +-
 .../proto/google/cloud/kms/v1/service.proto   |  416 +++-
 synth.metadata                                |   18 +-
 47 files changed, 12885 insertions(+), 1610 deletions(-)
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesRequest.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesRequestOrBuilder.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesResponse.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesResponseOrBuilder.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignRequest.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignRequestOrBuilder.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignResponse.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignResponseOrBuilder.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyRequest.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyRequestOrBuilder.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyResponse.java
 create mode 100644 proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyResponseOrBuilder.java

diff --git a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceClient.java b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceClient.java
index 17abefd9..e205cdeb 100644
--- a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceClient.java
+++ b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceClient.java
@@ -2132,6 +2132,459 @@ public final CryptoKeyVersion updateCryptoKeyVersion(UpdateCryptoKeyVersionReque
     return stub.updateCryptoKeyVersionCallable();
   }
 
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in
+   * [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
+   *
+   * <p>Returns an error if called on a key whose purpose is not
+   * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   CryptoKeyName name =
+   *       CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]");
+   *   String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
+   *   CryptoKey response =
+   *       keyManagementServiceClient.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
+   * }
+   * }</pre>
+   *
+   * @param name Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to
+   *     update.
+   * @param cryptoKeyVersionId Required. The id of the child
+   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as primary.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final CryptoKey updateCryptoKeyPrimaryVersion(
+      CryptoKeyName name, String cryptoKeyVersionId) {
+    UpdateCryptoKeyPrimaryVersionRequest request =
+        UpdateCryptoKeyPrimaryVersionRequest.newBuilder()
+            .setName(name == null ? null : name.toString())
+            .setCryptoKeyVersionId(cryptoKeyVersionId)
+            .build();
+    return updateCryptoKeyPrimaryVersion(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in
+   * [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
+   *
+   * <p>Returns an error if called on a key whose purpose is not
+   * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   String name =
+   *       CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]").toString();
+   *   String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
+   *   CryptoKey response =
+   *       keyManagementServiceClient.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
+   * }
+   * }</pre>
+   *
+   * @param name Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to
+   *     update.
+   * @param cryptoKeyVersionId Required. The id of the child
+   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as primary.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final CryptoKey updateCryptoKeyPrimaryVersion(String name, String cryptoKeyVersionId) {
+    UpdateCryptoKeyPrimaryVersionRequest request =
+        UpdateCryptoKeyPrimaryVersionRequest.newBuilder()
+            .setName(name)
+            .setCryptoKeyVersionId(cryptoKeyVersionId)
+            .build();
+    return updateCryptoKeyPrimaryVersion(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in
+   * [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
+   *
+   * <p>Returns an error if called on a key whose purpose is not
+   * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   UpdateCryptoKeyPrimaryVersionRequest request =
+   *       UpdateCryptoKeyPrimaryVersionRequest.newBuilder()
+   *           .setName(
+   *               CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]")
+   *                   .toString())
+   *           .setCryptoKeyVersionId("cryptoKeyVersionId987674581")
+   *           .build();
+   *   CryptoKey response = keyManagementServiceClient.updateCryptoKeyPrimaryVersion(request);
+   * }
+   * }</pre>
+   *
+   * @param request The request object containing all of the parameters for the API call.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final CryptoKey updateCryptoKeyPrimaryVersion(
+      UpdateCryptoKeyPrimaryVersionRequest request) {
+    return updateCryptoKeyPrimaryVersionCallable().call(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in
+   * [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
+   *
+   * <p>Returns an error if called on a key whose purpose is not
+   * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   UpdateCryptoKeyPrimaryVersionRequest request =
+   *       UpdateCryptoKeyPrimaryVersionRequest.newBuilder()
+   *           .setName(
+   *               CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]")
+   *                   .toString())
+   *           .setCryptoKeyVersionId("cryptoKeyVersionId987674581")
+   *           .build();
+   *   ApiFuture<CryptoKey> future =
+   *       keyManagementServiceClient.updateCryptoKeyPrimaryVersionCallable().futureCall(request);
+   *   // Do something.
+   *   CryptoKey response = future.get();
+   * }
+   * }</pre>
+   */
+  public final UnaryCallable<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
+      updateCryptoKeyPrimaryVersionCallable() {
+    return stub.updateCryptoKeyPrimaryVersionCallable();
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
+   *
+   * <p>Upon calling this method,
+   * [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
+   * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+   * will be changed to
+   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
+   * material will be irrevocably destroyed.
+   *
+   * <p>Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
+   * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may
+   * be called to reverse the process.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   CryptoKeyVersionName name =
+   *       CryptoKeyVersionName.of(
+   *           "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+   *   CryptoKeyVersion response = keyManagementServiceClient.destroyCryptoKeyVersion(name);
+   * }
+   * }</pre>
+   *
+   * @param name Required. The resource name of the
+   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to destroy.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final CryptoKeyVersion destroyCryptoKeyVersion(CryptoKeyVersionName name) {
+    DestroyCryptoKeyVersionRequest request =
+        DestroyCryptoKeyVersionRequest.newBuilder()
+            .setName(name == null ? null : name.toString())
+            .build();
+    return destroyCryptoKeyVersion(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
+   *
+   * <p>Upon calling this method,
+   * [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
+   * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+   * will be changed to
+   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
+   * material will be irrevocably destroyed.
+   *
+   * <p>Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
+   * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may
+   * be called to reverse the process.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   String name =
+   *       CryptoKeyVersionName.of(
+   *               "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]")
+   *           .toString();
+   *   CryptoKeyVersion response = keyManagementServiceClient.destroyCryptoKeyVersion(name);
+   * }
+   * }</pre>
+   *
+   * @param name Required. The resource name of the
+   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to destroy.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final CryptoKeyVersion destroyCryptoKeyVersion(String name) {
+    DestroyCryptoKeyVersionRequest request =
+        DestroyCryptoKeyVersionRequest.newBuilder().setName(name).build();
+    return destroyCryptoKeyVersion(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
+   *
+   * <p>Upon calling this method,
+   * [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
+   * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+   * will be changed to
+   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
+   * material will be irrevocably destroyed.
+   *
+   * <p>Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
+   * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may
+   * be called to reverse the process.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   DestroyCryptoKeyVersionRequest request =
+   *       DestroyCryptoKeyVersionRequest.newBuilder()
+   *           .setName(
+   *               CryptoKeyVersionName.of(
+   *                       "[PROJECT]",
+   *                       "[LOCATION]",
+   *                       "[KEY_RING]",
+   *                       "[CRYPTO_KEY]",
+   *                       "[CRYPTO_KEY_VERSION]")
+   *                   .toString())
+   *           .build();
+   *   CryptoKeyVersion response = keyManagementServiceClient.destroyCryptoKeyVersion(request);
+   * }
+   * }</pre>
+   *
+   * @param request The request object containing all of the parameters for the API call.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final CryptoKeyVersion destroyCryptoKeyVersion(DestroyCryptoKeyVersionRequest request) {
+    return destroyCryptoKeyVersionCallable().call(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
+   *
+   * <p>Upon calling this method,
+   * [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
+   * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+   * will be changed to
+   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
+   * material will be irrevocably destroyed.
+   *
+   * <p>Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
+   * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may
+   * be called to reverse the process.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   DestroyCryptoKeyVersionRequest request =
+   *       DestroyCryptoKeyVersionRequest.newBuilder()
+   *           .setName(
+   *               CryptoKeyVersionName.of(
+   *                       "[PROJECT]",
+   *                       "[LOCATION]",
+   *                       "[KEY_RING]",
+   *                       "[CRYPTO_KEY]",
+   *                       "[CRYPTO_KEY_VERSION]")
+   *                   .toString())
+   *           .build();
+   *   ApiFuture<CryptoKeyVersion> future =
+   *       keyManagementServiceClient.destroyCryptoKeyVersionCallable().futureCall(request);
+   *   // Do something.
+   *   CryptoKeyVersion response = future.get();
+   * }
+   * }</pre>
+   */
+  public final UnaryCallable<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
+      destroyCryptoKeyVersionCallable() {
+    return stub.destroyCryptoKeyVersionCallable();
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * state.
+   *
+   * <p>Upon restoration of the CryptoKeyVersion,
+   * [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+   * [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and
+   * [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   CryptoKeyVersionName name =
+   *       CryptoKeyVersionName.of(
+   *           "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+   *   CryptoKeyVersion response = keyManagementServiceClient.restoreCryptoKeyVersion(name);
+   * }
+   * }</pre>
+   *
+   * @param name Required. The resource name of the
+   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to restore.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final CryptoKeyVersion restoreCryptoKeyVersion(CryptoKeyVersionName name) {
+    RestoreCryptoKeyVersionRequest request =
+        RestoreCryptoKeyVersionRequest.newBuilder()
+            .setName(name == null ? null : name.toString())
+            .build();
+    return restoreCryptoKeyVersion(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * state.
+   *
+   * <p>Upon restoration of the CryptoKeyVersion,
+   * [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+   * [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and
+   * [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   String name =
+   *       CryptoKeyVersionName.of(
+   *               "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]")
+   *           .toString();
+   *   CryptoKeyVersion response = keyManagementServiceClient.restoreCryptoKeyVersion(name);
+   * }
+   * }</pre>
+   *
+   * @param name Required. The resource name of the
+   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to restore.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final CryptoKeyVersion restoreCryptoKeyVersion(String name) {
+    RestoreCryptoKeyVersionRequest request =
+        RestoreCryptoKeyVersionRequest.newBuilder().setName(name).build();
+    return restoreCryptoKeyVersion(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * state.
+   *
+   * <p>Upon restoration of the CryptoKeyVersion,
+   * [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+   * [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and
+   * [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   RestoreCryptoKeyVersionRequest request =
+   *       RestoreCryptoKeyVersionRequest.newBuilder()
+   *           .setName(
+   *               CryptoKeyVersionName.of(
+   *                       "[PROJECT]",
+   *                       "[LOCATION]",
+   *                       "[KEY_RING]",
+   *                       "[CRYPTO_KEY]",
+   *                       "[CRYPTO_KEY_VERSION]")
+   *                   .toString())
+   *           .build();
+   *   CryptoKeyVersion response = keyManagementServiceClient.restoreCryptoKeyVersion(request);
+   * }
+   * }</pre>
+   *
+   * @param request The request object containing all of the parameters for the API call.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final CryptoKeyVersion restoreCryptoKeyVersion(RestoreCryptoKeyVersionRequest request) {
+    return restoreCryptoKeyVersionCallable().call(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * state.
+   *
+   * <p>Upon restoration of the CryptoKeyVersion,
+   * [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+   * [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and
+   * [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   RestoreCryptoKeyVersionRequest request =
+   *       RestoreCryptoKeyVersionRequest.newBuilder()
+   *           .setName(
+   *               CryptoKeyVersionName.of(
+   *                       "[PROJECT]",
+   *                       "[LOCATION]",
+   *                       "[KEY_RING]",
+   *                       "[CRYPTO_KEY]",
+   *                       "[CRYPTO_KEY_VERSION]")
+   *                   .toString())
+   *           .build();
+   *   ApiFuture<CryptoKeyVersion> future =
+   *       keyManagementServiceClient.restoreCryptoKeyVersionCallable().futureCall(request);
+   *   // Do something.
+   *   CryptoKeyVersion response = future.get();
+   * }
+   * }</pre>
+   */
+  public final UnaryCallable<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
+      restoreCryptoKeyVersionCallable() {
+    return stub.restoreCryptoKeyVersionCallable();
+  }
+
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
    * Encrypts data, so that it can only be recovered by a call to
@@ -2653,234 +3106,86 @@ public final AsymmetricDecryptResponse asymmetricDecrypt(String name, ByteString
     AsymmetricDecryptRequest request =
         AsymmetricDecryptRequest.newBuilder().setName(name).setCiphertext(ciphertext).build();
     return asymmetricDecrypt(request);
-  }
-
-  // AUTO-GENERATED DOCUMENTATION AND METHOD.
-  /**
-   * Decrypts data that was encrypted with a public key retrieved from
-   * [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] corresponding to a
-   * [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
-   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_DECRYPT.
-   *
-   * <p>Sample code:
-   *
-   * <pre>{@code
-   * try (KeyManagementServiceClient keyManagementServiceClient =
-   *     KeyManagementServiceClient.create()) {
-   *   AsymmetricDecryptRequest request =
-   *       AsymmetricDecryptRequest.newBuilder()
-   *           .setName(
-   *               CryptoKeyVersionName.of(
-   *                       "[PROJECT]",
-   *                       "[LOCATION]",
-   *                       "[KEY_RING]",
-   *                       "[CRYPTO_KEY]",
-   *                       "[CRYPTO_KEY_VERSION]")
-   *                   .toString())
-   *           .setCiphertext(ByteString.EMPTY)
-   *           .setCiphertextCrc32C(Int64Value.newBuilder().build())
-   *           .build();
-   *   AsymmetricDecryptResponse response = keyManagementServiceClient.asymmetricDecrypt(request);
-   * }
-   * }</pre>
-   *
-   * @param request The request object containing all of the parameters for the API call.
-   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
-   */
-  public final AsymmetricDecryptResponse asymmetricDecrypt(AsymmetricDecryptRequest request) {
-    return asymmetricDecryptCallable().call(request);
-  }
-
-  // AUTO-GENERATED DOCUMENTATION AND METHOD.
-  /**
-   * Decrypts data that was encrypted with a public key retrieved from
-   * [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] corresponding to a
-   * [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
-   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_DECRYPT.
-   *
-   * <p>Sample code:
-   *
-   * <pre>{@code
-   * try (KeyManagementServiceClient keyManagementServiceClient =
-   *     KeyManagementServiceClient.create()) {
-   *   AsymmetricDecryptRequest request =
-   *       AsymmetricDecryptRequest.newBuilder()
-   *           .setName(
-   *               CryptoKeyVersionName.of(
-   *                       "[PROJECT]",
-   *                       "[LOCATION]",
-   *                       "[KEY_RING]",
-   *                       "[CRYPTO_KEY]",
-   *                       "[CRYPTO_KEY_VERSION]")
-   *                   .toString())
-   *           .setCiphertext(ByteString.EMPTY)
-   *           .setCiphertextCrc32C(Int64Value.newBuilder().build())
-   *           .build();
-   *   ApiFuture<AsymmetricDecryptResponse> future =
-   *       keyManagementServiceClient.asymmetricDecryptCallable().futureCall(request);
-   *   // Do something.
-   *   AsymmetricDecryptResponse response = future.get();
-   * }
-   * }</pre>
-   */
-  public final UnaryCallable<AsymmetricDecryptRequest, AsymmetricDecryptResponse>
-      asymmetricDecryptCallable() {
-    return stub.asymmetricDecryptCallable();
-  }
-
-  // AUTO-GENERATED DOCUMENTATION AND METHOD.
-  /**
-   * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in
-   * [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
-   *
-   * <p>Returns an error if called on a key whose purpose is not
-   * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
-   *
-   * <p>Sample code:
-   *
-   * <pre>{@code
-   * try (KeyManagementServiceClient keyManagementServiceClient =
-   *     KeyManagementServiceClient.create()) {
-   *   CryptoKeyName name =
-   *       CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]");
-   *   String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
-   *   CryptoKey response =
-   *       keyManagementServiceClient.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
-   * }
-   * }</pre>
-   *
-   * @param name Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to
-   *     update.
-   * @param cryptoKeyVersionId Required. The id of the child
-   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as primary.
-   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
-   */
-  public final CryptoKey updateCryptoKeyPrimaryVersion(
-      CryptoKeyName name, String cryptoKeyVersionId) {
-    UpdateCryptoKeyPrimaryVersionRequest request =
-        UpdateCryptoKeyPrimaryVersionRequest.newBuilder()
-            .setName(name == null ? null : name.toString())
-            .setCryptoKeyVersionId(cryptoKeyVersionId)
-            .build();
-    return updateCryptoKeyPrimaryVersion(request);
-  }
-
-  // AUTO-GENERATED DOCUMENTATION AND METHOD.
-  /**
-   * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in
-   * [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
-   *
-   * <p>Returns an error if called on a key whose purpose is not
-   * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
-   *
-   * <p>Sample code:
-   *
-   * <pre>{@code
-   * try (KeyManagementServiceClient keyManagementServiceClient =
-   *     KeyManagementServiceClient.create()) {
-   *   String name =
-   *       CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]").toString();
-   *   String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
-   *   CryptoKey response =
-   *       keyManagementServiceClient.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
-   * }
-   * }</pre>
-   *
-   * @param name Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to
-   *     update.
-   * @param cryptoKeyVersionId Required. The id of the child
-   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as primary.
-   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
-   */
-  public final CryptoKey updateCryptoKeyPrimaryVersion(String name, String cryptoKeyVersionId) {
-    UpdateCryptoKeyPrimaryVersionRequest request =
-        UpdateCryptoKeyPrimaryVersionRequest.newBuilder()
-            .setName(name)
-            .setCryptoKeyVersionId(cryptoKeyVersionId)
-            .build();
-    return updateCryptoKeyPrimaryVersion(request);
-  }
-
-  // AUTO-GENERATED DOCUMENTATION AND METHOD.
-  /**
-   * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in
-   * [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
-   *
-   * <p>Returns an error if called on a key whose purpose is not
-   * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Decrypts data that was encrypted with a public key retrieved from
+   * [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] corresponding to a
+   * [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
+   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_DECRYPT.
    *
    * <p>Sample code:
    *
    * <pre>{@code
    * try (KeyManagementServiceClient keyManagementServiceClient =
    *     KeyManagementServiceClient.create()) {
-   *   UpdateCryptoKeyPrimaryVersionRequest request =
-   *       UpdateCryptoKeyPrimaryVersionRequest.newBuilder()
+   *   AsymmetricDecryptRequest request =
+   *       AsymmetricDecryptRequest.newBuilder()
    *           .setName(
-   *               CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]")
+   *               CryptoKeyVersionName.of(
+   *                       "[PROJECT]",
+   *                       "[LOCATION]",
+   *                       "[KEY_RING]",
+   *                       "[CRYPTO_KEY]",
+   *                       "[CRYPTO_KEY_VERSION]")
    *                   .toString())
-   *           .setCryptoKeyVersionId("cryptoKeyVersionId987674581")
+   *           .setCiphertext(ByteString.EMPTY)
+   *           .setCiphertextCrc32C(Int64Value.newBuilder().build())
    *           .build();
-   *   CryptoKey response = keyManagementServiceClient.updateCryptoKeyPrimaryVersion(request);
+   *   AsymmetricDecryptResponse response = keyManagementServiceClient.asymmetricDecrypt(request);
    * }
    * }</pre>
    *
    * @param request The request object containing all of the parameters for the API call.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
    */
-  public final CryptoKey updateCryptoKeyPrimaryVersion(
-      UpdateCryptoKeyPrimaryVersionRequest request) {
-    return updateCryptoKeyPrimaryVersionCallable().call(request);
+  public final AsymmetricDecryptResponse asymmetricDecrypt(AsymmetricDecryptRequest request) {
+    return asymmetricDecryptCallable().call(request);
   }
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in
-   * [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
-   *
-   * <p>Returns an error if called on a key whose purpose is not
-   * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+   * Decrypts data that was encrypted with a public key retrieved from
+   * [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] corresponding to a
+   * [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
+   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_DECRYPT.
    *
    * <p>Sample code:
    *
    * <pre>{@code
    * try (KeyManagementServiceClient keyManagementServiceClient =
    *     KeyManagementServiceClient.create()) {
-   *   UpdateCryptoKeyPrimaryVersionRequest request =
-   *       UpdateCryptoKeyPrimaryVersionRequest.newBuilder()
+   *   AsymmetricDecryptRequest request =
+   *       AsymmetricDecryptRequest.newBuilder()
    *           .setName(
-   *               CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]")
+   *               CryptoKeyVersionName.of(
+   *                       "[PROJECT]",
+   *                       "[LOCATION]",
+   *                       "[KEY_RING]",
+   *                       "[CRYPTO_KEY]",
+   *                       "[CRYPTO_KEY_VERSION]")
    *                   .toString())
-   *           .setCryptoKeyVersionId("cryptoKeyVersionId987674581")
+   *           .setCiphertext(ByteString.EMPTY)
+   *           .setCiphertextCrc32C(Int64Value.newBuilder().build())
    *           .build();
-   *   ApiFuture<CryptoKey> future =
-   *       keyManagementServiceClient.updateCryptoKeyPrimaryVersionCallable().futureCall(request);
+   *   ApiFuture<AsymmetricDecryptResponse> future =
+   *       keyManagementServiceClient.asymmetricDecryptCallable().futureCall(request);
    *   // Do something.
-   *   CryptoKey response = future.get();
+   *   AsymmetricDecryptResponse response = future.get();
    * }
    * }</pre>
    */
-  public final UnaryCallable<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
-      updateCryptoKeyPrimaryVersionCallable() {
-    return stub.updateCryptoKeyPrimaryVersionCallable();
+  public final UnaryCallable<AsymmetricDecryptRequest, AsymmetricDecryptResponse>
+      asymmetricDecryptCallable() {
+    return stub.asymmetricDecryptCallable();
   }
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
-   *
-   * <p>Upon calling this method,
-   * [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-   * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
-   * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-   * will be changed to
-   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
-   * material will be irrevocably destroyed.
-   *
-   * <p>Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
-   * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may
-   * be called to reverse the process.
+   * Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
+   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, producing a tag that can be
+   * verified by another source with the same key.
    *
    * <p>Sample code:
    *
@@ -2890,38 +3195,31 @@ public final CryptoKey updateCryptoKeyPrimaryVersion(
    *   CryptoKeyVersionName name =
    *       CryptoKeyVersionName.of(
    *           "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
-   *   CryptoKeyVersion response = keyManagementServiceClient.destroyCryptoKeyVersion(name);
+   *   ByteString data = ByteString.EMPTY;
+   *   MacSignResponse response = keyManagementServiceClient.macSign(name, data);
    * }
    * }</pre>
    *
    * @param name Required. The resource name of the
-   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to destroy.
+   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+   * @param data Required. The data to sign. The MAC tag is computed over this data field based on
+   *     the specific algorithm.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
    */
-  public final CryptoKeyVersion destroyCryptoKeyVersion(CryptoKeyVersionName name) {
-    DestroyCryptoKeyVersionRequest request =
-        DestroyCryptoKeyVersionRequest.newBuilder()
+  public final MacSignResponse macSign(CryptoKeyVersionName name, ByteString data) {
+    MacSignRequest request =
+        MacSignRequest.newBuilder()
             .setName(name == null ? null : name.toString())
+            .setData(data)
             .build();
-    return destroyCryptoKeyVersion(request);
+    return macSign(request);
   }
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
-   *
-   * <p>Upon calling this method,
-   * [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-   * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
-   * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-   * will be changed to
-   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
-   * material will be irrevocably destroyed.
-   *
-   * <p>Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
-   * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may
-   * be called to reverse the process.
+   * Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
+   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, producing a tag that can be
+   * verified by another source with the same key.
    *
    * <p>Sample code:
    *
@@ -2932,44 +3230,35 @@ public final CryptoKeyVersion destroyCryptoKeyVersion(CryptoKeyVersionName name)
    *       CryptoKeyVersionName.of(
    *               "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]")
    *           .toString();
-   *   CryptoKeyVersion response = keyManagementServiceClient.destroyCryptoKeyVersion(name);
+   *   ByteString data = ByteString.EMPTY;
+   *   MacSignResponse response = keyManagementServiceClient.macSign(name, data);
    * }
    * }</pre>
    *
    * @param name Required. The resource name of the
-   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to destroy.
+   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+   * @param data Required. The data to sign. The MAC tag is computed over this data field based on
+   *     the specific algorithm.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
    */
-  public final CryptoKeyVersion destroyCryptoKeyVersion(String name) {
-    DestroyCryptoKeyVersionRequest request =
-        DestroyCryptoKeyVersionRequest.newBuilder().setName(name).build();
-    return destroyCryptoKeyVersion(request);
+  public final MacSignResponse macSign(String name, ByteString data) {
+    MacSignRequest request = MacSignRequest.newBuilder().setName(name).setData(data).build();
+    return macSign(request);
   }
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
-   *
-   * <p>Upon calling this method,
-   * [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-   * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
-   * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-   * will be changed to
-   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
-   * material will be irrevocably destroyed.
-   *
-   * <p>Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
-   * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may
-   * be called to reverse the process.
+   * Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
+   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, producing a tag that can be
+   * verified by another source with the same key.
    *
    * <p>Sample code:
    *
    * <pre>{@code
    * try (KeyManagementServiceClient keyManagementServiceClient =
    *     KeyManagementServiceClient.create()) {
-   *   DestroyCryptoKeyVersionRequest request =
-   *       DestroyCryptoKeyVersionRequest.newBuilder()
+   *   MacSignRequest request =
+   *       MacSignRequest.newBuilder()
    *           .setName(
    *               CryptoKeyVersionName.of(
    *                       "[PROJECT]",
@@ -2978,42 +3267,33 @@ public final CryptoKeyVersion destroyCryptoKeyVersion(String name) {
    *                       "[CRYPTO_KEY]",
    *                       "[CRYPTO_KEY_VERSION]")
    *                   .toString())
+   *           .setData(ByteString.EMPTY)
+   *           .setDataCrc32C(Int64Value.newBuilder().build())
    *           .build();
-   *   CryptoKeyVersion response = keyManagementServiceClient.destroyCryptoKeyVersion(request);
+   *   MacSignResponse response = keyManagementServiceClient.macSign(request);
    * }
    * }</pre>
    *
    * @param request The request object containing all of the parameters for the API call.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
    */
-  public final CryptoKeyVersion destroyCryptoKeyVersion(DestroyCryptoKeyVersionRequest request) {
-    return destroyCryptoKeyVersionCallable().call(request);
+  public final MacSignResponse macSign(MacSignRequest request) {
+    return macSignCallable().call(request);
   }
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
-   *
-   * <p>Upon calling this method,
-   * [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-   * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
-   * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-   * will be changed to
-   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
-   * material will be irrevocably destroyed.
-   *
-   * <p>Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
-   * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may
-   * be called to reverse the process.
+   * Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
+   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, producing a tag that can be
+   * verified by another source with the same key.
    *
    * <p>Sample code:
    *
    * <pre>{@code
    * try (KeyManagementServiceClient keyManagementServiceClient =
    *     KeyManagementServiceClient.create()) {
-   *   DestroyCryptoKeyVersionRequest request =
-   *       DestroyCryptoKeyVersionRequest.newBuilder()
+   *   MacSignRequest request =
+   *       MacSignRequest.newBuilder()
    *           .setName(
    *               CryptoKeyVersionName.of(
    *                       "[PROJECT]",
@@ -3022,29 +3302,25 @@ public final CryptoKeyVersion destroyCryptoKeyVersion(DestroyCryptoKeyVersionReq
    *                       "[CRYPTO_KEY]",
    *                       "[CRYPTO_KEY_VERSION]")
    *                   .toString())
+   *           .setData(ByteString.EMPTY)
+   *           .setDataCrc32C(Int64Value.newBuilder().build())
    *           .build();
-   *   ApiFuture<CryptoKeyVersion> future =
-   *       keyManagementServiceClient.destroyCryptoKeyVersionCallable().futureCall(request);
+   *   ApiFuture<MacSignResponse> future =
+   *       keyManagementServiceClient.macSignCallable().futureCall(request);
    *   // Do something.
-   *   CryptoKeyVersion response = future.get();
+   *   MacSignResponse response = future.get();
    * }
    * }</pre>
    */
-  public final UnaryCallable<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
-      destroyCryptoKeyVersionCallable() {
-    return stub.destroyCryptoKeyVersionCallable();
+  public final UnaryCallable<MacSignRequest, MacSignResponse> macSignCallable() {
+    return stub.macSignCallable();
   }
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
-   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-   * state.
-   *
-   * <p>Upon restoration of the CryptoKeyVersion,
-   * [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-   * [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and
-   * [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+   * Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
+   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, and returns a response that
+   * indicates whether or not the verification was successful.
    *
    * <p>Sample code:
    *
@@ -3054,32 +3330,35 @@ public final CryptoKeyVersion destroyCryptoKeyVersion(DestroyCryptoKeyVersionReq
    *   CryptoKeyVersionName name =
    *       CryptoKeyVersionName.of(
    *           "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
-   *   CryptoKeyVersion response = keyManagementServiceClient.restoreCryptoKeyVersion(name);
+   *   ByteString data = ByteString.EMPTY;
+   *   ByteString mac = ByteString.EMPTY;
+   *   MacVerifyResponse response = keyManagementServiceClient.macVerify(name, data, mac);
    * }
    * }</pre>
    *
    * @param name Required. The resource name of the
-   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to restore.
+   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+   * @param data Required. The data used previously as a
+   *     [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] to generate the MAC tag.
+   * @param mac Required. The signature to verify.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
    */
-  public final CryptoKeyVersion restoreCryptoKeyVersion(CryptoKeyVersionName name) {
-    RestoreCryptoKeyVersionRequest request =
-        RestoreCryptoKeyVersionRequest.newBuilder()
+  public final MacVerifyResponse macVerify(
+      CryptoKeyVersionName name, ByteString data, ByteString mac) {
+    MacVerifyRequest request =
+        MacVerifyRequest.newBuilder()
             .setName(name == null ? null : name.toString())
+            .setData(data)
+            .setMac(mac)
             .build();
-    return restoreCryptoKeyVersion(request);
+    return macVerify(request);
   }
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
-   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-   * state.
-   *
-   * <p>Upon restoration of the CryptoKeyVersion,
-   * [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-   * [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and
-   * [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+   * Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
+   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, and returns a response that
+   * indicates whether or not the verification was successful.
    *
    * <p>Sample code:
    *
@@ -3090,38 +3369,38 @@ public final CryptoKeyVersion restoreCryptoKeyVersion(CryptoKeyVersionName name)
    *       CryptoKeyVersionName.of(
    *               "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]")
    *           .toString();
-   *   CryptoKeyVersion response = keyManagementServiceClient.restoreCryptoKeyVersion(name);
+   *   ByteString data = ByteString.EMPTY;
+   *   ByteString mac = ByteString.EMPTY;
+   *   MacVerifyResponse response = keyManagementServiceClient.macVerify(name, data, mac);
    * }
    * }</pre>
    *
    * @param name Required. The resource name of the
-   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to restore.
+   *     [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+   * @param data Required. The data used previously as a
+   *     [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] to generate the MAC tag.
+   * @param mac Required. The signature to verify.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
    */
-  public final CryptoKeyVersion restoreCryptoKeyVersion(String name) {
-    RestoreCryptoKeyVersionRequest request =
-        RestoreCryptoKeyVersionRequest.newBuilder().setName(name).build();
-    return restoreCryptoKeyVersion(request);
+  public final MacVerifyResponse macVerify(String name, ByteString data, ByteString mac) {
+    MacVerifyRequest request =
+        MacVerifyRequest.newBuilder().setName(name).setData(data).setMac(mac).build();
+    return macVerify(request);
   }
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
-   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-   * state.
-   *
-   * <p>Upon restoration of the CryptoKeyVersion,
-   * [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-   * [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and
-   * [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+   * Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
+   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, and returns a response that
+   * indicates whether or not the verification was successful.
    *
    * <p>Sample code:
    *
    * <pre>{@code
    * try (KeyManagementServiceClient keyManagementServiceClient =
    *     KeyManagementServiceClient.create()) {
-   *   RestoreCryptoKeyVersionRequest request =
-   *       RestoreCryptoKeyVersionRequest.newBuilder()
+   *   MacVerifyRequest request =
+   *       MacVerifyRequest.newBuilder()
    *           .setName(
    *               CryptoKeyVersionName.of(
    *                       "[PROJECT]",
@@ -3130,36 +3409,35 @@ public final CryptoKeyVersion restoreCryptoKeyVersion(String name) {
    *                       "[CRYPTO_KEY]",
    *                       "[CRYPTO_KEY_VERSION]")
    *                   .toString())
+   *           .setData(ByteString.EMPTY)
+   *           .setDataCrc32C(Int64Value.newBuilder().build())
+   *           .setMac(ByteString.EMPTY)
+   *           .setMacCrc32C(Int64Value.newBuilder().build())
    *           .build();
-   *   CryptoKeyVersion response = keyManagementServiceClient.restoreCryptoKeyVersion(request);
+   *   MacVerifyResponse response = keyManagementServiceClient.macVerify(request);
    * }
    * }</pre>
    *
    * @param request The request object containing all of the parameters for the API call.
    * @throws com.google.api.gax.rpc.ApiException if the remote call fails
    */
-  public final CryptoKeyVersion restoreCryptoKeyVersion(RestoreCryptoKeyVersionRequest request) {
-    return restoreCryptoKeyVersionCallable().call(request);
+  public final MacVerifyResponse macVerify(MacVerifyRequest request) {
+    return macVerifyCallable().call(request);
   }
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
   /**
-   * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
-   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-   * state.
-   *
-   * <p>Upon restoration of the CryptoKeyVersion,
-   * [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-   * [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and
-   * [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+   * Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
+   * [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, and returns a response that
+   * indicates whether or not the verification was successful.
    *
    * <p>Sample code:
    *
    * <pre>{@code
    * try (KeyManagementServiceClient keyManagementServiceClient =
    *     KeyManagementServiceClient.create()) {
-   *   RestoreCryptoKeyVersionRequest request =
-   *       RestoreCryptoKeyVersionRequest.newBuilder()
+   *   MacVerifyRequest request =
+   *       MacVerifyRequest.newBuilder()
    *           .setName(
    *               CryptoKeyVersionName.of(
    *                       "[PROJECT]",
@@ -3168,17 +3446,111 @@ public final CryptoKeyVersion restoreCryptoKeyVersion(RestoreCryptoKeyVersionReq
    *                       "[CRYPTO_KEY]",
    *                       "[CRYPTO_KEY_VERSION]")
    *                   .toString())
+   *           .setData(ByteString.EMPTY)
+   *           .setDataCrc32C(Int64Value.newBuilder().build())
+   *           .setMac(ByteString.EMPTY)
+   *           .setMacCrc32C(Int64Value.newBuilder().build())
    *           .build();
-   *   ApiFuture<CryptoKeyVersion> future =
-   *       keyManagementServiceClient.restoreCryptoKeyVersionCallable().futureCall(request);
+   *   ApiFuture<MacVerifyResponse> future =
+   *       keyManagementServiceClient.macVerifyCallable().futureCall(request);
    *   // Do something.
-   *   CryptoKeyVersion response = future.get();
+   *   MacVerifyResponse response = future.get();
    * }
    * }</pre>
    */
-  public final UnaryCallable<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
-      restoreCryptoKeyVersionCallable() {
-    return stub.restoreCryptoKeyVersionCallable();
+  public final UnaryCallable<MacVerifyRequest, MacVerifyResponse> macVerifyCallable() {
+    return stub.macVerifyCallable();
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Generate random bytes using the Cloud KMS randomness source in the provided location.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   String location = "location1901043637";
+   *   int lengthBytes = -745661998;
+   *   ProtectionLevel protectionLevel = ProtectionLevel.forNumber(0);
+   *   GenerateRandomBytesResponse response =
+   *       keyManagementServiceClient.generateRandomBytes(location, lengthBytes, protectionLevel);
+   * }
+   * }</pre>
+   *
+   * @param location The project-specific location in which to generate random bytes. For example,
+   *     "projects/my-project/locations/us-central1".
+   * @param lengthBytes The length in bytes of the amount of randomness to retrieve. Minimum 8
+   *     bytes, maximum 1024 bytes.
+   * @param protectionLevel The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when
+   *     generating the random data. Defaults to
+   *     [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final GenerateRandomBytesResponse generateRandomBytes(
+      String location, int lengthBytes, ProtectionLevel protectionLevel) {
+    GenerateRandomBytesRequest request =
+        GenerateRandomBytesRequest.newBuilder()
+            .setLocation(location)
+            .setLengthBytes(lengthBytes)
+            .setProtectionLevel(protectionLevel)
+            .build();
+    return generateRandomBytes(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Generate random bytes using the Cloud KMS randomness source in the provided location.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   GenerateRandomBytesRequest request =
+   *       GenerateRandomBytesRequest.newBuilder()
+   *           .setLocation("location1901043637")
+   *           .setLengthBytes(-745661998)
+   *           .setProtectionLevel(ProtectionLevel.forNumber(0))
+   *           .build();
+   *   GenerateRandomBytesResponse response =
+   *       keyManagementServiceClient.generateRandomBytes(request);
+   * }
+   * }</pre>
+   *
+   * @param request The request object containing all of the parameters for the API call.
+   * @throws com.google.api.gax.rpc.ApiException if the remote call fails
+   */
+  public final GenerateRandomBytesResponse generateRandomBytes(GenerateRandomBytesRequest request) {
+    return generateRandomBytesCallable().call(request);
+  }
+
+  // AUTO-GENERATED DOCUMENTATION AND METHOD.
+  /**
+   * Generate random bytes using the Cloud KMS randomness source in the provided location.
+   *
+   * <p>Sample code:
+   *
+   * <pre>{@code
+   * try (KeyManagementServiceClient keyManagementServiceClient =
+   *     KeyManagementServiceClient.create()) {
+   *   GenerateRandomBytesRequest request =
+   *       GenerateRandomBytesRequest.newBuilder()
+   *           .setLocation("location1901043637")
+   *           .setLengthBytes(-745661998)
+   *           .setProtectionLevel(ProtectionLevel.forNumber(0))
+   *           .build();
+   *   ApiFuture<GenerateRandomBytesResponse> future =
+   *       keyManagementServiceClient.generateRandomBytesCallable().futureCall(request);
+   *   // Do something.
+   *   GenerateRandomBytesResponse response = future.get();
+   * }
+   * }</pre>
+   */
+  public final UnaryCallable<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+      generateRandomBytesCallable() {
+    return stub.generateRandomBytesCallable();
   }
 
   // AUTO-GENERATED DOCUMENTATION AND METHOD.
diff --git a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceSettings.java b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceSettings.java
index fd8008f6..5ea1d68b 100644
--- a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceSettings.java
+++ b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceSettings.java
@@ -171,6 +171,25 @@ public UnaryCallSettings<UpdateCryptoKeyRequest, CryptoKey> updateCryptoKeySetti
     return ((KeyManagementServiceStubSettings) getStubSettings()).updateCryptoKeyVersionSettings();
   }
 
+  /** Returns the object with the settings used for calls to updateCryptoKeyPrimaryVersion. */
+  public UnaryCallSettings<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
+      updateCryptoKeyPrimaryVersionSettings() {
+    return ((KeyManagementServiceStubSettings) getStubSettings())
+        .updateCryptoKeyPrimaryVersionSettings();
+  }
+
+  /** Returns the object with the settings used for calls to destroyCryptoKeyVersion. */
+  public UnaryCallSettings<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
+      destroyCryptoKeyVersionSettings() {
+    return ((KeyManagementServiceStubSettings) getStubSettings()).destroyCryptoKeyVersionSettings();
+  }
+
+  /** Returns the object with the settings used for calls to restoreCryptoKeyVersion. */
+  public UnaryCallSettings<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
+      restoreCryptoKeyVersionSettings() {
+    return ((KeyManagementServiceStubSettings) getStubSettings()).restoreCryptoKeyVersionSettings();
+  }
+
   /** Returns the object with the settings used for calls to encrypt. */
   public UnaryCallSettings<EncryptRequest, EncryptResponse> encryptSettings() {
     return ((KeyManagementServiceStubSettings) getStubSettings()).encryptSettings();
@@ -192,23 +211,20 @@ public UnaryCallSettings<AsymmetricSignRequest, AsymmetricSignResponse> asymmetr
     return ((KeyManagementServiceStubSettings) getStubSettings()).asymmetricDecryptSettings();
   }
 
-  /** Returns the object with the settings used for calls to updateCryptoKeyPrimaryVersion. */
-  public UnaryCallSettings<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
-      updateCryptoKeyPrimaryVersionSettings() {
-    return ((KeyManagementServiceStubSettings) getStubSettings())
-        .updateCryptoKeyPrimaryVersionSettings();
+  /** Returns the object with the settings used for calls to macSign. */
+  public UnaryCallSettings<MacSignRequest, MacSignResponse> macSignSettings() {
+    return ((KeyManagementServiceStubSettings) getStubSettings()).macSignSettings();
   }
 
-  /** Returns the object with the settings used for calls to destroyCryptoKeyVersion. */
-  public UnaryCallSettings<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
-      destroyCryptoKeyVersionSettings() {
-    return ((KeyManagementServiceStubSettings) getStubSettings()).destroyCryptoKeyVersionSettings();
+  /** Returns the object with the settings used for calls to macVerify. */
+  public UnaryCallSettings<MacVerifyRequest, MacVerifyResponse> macVerifySettings() {
+    return ((KeyManagementServiceStubSettings) getStubSettings()).macVerifySettings();
   }
 
-  /** Returns the object with the settings used for calls to restoreCryptoKeyVersion. */
-  public UnaryCallSettings<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
-      restoreCryptoKeyVersionSettings() {
-    return ((KeyManagementServiceStubSettings) getStubSettings()).restoreCryptoKeyVersionSettings();
+  /** Returns the object with the settings used for calls to generateRandomBytes. */
+  public UnaryCallSettings<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+      generateRandomBytesSettings() {
+    return ((KeyManagementServiceStubSettings) getStubSettings()).generateRandomBytesSettings();
   }
 
   /** Returns the object with the settings used for calls to setIamPolicy. */
@@ -419,6 +435,24 @@ public UnaryCallSettings.Builder<UpdateCryptoKeyRequest, CryptoKey> updateCrypto
       return getStubSettingsBuilder().updateCryptoKeyVersionSettings();
     }
 
+    /** Returns the builder for the settings used for calls to updateCryptoKeyPrimaryVersion. */
+    public UnaryCallSettings.Builder<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
+        updateCryptoKeyPrimaryVersionSettings() {
+      return getStubSettingsBuilder().updateCryptoKeyPrimaryVersionSettings();
+    }
+
+    /** Returns the builder for the settings used for calls to destroyCryptoKeyVersion. */
+    public UnaryCallSettings.Builder<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
+        destroyCryptoKeyVersionSettings() {
+      return getStubSettingsBuilder().destroyCryptoKeyVersionSettings();
+    }
+
+    /** Returns the builder for the settings used for calls to restoreCryptoKeyVersion. */
+    public UnaryCallSettings.Builder<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
+        restoreCryptoKeyVersionSettings() {
+      return getStubSettingsBuilder().restoreCryptoKeyVersionSettings();
+    }
+
     /** Returns the builder for the settings used for calls to encrypt. */
     public UnaryCallSettings.Builder<EncryptRequest, EncryptResponse> encryptSettings() {
       return getStubSettingsBuilder().encryptSettings();
@@ -441,22 +475,20 @@ public UnaryCallSettings.Builder<DecryptRequest, DecryptResponse> decryptSetting
       return getStubSettingsBuilder().asymmetricDecryptSettings();
     }
 
-    /** Returns the builder for the settings used for calls to updateCryptoKeyPrimaryVersion. */
-    public UnaryCallSettings.Builder<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
-        updateCryptoKeyPrimaryVersionSettings() {
-      return getStubSettingsBuilder().updateCryptoKeyPrimaryVersionSettings();
+    /** Returns the builder for the settings used for calls to macSign. */
+    public UnaryCallSettings.Builder<MacSignRequest, MacSignResponse> macSignSettings() {
+      return getStubSettingsBuilder().macSignSettings();
     }
 
-    /** Returns the builder for the settings used for calls to destroyCryptoKeyVersion. */
-    public UnaryCallSettings.Builder<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
-        destroyCryptoKeyVersionSettings() {
-      return getStubSettingsBuilder().destroyCryptoKeyVersionSettings();
+    /** Returns the builder for the settings used for calls to macVerify. */
+    public UnaryCallSettings.Builder<MacVerifyRequest, MacVerifyResponse> macVerifySettings() {
+      return getStubSettingsBuilder().macVerifySettings();
     }
 
-    /** Returns the builder for the settings used for calls to restoreCryptoKeyVersion. */
-    public UnaryCallSettings.Builder<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
-        restoreCryptoKeyVersionSettings() {
-      return getStubSettingsBuilder().restoreCryptoKeyVersionSettings();
+    /** Returns the builder for the settings used for calls to generateRandomBytes. */
+    public UnaryCallSettings.Builder<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+        generateRandomBytesSettings() {
+      return getStubSettingsBuilder().generateRandomBytesSettings();
     }
 
     /** Returns the builder for the settings used for calls to setIamPolicy. */
diff --git a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/gapic_metadata.json b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/gapic_metadata.json
index e34e14ad..892870aa 100644
--- a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/gapic_metadata.json
+++ b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/gapic_metadata.json
@@ -37,6 +37,9 @@
             "Encrypt": {
               "methods": ["encrypt", "encrypt", "encrypt", "encryptCallable"]
             },
+            "GenerateRandomBytes": {
+              "methods": ["generateRandomBytes", "generateRandomBytes", "generateRandomBytesCallable"]
+            },
             "GetCryptoKey": {
               "methods": ["getCryptoKey", "getCryptoKey", "getCryptoKey", "getCryptoKeyCallable"]
             },
@@ -70,6 +73,12 @@
             "ListKeyRings": {
               "methods": ["listKeyRings", "listKeyRings", "listKeyRings", "listKeyRingsPagedCallable", "listKeyRingsCallable"]
             },
+            "MacSign": {
+              "methods": ["macSign", "macSign", "macSign", "macSignCallable"]
+            },
+            "MacVerify": {
+              "methods": ["macVerify", "macVerify", "macVerify", "macVerifyCallable"]
+            },
             "RestoreCryptoKeyVersion": {
               "methods": ["restoreCryptoKeyVersion", "restoreCryptoKeyVersion", "restoreCryptoKeyVersion", "restoreCryptoKeyVersionCallable"]
             },
diff --git a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/GrpcKeyManagementServiceStub.java b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/GrpcKeyManagementServiceStub.java
index 280a21da..7ebd65ac 100644
--- a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/GrpcKeyManagementServiceStub.java
+++ b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/GrpcKeyManagementServiceStub.java
@@ -42,6 +42,8 @@
 import com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest;
 import com.google.cloud.kms.v1.EncryptRequest;
 import com.google.cloud.kms.v1.EncryptResponse;
+import com.google.cloud.kms.v1.GenerateRandomBytesRequest;
+import com.google.cloud.kms.v1.GenerateRandomBytesResponse;
 import com.google.cloud.kms.v1.GetCryptoKeyRequest;
 import com.google.cloud.kms.v1.GetCryptoKeyVersionRequest;
 import com.google.cloud.kms.v1.GetImportJobRequest;
@@ -58,6 +60,10 @@
 import com.google.cloud.kms.v1.ListImportJobsResponse;
 import com.google.cloud.kms.v1.ListKeyRingsRequest;
 import com.google.cloud.kms.v1.ListKeyRingsResponse;
+import com.google.cloud.kms.v1.MacSignRequest;
+import com.google.cloud.kms.v1.MacSignResponse;
+import com.google.cloud.kms.v1.MacVerifyRequest;
+import com.google.cloud.kms.v1.MacVerifyResponse;
 import com.google.cloud.kms.v1.PublicKey;
 import com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest;
 import com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest;
@@ -242,6 +248,37 @@ public class GrpcKeyManagementServiceStub extends KeyManagementServiceStub {
               .setResponseMarshaller(ProtoUtils.marshaller(CryptoKeyVersion.getDefaultInstance()))
               .build();
 
+  private static final MethodDescriptor<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
+      updateCryptoKeyPrimaryVersionMethodDescriptor =
+          MethodDescriptor.<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>newBuilder()
+              .setType(MethodDescriptor.MethodType.UNARY)
+              .setFullMethodName(
+                  "google.cloud.kms.v1.KeyManagementService/UpdateCryptoKeyPrimaryVersion")
+              .setRequestMarshaller(
+                  ProtoUtils.marshaller(UpdateCryptoKeyPrimaryVersionRequest.getDefaultInstance()))
+              .setResponseMarshaller(ProtoUtils.marshaller(CryptoKey.getDefaultInstance()))
+              .build();
+
+  private static final MethodDescriptor<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
+      destroyCryptoKeyVersionMethodDescriptor =
+          MethodDescriptor.<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>newBuilder()
+              .setType(MethodDescriptor.MethodType.UNARY)
+              .setFullMethodName("google.cloud.kms.v1.KeyManagementService/DestroyCryptoKeyVersion")
+              .setRequestMarshaller(
+                  ProtoUtils.marshaller(DestroyCryptoKeyVersionRequest.getDefaultInstance()))
+              .setResponseMarshaller(ProtoUtils.marshaller(CryptoKeyVersion.getDefaultInstance()))
+              .build();
+
+  private static final MethodDescriptor<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
+      restoreCryptoKeyVersionMethodDescriptor =
+          MethodDescriptor.<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>newBuilder()
+              .setType(MethodDescriptor.MethodType.UNARY)
+              .setFullMethodName("google.cloud.kms.v1.KeyManagementService/RestoreCryptoKeyVersion")
+              .setRequestMarshaller(
+                  ProtoUtils.marshaller(RestoreCryptoKeyVersionRequest.getDefaultInstance()))
+              .setResponseMarshaller(ProtoUtils.marshaller(CryptoKeyVersion.getDefaultInstance()))
+              .build();
+
   private static final MethodDescriptor<EncryptRequest, EncryptResponse> encryptMethodDescriptor =
       MethodDescriptor.<EncryptRequest, EncryptResponse>newBuilder()
           .setType(MethodDescriptor.MethodType.UNARY)
@@ -280,35 +317,32 @@ public class GrpcKeyManagementServiceStub extends KeyManagementServiceStub {
                   ProtoUtils.marshaller(AsymmetricDecryptResponse.getDefaultInstance()))
               .build();
 
-  private static final MethodDescriptor<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
-      updateCryptoKeyPrimaryVersionMethodDescriptor =
-          MethodDescriptor.<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>newBuilder()
-              .setType(MethodDescriptor.MethodType.UNARY)
-              .setFullMethodName(
-                  "google.cloud.kms.v1.KeyManagementService/UpdateCryptoKeyPrimaryVersion")
-              .setRequestMarshaller(
-                  ProtoUtils.marshaller(UpdateCryptoKeyPrimaryVersionRequest.getDefaultInstance()))
-              .setResponseMarshaller(ProtoUtils.marshaller(CryptoKey.getDefaultInstance()))
-              .build();
+  private static final MethodDescriptor<MacSignRequest, MacSignResponse> macSignMethodDescriptor =
+      MethodDescriptor.<MacSignRequest, MacSignResponse>newBuilder()
+          .setType(MethodDescriptor.MethodType.UNARY)
+          .setFullMethodName("google.cloud.kms.v1.KeyManagementService/MacSign")
+          .setRequestMarshaller(ProtoUtils.marshaller(MacSignRequest.getDefaultInstance()))
+          .setResponseMarshaller(ProtoUtils.marshaller(MacSignResponse.getDefaultInstance()))
+          .build();
 
-  private static final MethodDescriptor<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
-      destroyCryptoKeyVersionMethodDescriptor =
-          MethodDescriptor.<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>newBuilder()
+  private static final MethodDescriptor<MacVerifyRequest, MacVerifyResponse>
+      macVerifyMethodDescriptor =
+          MethodDescriptor.<MacVerifyRequest, MacVerifyResponse>newBuilder()
               .setType(MethodDescriptor.MethodType.UNARY)
-              .setFullMethodName("google.cloud.kms.v1.KeyManagementService/DestroyCryptoKeyVersion")
-              .setRequestMarshaller(
-                  ProtoUtils.marshaller(DestroyCryptoKeyVersionRequest.getDefaultInstance()))
-              .setResponseMarshaller(ProtoUtils.marshaller(CryptoKeyVersion.getDefaultInstance()))
+              .setFullMethodName("google.cloud.kms.v1.KeyManagementService/MacVerify")
+              .setRequestMarshaller(ProtoUtils.marshaller(MacVerifyRequest.getDefaultInstance()))
+              .setResponseMarshaller(ProtoUtils.marshaller(MacVerifyResponse.getDefaultInstance()))
               .build();
 
-  private static final MethodDescriptor<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
-      restoreCryptoKeyVersionMethodDescriptor =
-          MethodDescriptor.<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>newBuilder()
+  private static final MethodDescriptor<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+      generateRandomBytesMethodDescriptor =
+          MethodDescriptor.<GenerateRandomBytesRequest, GenerateRandomBytesResponse>newBuilder()
               .setType(MethodDescriptor.MethodType.UNARY)
-              .setFullMethodName("google.cloud.kms.v1.KeyManagementService/RestoreCryptoKeyVersion")
+              .setFullMethodName("google.cloud.kms.v1.KeyManagementService/GenerateRandomBytes")
               .setRequestMarshaller(
-                  ProtoUtils.marshaller(RestoreCryptoKeyVersionRequest.getDefaultInstance()))
-              .setResponseMarshaller(ProtoUtils.marshaller(CryptoKeyVersion.getDefaultInstance()))
+                  ProtoUtils.marshaller(GenerateRandomBytesRequest.getDefaultInstance()))
+              .setResponseMarshaller(
+                  ProtoUtils.marshaller(GenerateRandomBytesResponse.getDefaultInstance()))
               .build();
 
   private static final MethodDescriptor<SetIamPolicyRequest, Policy> setIamPolicyMethodDescriptor =
@@ -367,17 +401,21 @@ public class GrpcKeyManagementServiceStub extends KeyManagementServiceStub {
   private final UnaryCallable<UpdateCryptoKeyRequest, CryptoKey> updateCryptoKeyCallable;
   private final UnaryCallable<UpdateCryptoKeyVersionRequest, CryptoKeyVersion>
       updateCryptoKeyVersionCallable;
-  private final UnaryCallable<EncryptRequest, EncryptResponse> encryptCallable;
-  private final UnaryCallable<DecryptRequest, DecryptResponse> decryptCallable;
-  private final UnaryCallable<AsymmetricSignRequest, AsymmetricSignResponse> asymmetricSignCallable;
-  private final UnaryCallable<AsymmetricDecryptRequest, AsymmetricDecryptResponse>
-      asymmetricDecryptCallable;
   private final UnaryCallable<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
       updateCryptoKeyPrimaryVersionCallable;
   private final UnaryCallable<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
       destroyCryptoKeyVersionCallable;
   private final UnaryCallable<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
       restoreCryptoKeyVersionCallable;
+  private final UnaryCallable<EncryptRequest, EncryptResponse> encryptCallable;
+  private final UnaryCallable<DecryptRequest, DecryptResponse> decryptCallable;
+  private final UnaryCallable<AsymmetricSignRequest, AsymmetricSignResponse> asymmetricSignCallable;
+  private final UnaryCallable<AsymmetricDecryptRequest, AsymmetricDecryptResponse>
+      asymmetricDecryptCallable;
+  private final UnaryCallable<MacSignRequest, MacSignResponse> macSignCallable;
+  private final UnaryCallable<MacVerifyRequest, MacVerifyResponse> macVerifyCallable;
+  private final UnaryCallable<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+      generateRandomBytesCallable;
   private final UnaryCallable<SetIamPolicyRequest, Policy> setIamPolicyCallable;
   private final UnaryCallable<GetIamPolicyRequest, Policy> getIamPolicyCallable;
   private final UnaryCallable<TestIamPermissionsRequest, TestIamPermissionsResponse>
@@ -597,6 +635,39 @@ protected GrpcKeyManagementServiceStub(
                       return params.build();
                     })
                 .build();
+    GrpcCallSettings<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
+        updateCryptoKeyPrimaryVersionTransportSettings =
+            GrpcCallSettings.<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>newBuilder()
+                .setMethodDescriptor(updateCryptoKeyPrimaryVersionMethodDescriptor)
+                .setParamsExtractor(
+                    request -> {
+                      ImmutableMap.Builder<String, String> params = ImmutableMap.builder();
+                      params.put("name", String.valueOf(request.getName()));
+                      return params.build();
+                    })
+                .build();
+    GrpcCallSettings<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
+        destroyCryptoKeyVersionTransportSettings =
+            GrpcCallSettings.<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>newBuilder()
+                .setMethodDescriptor(destroyCryptoKeyVersionMethodDescriptor)
+                .setParamsExtractor(
+                    request -> {
+                      ImmutableMap.Builder<String, String> params = ImmutableMap.builder();
+                      params.put("name", String.valueOf(request.getName()));
+                      return params.build();
+                    })
+                .build();
+    GrpcCallSettings<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
+        restoreCryptoKeyVersionTransportSettings =
+            GrpcCallSettings.<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>newBuilder()
+                .setMethodDescriptor(restoreCryptoKeyVersionMethodDescriptor)
+                .setParamsExtractor(
+                    request -> {
+                      ImmutableMap.Builder<String, String> params = ImmutableMap.builder();
+                      params.put("name", String.valueOf(request.getName()));
+                      return params.build();
+                    })
+                .build();
     GrpcCallSettings<EncryptRequest, EncryptResponse> encryptTransportSettings =
         GrpcCallSettings.<EncryptRequest, EncryptResponse>newBuilder()
             .setMethodDescriptor(encryptMethodDescriptor)
@@ -639,36 +710,34 @@ protected GrpcKeyManagementServiceStub(
                       return params.build();
                     })
                 .build();
-    GrpcCallSettings<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
-        updateCryptoKeyPrimaryVersionTransportSettings =
-            GrpcCallSettings.<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>newBuilder()
-                .setMethodDescriptor(updateCryptoKeyPrimaryVersionMethodDescriptor)
-                .setParamsExtractor(
-                    request -> {
-                      ImmutableMap.Builder<String, String> params = ImmutableMap.builder();
-                      params.put("name", String.valueOf(request.getName()));
-                      return params.build();
-                    })
-                .build();
-    GrpcCallSettings<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
-        destroyCryptoKeyVersionTransportSettings =
-            GrpcCallSettings.<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>newBuilder()
-                .setMethodDescriptor(destroyCryptoKeyVersionMethodDescriptor)
-                .setParamsExtractor(
-                    request -> {
-                      ImmutableMap.Builder<String, String> params = ImmutableMap.builder();
-                      params.put("name", String.valueOf(request.getName()));
-                      return params.build();
-                    })
-                .build();
-    GrpcCallSettings<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
-        restoreCryptoKeyVersionTransportSettings =
-            GrpcCallSettings.<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>newBuilder()
-                .setMethodDescriptor(restoreCryptoKeyVersionMethodDescriptor)
+    GrpcCallSettings<MacSignRequest, MacSignResponse> macSignTransportSettings =
+        GrpcCallSettings.<MacSignRequest, MacSignResponse>newBuilder()
+            .setMethodDescriptor(macSignMethodDescriptor)
+            .setParamsExtractor(
+                request -> {
+                  ImmutableMap.Builder<String, String> params = ImmutableMap.builder();
+                  params.put("name", String.valueOf(request.getName()));
+                  return params.build();
+                })
+            .build();
+    GrpcCallSettings<MacVerifyRequest, MacVerifyResponse> macVerifyTransportSettings =
+        GrpcCallSettings.<MacVerifyRequest, MacVerifyResponse>newBuilder()
+            .setMethodDescriptor(macVerifyMethodDescriptor)
+            .setParamsExtractor(
+                request -> {
+                  ImmutableMap.Builder<String, String> params = ImmutableMap.builder();
+                  params.put("name", String.valueOf(request.getName()));
+                  return params.build();
+                })
+            .build();
+    GrpcCallSettings<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+        generateRandomBytesTransportSettings =
+            GrpcCallSettings.<GenerateRandomBytesRequest, GenerateRandomBytesResponse>newBuilder()
+                .setMethodDescriptor(generateRandomBytesMethodDescriptor)
                 .setParamsExtractor(
                     request -> {
                       ImmutableMap.Builder<String, String> params = ImmutableMap.builder();
-                      params.put("name", String.valueOf(request.getName()));
+                      params.put("location", String.valueOf(request.getLocation()));
                       return params.build();
                     })
                 .build();
@@ -776,6 +845,21 @@ protected GrpcKeyManagementServiceStub(
             updateCryptoKeyVersionTransportSettings,
             settings.updateCryptoKeyVersionSettings(),
             clientContext);
+    this.updateCryptoKeyPrimaryVersionCallable =
+        callableFactory.createUnaryCallable(
+            updateCryptoKeyPrimaryVersionTransportSettings,
+            settings.updateCryptoKeyPrimaryVersionSettings(),
+            clientContext);
+    this.destroyCryptoKeyVersionCallable =
+        callableFactory.createUnaryCallable(
+            destroyCryptoKeyVersionTransportSettings,
+            settings.destroyCryptoKeyVersionSettings(),
+            clientContext);
+    this.restoreCryptoKeyVersionCallable =
+        callableFactory.createUnaryCallable(
+            restoreCryptoKeyVersionTransportSettings,
+            settings.restoreCryptoKeyVersionSettings(),
+            clientContext);
     this.encryptCallable =
         callableFactory.createUnaryCallable(
             encryptTransportSettings, settings.encryptSettings(), clientContext);
@@ -790,20 +874,16 @@ protected GrpcKeyManagementServiceStub(
             asymmetricDecryptTransportSettings,
             settings.asymmetricDecryptSettings(),
             clientContext);
-    this.updateCryptoKeyPrimaryVersionCallable =
+    this.macSignCallable =
         callableFactory.createUnaryCallable(
-            updateCryptoKeyPrimaryVersionTransportSettings,
-            settings.updateCryptoKeyPrimaryVersionSettings(),
-            clientContext);
-    this.destroyCryptoKeyVersionCallable =
+            macSignTransportSettings, settings.macSignSettings(), clientContext);
+    this.macVerifyCallable =
         callableFactory.createUnaryCallable(
-            destroyCryptoKeyVersionTransportSettings,
-            settings.destroyCryptoKeyVersionSettings(),
-            clientContext);
-    this.restoreCryptoKeyVersionCallable =
+            macVerifyTransportSettings, settings.macVerifySettings(), clientContext);
+    this.generateRandomBytesCallable =
         callableFactory.createUnaryCallable(
-            restoreCryptoKeyVersionTransportSettings,
-            settings.restoreCryptoKeyVersionSettings(),
+            generateRandomBytesTransportSettings,
+            settings.generateRandomBytesSettings(),
             clientContext);
     this.setIamPolicyCallable =
         callableFactory.createUnaryCallable(
@@ -932,6 +1012,24 @@ public UnaryCallable<UpdateCryptoKeyRequest, CryptoKey> updateCryptoKeyCallable(
     return updateCryptoKeyVersionCallable;
   }
 
+  @Override
+  public UnaryCallable<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
+      updateCryptoKeyPrimaryVersionCallable() {
+    return updateCryptoKeyPrimaryVersionCallable;
+  }
+
+  @Override
+  public UnaryCallable<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
+      destroyCryptoKeyVersionCallable() {
+    return destroyCryptoKeyVersionCallable;
+  }
+
+  @Override
+  public UnaryCallable<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
+      restoreCryptoKeyVersionCallable() {
+    return restoreCryptoKeyVersionCallable;
+  }
+
   @Override
   public UnaryCallable<EncryptRequest, EncryptResponse> encryptCallable() {
     return encryptCallable;
@@ -954,21 +1052,19 @@ public UnaryCallable<AsymmetricSignRequest, AsymmetricSignResponse> asymmetricSi
   }
 
   @Override
-  public UnaryCallable<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
-      updateCryptoKeyPrimaryVersionCallable() {
-    return updateCryptoKeyPrimaryVersionCallable;
+  public UnaryCallable<MacSignRequest, MacSignResponse> macSignCallable() {
+    return macSignCallable;
   }
 
   @Override
-  public UnaryCallable<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
-      destroyCryptoKeyVersionCallable() {
-    return destroyCryptoKeyVersionCallable;
+  public UnaryCallable<MacVerifyRequest, MacVerifyResponse> macVerifyCallable() {
+    return macVerifyCallable;
   }
 
   @Override
-  public UnaryCallable<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
-      restoreCryptoKeyVersionCallable() {
-    return restoreCryptoKeyVersionCallable;
+  public UnaryCallable<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+      generateRandomBytesCallable() {
+    return generateRandomBytesCallable;
   }
 
   @Override
diff --git a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/KeyManagementServiceStub.java b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/KeyManagementServiceStub.java
index 45c4fb2e..75a38b14 100644
--- a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/KeyManagementServiceStub.java
+++ b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/KeyManagementServiceStub.java
@@ -38,6 +38,8 @@
 import com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest;
 import com.google.cloud.kms.v1.EncryptRequest;
 import com.google.cloud.kms.v1.EncryptResponse;
+import com.google.cloud.kms.v1.GenerateRandomBytesRequest;
+import com.google.cloud.kms.v1.GenerateRandomBytesResponse;
 import com.google.cloud.kms.v1.GetCryptoKeyRequest;
 import com.google.cloud.kms.v1.GetCryptoKeyVersionRequest;
 import com.google.cloud.kms.v1.GetImportJobRequest;
@@ -54,6 +56,10 @@
 import com.google.cloud.kms.v1.ListImportJobsResponse;
 import com.google.cloud.kms.v1.ListKeyRingsRequest;
 import com.google.cloud.kms.v1.ListKeyRingsResponse;
+import com.google.cloud.kms.v1.MacSignRequest;
+import com.google.cloud.kms.v1.MacSignResponse;
+import com.google.cloud.kms.v1.MacVerifyRequest;
+import com.google.cloud.kms.v1.MacVerifyResponse;
 import com.google.cloud.kms.v1.PublicKey;
 import com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest;
 import com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest;
@@ -163,6 +169,22 @@ public UnaryCallable<UpdateCryptoKeyRequest, CryptoKey> updateCryptoKeyCallable(
     throw new UnsupportedOperationException("Not implemented: updateCryptoKeyVersionCallable()");
   }
 
+  public UnaryCallable<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
+      updateCryptoKeyPrimaryVersionCallable() {
+    throw new UnsupportedOperationException(
+        "Not implemented: updateCryptoKeyPrimaryVersionCallable()");
+  }
+
+  public UnaryCallable<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
+      destroyCryptoKeyVersionCallable() {
+    throw new UnsupportedOperationException("Not implemented: destroyCryptoKeyVersionCallable()");
+  }
+
+  public UnaryCallable<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
+      restoreCryptoKeyVersionCallable() {
+    throw new UnsupportedOperationException("Not implemented: restoreCryptoKeyVersionCallable()");
+  }
+
   public UnaryCallable<EncryptRequest, EncryptResponse> encryptCallable() {
     throw new UnsupportedOperationException("Not implemented: encryptCallable()");
   }
@@ -180,20 +202,17 @@ public UnaryCallable<AsymmetricSignRequest, AsymmetricSignResponse> asymmetricSi
     throw new UnsupportedOperationException("Not implemented: asymmetricDecryptCallable()");
   }
 
-  public UnaryCallable<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
-      updateCryptoKeyPrimaryVersionCallable() {
-    throw new UnsupportedOperationException(
-        "Not implemented: updateCryptoKeyPrimaryVersionCallable()");
+  public UnaryCallable<MacSignRequest, MacSignResponse> macSignCallable() {
+    throw new UnsupportedOperationException("Not implemented: macSignCallable()");
   }
 
-  public UnaryCallable<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
-      destroyCryptoKeyVersionCallable() {
-    throw new UnsupportedOperationException("Not implemented: destroyCryptoKeyVersionCallable()");
+  public UnaryCallable<MacVerifyRequest, MacVerifyResponse> macVerifyCallable() {
+    throw new UnsupportedOperationException("Not implemented: macVerifyCallable()");
   }
 
-  public UnaryCallable<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
-      restoreCryptoKeyVersionCallable() {
-    throw new UnsupportedOperationException("Not implemented: restoreCryptoKeyVersionCallable()");
+  public UnaryCallable<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+      generateRandomBytesCallable() {
+    throw new UnsupportedOperationException("Not implemented: generateRandomBytesCallable()");
   }
 
   public UnaryCallable<SetIamPolicyRequest, Policy> setIamPolicyCallable() {
diff --git a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/KeyManagementServiceStubSettings.java b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/KeyManagementServiceStubSettings.java
index 74dba4f6..e0e940b3 100644
--- a/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/KeyManagementServiceStubSettings.java
+++ b/google-cloud-kms/src/main/java/com/google/cloud/kms/v1/stub/KeyManagementServiceStubSettings.java
@@ -58,6 +58,8 @@
 import com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest;
 import com.google.cloud.kms.v1.EncryptRequest;
 import com.google.cloud.kms.v1.EncryptResponse;
+import com.google.cloud.kms.v1.GenerateRandomBytesRequest;
+import com.google.cloud.kms.v1.GenerateRandomBytesResponse;
 import com.google.cloud.kms.v1.GetCryptoKeyRequest;
 import com.google.cloud.kms.v1.GetCryptoKeyVersionRequest;
 import com.google.cloud.kms.v1.GetImportJobRequest;
@@ -74,6 +76,10 @@
 import com.google.cloud.kms.v1.ListImportJobsResponse;
 import com.google.cloud.kms.v1.ListKeyRingsRequest;
 import com.google.cloud.kms.v1.ListKeyRingsResponse;
+import com.google.cloud.kms.v1.MacSignRequest;
+import com.google.cloud.kms.v1.MacSignResponse;
+import com.google.cloud.kms.v1.MacVerifyRequest;
+import com.google.cloud.kms.v1.MacVerifyResponse;
 import com.google.cloud.kms.v1.PublicKey;
 import com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest;
 import com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest;
@@ -166,18 +172,22 @@ public class KeyManagementServiceStubSettings
   private final UnaryCallSettings<UpdateCryptoKeyRequest, CryptoKey> updateCryptoKeySettings;
   private final UnaryCallSettings<UpdateCryptoKeyVersionRequest, CryptoKeyVersion>
       updateCryptoKeyVersionSettings;
-  private final UnaryCallSettings<EncryptRequest, EncryptResponse> encryptSettings;
-  private final UnaryCallSettings<DecryptRequest, DecryptResponse> decryptSettings;
-  private final UnaryCallSettings<AsymmetricSignRequest, AsymmetricSignResponse>
-      asymmetricSignSettings;
-  private final UnaryCallSettings<AsymmetricDecryptRequest, AsymmetricDecryptResponse>
-      asymmetricDecryptSettings;
   private final UnaryCallSettings<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
       updateCryptoKeyPrimaryVersionSettings;
   private final UnaryCallSettings<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
       destroyCryptoKeyVersionSettings;
   private final UnaryCallSettings<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
       restoreCryptoKeyVersionSettings;
+  private final UnaryCallSettings<EncryptRequest, EncryptResponse> encryptSettings;
+  private final UnaryCallSettings<DecryptRequest, DecryptResponse> decryptSettings;
+  private final UnaryCallSettings<AsymmetricSignRequest, AsymmetricSignResponse>
+      asymmetricSignSettings;
+  private final UnaryCallSettings<AsymmetricDecryptRequest, AsymmetricDecryptResponse>
+      asymmetricDecryptSettings;
+  private final UnaryCallSettings<MacSignRequest, MacSignResponse> macSignSettings;
+  private final UnaryCallSettings<MacVerifyRequest, MacVerifyResponse> macVerifySettings;
+  private final UnaryCallSettings<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+      generateRandomBytesSettings;
   private final UnaryCallSettings<SetIamPolicyRequest, Policy> setIamPolicySettings;
   private final UnaryCallSettings<GetIamPolicyRequest, Policy> getIamPolicySettings;
   private final UnaryCallSettings<TestIamPermissionsRequest, TestIamPermissionsResponse>
@@ -502,6 +512,24 @@ public UnaryCallSettings<UpdateCryptoKeyRequest, CryptoKey> updateCryptoKeySetti
     return updateCryptoKeyVersionSettings;
   }
 
+  /** Returns the object with the settings used for calls to updateCryptoKeyPrimaryVersion. */
+  public UnaryCallSettings<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
+      updateCryptoKeyPrimaryVersionSettings() {
+    return updateCryptoKeyPrimaryVersionSettings;
+  }
+
+  /** Returns the object with the settings used for calls to destroyCryptoKeyVersion. */
+  public UnaryCallSettings<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
+      destroyCryptoKeyVersionSettings() {
+    return destroyCryptoKeyVersionSettings;
+  }
+
+  /** Returns the object with the settings used for calls to restoreCryptoKeyVersion. */
+  public UnaryCallSettings<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
+      restoreCryptoKeyVersionSettings() {
+    return restoreCryptoKeyVersionSettings;
+  }
+
   /** Returns the object with the settings used for calls to encrypt. */
   public UnaryCallSettings<EncryptRequest, EncryptResponse> encryptSettings() {
     return encryptSettings;
@@ -523,22 +551,20 @@ public UnaryCallSettings<AsymmetricSignRequest, AsymmetricSignResponse> asymmetr
     return asymmetricDecryptSettings;
   }
 
-  /** Returns the object with the settings used for calls to updateCryptoKeyPrimaryVersion. */
-  public UnaryCallSettings<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
-      updateCryptoKeyPrimaryVersionSettings() {
-    return updateCryptoKeyPrimaryVersionSettings;
+  /** Returns the object with the settings used for calls to macSign. */
+  public UnaryCallSettings<MacSignRequest, MacSignResponse> macSignSettings() {
+    return macSignSettings;
   }
 
-  /** Returns the object with the settings used for calls to destroyCryptoKeyVersion. */
-  public UnaryCallSettings<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
-      destroyCryptoKeyVersionSettings() {
-    return destroyCryptoKeyVersionSettings;
+  /** Returns the object with the settings used for calls to macVerify. */
+  public UnaryCallSettings<MacVerifyRequest, MacVerifyResponse> macVerifySettings() {
+    return macVerifySettings;
   }
 
-  /** Returns the object with the settings used for calls to restoreCryptoKeyVersion. */
-  public UnaryCallSettings<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
-      restoreCryptoKeyVersionSettings() {
-    return restoreCryptoKeyVersionSettings;
+  /** Returns the object with the settings used for calls to generateRandomBytes. */
+  public UnaryCallSettings<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+      generateRandomBytesSettings() {
+    return generateRandomBytesSettings;
   }
 
   /** Returns the object with the settings used for calls to setIamPolicy. */
@@ -647,14 +673,17 @@ protected KeyManagementServiceStubSettings(Builder settingsBuilder) throws IOExc
     createImportJobSettings = settingsBuilder.createImportJobSettings().build();
     updateCryptoKeySettings = settingsBuilder.updateCryptoKeySettings().build();
     updateCryptoKeyVersionSettings = settingsBuilder.updateCryptoKeyVersionSettings().build();
-    encryptSettings = settingsBuilder.encryptSettings().build();
-    decryptSettings = settingsBuilder.decryptSettings().build();
-    asymmetricSignSettings = settingsBuilder.asymmetricSignSettings().build();
-    asymmetricDecryptSettings = settingsBuilder.asymmetricDecryptSettings().build();
     updateCryptoKeyPrimaryVersionSettings =
         settingsBuilder.updateCryptoKeyPrimaryVersionSettings().build();
     destroyCryptoKeyVersionSettings = settingsBuilder.destroyCryptoKeyVersionSettings().build();
     restoreCryptoKeyVersionSettings = settingsBuilder.restoreCryptoKeyVersionSettings().build();
+    encryptSettings = settingsBuilder.encryptSettings().build();
+    decryptSettings = settingsBuilder.decryptSettings().build();
+    asymmetricSignSettings = settingsBuilder.asymmetricSignSettings().build();
+    asymmetricDecryptSettings = settingsBuilder.asymmetricDecryptSettings().build();
+    macSignSettings = settingsBuilder.macSignSettings().build();
+    macVerifySettings = settingsBuilder.macVerifySettings().build();
+    generateRandomBytesSettings = settingsBuilder.generateRandomBytesSettings().build();
     setIamPolicySettings = settingsBuilder.setIamPolicySettings().build();
     getIamPolicySettings = settingsBuilder.getIamPolicySettings().build();
     testIamPermissionsSettings = settingsBuilder.testIamPermissionsSettings().build();
@@ -697,18 +726,22 @@ public static class Builder
         updateCryptoKeySettings;
     private final UnaryCallSettings.Builder<UpdateCryptoKeyVersionRequest, CryptoKeyVersion>
         updateCryptoKeyVersionSettings;
-    private final UnaryCallSettings.Builder<EncryptRequest, EncryptResponse> encryptSettings;
-    private final UnaryCallSettings.Builder<DecryptRequest, DecryptResponse> decryptSettings;
-    private final UnaryCallSettings.Builder<AsymmetricSignRequest, AsymmetricSignResponse>
-        asymmetricSignSettings;
-    private final UnaryCallSettings.Builder<AsymmetricDecryptRequest, AsymmetricDecryptResponse>
-        asymmetricDecryptSettings;
     private final UnaryCallSettings.Builder<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
         updateCryptoKeyPrimaryVersionSettings;
     private final UnaryCallSettings.Builder<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
         destroyCryptoKeyVersionSettings;
     private final UnaryCallSettings.Builder<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
         restoreCryptoKeyVersionSettings;
+    private final UnaryCallSettings.Builder<EncryptRequest, EncryptResponse> encryptSettings;
+    private final UnaryCallSettings.Builder<DecryptRequest, DecryptResponse> decryptSettings;
+    private final UnaryCallSettings.Builder<AsymmetricSignRequest, AsymmetricSignResponse>
+        asymmetricSignSettings;
+    private final UnaryCallSettings.Builder<AsymmetricDecryptRequest, AsymmetricDecryptResponse>
+        asymmetricDecryptSettings;
+    private final UnaryCallSettings.Builder<MacSignRequest, MacSignResponse> macSignSettings;
+    private final UnaryCallSettings.Builder<MacVerifyRequest, MacVerifyResponse> macVerifySettings;
+    private final UnaryCallSettings.Builder<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+        generateRandomBytesSettings;
     private final UnaryCallSettings.Builder<SetIamPolicyRequest, Policy> setIamPolicySettings;
     private final UnaryCallSettings.Builder<GetIamPolicyRequest, Policy> getIamPolicySettings;
     private final UnaryCallSettings.Builder<TestIamPermissionsRequest, TestIamPermissionsResponse>
@@ -726,6 +759,7 @@ public static class Builder
                   StatusCode.Code.UNAVAILABLE, StatusCode.Code.DEADLINE_EXCEEDED)));
       definitions.put(
           "no_retry_0_codes", ImmutableSet.copyOf(Lists.<StatusCode.Code>newArrayList()));
+      definitions.put("no_retry_codes", ImmutableSet.copyOf(Lists.<StatusCode.Code>newArrayList()));
       RETRYABLE_CODE_DEFINITIONS = definitions.build();
     }
 
@@ -753,6 +787,8 @@ public static class Builder
               .setTotalTimeout(Duration.ofMillis(60000L))
               .build();
       definitions.put("no_retry_0_params", settings);
+      settings = RetrySettings.newBuilder().setRpcTimeoutMultiplier(1.0).build();
+      definitions.put("no_retry_params", settings);
       RETRY_PARAM_DEFINITIONS = definitions.build();
     }
 
@@ -780,13 +816,16 @@ protected Builder(ClientContext clientContext) {
       createImportJobSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       updateCryptoKeySettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       updateCryptoKeyVersionSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
+      updateCryptoKeyPrimaryVersionSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
+      destroyCryptoKeyVersionSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
+      restoreCryptoKeyVersionSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       encryptSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       decryptSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       asymmetricSignSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       asymmetricDecryptSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
-      updateCryptoKeyPrimaryVersionSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
-      destroyCryptoKeyVersionSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
-      restoreCryptoKeyVersionSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
+      macSignSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
+      macVerifySettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
+      generateRandomBytesSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       setIamPolicySettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       getIamPolicySettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
       testIamPermissionsSettings = UnaryCallSettings.newUnaryCallSettingsBuilder();
@@ -809,13 +848,16 @@ protected Builder(ClientContext clientContext) {
               createImportJobSettings,
               updateCryptoKeySettings,
               updateCryptoKeyVersionSettings,
+              updateCryptoKeyPrimaryVersionSettings,
+              destroyCryptoKeyVersionSettings,
+              restoreCryptoKeyVersionSettings,
               encryptSettings,
               decryptSettings,
               asymmetricSignSettings,
               asymmetricDecryptSettings,
-              updateCryptoKeyPrimaryVersionSettings,
-              destroyCryptoKeyVersionSettings,
-              restoreCryptoKeyVersionSettings,
+              macSignSettings,
+              macVerifySettings,
+              generateRandomBytesSettings,
               setIamPolicySettings,
               getIamPolicySettings,
               testIamPermissionsSettings);
@@ -841,14 +883,17 @@ protected Builder(KeyManagementServiceStubSettings settings) {
       createImportJobSettings = settings.createImportJobSettings.toBuilder();
       updateCryptoKeySettings = settings.updateCryptoKeySettings.toBuilder();
       updateCryptoKeyVersionSettings = settings.updateCryptoKeyVersionSettings.toBuilder();
-      encryptSettings = settings.encryptSettings.toBuilder();
-      decryptSettings = settings.decryptSettings.toBuilder();
-      asymmetricSignSettings = settings.asymmetricSignSettings.toBuilder();
-      asymmetricDecryptSettings = settings.asymmetricDecryptSettings.toBuilder();
       updateCryptoKeyPrimaryVersionSettings =
           settings.updateCryptoKeyPrimaryVersionSettings.toBuilder();
       destroyCryptoKeyVersionSettings = settings.destroyCryptoKeyVersionSettings.toBuilder();
       restoreCryptoKeyVersionSettings = settings.restoreCryptoKeyVersionSettings.toBuilder();
+      encryptSettings = settings.encryptSettings.toBuilder();
+      decryptSettings = settings.decryptSettings.toBuilder();
+      asymmetricSignSettings = settings.asymmetricSignSettings.toBuilder();
+      asymmetricDecryptSettings = settings.asymmetricDecryptSettings.toBuilder();
+      macSignSettings = settings.macSignSettings.toBuilder();
+      macVerifySettings = settings.macVerifySettings.toBuilder();
+      generateRandomBytesSettings = settings.generateRandomBytesSettings.toBuilder();
       setIamPolicySettings = settings.setIamPolicySettings.toBuilder();
       getIamPolicySettings = settings.getIamPolicySettings.toBuilder();
       testIamPermissionsSettings = settings.testIamPermissionsSettings.toBuilder();
@@ -871,13 +916,16 @@ protected Builder(KeyManagementServiceStubSettings settings) {
               createImportJobSettings,
               updateCryptoKeySettings,
               updateCryptoKeyVersionSettings,
+              updateCryptoKeyPrimaryVersionSettings,
+              destroyCryptoKeyVersionSettings,
+              restoreCryptoKeyVersionSettings,
               encryptSettings,
               decryptSettings,
               asymmetricSignSettings,
               asymmetricDecryptSettings,
-              updateCryptoKeyPrimaryVersionSettings,
-              destroyCryptoKeyVersionSettings,
-              restoreCryptoKeyVersionSettings,
+              macSignSettings,
+              macVerifySettings,
+              generateRandomBytesSettings,
               setIamPolicySettings,
               getIamPolicySettings,
               testIamPermissionsSettings);
@@ -978,40 +1026,55 @@ private static Builder initDefaults(Builder builder) {
           .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("retry_policy_1_params"));
 
       builder
-          .encryptSettings()
+          .updateCryptoKeyPrimaryVersionSettings()
           .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("retry_policy_1_codes"))
           .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("retry_policy_1_params"));
 
       builder
-          .decryptSettings()
+          .destroyCryptoKeyVersionSettings()
           .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("retry_policy_1_codes"))
           .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("retry_policy_1_params"));
 
       builder
-          .asymmetricSignSettings()
+          .restoreCryptoKeyVersionSettings()
           .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("retry_policy_1_codes"))
           .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("retry_policy_1_params"));
 
       builder
-          .asymmetricDecryptSettings()
+          .encryptSettings()
           .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("retry_policy_1_codes"))
           .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("retry_policy_1_params"));
 
       builder
-          .updateCryptoKeyPrimaryVersionSettings()
+          .decryptSettings()
           .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("retry_policy_1_codes"))
           .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("retry_policy_1_params"));
 
       builder
-          .destroyCryptoKeyVersionSettings()
+          .asymmetricSignSettings()
           .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("retry_policy_1_codes"))
           .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("retry_policy_1_params"));
 
       builder
-          .restoreCryptoKeyVersionSettings()
+          .asymmetricDecryptSettings()
           .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("retry_policy_1_codes"))
           .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("retry_policy_1_params"));
 
+      builder
+          .macSignSettings()
+          .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("no_retry_codes"))
+          .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("no_retry_params"));
+
+      builder
+          .macVerifySettings()
+          .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("no_retry_codes"))
+          .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("no_retry_params"));
+
+      builder
+          .generateRandomBytesSettings()
+          .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("no_retry_codes"))
+          .setRetrySettings(RETRY_PARAM_DEFINITIONS.get("no_retry_params"));
+
       builder
           .setIamPolicySettings()
           .setRetryableCodes(RETRYABLE_CODE_DEFINITIONS.get("retry_policy_1_codes"))
@@ -1139,6 +1202,24 @@ public UnaryCallSettings.Builder<UpdateCryptoKeyRequest, CryptoKey> updateCrypto
       return updateCryptoKeyVersionSettings;
     }
 
+    /** Returns the builder for the settings used for calls to updateCryptoKeyPrimaryVersion. */
+    public UnaryCallSettings.Builder<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
+        updateCryptoKeyPrimaryVersionSettings() {
+      return updateCryptoKeyPrimaryVersionSettings;
+    }
+
+    /** Returns the builder for the settings used for calls to destroyCryptoKeyVersion. */
+    public UnaryCallSettings.Builder<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
+        destroyCryptoKeyVersionSettings() {
+      return destroyCryptoKeyVersionSettings;
+    }
+
+    /** Returns the builder for the settings used for calls to restoreCryptoKeyVersion. */
+    public UnaryCallSettings.Builder<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
+        restoreCryptoKeyVersionSettings() {
+      return restoreCryptoKeyVersionSettings;
+    }
+
     /** Returns the builder for the settings used for calls to encrypt. */
     public UnaryCallSettings.Builder<EncryptRequest, EncryptResponse> encryptSettings() {
       return encryptSettings;
@@ -1161,22 +1242,20 @@ public UnaryCallSettings.Builder<DecryptRequest, DecryptResponse> decryptSetting
       return asymmetricDecryptSettings;
     }
 
-    /** Returns the builder for the settings used for calls to updateCryptoKeyPrimaryVersion. */
-    public UnaryCallSettings.Builder<UpdateCryptoKeyPrimaryVersionRequest, CryptoKey>
-        updateCryptoKeyPrimaryVersionSettings() {
-      return updateCryptoKeyPrimaryVersionSettings;
+    /** Returns the builder for the settings used for calls to macSign. */
+    public UnaryCallSettings.Builder<MacSignRequest, MacSignResponse> macSignSettings() {
+      return macSignSettings;
     }
 
-    /** Returns the builder for the settings used for calls to destroyCryptoKeyVersion. */
-    public UnaryCallSettings.Builder<DestroyCryptoKeyVersionRequest, CryptoKeyVersion>
-        destroyCryptoKeyVersionSettings() {
-      return destroyCryptoKeyVersionSettings;
+    /** Returns the builder for the settings used for calls to macVerify. */
+    public UnaryCallSettings.Builder<MacVerifyRequest, MacVerifyResponse> macVerifySettings() {
+      return macVerifySettings;
     }
 
-    /** Returns the builder for the settings used for calls to restoreCryptoKeyVersion. */
-    public UnaryCallSettings.Builder<RestoreCryptoKeyVersionRequest, CryptoKeyVersion>
-        restoreCryptoKeyVersionSettings() {
-      return restoreCryptoKeyVersionSettings;
+    /** Returns the builder for the settings used for calls to generateRandomBytes. */
+    public UnaryCallSettings.Builder<GenerateRandomBytesRequest, GenerateRandomBytesResponse>
+        generateRandomBytesSettings() {
+      return generateRandomBytesSettings;
     }
 
     /** Returns the builder for the settings used for calls to setIamPolicy. */
diff --git a/google-cloud-kms/src/test/java/com/google/cloud/kms/v1/KeyManagementServiceClientTest.java b/google-cloud-kms/src/test/java/com/google/cloud/kms/v1/KeyManagementServiceClientTest.java
index a7f1b8aa..ba4e3107 100644
--- a/google-cloud-kms/src/test/java/com/google/cloud/kms/v1/KeyManagementServiceClientTest.java
+++ b/google-cloud-kms/src/test/java/com/google/cloud/kms/v1/KeyManagementServiceClientTest.java
@@ -40,6 +40,7 @@
 import com.google.iam.v1.TestIamPermissionsResponse;
 import com.google.protobuf.AbstractMessage;
 import com.google.protobuf.ByteString;
+import com.google.protobuf.Duration;
 import com.google.protobuf.FieldMask;
 import com.google.protobuf.Int64Value;
 import com.google.protobuf.Timestamp;
@@ -545,6 +546,8 @@ public void getCryptoKeyTest() throws Exception {
             .setNextRotationTime(Timestamp.newBuilder().build())
             .setVersionTemplate(CryptoKeyVersionTemplate.newBuilder().build())
             .putAllLabels(new HashMap<String, String>())
+            .setImportOnly(true)
+            .setDestroyScheduledDuration(Duration.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
@@ -591,6 +594,8 @@ public void getCryptoKeyTest2() throws Exception {
             .setNextRotationTime(Timestamp.newBuilder().build())
             .setVersionTemplate(CryptoKeyVersionTemplate.newBuilder().build())
             .putAllLabels(new HashMap<String, String>())
+            .setImportOnly(true)
+            .setDestroyScheduledDuration(Duration.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
@@ -745,6 +750,7 @@ public void getPublicKeyTest() throws Exception {
             .setPem("pem110872")
             .setPemCrc32C(Int64Value.newBuilder().build())
             .setName("name3373707")
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
@@ -789,6 +795,7 @@ public void getPublicKeyTest2() throws Exception {
             .setPem("pem110872")
             .setPemCrc32C(Int64Value.newBuilder().build())
             .setName("name3373707")
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
@@ -1019,6 +1026,8 @@ public void createCryptoKeyTest() throws Exception {
             .setNextRotationTime(Timestamp.newBuilder().build())
             .setVersionTemplate(CryptoKeyVersionTemplate.newBuilder().build())
             .putAllLabels(new HashMap<String, String>())
+            .setImportOnly(true)
+            .setDestroyScheduledDuration(Duration.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
@@ -1070,6 +1079,8 @@ public void createCryptoKeyTest2() throws Exception {
             .setNextRotationTime(Timestamp.newBuilder().build())
             .setVersionTemplate(CryptoKeyVersionTemplate.newBuilder().build())
             .putAllLabels(new HashMap<String, String>())
+            .setImportOnly(true)
+            .setDestroyScheduledDuration(Duration.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
@@ -1418,6 +1429,8 @@ public void updateCryptoKeyTest() throws Exception {
             .setNextRotationTime(Timestamp.newBuilder().build())
             .setVersionTemplate(CryptoKeyVersionTemplate.newBuilder().build())
             .putAllLabels(new HashMap<String, String>())
+            .setImportOnly(true)
+            .setDestroyScheduledDuration(Duration.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
@@ -1514,29 +1527,35 @@ public void updateCryptoKeyVersionExceptionTest() throws Exception {
   }
 
   @Test
-  public void encryptTest() throws Exception {
-    EncryptResponse expectedResponse =
-        EncryptResponse.newBuilder()
-            .setName("name3373707")
-            .setCiphertext(ByteString.EMPTY)
-            .setCiphertextCrc32C(Int64Value.newBuilder().build())
-            .setVerifiedPlaintextCrc32C(true)
-            .setVerifiedAdditionalAuthenticatedDataCrc32C(true)
+  public void updateCryptoKeyPrimaryVersionTest() throws Exception {
+    CryptoKey expectedResponse =
+        CryptoKey.newBuilder()
+            .setName(
+                CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]")
+                    .toString())
+            .setPrimary(CryptoKeyVersion.newBuilder().build())
+            .setCreateTime(Timestamp.newBuilder().build())
+            .setNextRotationTime(Timestamp.newBuilder().build())
+            .setVersionTemplate(CryptoKeyVersionTemplate.newBuilder().build())
+            .putAllLabels(new HashMap<String, String>())
+            .setImportOnly(true)
+            .setDestroyScheduledDuration(Duration.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
-    ResourceName name = KeyRingName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]");
-    ByteString plaintext = ByteString.EMPTY;
+    CryptoKeyName name = CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]");
+    String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
 
-    EncryptResponse actualResponse = client.encrypt(name, plaintext);
+    CryptoKey actualResponse = client.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    EncryptRequest actualRequest = ((EncryptRequest) actualRequests.get(0));
+    UpdateCryptoKeyPrimaryVersionRequest actualRequest =
+        ((UpdateCryptoKeyPrimaryVersionRequest) actualRequests.get(0));
 
     Assert.assertEquals(name.toString(), actualRequest.getName());
-    Assert.assertEquals(plaintext, actualRequest.getPlaintext());
+    Assert.assertEquals(cryptoKeyVersionId, actualRequest.getCryptoKeyVersionId());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -1544,14 +1563,15 @@ public void encryptTest() throws Exception {
   }
 
   @Test
-  public void encryptExceptionTest() throws Exception {
+  public void updateCryptoKeyPrimaryVersionExceptionTest() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
-      ResourceName name = KeyRingName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]");
-      ByteString plaintext = ByteString.EMPTY;
-      client.encrypt(name, plaintext);
+      CryptoKeyName name =
+          CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]");
+      String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
+      client.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -1559,29 +1579,35 @@ public void encryptExceptionTest() throws Exception {
   }
 
   @Test
-  public void encryptTest2() throws Exception {
-    EncryptResponse expectedResponse =
-        EncryptResponse.newBuilder()
-            .setName("name3373707")
-            .setCiphertext(ByteString.EMPTY)
-            .setCiphertextCrc32C(Int64Value.newBuilder().build())
-            .setVerifiedPlaintextCrc32C(true)
-            .setVerifiedAdditionalAuthenticatedDataCrc32C(true)
+  public void updateCryptoKeyPrimaryVersionTest2() throws Exception {
+    CryptoKey expectedResponse =
+        CryptoKey.newBuilder()
+            .setName(
+                CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]")
+                    .toString())
+            .setPrimary(CryptoKeyVersion.newBuilder().build())
+            .setCreateTime(Timestamp.newBuilder().build())
+            .setNextRotationTime(Timestamp.newBuilder().build())
+            .setVersionTemplate(CryptoKeyVersionTemplate.newBuilder().build())
+            .putAllLabels(new HashMap<String, String>())
+            .setImportOnly(true)
+            .setDestroyScheduledDuration(Duration.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
     String name = "name3373707";
-    ByteString plaintext = ByteString.EMPTY;
+    String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
 
-    EncryptResponse actualResponse = client.encrypt(name, plaintext);
+    CryptoKey actualResponse = client.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    EncryptRequest actualRequest = ((EncryptRequest) actualRequests.get(0));
+    UpdateCryptoKeyPrimaryVersionRequest actualRequest =
+        ((UpdateCryptoKeyPrimaryVersionRequest) actualRequests.get(0));
 
     Assert.assertEquals(name, actualRequest.getName());
-    Assert.assertEquals(plaintext, actualRequest.getPlaintext());
+    Assert.assertEquals(cryptoKeyVersionId, actualRequest.getCryptoKeyVersionId());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -1589,14 +1615,14 @@ public void encryptTest2() throws Exception {
   }
 
   @Test
-  public void encryptExceptionTest2() throws Exception {
+  public void updateCryptoKeyPrimaryVersionExceptionTest2() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
       String name = "name3373707";
-      ByteString plaintext = ByteString.EMPTY;
-      client.encrypt(name, plaintext);
+      String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
+      client.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -1604,26 +1630,43 @@ public void encryptExceptionTest2() throws Exception {
   }
 
   @Test
-  public void decryptTest() throws Exception {
-    DecryptResponse expectedResponse =
-        DecryptResponse.newBuilder()
-            .setPlaintext(ByteString.EMPTY)
-            .setPlaintextCrc32C(Int64Value.newBuilder().build())
+  public void destroyCryptoKeyVersionTest() throws Exception {
+    CryptoKeyVersion expectedResponse =
+        CryptoKeyVersion.newBuilder()
+            .setName(
+                CryptoKeyVersionName.of(
+                        "[PROJECT]",
+                        "[LOCATION]",
+                        "[KEY_RING]",
+                        "[CRYPTO_KEY]",
+                        "[CRYPTO_KEY_VERSION]")
+                    .toString())
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
+            .setAttestation(KeyOperationAttestation.newBuilder().build())
+            .setCreateTime(Timestamp.newBuilder().build())
+            .setGenerateTime(Timestamp.newBuilder().build())
+            .setDestroyTime(Timestamp.newBuilder().build())
+            .setDestroyEventTime(Timestamp.newBuilder().build())
+            .setImportJob("importJob-208547368")
+            .setImportTime(Timestamp.newBuilder().build())
+            .setImportFailureReason("importFailureReason985493705")
+            .setExternalProtectionLevelOptions(ExternalProtectionLevelOptions.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
-    CryptoKeyName name = CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]");
-    ByteString ciphertext = ByteString.EMPTY;
+    CryptoKeyVersionName name =
+        CryptoKeyVersionName.of(
+            "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
 
-    DecryptResponse actualResponse = client.decrypt(name, ciphertext);
+    CryptoKeyVersion actualResponse = client.destroyCryptoKeyVersion(name);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    DecryptRequest actualRequest = ((DecryptRequest) actualRequests.get(0));
+    DestroyCryptoKeyVersionRequest actualRequest =
+        ((DestroyCryptoKeyVersionRequest) actualRequests.get(0));
 
     Assert.assertEquals(name.toString(), actualRequest.getName());
-    Assert.assertEquals(ciphertext, actualRequest.getCiphertext());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -1631,15 +1674,15 @@ public void decryptTest() throws Exception {
   }
 
   @Test
-  public void decryptExceptionTest() throws Exception {
+  public void destroyCryptoKeyVersionExceptionTest() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
-      CryptoKeyName name =
-          CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]");
-      ByteString ciphertext = ByteString.EMPTY;
-      client.decrypt(name, ciphertext);
+      CryptoKeyVersionName name =
+          CryptoKeyVersionName.of(
+              "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+      client.destroyCryptoKeyVersion(name);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -1647,26 +1690,41 @@ public void decryptExceptionTest() throws Exception {
   }
 
   @Test
-  public void decryptTest2() throws Exception {
-    DecryptResponse expectedResponse =
-        DecryptResponse.newBuilder()
-            .setPlaintext(ByteString.EMPTY)
-            .setPlaintextCrc32C(Int64Value.newBuilder().build())
+  public void destroyCryptoKeyVersionTest2() throws Exception {
+    CryptoKeyVersion expectedResponse =
+        CryptoKeyVersion.newBuilder()
+            .setName(
+                CryptoKeyVersionName.of(
+                        "[PROJECT]",
+                        "[LOCATION]",
+                        "[KEY_RING]",
+                        "[CRYPTO_KEY]",
+                        "[CRYPTO_KEY_VERSION]")
+                    .toString())
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
+            .setAttestation(KeyOperationAttestation.newBuilder().build())
+            .setCreateTime(Timestamp.newBuilder().build())
+            .setGenerateTime(Timestamp.newBuilder().build())
+            .setDestroyTime(Timestamp.newBuilder().build())
+            .setDestroyEventTime(Timestamp.newBuilder().build())
+            .setImportJob("importJob-208547368")
+            .setImportTime(Timestamp.newBuilder().build())
+            .setImportFailureReason("importFailureReason985493705")
+            .setExternalProtectionLevelOptions(ExternalProtectionLevelOptions.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
     String name = "name3373707";
-    ByteString ciphertext = ByteString.EMPTY;
 
-    DecryptResponse actualResponse = client.decrypt(name, ciphertext);
+    CryptoKeyVersion actualResponse = client.destroyCryptoKeyVersion(name);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    DecryptRequest actualRequest = ((DecryptRequest) actualRequests.get(0));
+    DestroyCryptoKeyVersionRequest actualRequest =
+        ((DestroyCryptoKeyVersionRequest) actualRequests.get(0));
 
     Assert.assertEquals(name, actualRequest.getName());
-    Assert.assertEquals(ciphertext, actualRequest.getCiphertext());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -1674,14 +1732,13 @@ public void decryptTest2() throws Exception {
   }
 
   @Test
-  public void decryptExceptionTest2() throws Exception {
+  public void destroyCryptoKeyVersionExceptionTest2() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
       String name = "name3373707";
-      ByteString ciphertext = ByteString.EMPTY;
-      client.decrypt(name, ciphertext);
+      client.destroyCryptoKeyVersion(name);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -1689,30 +1746,43 @@ public void decryptExceptionTest2() throws Exception {
   }
 
   @Test
-  public void asymmetricSignTest() throws Exception {
-    AsymmetricSignResponse expectedResponse =
-        AsymmetricSignResponse.newBuilder()
-            .setSignature(ByteString.EMPTY)
-            .setSignatureCrc32C(Int64Value.newBuilder().build())
-            .setVerifiedDigestCrc32C(true)
-            .setName("name3373707")
+  public void restoreCryptoKeyVersionTest() throws Exception {
+    CryptoKeyVersion expectedResponse =
+        CryptoKeyVersion.newBuilder()
+            .setName(
+                CryptoKeyVersionName.of(
+                        "[PROJECT]",
+                        "[LOCATION]",
+                        "[KEY_RING]",
+                        "[CRYPTO_KEY]",
+                        "[CRYPTO_KEY_VERSION]")
+                    .toString())
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
+            .setAttestation(KeyOperationAttestation.newBuilder().build())
+            .setCreateTime(Timestamp.newBuilder().build())
+            .setGenerateTime(Timestamp.newBuilder().build())
+            .setDestroyTime(Timestamp.newBuilder().build())
+            .setDestroyEventTime(Timestamp.newBuilder().build())
+            .setImportJob("importJob-208547368")
+            .setImportTime(Timestamp.newBuilder().build())
+            .setImportFailureReason("importFailureReason985493705")
+            .setExternalProtectionLevelOptions(ExternalProtectionLevelOptions.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
     CryptoKeyVersionName name =
         CryptoKeyVersionName.of(
             "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
-    Digest digest = Digest.newBuilder().build();
 
-    AsymmetricSignResponse actualResponse = client.asymmetricSign(name, digest);
+    CryptoKeyVersion actualResponse = client.restoreCryptoKeyVersion(name);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    AsymmetricSignRequest actualRequest = ((AsymmetricSignRequest) actualRequests.get(0));
+    RestoreCryptoKeyVersionRequest actualRequest =
+        ((RestoreCryptoKeyVersionRequest) actualRequests.get(0));
 
     Assert.assertEquals(name.toString(), actualRequest.getName());
-    Assert.assertEquals(digest, actualRequest.getDigest());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -1720,7 +1790,7 @@ public void asymmetricSignTest() throws Exception {
   }
 
   @Test
-  public void asymmetricSignExceptionTest() throws Exception {
+  public void restoreCryptoKeyVersionExceptionTest() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
@@ -1728,8 +1798,7 @@ public void asymmetricSignExceptionTest() throws Exception {
       CryptoKeyVersionName name =
           CryptoKeyVersionName.of(
               "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
-      Digest digest = Digest.newBuilder().build();
-      client.asymmetricSign(name, digest);
+      client.restoreCryptoKeyVersion(name);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -1737,28 +1806,41 @@ public void asymmetricSignExceptionTest() throws Exception {
   }
 
   @Test
-  public void asymmetricSignTest2() throws Exception {
-    AsymmetricSignResponse expectedResponse =
-        AsymmetricSignResponse.newBuilder()
-            .setSignature(ByteString.EMPTY)
-            .setSignatureCrc32C(Int64Value.newBuilder().build())
-            .setVerifiedDigestCrc32C(true)
-            .setName("name3373707")
+  public void restoreCryptoKeyVersionTest2() throws Exception {
+    CryptoKeyVersion expectedResponse =
+        CryptoKeyVersion.newBuilder()
+            .setName(
+                CryptoKeyVersionName.of(
+                        "[PROJECT]",
+                        "[LOCATION]",
+                        "[KEY_RING]",
+                        "[CRYPTO_KEY]",
+                        "[CRYPTO_KEY_VERSION]")
+                    .toString())
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
+            .setAttestation(KeyOperationAttestation.newBuilder().build())
+            .setCreateTime(Timestamp.newBuilder().build())
+            .setGenerateTime(Timestamp.newBuilder().build())
+            .setDestroyTime(Timestamp.newBuilder().build())
+            .setDestroyEventTime(Timestamp.newBuilder().build())
+            .setImportJob("importJob-208547368")
+            .setImportTime(Timestamp.newBuilder().build())
+            .setImportFailureReason("importFailureReason985493705")
+            .setExternalProtectionLevelOptions(ExternalProtectionLevelOptions.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
     String name = "name3373707";
-    Digest digest = Digest.newBuilder().build();
 
-    AsymmetricSignResponse actualResponse = client.asymmetricSign(name, digest);
+    CryptoKeyVersion actualResponse = client.restoreCryptoKeyVersion(name);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    AsymmetricSignRequest actualRequest = ((AsymmetricSignRequest) actualRequests.get(0));
+    RestoreCryptoKeyVersionRequest actualRequest =
+        ((RestoreCryptoKeyVersionRequest) actualRequests.get(0));
 
     Assert.assertEquals(name, actualRequest.getName());
-    Assert.assertEquals(digest, actualRequest.getDigest());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -1766,14 +1848,13 @@ public void asymmetricSignTest2() throws Exception {
   }
 
   @Test
-  public void asymmetricSignExceptionTest2() throws Exception {
+  public void restoreCryptoKeyVersionExceptionTest2() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
       String name = "name3373707";
-      Digest digest = Digest.newBuilder().build();
-      client.asymmetricSign(name, digest);
+      client.restoreCryptoKeyVersion(name);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -1781,26 +1862,117 @@ public void asymmetricSignExceptionTest2() throws Exception {
   }
 
   @Test
-  public void asymmetricDecryptTest() throws Exception {
-    AsymmetricDecryptResponse expectedResponse =
-        AsymmetricDecryptResponse.newBuilder()
-            .setPlaintext(ByteString.EMPTY)
-            .setPlaintextCrc32C(Int64Value.newBuilder().build())
-            .setVerifiedCiphertextCrc32C(true)
+  public void encryptTest() throws Exception {
+    EncryptResponse expectedResponse =
+        EncryptResponse.newBuilder()
+            .setName("name3373707")
+            .setCiphertext(ByteString.EMPTY)
+            .setCiphertextCrc32C(Int64Value.newBuilder().build())
+            .setVerifiedPlaintextCrc32C(true)
+            .setVerifiedAdditionalAuthenticatedDataCrc32C(true)
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
-    CryptoKeyVersionName name =
-        CryptoKeyVersionName.of(
-            "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+    ResourceName name = KeyRingName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]");
+    ByteString plaintext = ByteString.EMPTY;
+
+    EncryptResponse actualResponse = client.encrypt(name, plaintext);
+    Assert.assertEquals(expectedResponse, actualResponse);
+
+    List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
+    Assert.assertEquals(1, actualRequests.size());
+    EncryptRequest actualRequest = ((EncryptRequest) actualRequests.get(0));
+
+    Assert.assertEquals(name.toString(), actualRequest.getName());
+    Assert.assertEquals(plaintext, actualRequest.getPlaintext());
+    Assert.assertTrue(
+        channelProvider.isHeaderSent(
+            ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
+            GaxGrpcProperties.getDefaultApiClientHeaderPattern()));
+  }
+
+  @Test
+  public void encryptExceptionTest() throws Exception {
+    StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
+    mockKeyManagementService.addException(exception);
+
+    try {
+      ResourceName name = KeyRingName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]");
+      ByteString plaintext = ByteString.EMPTY;
+      client.encrypt(name, plaintext);
+      Assert.fail("No exception raised");
+    } catch (InvalidArgumentException e) {
+      // Expected exception.
+    }
+  }
+
+  @Test
+  public void encryptTest2() throws Exception {
+    EncryptResponse expectedResponse =
+        EncryptResponse.newBuilder()
+            .setName("name3373707")
+            .setCiphertext(ByteString.EMPTY)
+            .setCiphertextCrc32C(Int64Value.newBuilder().build())
+            .setVerifiedPlaintextCrc32C(true)
+            .setVerifiedAdditionalAuthenticatedDataCrc32C(true)
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
+            .build();
+    mockKeyManagementService.addResponse(expectedResponse);
+
+    String name = "name3373707";
+    ByteString plaintext = ByteString.EMPTY;
+
+    EncryptResponse actualResponse = client.encrypt(name, plaintext);
+    Assert.assertEquals(expectedResponse, actualResponse);
+
+    List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
+    Assert.assertEquals(1, actualRequests.size());
+    EncryptRequest actualRequest = ((EncryptRequest) actualRequests.get(0));
+
+    Assert.assertEquals(name, actualRequest.getName());
+    Assert.assertEquals(plaintext, actualRequest.getPlaintext());
+    Assert.assertTrue(
+        channelProvider.isHeaderSent(
+            ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
+            GaxGrpcProperties.getDefaultApiClientHeaderPattern()));
+  }
+
+  @Test
+  public void encryptExceptionTest2() throws Exception {
+    StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
+    mockKeyManagementService.addException(exception);
+
+    try {
+      String name = "name3373707";
+      ByteString plaintext = ByteString.EMPTY;
+      client.encrypt(name, plaintext);
+      Assert.fail("No exception raised");
+    } catch (InvalidArgumentException e) {
+      // Expected exception.
+    }
+  }
+
+  @Test
+  public void decryptTest() throws Exception {
+    DecryptResponse expectedResponse =
+        DecryptResponse.newBuilder()
+            .setPlaintext(ByteString.EMPTY)
+            .setPlaintextCrc32C(Int64Value.newBuilder().build())
+            .setUsedPrimary(true)
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
+            .build();
+    mockKeyManagementService.addResponse(expectedResponse);
+
+    CryptoKeyName name = CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]");
     ByteString ciphertext = ByteString.EMPTY;
 
-    AsymmetricDecryptResponse actualResponse = client.asymmetricDecrypt(name, ciphertext);
+    DecryptResponse actualResponse = client.decrypt(name, ciphertext);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    AsymmetricDecryptRequest actualRequest = ((AsymmetricDecryptRequest) actualRequests.get(0));
+    DecryptRequest actualRequest = ((DecryptRequest) actualRequests.get(0));
 
     Assert.assertEquals(name.toString(), actualRequest.getName());
     Assert.assertEquals(ciphertext, actualRequest.getCiphertext());
@@ -1811,16 +1983,15 @@ public void asymmetricDecryptTest() throws Exception {
   }
 
   @Test
-  public void asymmetricDecryptExceptionTest() throws Exception {
+  public void decryptExceptionTest() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
-      CryptoKeyVersionName name =
-          CryptoKeyVersionName.of(
-              "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+      CryptoKeyName name =
+          CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]");
       ByteString ciphertext = ByteString.EMPTY;
-      client.asymmetricDecrypt(name, ciphertext);
+      client.decrypt(name, ciphertext);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -1828,24 +1999,25 @@ public void asymmetricDecryptExceptionTest() throws Exception {
   }
 
   @Test
-  public void asymmetricDecryptTest2() throws Exception {
-    AsymmetricDecryptResponse expectedResponse =
-        AsymmetricDecryptResponse.newBuilder()
+  public void decryptTest2() throws Exception {
+    DecryptResponse expectedResponse =
+        DecryptResponse.newBuilder()
             .setPlaintext(ByteString.EMPTY)
             .setPlaintextCrc32C(Int64Value.newBuilder().build())
-            .setVerifiedCiphertextCrc32C(true)
+            .setUsedPrimary(true)
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
     String name = "name3373707";
     ByteString ciphertext = ByteString.EMPTY;
 
-    AsymmetricDecryptResponse actualResponse = client.asymmetricDecrypt(name, ciphertext);
+    DecryptResponse actualResponse = client.decrypt(name, ciphertext);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    AsymmetricDecryptRequest actualRequest = ((AsymmetricDecryptRequest) actualRequests.get(0));
+    DecryptRequest actualRequest = ((DecryptRequest) actualRequests.get(0));
 
     Assert.assertEquals(name, actualRequest.getName());
     Assert.assertEquals(ciphertext, actualRequest.getCiphertext());
@@ -1856,14 +2028,14 @@ public void asymmetricDecryptTest2() throws Exception {
   }
 
   @Test
-  public void asymmetricDecryptExceptionTest2() throws Exception {
+  public void decryptExceptionTest2() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
       String name = "name3373707";
       ByteString ciphertext = ByteString.EMPTY;
-      client.asymmetricDecrypt(name, ciphertext);
+      client.decrypt(name, ciphertext);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -1871,33 +2043,31 @@ public void asymmetricDecryptExceptionTest2() throws Exception {
   }
 
   @Test
-  public void updateCryptoKeyPrimaryVersionTest() throws Exception {
-    CryptoKey expectedResponse =
-        CryptoKey.newBuilder()
-            .setName(
-                CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]")
-                    .toString())
-            .setPrimary(CryptoKeyVersion.newBuilder().build())
-            .setCreateTime(Timestamp.newBuilder().build())
-            .setNextRotationTime(Timestamp.newBuilder().build())
-            .setVersionTemplate(CryptoKeyVersionTemplate.newBuilder().build())
-            .putAllLabels(new HashMap<String, String>())
+  public void asymmetricSignTest() throws Exception {
+    AsymmetricSignResponse expectedResponse =
+        AsymmetricSignResponse.newBuilder()
+            .setSignature(ByteString.EMPTY)
+            .setSignatureCrc32C(Int64Value.newBuilder().build())
+            .setVerifiedDigestCrc32C(true)
+            .setName("name3373707")
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
-    CryptoKeyName name = CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]");
-    String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
+    CryptoKeyVersionName name =
+        CryptoKeyVersionName.of(
+            "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+    Digest digest = Digest.newBuilder().build();
 
-    CryptoKey actualResponse = client.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
+    AsymmetricSignResponse actualResponse = client.asymmetricSign(name, digest);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    UpdateCryptoKeyPrimaryVersionRequest actualRequest =
-        ((UpdateCryptoKeyPrimaryVersionRequest) actualRequests.get(0));
+    AsymmetricSignRequest actualRequest = ((AsymmetricSignRequest) actualRequests.get(0));
 
     Assert.assertEquals(name.toString(), actualRequest.getName());
-    Assert.assertEquals(cryptoKeyVersionId, actualRequest.getCryptoKeyVersionId());
+    Assert.assertEquals(digest, actualRequest.getDigest());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -1905,15 +2075,16 @@ public void updateCryptoKeyPrimaryVersionTest() throws Exception {
   }
 
   @Test
-  public void updateCryptoKeyPrimaryVersionExceptionTest() throws Exception {
+  public void asymmetricSignExceptionTest() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
-      CryptoKeyName name =
-          CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]");
-      String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
-      client.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
+      CryptoKeyVersionName name =
+          CryptoKeyVersionName.of(
+              "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+      Digest digest = Digest.newBuilder().build();
+      client.asymmetricSign(name, digest);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -1921,33 +2092,29 @@ public void updateCryptoKeyPrimaryVersionExceptionTest() throws Exception {
   }
 
   @Test
-  public void updateCryptoKeyPrimaryVersionTest2() throws Exception {
-    CryptoKey expectedResponse =
-        CryptoKey.newBuilder()
-            .setName(
-                CryptoKeyName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]")
-                    .toString())
-            .setPrimary(CryptoKeyVersion.newBuilder().build())
-            .setCreateTime(Timestamp.newBuilder().build())
-            .setNextRotationTime(Timestamp.newBuilder().build())
-            .setVersionTemplate(CryptoKeyVersionTemplate.newBuilder().build())
-            .putAllLabels(new HashMap<String, String>())
+  public void asymmetricSignTest2() throws Exception {
+    AsymmetricSignResponse expectedResponse =
+        AsymmetricSignResponse.newBuilder()
+            .setSignature(ByteString.EMPTY)
+            .setSignatureCrc32C(Int64Value.newBuilder().build())
+            .setVerifiedDigestCrc32C(true)
+            .setName("name3373707")
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
     String name = "name3373707";
-    String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
+    Digest digest = Digest.newBuilder().build();
 
-    CryptoKey actualResponse = client.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
+    AsymmetricSignResponse actualResponse = client.asymmetricSign(name, digest);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    UpdateCryptoKeyPrimaryVersionRequest actualRequest =
-        ((UpdateCryptoKeyPrimaryVersionRequest) actualRequests.get(0));
+    AsymmetricSignRequest actualRequest = ((AsymmetricSignRequest) actualRequests.get(0));
 
     Assert.assertEquals(name, actualRequest.getName());
-    Assert.assertEquals(cryptoKeyVersionId, actualRequest.getCryptoKeyVersionId());
+    Assert.assertEquals(digest, actualRequest.getDigest());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -1955,14 +2122,14 @@ public void updateCryptoKeyPrimaryVersionTest2() throws Exception {
   }
 
   @Test
-  public void updateCryptoKeyPrimaryVersionExceptionTest2() throws Exception {
+  public void asymmetricSignExceptionTest2() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
       String name = "name3373707";
-      String cryptoKeyVersionId = "cryptoKeyVersionId987674581";
-      client.updateCryptoKeyPrimaryVersion(name, cryptoKeyVersionId);
+      Digest digest = Digest.newBuilder().build();
+      client.asymmetricSign(name, digest);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -1970,43 +2137,30 @@ public void updateCryptoKeyPrimaryVersionExceptionTest2() throws Exception {
   }
 
   @Test
-  public void destroyCryptoKeyVersionTest() throws Exception {
-    CryptoKeyVersion expectedResponse =
-        CryptoKeyVersion.newBuilder()
-            .setName(
-                CryptoKeyVersionName.of(
-                        "[PROJECT]",
-                        "[LOCATION]",
-                        "[KEY_RING]",
-                        "[CRYPTO_KEY]",
-                        "[CRYPTO_KEY_VERSION]")
-                    .toString())
+  public void asymmetricDecryptTest() throws Exception {
+    AsymmetricDecryptResponse expectedResponse =
+        AsymmetricDecryptResponse.newBuilder()
+            .setPlaintext(ByteString.EMPTY)
+            .setPlaintextCrc32C(Int64Value.newBuilder().build())
+            .setVerifiedCiphertextCrc32C(true)
             .setProtectionLevel(ProtectionLevel.forNumber(0))
-            .setAttestation(KeyOperationAttestation.newBuilder().build())
-            .setCreateTime(Timestamp.newBuilder().build())
-            .setGenerateTime(Timestamp.newBuilder().build())
-            .setDestroyTime(Timestamp.newBuilder().build())
-            .setDestroyEventTime(Timestamp.newBuilder().build())
-            .setImportJob("importJob-208547368")
-            .setImportTime(Timestamp.newBuilder().build())
-            .setImportFailureReason("importFailureReason985493705")
-            .setExternalProtectionLevelOptions(ExternalProtectionLevelOptions.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
     CryptoKeyVersionName name =
         CryptoKeyVersionName.of(
             "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+    ByteString ciphertext = ByteString.EMPTY;
 
-    CryptoKeyVersion actualResponse = client.destroyCryptoKeyVersion(name);
+    AsymmetricDecryptResponse actualResponse = client.asymmetricDecrypt(name, ciphertext);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    DestroyCryptoKeyVersionRequest actualRequest =
-        ((DestroyCryptoKeyVersionRequest) actualRequests.get(0));
+    AsymmetricDecryptRequest actualRequest = ((AsymmetricDecryptRequest) actualRequests.get(0));
 
     Assert.assertEquals(name.toString(), actualRequest.getName());
+    Assert.assertEquals(ciphertext, actualRequest.getCiphertext());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -2014,7 +2168,7 @@ public void destroyCryptoKeyVersionTest() throws Exception {
   }
 
   @Test
-  public void destroyCryptoKeyVersionExceptionTest() throws Exception {
+  public void asymmetricDecryptExceptionTest() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
@@ -2022,7 +2176,8 @@ public void destroyCryptoKeyVersionExceptionTest() throws Exception {
       CryptoKeyVersionName name =
           CryptoKeyVersionName.of(
               "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
-      client.destroyCryptoKeyVersion(name);
+      ByteString ciphertext = ByteString.EMPTY;
+      client.asymmetricDecrypt(name, ciphertext);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -2030,41 +2185,28 @@ public void destroyCryptoKeyVersionExceptionTest() throws Exception {
   }
 
   @Test
-  public void destroyCryptoKeyVersionTest2() throws Exception {
-    CryptoKeyVersion expectedResponse =
-        CryptoKeyVersion.newBuilder()
-            .setName(
-                CryptoKeyVersionName.of(
-                        "[PROJECT]",
-                        "[LOCATION]",
-                        "[KEY_RING]",
-                        "[CRYPTO_KEY]",
-                        "[CRYPTO_KEY_VERSION]")
-                    .toString())
+  public void asymmetricDecryptTest2() throws Exception {
+    AsymmetricDecryptResponse expectedResponse =
+        AsymmetricDecryptResponse.newBuilder()
+            .setPlaintext(ByteString.EMPTY)
+            .setPlaintextCrc32C(Int64Value.newBuilder().build())
+            .setVerifiedCiphertextCrc32C(true)
             .setProtectionLevel(ProtectionLevel.forNumber(0))
-            .setAttestation(KeyOperationAttestation.newBuilder().build())
-            .setCreateTime(Timestamp.newBuilder().build())
-            .setGenerateTime(Timestamp.newBuilder().build())
-            .setDestroyTime(Timestamp.newBuilder().build())
-            .setDestroyEventTime(Timestamp.newBuilder().build())
-            .setImportJob("importJob-208547368")
-            .setImportTime(Timestamp.newBuilder().build())
-            .setImportFailureReason("importFailureReason985493705")
-            .setExternalProtectionLevelOptions(ExternalProtectionLevelOptions.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
     String name = "name3373707";
+    ByteString ciphertext = ByteString.EMPTY;
 
-    CryptoKeyVersion actualResponse = client.destroyCryptoKeyVersion(name);
+    AsymmetricDecryptResponse actualResponse = client.asymmetricDecrypt(name, ciphertext);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    DestroyCryptoKeyVersionRequest actualRequest =
-        ((DestroyCryptoKeyVersionRequest) actualRequests.get(0));
+    AsymmetricDecryptRequest actualRequest = ((AsymmetricDecryptRequest) actualRequests.get(0));
 
     Assert.assertEquals(name, actualRequest.getName());
+    Assert.assertEquals(ciphertext, actualRequest.getCiphertext());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -2072,13 +2214,14 @@ public void destroyCryptoKeyVersionTest2() throws Exception {
   }
 
   @Test
-  public void destroyCryptoKeyVersionExceptionTest2() throws Exception {
+  public void asymmetricDecryptExceptionTest2() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
       String name = "name3373707";
-      client.destroyCryptoKeyVersion(name);
+      ByteString ciphertext = ByteString.EMPTY;
+      client.asymmetricDecrypt(name, ciphertext);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -2086,43 +2229,31 @@ public void destroyCryptoKeyVersionExceptionTest2() throws Exception {
   }
 
   @Test
-  public void restoreCryptoKeyVersionTest() throws Exception {
-    CryptoKeyVersion expectedResponse =
-        CryptoKeyVersion.newBuilder()
-            .setName(
-                CryptoKeyVersionName.of(
-                        "[PROJECT]",
-                        "[LOCATION]",
-                        "[KEY_RING]",
-                        "[CRYPTO_KEY]",
-                        "[CRYPTO_KEY_VERSION]")
-                    .toString())
+  public void macSignTest() throws Exception {
+    MacSignResponse expectedResponse =
+        MacSignResponse.newBuilder()
+            .setName("name3373707")
+            .setMac(ByteString.EMPTY)
+            .setMacCrc32C(Int64Value.newBuilder().build())
+            .setVerifiedDataCrc32C(true)
             .setProtectionLevel(ProtectionLevel.forNumber(0))
-            .setAttestation(KeyOperationAttestation.newBuilder().build())
-            .setCreateTime(Timestamp.newBuilder().build())
-            .setGenerateTime(Timestamp.newBuilder().build())
-            .setDestroyTime(Timestamp.newBuilder().build())
-            .setDestroyEventTime(Timestamp.newBuilder().build())
-            .setImportJob("importJob-208547368")
-            .setImportTime(Timestamp.newBuilder().build())
-            .setImportFailureReason("importFailureReason985493705")
-            .setExternalProtectionLevelOptions(ExternalProtectionLevelOptions.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
     CryptoKeyVersionName name =
         CryptoKeyVersionName.of(
             "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+    ByteString data = ByteString.EMPTY;
 
-    CryptoKeyVersion actualResponse = client.restoreCryptoKeyVersion(name);
+    MacSignResponse actualResponse = client.macSign(name, data);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    RestoreCryptoKeyVersionRequest actualRequest =
-        ((RestoreCryptoKeyVersionRequest) actualRequests.get(0));
+    MacSignRequest actualRequest = ((MacSignRequest) actualRequests.get(0));
 
     Assert.assertEquals(name.toString(), actualRequest.getName());
+    Assert.assertEquals(data, actualRequest.getData());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -2130,7 +2261,7 @@ public void restoreCryptoKeyVersionTest() throws Exception {
   }
 
   @Test
-  public void restoreCryptoKeyVersionExceptionTest() throws Exception {
+  public void macSignExceptionTest() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
@@ -2138,7 +2269,8 @@ public void restoreCryptoKeyVersionExceptionTest() throws Exception {
       CryptoKeyVersionName name =
           CryptoKeyVersionName.of(
               "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
-      client.restoreCryptoKeyVersion(name);
+      ByteString data = ByteString.EMPTY;
+      client.macSign(name, data);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
@@ -2146,41 +2278,29 @@ public void restoreCryptoKeyVersionExceptionTest() throws Exception {
   }
 
   @Test
-  public void restoreCryptoKeyVersionTest2() throws Exception {
-    CryptoKeyVersion expectedResponse =
-        CryptoKeyVersion.newBuilder()
-            .setName(
-                CryptoKeyVersionName.of(
-                        "[PROJECT]",
-                        "[LOCATION]",
-                        "[KEY_RING]",
-                        "[CRYPTO_KEY]",
-                        "[CRYPTO_KEY_VERSION]")
-                    .toString())
+  public void macSignTest2() throws Exception {
+    MacSignResponse expectedResponse =
+        MacSignResponse.newBuilder()
+            .setName("name3373707")
+            .setMac(ByteString.EMPTY)
+            .setMacCrc32C(Int64Value.newBuilder().build())
+            .setVerifiedDataCrc32C(true)
             .setProtectionLevel(ProtectionLevel.forNumber(0))
-            .setAttestation(KeyOperationAttestation.newBuilder().build())
-            .setCreateTime(Timestamp.newBuilder().build())
-            .setGenerateTime(Timestamp.newBuilder().build())
-            .setDestroyTime(Timestamp.newBuilder().build())
-            .setDestroyEventTime(Timestamp.newBuilder().build())
-            .setImportJob("importJob-208547368")
-            .setImportTime(Timestamp.newBuilder().build())
-            .setImportFailureReason("importFailureReason985493705")
-            .setExternalProtectionLevelOptions(ExternalProtectionLevelOptions.newBuilder().build())
             .build();
     mockKeyManagementService.addResponse(expectedResponse);
 
     String name = "name3373707";
+    ByteString data = ByteString.EMPTY;
 
-    CryptoKeyVersion actualResponse = client.restoreCryptoKeyVersion(name);
+    MacSignResponse actualResponse = client.macSign(name, data);
     Assert.assertEquals(expectedResponse, actualResponse);
 
     List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
     Assert.assertEquals(1, actualRequests.size());
-    RestoreCryptoKeyVersionRequest actualRequest =
-        ((RestoreCryptoKeyVersionRequest) actualRequests.get(0));
+    MacSignRequest actualRequest = ((MacSignRequest) actualRequests.get(0));
 
     Assert.assertEquals(name, actualRequest.getName());
+    Assert.assertEquals(data, actualRequest.getData());
     Assert.assertTrue(
         channelProvider.isHeaderSent(
             ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
@@ -2188,13 +2308,162 @@ public void restoreCryptoKeyVersionTest2() throws Exception {
   }
 
   @Test
-  public void restoreCryptoKeyVersionExceptionTest2() throws Exception {
+  public void macSignExceptionTest2() throws Exception {
     StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
     mockKeyManagementService.addException(exception);
 
     try {
       String name = "name3373707";
-      client.restoreCryptoKeyVersion(name);
+      ByteString data = ByteString.EMPTY;
+      client.macSign(name, data);
+      Assert.fail("No exception raised");
+    } catch (InvalidArgumentException e) {
+      // Expected exception.
+    }
+  }
+
+  @Test
+  public void macVerifyTest() throws Exception {
+    MacVerifyResponse expectedResponse =
+        MacVerifyResponse.newBuilder()
+            .setName("name3373707")
+            .setSuccess(true)
+            .setVerifiedDataCrc32C(true)
+            .setVerifiedMacCrc32C(true)
+            .setVerifiedSuccessIntegrity(true)
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
+            .build();
+    mockKeyManagementService.addResponse(expectedResponse);
+
+    CryptoKeyVersionName name =
+        CryptoKeyVersionName.of(
+            "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+    ByteString data = ByteString.EMPTY;
+    ByteString mac = ByteString.EMPTY;
+
+    MacVerifyResponse actualResponse = client.macVerify(name, data, mac);
+    Assert.assertEquals(expectedResponse, actualResponse);
+
+    List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
+    Assert.assertEquals(1, actualRequests.size());
+    MacVerifyRequest actualRequest = ((MacVerifyRequest) actualRequests.get(0));
+
+    Assert.assertEquals(name.toString(), actualRequest.getName());
+    Assert.assertEquals(data, actualRequest.getData());
+    Assert.assertEquals(mac, actualRequest.getMac());
+    Assert.assertTrue(
+        channelProvider.isHeaderSent(
+            ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
+            GaxGrpcProperties.getDefaultApiClientHeaderPattern()));
+  }
+
+  @Test
+  public void macVerifyExceptionTest() throws Exception {
+    StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
+    mockKeyManagementService.addException(exception);
+
+    try {
+      CryptoKeyVersionName name =
+          CryptoKeyVersionName.of(
+              "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]", "[CRYPTO_KEY_VERSION]");
+      ByteString data = ByteString.EMPTY;
+      ByteString mac = ByteString.EMPTY;
+      client.macVerify(name, data, mac);
+      Assert.fail("No exception raised");
+    } catch (InvalidArgumentException e) {
+      // Expected exception.
+    }
+  }
+
+  @Test
+  public void macVerifyTest2() throws Exception {
+    MacVerifyResponse expectedResponse =
+        MacVerifyResponse.newBuilder()
+            .setName("name3373707")
+            .setSuccess(true)
+            .setVerifiedDataCrc32C(true)
+            .setVerifiedMacCrc32C(true)
+            .setVerifiedSuccessIntegrity(true)
+            .setProtectionLevel(ProtectionLevel.forNumber(0))
+            .build();
+    mockKeyManagementService.addResponse(expectedResponse);
+
+    String name = "name3373707";
+    ByteString data = ByteString.EMPTY;
+    ByteString mac = ByteString.EMPTY;
+
+    MacVerifyResponse actualResponse = client.macVerify(name, data, mac);
+    Assert.assertEquals(expectedResponse, actualResponse);
+
+    List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
+    Assert.assertEquals(1, actualRequests.size());
+    MacVerifyRequest actualRequest = ((MacVerifyRequest) actualRequests.get(0));
+
+    Assert.assertEquals(name, actualRequest.getName());
+    Assert.assertEquals(data, actualRequest.getData());
+    Assert.assertEquals(mac, actualRequest.getMac());
+    Assert.assertTrue(
+        channelProvider.isHeaderSent(
+            ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
+            GaxGrpcProperties.getDefaultApiClientHeaderPattern()));
+  }
+
+  @Test
+  public void macVerifyExceptionTest2() throws Exception {
+    StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
+    mockKeyManagementService.addException(exception);
+
+    try {
+      String name = "name3373707";
+      ByteString data = ByteString.EMPTY;
+      ByteString mac = ByteString.EMPTY;
+      client.macVerify(name, data, mac);
+      Assert.fail("No exception raised");
+    } catch (InvalidArgumentException e) {
+      // Expected exception.
+    }
+  }
+
+  @Test
+  public void generateRandomBytesTest() throws Exception {
+    GenerateRandomBytesResponse expectedResponse =
+        GenerateRandomBytesResponse.newBuilder()
+            .setData(ByteString.EMPTY)
+            .setDataCrc32C(Int64Value.newBuilder().build())
+            .build();
+    mockKeyManagementService.addResponse(expectedResponse);
+
+    String location = "location1901043637";
+    int lengthBytes = -745661998;
+    ProtectionLevel protectionLevel = ProtectionLevel.forNumber(0);
+
+    GenerateRandomBytesResponse actualResponse =
+        client.generateRandomBytes(location, lengthBytes, protectionLevel);
+    Assert.assertEquals(expectedResponse, actualResponse);
+
+    List<AbstractMessage> actualRequests = mockKeyManagementService.getRequests();
+    Assert.assertEquals(1, actualRequests.size());
+    GenerateRandomBytesRequest actualRequest = ((GenerateRandomBytesRequest) actualRequests.get(0));
+
+    Assert.assertEquals(location, actualRequest.getLocation());
+    Assert.assertEquals(lengthBytes, actualRequest.getLengthBytes());
+    Assert.assertEquals(protectionLevel, actualRequest.getProtectionLevel());
+    Assert.assertTrue(
+        channelProvider.isHeaderSent(
+            ApiClientHeaderProvider.getDefaultApiClientHeaderKey(),
+            GaxGrpcProperties.getDefaultApiClientHeaderPattern()));
+  }
+
+  @Test
+  public void generateRandomBytesExceptionTest() throws Exception {
+    StatusRuntimeException exception = new StatusRuntimeException(io.grpc.Status.INVALID_ARGUMENT);
+    mockKeyManagementService.addException(exception);
+
+    try {
+      String location = "location1901043637";
+      int lengthBytes = -745661998;
+      ProtectionLevel protectionLevel = ProtectionLevel.forNumber(0);
+      client.generateRandomBytes(location, lengthBytes, protectionLevel);
       Assert.fail("No exception raised");
     } catch (InvalidArgumentException e) {
       // Expected exception.
diff --git a/google-cloud-kms/src/test/java/com/google/cloud/kms/v1/MockKeyManagementServiceImpl.java b/google-cloud-kms/src/test/java/com/google/cloud/kms/v1/MockKeyManagementServiceImpl.java
index c5a5f4c0..85b6f2b5 100644
--- a/google-cloud-kms/src/test/java/com/google/cloud/kms/v1/MockKeyManagementServiceImpl.java
+++ b/google-cloud-kms/src/test/java/com/google/cloud/kms/v1/MockKeyManagementServiceImpl.java
@@ -394,6 +394,69 @@ public void updateCryptoKeyVersion(
     }
   }
 
+  @Override
+  public void updateCryptoKeyPrimaryVersion(
+      UpdateCryptoKeyPrimaryVersionRequest request, StreamObserver<CryptoKey> responseObserver) {
+    Object response = responses.poll();
+    if (response instanceof CryptoKey) {
+      requests.add(request);
+      responseObserver.onNext(((CryptoKey) response));
+      responseObserver.onCompleted();
+    } else if (response instanceof Exception) {
+      responseObserver.onError(((Exception) response));
+    } else {
+      responseObserver.onError(
+          new IllegalArgumentException(
+              String.format(
+                  "Unrecognized response type %s for method UpdateCryptoKeyPrimaryVersion, expected %s or %s",
+                  response == null ? "null" : response.getClass().getName(),
+                  CryptoKey.class.getName(),
+                  Exception.class.getName())));
+    }
+  }
+
+  @Override
+  public void destroyCryptoKeyVersion(
+      DestroyCryptoKeyVersionRequest request, StreamObserver<CryptoKeyVersion> responseObserver) {
+    Object response = responses.poll();
+    if (response instanceof CryptoKeyVersion) {
+      requests.add(request);
+      responseObserver.onNext(((CryptoKeyVersion) response));
+      responseObserver.onCompleted();
+    } else if (response instanceof Exception) {
+      responseObserver.onError(((Exception) response));
+    } else {
+      responseObserver.onError(
+          new IllegalArgumentException(
+              String.format(
+                  "Unrecognized response type %s for method DestroyCryptoKeyVersion, expected %s or %s",
+                  response == null ? "null" : response.getClass().getName(),
+                  CryptoKeyVersion.class.getName(),
+                  Exception.class.getName())));
+    }
+  }
+
+  @Override
+  public void restoreCryptoKeyVersion(
+      RestoreCryptoKeyVersionRequest request, StreamObserver<CryptoKeyVersion> responseObserver) {
+    Object response = responses.poll();
+    if (response instanceof CryptoKeyVersion) {
+      requests.add(request);
+      responseObserver.onNext(((CryptoKeyVersion) response));
+      responseObserver.onCompleted();
+    } else if (response instanceof Exception) {
+      responseObserver.onError(((Exception) response));
+    } else {
+      responseObserver.onError(
+          new IllegalArgumentException(
+              String.format(
+                  "Unrecognized response type %s for method RestoreCryptoKeyVersion, expected %s or %s",
+                  response == null ? "null" : response.getClass().getName(),
+                  CryptoKeyVersion.class.getName(),
+                  Exception.class.getName())));
+    }
+  }
+
   @Override
   public void encrypt(EncryptRequest request, StreamObserver<EncryptResponse> responseObserver) {
     Object response = responses.poll();
@@ -478,12 +541,11 @@ public void asymmetricDecrypt(
   }
 
   @Override
-  public void updateCryptoKeyPrimaryVersion(
-      UpdateCryptoKeyPrimaryVersionRequest request, StreamObserver<CryptoKey> responseObserver) {
+  public void macSign(MacSignRequest request, StreamObserver<MacSignResponse> responseObserver) {
     Object response = responses.poll();
-    if (response instanceof CryptoKey) {
+    if (response instanceof MacSignResponse) {
       requests.add(request);
-      responseObserver.onNext(((CryptoKey) response));
+      responseObserver.onNext(((MacSignResponse) response));
       responseObserver.onCompleted();
     } else if (response instanceof Exception) {
       responseObserver.onError(((Exception) response));
@@ -491,20 +553,20 @@ public void updateCryptoKeyPrimaryVersion(
       responseObserver.onError(
           new IllegalArgumentException(
               String.format(
-                  "Unrecognized response type %s for method UpdateCryptoKeyPrimaryVersion, expected %s or %s",
+                  "Unrecognized response type %s for method MacSign, expected %s or %s",
                   response == null ? "null" : response.getClass().getName(),
-                  CryptoKey.class.getName(),
+                  MacSignResponse.class.getName(),
                   Exception.class.getName())));
     }
   }
 
   @Override
-  public void destroyCryptoKeyVersion(
-      DestroyCryptoKeyVersionRequest request, StreamObserver<CryptoKeyVersion> responseObserver) {
+  public void macVerify(
+      MacVerifyRequest request, StreamObserver<MacVerifyResponse> responseObserver) {
     Object response = responses.poll();
-    if (response instanceof CryptoKeyVersion) {
+    if (response instanceof MacVerifyResponse) {
       requests.add(request);
-      responseObserver.onNext(((CryptoKeyVersion) response));
+      responseObserver.onNext(((MacVerifyResponse) response));
       responseObserver.onCompleted();
     } else if (response instanceof Exception) {
       responseObserver.onError(((Exception) response));
@@ -512,20 +574,21 @@ public void destroyCryptoKeyVersion(
       responseObserver.onError(
           new IllegalArgumentException(
               String.format(
-                  "Unrecognized response type %s for method DestroyCryptoKeyVersion, expected %s or %s",
+                  "Unrecognized response type %s for method MacVerify, expected %s or %s",
                   response == null ? "null" : response.getClass().getName(),
-                  CryptoKeyVersion.class.getName(),
+                  MacVerifyResponse.class.getName(),
                   Exception.class.getName())));
     }
   }
 
   @Override
-  public void restoreCryptoKeyVersion(
-      RestoreCryptoKeyVersionRequest request, StreamObserver<CryptoKeyVersion> responseObserver) {
+  public void generateRandomBytes(
+      GenerateRandomBytesRequest request,
+      StreamObserver<GenerateRandomBytesResponse> responseObserver) {
     Object response = responses.poll();
-    if (response instanceof CryptoKeyVersion) {
+    if (response instanceof GenerateRandomBytesResponse) {
       requests.add(request);
-      responseObserver.onNext(((CryptoKeyVersion) response));
+      responseObserver.onNext(((GenerateRandomBytesResponse) response));
       responseObserver.onCompleted();
     } else if (response instanceof Exception) {
       responseObserver.onError(((Exception) response));
@@ -533,9 +596,9 @@ public void restoreCryptoKeyVersion(
       responseObserver.onError(
           new IllegalArgumentException(
               String.format(
-                  "Unrecognized response type %s for method RestoreCryptoKeyVersion, expected %s or %s",
+                  "Unrecognized response type %s for method GenerateRandomBytes, expected %s or %s",
                   response == null ? "null" : response.getClass().getName(),
-                  CryptoKeyVersion.class.getName(),
+                  GenerateRandomBytesResponse.class.getName(),
                   Exception.class.getName())));
     }
   }
diff --git a/grpc-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceGrpc.java b/grpc-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceGrpc.java
index 4d802cee..6567eab9 100644
--- a/grpc-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceGrpc.java
+++ b/grpc-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KeyManagementServiceGrpc.java
@@ -766,6 +766,162 @@ private KeyManagementServiceGrpc() {}
     return getUpdateCryptoKeyVersionMethod;
   }
 
+  private static volatile io.grpc.MethodDescriptor<
+          com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest,
+          com.google.cloud.kms.v1.CryptoKey>
+      getUpdateCryptoKeyPrimaryVersionMethod;
+
+  @io.grpc.stub.annotations.RpcMethod(
+      fullMethodName = SERVICE_NAME + '/' + "UpdateCryptoKeyPrimaryVersion",
+      requestType = com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest.class,
+      responseType = com.google.cloud.kms.v1.CryptoKey.class,
+      methodType = io.grpc.MethodDescriptor.MethodType.UNARY)
+  public static io.grpc.MethodDescriptor<
+          com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest,
+          com.google.cloud.kms.v1.CryptoKey>
+      getUpdateCryptoKeyPrimaryVersionMethod() {
+    io.grpc.MethodDescriptor<
+            com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest,
+            com.google.cloud.kms.v1.CryptoKey>
+        getUpdateCryptoKeyPrimaryVersionMethod;
+    if ((getUpdateCryptoKeyPrimaryVersionMethod =
+            KeyManagementServiceGrpc.getUpdateCryptoKeyPrimaryVersionMethod)
+        == null) {
+      synchronized (KeyManagementServiceGrpc.class) {
+        if ((getUpdateCryptoKeyPrimaryVersionMethod =
+                KeyManagementServiceGrpc.getUpdateCryptoKeyPrimaryVersionMethod)
+            == null) {
+          KeyManagementServiceGrpc.getUpdateCryptoKeyPrimaryVersionMethod =
+              getUpdateCryptoKeyPrimaryVersionMethod =
+                  io.grpc.MethodDescriptor
+                      .<com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest,
+                          com.google.cloud.kms.v1.CryptoKey>
+                          newBuilder()
+                      .setType(io.grpc.MethodDescriptor.MethodType.UNARY)
+                      .setFullMethodName(
+                          generateFullMethodName(SERVICE_NAME, "UpdateCryptoKeyPrimaryVersion"))
+                      .setSampledToLocalTracing(true)
+                      .setRequestMarshaller(
+                          io.grpc.protobuf.ProtoUtils.marshaller(
+                              com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest
+                                  .getDefaultInstance()))
+                      .setResponseMarshaller(
+                          io.grpc.protobuf.ProtoUtils.marshaller(
+                              com.google.cloud.kms.v1.CryptoKey.getDefaultInstance()))
+                      .setSchemaDescriptor(
+                          new KeyManagementServiceMethodDescriptorSupplier(
+                              "UpdateCryptoKeyPrimaryVersion"))
+                      .build();
+        }
+      }
+    }
+    return getUpdateCryptoKeyPrimaryVersionMethod;
+  }
+
+  private static volatile io.grpc.MethodDescriptor<
+          com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest,
+          com.google.cloud.kms.v1.CryptoKeyVersion>
+      getDestroyCryptoKeyVersionMethod;
+
+  @io.grpc.stub.annotations.RpcMethod(
+      fullMethodName = SERVICE_NAME + '/' + "DestroyCryptoKeyVersion",
+      requestType = com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest.class,
+      responseType = com.google.cloud.kms.v1.CryptoKeyVersion.class,
+      methodType = io.grpc.MethodDescriptor.MethodType.UNARY)
+  public static io.grpc.MethodDescriptor<
+          com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest,
+          com.google.cloud.kms.v1.CryptoKeyVersion>
+      getDestroyCryptoKeyVersionMethod() {
+    io.grpc.MethodDescriptor<
+            com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest,
+            com.google.cloud.kms.v1.CryptoKeyVersion>
+        getDestroyCryptoKeyVersionMethod;
+    if ((getDestroyCryptoKeyVersionMethod =
+            KeyManagementServiceGrpc.getDestroyCryptoKeyVersionMethod)
+        == null) {
+      synchronized (KeyManagementServiceGrpc.class) {
+        if ((getDestroyCryptoKeyVersionMethod =
+                KeyManagementServiceGrpc.getDestroyCryptoKeyVersionMethod)
+            == null) {
+          KeyManagementServiceGrpc.getDestroyCryptoKeyVersionMethod =
+              getDestroyCryptoKeyVersionMethod =
+                  io.grpc.MethodDescriptor
+                      .<com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest,
+                          com.google.cloud.kms.v1.CryptoKeyVersion>
+                          newBuilder()
+                      .setType(io.grpc.MethodDescriptor.MethodType.UNARY)
+                      .setFullMethodName(
+                          generateFullMethodName(SERVICE_NAME, "DestroyCryptoKeyVersion"))
+                      .setSampledToLocalTracing(true)
+                      .setRequestMarshaller(
+                          io.grpc.protobuf.ProtoUtils.marshaller(
+                              com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest
+                                  .getDefaultInstance()))
+                      .setResponseMarshaller(
+                          io.grpc.protobuf.ProtoUtils.marshaller(
+                              com.google.cloud.kms.v1.CryptoKeyVersion.getDefaultInstance()))
+                      .setSchemaDescriptor(
+                          new KeyManagementServiceMethodDescriptorSupplier(
+                              "DestroyCryptoKeyVersion"))
+                      .build();
+        }
+      }
+    }
+    return getDestroyCryptoKeyVersionMethod;
+  }
+
+  private static volatile io.grpc.MethodDescriptor<
+          com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest,
+          com.google.cloud.kms.v1.CryptoKeyVersion>
+      getRestoreCryptoKeyVersionMethod;
+
+  @io.grpc.stub.annotations.RpcMethod(
+      fullMethodName = SERVICE_NAME + '/' + "RestoreCryptoKeyVersion",
+      requestType = com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest.class,
+      responseType = com.google.cloud.kms.v1.CryptoKeyVersion.class,
+      methodType = io.grpc.MethodDescriptor.MethodType.UNARY)
+  public static io.grpc.MethodDescriptor<
+          com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest,
+          com.google.cloud.kms.v1.CryptoKeyVersion>
+      getRestoreCryptoKeyVersionMethod() {
+    io.grpc.MethodDescriptor<
+            com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest,
+            com.google.cloud.kms.v1.CryptoKeyVersion>
+        getRestoreCryptoKeyVersionMethod;
+    if ((getRestoreCryptoKeyVersionMethod =
+            KeyManagementServiceGrpc.getRestoreCryptoKeyVersionMethod)
+        == null) {
+      synchronized (KeyManagementServiceGrpc.class) {
+        if ((getRestoreCryptoKeyVersionMethod =
+                KeyManagementServiceGrpc.getRestoreCryptoKeyVersionMethod)
+            == null) {
+          KeyManagementServiceGrpc.getRestoreCryptoKeyVersionMethod =
+              getRestoreCryptoKeyVersionMethod =
+                  io.grpc.MethodDescriptor
+                      .<com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest,
+                          com.google.cloud.kms.v1.CryptoKeyVersion>
+                          newBuilder()
+                      .setType(io.grpc.MethodDescriptor.MethodType.UNARY)
+                      .setFullMethodName(
+                          generateFullMethodName(SERVICE_NAME, "RestoreCryptoKeyVersion"))
+                      .setSampledToLocalTracing(true)
+                      .setRequestMarshaller(
+                          io.grpc.protobuf.ProtoUtils.marshaller(
+                              com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest
+                                  .getDefaultInstance()))
+                      .setResponseMarshaller(
+                          io.grpc.protobuf.ProtoUtils.marshaller(
+                              com.google.cloud.kms.v1.CryptoKeyVersion.getDefaultInstance()))
+                      .setSchemaDescriptor(
+                          new KeyManagementServiceMethodDescriptorSupplier(
+                              "RestoreCryptoKeyVersion"))
+                      .build();
+        }
+      }
+    }
+    return getRestoreCryptoKeyVersionMethod;
+  }
+
   private static volatile io.grpc.MethodDescriptor<
           com.google.cloud.kms.v1.EncryptRequest, com.google.cloud.kms.v1.EncryptResponse>
       getEncryptMethod;
@@ -945,159 +1101,137 @@ private KeyManagementServiceGrpc() {}
   }
 
   private static volatile io.grpc.MethodDescriptor<
-          com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest,
-          com.google.cloud.kms.v1.CryptoKey>
-      getUpdateCryptoKeyPrimaryVersionMethod;
+          com.google.cloud.kms.v1.MacSignRequest, com.google.cloud.kms.v1.MacSignResponse>
+      getMacSignMethod;
 
   @io.grpc.stub.annotations.RpcMethod(
-      fullMethodName = SERVICE_NAME + '/' + "UpdateCryptoKeyPrimaryVersion",
-      requestType = com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest.class,
-      responseType = com.google.cloud.kms.v1.CryptoKey.class,
+      fullMethodName = SERVICE_NAME + '/' + "MacSign",
+      requestType = com.google.cloud.kms.v1.MacSignRequest.class,
+      responseType = com.google.cloud.kms.v1.MacSignResponse.class,
       methodType = io.grpc.MethodDescriptor.MethodType.UNARY)
   public static io.grpc.MethodDescriptor<
-          com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest,
-          com.google.cloud.kms.v1.CryptoKey>
-      getUpdateCryptoKeyPrimaryVersionMethod() {
+          com.google.cloud.kms.v1.MacSignRequest, com.google.cloud.kms.v1.MacSignResponse>
+      getMacSignMethod() {
     io.grpc.MethodDescriptor<
-            com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest,
-            com.google.cloud.kms.v1.CryptoKey>
-        getUpdateCryptoKeyPrimaryVersionMethod;
-    if ((getUpdateCryptoKeyPrimaryVersionMethod =
-            KeyManagementServiceGrpc.getUpdateCryptoKeyPrimaryVersionMethod)
-        == null) {
+            com.google.cloud.kms.v1.MacSignRequest, com.google.cloud.kms.v1.MacSignResponse>
+        getMacSignMethod;
+    if ((getMacSignMethod = KeyManagementServiceGrpc.getMacSignMethod) == null) {
       synchronized (KeyManagementServiceGrpc.class) {
-        if ((getUpdateCryptoKeyPrimaryVersionMethod =
-                KeyManagementServiceGrpc.getUpdateCryptoKeyPrimaryVersionMethod)
-            == null) {
-          KeyManagementServiceGrpc.getUpdateCryptoKeyPrimaryVersionMethod =
-              getUpdateCryptoKeyPrimaryVersionMethod =
+        if ((getMacSignMethod = KeyManagementServiceGrpc.getMacSignMethod) == null) {
+          KeyManagementServiceGrpc.getMacSignMethod =
+              getMacSignMethod =
                   io.grpc.MethodDescriptor
-                      .<com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest,
-                          com.google.cloud.kms.v1.CryptoKey>
+                      .<com.google.cloud.kms.v1.MacSignRequest,
+                          com.google.cloud.kms.v1.MacSignResponse>
                           newBuilder()
                       .setType(io.grpc.MethodDescriptor.MethodType.UNARY)
-                      .setFullMethodName(
-                          generateFullMethodName(SERVICE_NAME, "UpdateCryptoKeyPrimaryVersion"))
+                      .setFullMethodName(generateFullMethodName(SERVICE_NAME, "MacSign"))
                       .setSampledToLocalTracing(true)
                       .setRequestMarshaller(
                           io.grpc.protobuf.ProtoUtils.marshaller(
-                              com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest
-                                  .getDefaultInstance()))
+                              com.google.cloud.kms.v1.MacSignRequest.getDefaultInstance()))
                       .setResponseMarshaller(
                           io.grpc.protobuf.ProtoUtils.marshaller(
-                              com.google.cloud.kms.v1.CryptoKey.getDefaultInstance()))
+                              com.google.cloud.kms.v1.MacSignResponse.getDefaultInstance()))
                       .setSchemaDescriptor(
-                          new KeyManagementServiceMethodDescriptorSupplier(
-                              "UpdateCryptoKeyPrimaryVersion"))
+                          new KeyManagementServiceMethodDescriptorSupplier("MacSign"))
                       .build();
         }
       }
     }
-    return getUpdateCryptoKeyPrimaryVersionMethod;
+    return getMacSignMethod;
   }
 
   private static volatile io.grpc.MethodDescriptor<
-          com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest,
-          com.google.cloud.kms.v1.CryptoKeyVersion>
-      getDestroyCryptoKeyVersionMethod;
+          com.google.cloud.kms.v1.MacVerifyRequest, com.google.cloud.kms.v1.MacVerifyResponse>
+      getMacVerifyMethod;
 
   @io.grpc.stub.annotations.RpcMethod(
-      fullMethodName = SERVICE_NAME + '/' + "DestroyCryptoKeyVersion",
-      requestType = com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest.class,
-      responseType = com.google.cloud.kms.v1.CryptoKeyVersion.class,
+      fullMethodName = SERVICE_NAME + '/' + "MacVerify",
+      requestType = com.google.cloud.kms.v1.MacVerifyRequest.class,
+      responseType = com.google.cloud.kms.v1.MacVerifyResponse.class,
       methodType = io.grpc.MethodDescriptor.MethodType.UNARY)
   public static io.grpc.MethodDescriptor<
-          com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest,
-          com.google.cloud.kms.v1.CryptoKeyVersion>
-      getDestroyCryptoKeyVersionMethod() {
+          com.google.cloud.kms.v1.MacVerifyRequest, com.google.cloud.kms.v1.MacVerifyResponse>
+      getMacVerifyMethod() {
     io.grpc.MethodDescriptor<
-            com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest,
-            com.google.cloud.kms.v1.CryptoKeyVersion>
-        getDestroyCryptoKeyVersionMethod;
-    if ((getDestroyCryptoKeyVersionMethod =
-            KeyManagementServiceGrpc.getDestroyCryptoKeyVersionMethod)
-        == null) {
+            com.google.cloud.kms.v1.MacVerifyRequest, com.google.cloud.kms.v1.MacVerifyResponse>
+        getMacVerifyMethod;
+    if ((getMacVerifyMethod = KeyManagementServiceGrpc.getMacVerifyMethod) == null) {
       synchronized (KeyManagementServiceGrpc.class) {
-        if ((getDestroyCryptoKeyVersionMethod =
-                KeyManagementServiceGrpc.getDestroyCryptoKeyVersionMethod)
-            == null) {
-          KeyManagementServiceGrpc.getDestroyCryptoKeyVersionMethod =
-              getDestroyCryptoKeyVersionMethod =
+        if ((getMacVerifyMethod = KeyManagementServiceGrpc.getMacVerifyMethod) == null) {
+          KeyManagementServiceGrpc.getMacVerifyMethod =
+              getMacVerifyMethod =
                   io.grpc.MethodDescriptor
-                      .<com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest,
-                          com.google.cloud.kms.v1.CryptoKeyVersion>
+                      .<com.google.cloud.kms.v1.MacVerifyRequest,
+                          com.google.cloud.kms.v1.MacVerifyResponse>
                           newBuilder()
                       .setType(io.grpc.MethodDescriptor.MethodType.UNARY)
-                      .setFullMethodName(
-                          generateFullMethodName(SERVICE_NAME, "DestroyCryptoKeyVersion"))
+                      .setFullMethodName(generateFullMethodName(SERVICE_NAME, "MacVerify"))
                       .setSampledToLocalTracing(true)
                       .setRequestMarshaller(
                           io.grpc.protobuf.ProtoUtils.marshaller(
-                              com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest
-                                  .getDefaultInstance()))
+                              com.google.cloud.kms.v1.MacVerifyRequest.getDefaultInstance()))
                       .setResponseMarshaller(
                           io.grpc.protobuf.ProtoUtils.marshaller(
-                              com.google.cloud.kms.v1.CryptoKeyVersion.getDefaultInstance()))
+                              com.google.cloud.kms.v1.MacVerifyResponse.getDefaultInstance()))
                       .setSchemaDescriptor(
-                          new KeyManagementServiceMethodDescriptorSupplier(
-                              "DestroyCryptoKeyVersion"))
+                          new KeyManagementServiceMethodDescriptorSupplier("MacVerify"))
                       .build();
         }
       }
     }
-    return getDestroyCryptoKeyVersionMethod;
+    return getMacVerifyMethod;
   }
 
   private static volatile io.grpc.MethodDescriptor<
-          com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest,
-          com.google.cloud.kms.v1.CryptoKeyVersion>
-      getRestoreCryptoKeyVersionMethod;
+          com.google.cloud.kms.v1.GenerateRandomBytesRequest,
+          com.google.cloud.kms.v1.GenerateRandomBytesResponse>
+      getGenerateRandomBytesMethod;
 
   @io.grpc.stub.annotations.RpcMethod(
-      fullMethodName = SERVICE_NAME + '/' + "RestoreCryptoKeyVersion",
-      requestType = com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest.class,
-      responseType = com.google.cloud.kms.v1.CryptoKeyVersion.class,
+      fullMethodName = SERVICE_NAME + '/' + "GenerateRandomBytes",
+      requestType = com.google.cloud.kms.v1.GenerateRandomBytesRequest.class,
+      responseType = com.google.cloud.kms.v1.GenerateRandomBytesResponse.class,
       methodType = io.grpc.MethodDescriptor.MethodType.UNARY)
   public static io.grpc.MethodDescriptor<
-          com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest,
-          com.google.cloud.kms.v1.CryptoKeyVersion>
-      getRestoreCryptoKeyVersionMethod() {
+          com.google.cloud.kms.v1.GenerateRandomBytesRequest,
+          com.google.cloud.kms.v1.GenerateRandomBytesResponse>
+      getGenerateRandomBytesMethod() {
     io.grpc.MethodDescriptor<
-            com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest,
-            com.google.cloud.kms.v1.CryptoKeyVersion>
-        getRestoreCryptoKeyVersionMethod;
-    if ((getRestoreCryptoKeyVersionMethod =
-            KeyManagementServiceGrpc.getRestoreCryptoKeyVersionMethod)
+            com.google.cloud.kms.v1.GenerateRandomBytesRequest,
+            com.google.cloud.kms.v1.GenerateRandomBytesResponse>
+        getGenerateRandomBytesMethod;
+    if ((getGenerateRandomBytesMethod = KeyManagementServiceGrpc.getGenerateRandomBytesMethod)
         == null) {
       synchronized (KeyManagementServiceGrpc.class) {
-        if ((getRestoreCryptoKeyVersionMethod =
-                KeyManagementServiceGrpc.getRestoreCryptoKeyVersionMethod)
+        if ((getGenerateRandomBytesMethod = KeyManagementServiceGrpc.getGenerateRandomBytesMethod)
             == null) {
-          KeyManagementServiceGrpc.getRestoreCryptoKeyVersionMethod =
-              getRestoreCryptoKeyVersionMethod =
+          KeyManagementServiceGrpc.getGenerateRandomBytesMethod =
+              getGenerateRandomBytesMethod =
                   io.grpc.MethodDescriptor
-                      .<com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest,
-                          com.google.cloud.kms.v1.CryptoKeyVersion>
+                      .<com.google.cloud.kms.v1.GenerateRandomBytesRequest,
+                          com.google.cloud.kms.v1.GenerateRandomBytesResponse>
                           newBuilder()
                       .setType(io.grpc.MethodDescriptor.MethodType.UNARY)
                       .setFullMethodName(
-                          generateFullMethodName(SERVICE_NAME, "RestoreCryptoKeyVersion"))
+                          generateFullMethodName(SERVICE_NAME, "GenerateRandomBytes"))
                       .setSampledToLocalTracing(true)
                       .setRequestMarshaller(
                           io.grpc.protobuf.ProtoUtils.marshaller(
-                              com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest
+                              com.google.cloud.kms.v1.GenerateRandomBytesRequest
                                   .getDefaultInstance()))
                       .setResponseMarshaller(
                           io.grpc.protobuf.ProtoUtils.marshaller(
-                              com.google.cloud.kms.v1.CryptoKeyVersion.getDefaultInstance()))
+                              com.google.cloud.kms.v1.GenerateRandomBytesResponse
+                                  .getDefaultInstance()))
                       .setSchemaDescriptor(
-                          new KeyManagementServiceMethodDescriptorSupplier(
-                              "RestoreCryptoKeyVersion"))
+                          new KeyManagementServiceMethodDescriptorSupplier("GenerateRandomBytes"))
                       .build();
         }
       }
     }
-    return getRestoreCryptoKeyVersionMethod;
+    return getGenerateRandomBytesMethod;
   }
 
   /** Creates a new async stub that supports all call types for the service */
@@ -1404,6 +1538,64 @@ public void updateCryptoKeyVersion(
           getUpdateCryptoKeyVersionMethod(), responseObserver);
     }
 
+    /**
+     *
+     *
+     * <pre>
+     * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
+     * Returns an error if called on a key whose purpose is not
+     * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+     * </pre>
+     */
+    public void updateCryptoKeyPrimaryVersion(
+        com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKey> responseObserver) {
+      io.grpc.stub.ServerCalls.asyncUnimplementedUnaryCall(
+          getUpdateCryptoKeyPrimaryVersionMethod(), responseObserver);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
+     * Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
+     * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+     * will be changed to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
+     * material will be irrevocably destroyed.
+     * Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
+     * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
+     * </pre>
+     */
+    public void destroyCryptoKeyVersion(
+        com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion> responseObserver) {
+      io.grpc.stub.ServerCalls.asyncUnimplementedUnaryCall(
+          getDestroyCryptoKeyVersionMethod(), responseObserver);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state.
+     * Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+     * will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
+     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+     * </pre>
+     */
+    public void restoreCryptoKeyVersion(
+        com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion> responseObserver) {
+      io.grpc.stub.ServerCalls.asyncUnimplementedUnaryCall(
+          getRestoreCryptoKeyVersionMethod(), responseObserver);
+    }
+
     /**
      *
      *
@@ -1471,58 +1663,46 @@ public void asymmetricDecrypt(
      *
      *
      * <pre>
-     * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
-     * Returns an error if called on a key whose purpose is not
-     * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+     * Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+     * MAC, producing a tag that can be verified by another source with the
+     * same key.
      * </pre>
      */
-    public void updateCryptoKeyPrimaryVersion(
-        com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest request,
-        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKey> responseObserver) {
-      io.grpc.stub.ServerCalls.asyncUnimplementedUnaryCall(
-          getUpdateCryptoKeyPrimaryVersionMethod(), responseObserver);
+    public void macSign(
+        com.google.cloud.kms.v1.MacSignRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.MacSignResponse> responseObserver) {
+      io.grpc.stub.ServerCalls.asyncUnimplementedUnaryCall(getMacSignMethod(), responseObserver);
     }
 
     /**
      *
      *
      * <pre>
-     * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
-     * Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
-     * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-     * will be changed to
-     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
-     * material will be irrevocably destroyed.
-     * Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
-     * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
+     * Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+     * MAC, and returns a response that indicates whether or not the verification
+     * was successful.
      * </pre>
      */
-    public void destroyCryptoKeyVersion(
-        com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest request,
-        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion> responseObserver) {
-      io.grpc.stub.ServerCalls.asyncUnimplementedUnaryCall(
-          getDestroyCryptoKeyVersionMethod(), responseObserver);
+    public void macVerify(
+        com.google.cloud.kms.v1.MacVerifyRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.MacVerifyResponse> responseObserver) {
+      io.grpc.stub.ServerCalls.asyncUnimplementedUnaryCall(getMacVerifyMethod(), responseObserver);
     }
 
     /**
      *
      *
      * <pre>
-     * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
-     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-     * state.
-     * Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-     * will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
-     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+     * Generate random bytes using the Cloud KMS randomness source in the provided
+     * location.
      * </pre>
      */
-    public void restoreCryptoKeyVersion(
-        com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest request,
-        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion> responseObserver) {
+    public void generateRandomBytes(
+        com.google.cloud.kms.v1.GenerateRandomBytesRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.GenerateRandomBytesResponse>
+            responseObserver) {
       io.grpc.stub.ServerCalls.asyncUnimplementedUnaryCall(
-          getRestoreCryptoKeyVersionMethod(), responseObserver);
+          getGenerateRandomBytesMethod(), responseObserver);
     }
 
     @java.lang.Override
@@ -1631,6 +1811,27 @@ public final io.grpc.ServerServiceDefinition bindService() {
                       com.google.cloud.kms.v1.UpdateCryptoKeyVersionRequest,
                       com.google.cloud.kms.v1.CryptoKeyVersion>(
                       this, METHODID_UPDATE_CRYPTO_KEY_VERSION)))
+          .addMethod(
+              getUpdateCryptoKeyPrimaryVersionMethod(),
+              io.grpc.stub.ServerCalls.asyncUnaryCall(
+                  new MethodHandlers<
+                      com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest,
+                      com.google.cloud.kms.v1.CryptoKey>(
+                      this, METHODID_UPDATE_CRYPTO_KEY_PRIMARY_VERSION)))
+          .addMethod(
+              getDestroyCryptoKeyVersionMethod(),
+              io.grpc.stub.ServerCalls.asyncUnaryCall(
+                  new MethodHandlers<
+                      com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest,
+                      com.google.cloud.kms.v1.CryptoKeyVersion>(
+                      this, METHODID_DESTROY_CRYPTO_KEY_VERSION)))
+          .addMethod(
+              getRestoreCryptoKeyVersionMethod(),
+              io.grpc.stub.ServerCalls.asyncUnaryCall(
+                  new MethodHandlers<
+                      com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest,
+                      com.google.cloud.kms.v1.CryptoKeyVersion>(
+                      this, METHODID_RESTORE_CRYPTO_KEY_VERSION)))
           .addMethod(
               getEncryptMethod(),
               io.grpc.stub.ServerCalls.asyncUnaryCall(
@@ -1658,26 +1859,24 @@ public final io.grpc.ServerServiceDefinition bindService() {
                       com.google.cloud.kms.v1.AsymmetricDecryptResponse>(
                       this, METHODID_ASYMMETRIC_DECRYPT)))
           .addMethod(
-              getUpdateCryptoKeyPrimaryVersionMethod(),
+              getMacSignMethod(),
               io.grpc.stub.ServerCalls.asyncUnaryCall(
                   new MethodHandlers<
-                      com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest,
-                      com.google.cloud.kms.v1.CryptoKey>(
-                      this, METHODID_UPDATE_CRYPTO_KEY_PRIMARY_VERSION)))
+                      com.google.cloud.kms.v1.MacSignRequest,
+                      com.google.cloud.kms.v1.MacSignResponse>(this, METHODID_MAC_SIGN)))
           .addMethod(
-              getDestroyCryptoKeyVersionMethod(),
+              getMacVerifyMethod(),
               io.grpc.stub.ServerCalls.asyncUnaryCall(
                   new MethodHandlers<
-                      com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest,
-                      com.google.cloud.kms.v1.CryptoKeyVersion>(
-                      this, METHODID_DESTROY_CRYPTO_KEY_VERSION)))
+                      com.google.cloud.kms.v1.MacVerifyRequest,
+                      com.google.cloud.kms.v1.MacVerifyResponse>(this, METHODID_MAC_VERIFY)))
           .addMethod(
-              getRestoreCryptoKeyVersionMethod(),
+              getGenerateRandomBytesMethod(),
               io.grpc.stub.ServerCalls.asyncUnaryCall(
                   new MethodHandlers<
-                      com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest,
-                      com.google.cloud.kms.v1.CryptoKeyVersion>(
-                      this, METHODID_RESTORE_CRYPTO_KEY_VERSION)))
+                      com.google.cloud.kms.v1.GenerateRandomBytesRequest,
+                      com.google.cloud.kms.v1.GenerateRandomBytesResponse>(
+                      this, METHODID_GENERATE_RANDOM_BYTES)))
           .build();
     }
   }
@@ -1977,11 +2176,75 @@ public void updateCryptoKey(
      * move between other states.
      * </pre>
      */
-    public void updateCryptoKeyVersion(
-        com.google.cloud.kms.v1.UpdateCryptoKeyVersionRequest request,
+    public void updateCryptoKeyVersion(
+        com.google.cloud.kms.v1.UpdateCryptoKeyVersionRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion> responseObserver) {
+      io.grpc.stub.ClientCalls.asyncUnaryCall(
+          getChannel().newCall(getUpdateCryptoKeyVersionMethod(), getCallOptions()),
+          request,
+          responseObserver);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
+     * Returns an error if called on a key whose purpose is not
+     * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+     * </pre>
+     */
+    public void updateCryptoKeyPrimaryVersion(
+        com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKey> responseObserver) {
+      io.grpc.stub.ClientCalls.asyncUnaryCall(
+          getChannel().newCall(getUpdateCryptoKeyPrimaryVersionMethod(), getCallOptions()),
+          request,
+          responseObserver);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
+     * Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
+     * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+     * will be changed to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
+     * material will be irrevocably destroyed.
+     * Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
+     * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
+     * </pre>
+     */
+    public void destroyCryptoKeyVersion(
+        com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion> responseObserver) {
+      io.grpc.stub.ClientCalls.asyncUnaryCall(
+          getChannel().newCall(getDestroyCryptoKeyVersionMethod(), getCallOptions()),
+          request,
+          responseObserver);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state.
+     * Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+     * will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
+     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+     * </pre>
+     */
+    public void restoreCryptoKeyVersion(
+        com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest request,
         io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion> responseObserver) {
       io.grpc.stub.ClientCalls.asyncUnaryCall(
-          getChannel().newCall(getUpdateCryptoKeyVersionMethod(), getCallOptions()),
+          getChannel().newCall(getRestoreCryptoKeyVersionMethod(), getCallOptions()),
           request,
           responseObserver);
     }
@@ -2059,62 +2322,48 @@ public void asymmetricDecrypt(
      *
      *
      * <pre>
-     * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
-     * Returns an error if called on a key whose purpose is not
-     * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+     * Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+     * MAC, producing a tag that can be verified by another source with the
+     * same key.
      * </pre>
      */
-    public void updateCryptoKeyPrimaryVersion(
-        com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest request,
-        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKey> responseObserver) {
+    public void macSign(
+        com.google.cloud.kms.v1.MacSignRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.MacSignResponse> responseObserver) {
       io.grpc.stub.ClientCalls.asyncUnaryCall(
-          getChannel().newCall(getUpdateCryptoKeyPrimaryVersionMethod(), getCallOptions()),
-          request,
-          responseObserver);
+          getChannel().newCall(getMacSignMethod(), getCallOptions()), request, responseObserver);
     }
 
     /**
      *
      *
      * <pre>
-     * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
-     * Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
-     * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-     * will be changed to
-     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
-     * material will be irrevocably destroyed.
-     * Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
-     * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
+     * Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+     * MAC, and returns a response that indicates whether or not the verification
+     * was successful.
      * </pre>
      */
-    public void destroyCryptoKeyVersion(
-        com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest request,
-        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion> responseObserver) {
+    public void macVerify(
+        com.google.cloud.kms.v1.MacVerifyRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.MacVerifyResponse> responseObserver) {
       io.grpc.stub.ClientCalls.asyncUnaryCall(
-          getChannel().newCall(getDestroyCryptoKeyVersionMethod(), getCallOptions()),
-          request,
-          responseObserver);
+          getChannel().newCall(getMacVerifyMethod(), getCallOptions()), request, responseObserver);
     }
 
     /**
      *
      *
      * <pre>
-     * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
-     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-     * state.
-     * Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-     * will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
-     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+     * Generate random bytes using the Cloud KMS randomness source in the provided
+     * location.
      * </pre>
      */
-    public void restoreCryptoKeyVersion(
-        com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest request,
-        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion> responseObserver) {
+    public void generateRandomBytes(
+        com.google.cloud.kms.v1.GenerateRandomBytesRequest request,
+        io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.GenerateRandomBytesResponse>
+            responseObserver) {
       io.grpc.stub.ClientCalls.asyncUnaryCall(
-          getChannel().newCall(getRestoreCryptoKeyVersionMethod(), getCallOptions()),
+          getChannel().newCall(getGenerateRandomBytesMethod(), getCallOptions()),
           request,
           responseObserver);
     }
@@ -2375,6 +2624,61 @@ public com.google.cloud.kms.v1.CryptoKeyVersion updateCryptoKeyVersion(
           getChannel(), getUpdateCryptoKeyVersionMethod(), getCallOptions(), request);
     }
 
+    /**
+     *
+     *
+     * <pre>
+     * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
+     * Returns an error if called on a key whose purpose is not
+     * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+     * </pre>
+     */
+    public com.google.cloud.kms.v1.CryptoKey updateCryptoKeyPrimaryVersion(
+        com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest request) {
+      return io.grpc.stub.ClientCalls.blockingUnaryCall(
+          getChannel(), getUpdateCryptoKeyPrimaryVersionMethod(), getCallOptions(), request);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
+     * Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
+     * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+     * will be changed to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
+     * material will be irrevocably destroyed.
+     * Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
+     * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
+     * </pre>
+     */
+    public com.google.cloud.kms.v1.CryptoKeyVersion destroyCryptoKeyVersion(
+        com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest request) {
+      return io.grpc.stub.ClientCalls.blockingUnaryCall(
+          getChannel(), getDestroyCryptoKeyVersionMethod(), getCallOptions(), request);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state.
+     * Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+     * will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
+     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+     * </pre>
+     */
+    public com.google.cloud.kms.v1.CryptoKeyVersion restoreCryptoKeyVersion(
+        com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest request) {
+      return io.grpc.stub.ClientCalls.blockingUnaryCall(
+          getChannel(), getRestoreCryptoKeyVersionMethod(), getCallOptions(), request);
+    }
+
     /**
      *
      *
@@ -2438,55 +2742,44 @@ public com.google.cloud.kms.v1.AsymmetricDecryptResponse asymmetricDecrypt(
      *
      *
      * <pre>
-     * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
-     * Returns an error if called on a key whose purpose is not
-     * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+     * Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+     * MAC, producing a tag that can be verified by another source with the
+     * same key.
      * </pre>
      */
-    public com.google.cloud.kms.v1.CryptoKey updateCryptoKeyPrimaryVersion(
-        com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest request) {
+    public com.google.cloud.kms.v1.MacSignResponse macSign(
+        com.google.cloud.kms.v1.MacSignRequest request) {
       return io.grpc.stub.ClientCalls.blockingUnaryCall(
-          getChannel(), getUpdateCryptoKeyPrimaryVersionMethod(), getCallOptions(), request);
+          getChannel(), getMacSignMethod(), getCallOptions(), request);
     }
 
     /**
      *
      *
      * <pre>
-     * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
-     * Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
-     * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-     * will be changed to
-     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
-     * material will be irrevocably destroyed.
-     * Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
-     * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
+     * Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+     * MAC, and returns a response that indicates whether or not the verification
+     * was successful.
      * </pre>
      */
-    public com.google.cloud.kms.v1.CryptoKeyVersion destroyCryptoKeyVersion(
-        com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest request) {
+    public com.google.cloud.kms.v1.MacVerifyResponse macVerify(
+        com.google.cloud.kms.v1.MacVerifyRequest request) {
       return io.grpc.stub.ClientCalls.blockingUnaryCall(
-          getChannel(), getDestroyCryptoKeyVersionMethod(), getCallOptions(), request);
+          getChannel(), getMacVerifyMethod(), getCallOptions(), request);
     }
 
     /**
      *
      *
      * <pre>
-     * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
-     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-     * state.
-     * Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-     * will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
-     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+     * Generate random bytes using the Cloud KMS randomness source in the provided
+     * location.
      * </pre>
      */
-    public com.google.cloud.kms.v1.CryptoKeyVersion restoreCryptoKeyVersion(
-        com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest request) {
+    public com.google.cloud.kms.v1.GenerateRandomBytesResponse generateRandomBytes(
+        com.google.cloud.kms.v1.GenerateRandomBytesRequest request) {
       return io.grpc.stub.ClientCalls.blockingUnaryCall(
-          getChannel(), getRestoreCryptoKeyVersionMethod(), getCallOptions(), request);
+          getChannel(), getGenerateRandomBytesMethod(), getCallOptions(), request);
     }
   }
 
@@ -2753,6 +3046,65 @@ protected KeyManagementServiceFutureStub build(
           getChannel().newCall(getUpdateCryptoKeyVersionMethod(), getCallOptions()), request);
     }
 
+    /**
+     *
+     *
+     * <pre>
+     * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
+     * Returns an error if called on a key whose purpose is not
+     * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+     * </pre>
+     */
+    public com.google.common.util.concurrent.ListenableFuture<com.google.cloud.kms.v1.CryptoKey>
+        updateCryptoKeyPrimaryVersion(
+            com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest request) {
+      return io.grpc.stub.ClientCalls.futureUnaryCall(
+          getChannel().newCall(getUpdateCryptoKeyPrimaryVersionMethod(), getCallOptions()),
+          request);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
+     * Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
+     * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+     * will be changed to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
+     * material will be irrevocably destroyed.
+     * Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
+     * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
+     * </pre>
+     */
+    public com.google.common.util.concurrent.ListenableFuture<
+            com.google.cloud.kms.v1.CryptoKeyVersion>
+        destroyCryptoKeyVersion(com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest request) {
+      return io.grpc.stub.ClientCalls.futureUnaryCall(
+          getChannel().newCall(getDestroyCryptoKeyVersionMethod(), getCallOptions()), request);
+    }
+
+    /**
+     *
+     *
+     * <pre>
+     * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state.
+     * Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+     * will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
+     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+     * </pre>
+     */
+    public com.google.common.util.concurrent.ListenableFuture<
+            com.google.cloud.kms.v1.CryptoKeyVersion>
+        restoreCryptoKeyVersion(com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest request) {
+      return io.grpc.stub.ClientCalls.futureUnaryCall(
+          getChannel().newCall(getRestoreCryptoKeyVersionMethod(), getCallOptions()), request);
+    }
+
     /**
      *
      *
@@ -2820,59 +3172,47 @@ protected KeyManagementServiceFutureStub build(
      *
      *
      * <pre>
-     * Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
-     * Returns an error if called on a key whose purpose is not
-     * [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+     * Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+     * MAC, producing a tag that can be verified by another source with the
+     * same key.
      * </pre>
      */
-    public com.google.common.util.concurrent.ListenableFuture<com.google.cloud.kms.v1.CryptoKey>
-        updateCryptoKeyPrimaryVersion(
-            com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest request) {
+    public com.google.common.util.concurrent.ListenableFuture<
+            com.google.cloud.kms.v1.MacSignResponse>
+        macSign(com.google.cloud.kms.v1.MacSignRequest request) {
       return io.grpc.stub.ClientCalls.futureUnaryCall(
-          getChannel().newCall(getUpdateCryptoKeyPrimaryVersionMethod(), getCallOptions()),
-          request);
+          getChannel().newCall(getMacSignMethod(), getCallOptions()), request);
     }
 
     /**
      *
      *
      * <pre>
-     * Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
-     * Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
-     * hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-     * will be changed to
-     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
-     * material will be irrevocably destroyed.
-     * Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
-     * [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
+     * Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+     * MAC, and returns a response that indicates whether or not the verification
+     * was successful.
      * </pre>
      */
     public com.google.common.util.concurrent.ListenableFuture<
-            com.google.cloud.kms.v1.CryptoKeyVersion>
-        destroyCryptoKeyVersion(com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest request) {
+            com.google.cloud.kms.v1.MacVerifyResponse>
+        macVerify(com.google.cloud.kms.v1.MacVerifyRequest request) {
       return io.grpc.stub.ClientCalls.futureUnaryCall(
-          getChannel().newCall(getDestroyCryptoKeyVersionMethod(), getCallOptions()), request);
+          getChannel().newCall(getMacVerifyMethod(), getCallOptions()), request);
     }
 
     /**
      *
      *
      * <pre>
-     * Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
-     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-     * state.
-     * Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-     * will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
-     * and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+     * Generate random bytes using the Cloud KMS randomness source in the provided
+     * location.
      * </pre>
      */
     public com.google.common.util.concurrent.ListenableFuture<
-            com.google.cloud.kms.v1.CryptoKeyVersion>
-        restoreCryptoKeyVersion(com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest request) {
+            com.google.cloud.kms.v1.GenerateRandomBytesResponse>
+        generateRandomBytes(com.google.cloud.kms.v1.GenerateRandomBytesRequest request) {
       return io.grpc.stub.ClientCalls.futureUnaryCall(
-          getChannel().newCall(getRestoreCryptoKeyVersionMethod(), getCallOptions()), request);
+          getChannel().newCall(getGenerateRandomBytesMethod(), getCallOptions()), request);
     }
   }
 
@@ -2892,13 +3232,16 @@ protected KeyManagementServiceFutureStub build(
   private static final int METHODID_CREATE_IMPORT_JOB = 13;
   private static final int METHODID_UPDATE_CRYPTO_KEY = 14;
   private static final int METHODID_UPDATE_CRYPTO_KEY_VERSION = 15;
-  private static final int METHODID_ENCRYPT = 16;
-  private static final int METHODID_DECRYPT = 17;
-  private static final int METHODID_ASYMMETRIC_SIGN = 18;
-  private static final int METHODID_ASYMMETRIC_DECRYPT = 19;
-  private static final int METHODID_UPDATE_CRYPTO_KEY_PRIMARY_VERSION = 20;
-  private static final int METHODID_DESTROY_CRYPTO_KEY_VERSION = 21;
-  private static final int METHODID_RESTORE_CRYPTO_KEY_VERSION = 22;
+  private static final int METHODID_UPDATE_CRYPTO_KEY_PRIMARY_VERSION = 16;
+  private static final int METHODID_DESTROY_CRYPTO_KEY_VERSION = 17;
+  private static final int METHODID_RESTORE_CRYPTO_KEY_VERSION = 18;
+  private static final int METHODID_ENCRYPT = 19;
+  private static final int METHODID_DECRYPT = 20;
+  private static final int METHODID_ASYMMETRIC_SIGN = 21;
+  private static final int METHODID_ASYMMETRIC_DECRYPT = 22;
+  private static final int METHODID_MAC_SIGN = 23;
+  private static final int METHODID_MAC_VERIFY = 24;
+  private static final int METHODID_GENERATE_RANDOM_BYTES = 25;
 
   private static final class MethodHandlers<Req, Resp>
       implements io.grpc.stub.ServerCalls.UnaryMethod<Req, Resp>,
@@ -3005,6 +3348,23 @@ public void invoke(Req request, io.grpc.stub.StreamObserver<Resp> responseObserv
               (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion>)
                   responseObserver);
           break;
+        case METHODID_UPDATE_CRYPTO_KEY_PRIMARY_VERSION:
+          serviceImpl.updateCryptoKeyPrimaryVersion(
+              (com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest) request,
+              (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKey>) responseObserver);
+          break;
+        case METHODID_DESTROY_CRYPTO_KEY_VERSION:
+          serviceImpl.destroyCryptoKeyVersion(
+              (com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest) request,
+              (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion>)
+                  responseObserver);
+          break;
+        case METHODID_RESTORE_CRYPTO_KEY_VERSION:
+          serviceImpl.restoreCryptoKeyVersion(
+              (com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest) request,
+              (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion>)
+                  responseObserver);
+          break;
         case METHODID_ENCRYPT:
           serviceImpl.encrypt(
               (com.google.cloud.kms.v1.EncryptRequest) request,
@@ -3029,21 +3389,22 @@ public void invoke(Req request, io.grpc.stub.StreamObserver<Resp> responseObserv
               (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.AsymmetricDecryptResponse>)
                   responseObserver);
           break;
-        case METHODID_UPDATE_CRYPTO_KEY_PRIMARY_VERSION:
-          serviceImpl.updateCryptoKeyPrimaryVersion(
-              (com.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest) request,
-              (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKey>) responseObserver);
+        case METHODID_MAC_SIGN:
+          serviceImpl.macSign(
+              (com.google.cloud.kms.v1.MacSignRequest) request,
+              (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.MacSignResponse>)
+                  responseObserver);
           break;
-        case METHODID_DESTROY_CRYPTO_KEY_VERSION:
-          serviceImpl.destroyCryptoKeyVersion(
-              (com.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest) request,
-              (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion>)
+        case METHODID_MAC_VERIFY:
+          serviceImpl.macVerify(
+              (com.google.cloud.kms.v1.MacVerifyRequest) request,
+              (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.MacVerifyResponse>)
                   responseObserver);
           break;
-        case METHODID_RESTORE_CRYPTO_KEY_VERSION:
-          serviceImpl.restoreCryptoKeyVersion(
-              (com.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest) request,
-              (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.CryptoKeyVersion>)
+        case METHODID_GENERATE_RANDOM_BYTES:
+          serviceImpl.generateRandomBytes(
+              (com.google.cloud.kms.v1.GenerateRandomBytesRequest) request,
+              (io.grpc.stub.StreamObserver<com.google.cloud.kms.v1.GenerateRandomBytesResponse>)
                   responseObserver);
           break;
         default:
@@ -3126,13 +3487,16 @@ public static io.grpc.ServiceDescriptor getServiceDescriptor() {
                       .addMethod(getCreateImportJobMethod())
                       .addMethod(getUpdateCryptoKeyMethod())
                       .addMethod(getUpdateCryptoKeyVersionMethod())
+                      .addMethod(getUpdateCryptoKeyPrimaryVersionMethod())
+                      .addMethod(getDestroyCryptoKeyVersionMethod())
+                      .addMethod(getRestoreCryptoKeyVersionMethod())
                       .addMethod(getEncryptMethod())
                       .addMethod(getDecryptMethod())
                       .addMethod(getAsymmetricSignMethod())
                       .addMethod(getAsymmetricDecryptMethod())
-                      .addMethod(getUpdateCryptoKeyPrimaryVersionMethod())
-                      .addMethod(getDestroyCryptoKeyVersionMethod())
-                      .addMethod(getRestoreCryptoKeyVersionMethod())
+                      .addMethod(getMacSignMethod())
+                      .addMethod(getMacVerifyMethod())
+                      .addMethod(getGenerateRandomBytesMethod())
                       .build();
         }
       }
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptRequest.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptRequest.java
index 79de6ad4..023beba8 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptRequest.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptRequest.java
@@ -225,7 +225,6 @@ public com.google.protobuf.ByteString getCiphertext() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -255,7 +254,6 @@ public boolean hasCiphertextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -287,7 +285,6 @@ public com.google.protobuf.Int64Value getCiphertextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -861,7 +858,6 @@ public Builder clearCiphertext() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -890,7 +886,6 @@ public boolean hasCiphertextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -925,7 +920,6 @@ public com.google.protobuf.Int64Value getCiphertextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -962,7 +956,6 @@ public Builder setCiphertextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -996,7 +989,6 @@ public Builder setCiphertextCrc32C(com.google.protobuf.Int64Value.Builder builde
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1037,7 +1029,6 @@ public Builder mergeCiphertextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1072,7 +1063,6 @@ public Builder clearCiphertextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1101,7 +1091,6 @@ public com.google.protobuf.Int64Value.Builder getCiphertextCrc32CBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1134,7 +1123,6 @@ public com.google.protobuf.Int64ValueOrBuilder getCiphertextCrc32COrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptRequestOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptRequestOrBuilder.java
index a871ae5c..f4ad9103 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptRequestOrBuilder.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptRequestOrBuilder.java
@@ -85,7 +85,6 @@ public interface AsymmetricDecryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -112,7 +111,6 @@ public interface AsymmetricDecryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -139,7 +137,6 @@ public interface AsymmetricDecryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptResponse.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptResponse.java
index f60acebe..26a81834 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptResponse.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptResponse.java
@@ -39,6 +39,7 @@ private AsymmetricDecryptResponse(com.google.protobuf.GeneratedMessageV3.Builder
 
   private AsymmetricDecryptResponse() {
     plaintext_ = com.google.protobuf.ByteString.EMPTY;
+    protectionLevel_ = 0;
   }
 
   @java.lang.Override
@@ -95,6 +96,13 @@ private AsymmetricDecryptResponse(
               verifiedCiphertextCrc32C_ = input.readBool();
               break;
             }
+          case 32:
+            {
+              int rawValue = input.readEnum();
+
+              protectionLevel_ = rawValue;
+              break;
+            }
           default:
             {
               if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
@@ -164,7 +172,6 @@ public com.google.protobuf.ByteString getPlaintext() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -190,7 +197,6 @@ public boolean hasPlaintextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -218,7 +224,6 @@ public com.google.protobuf.Int64Value getPlaintextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -242,7 +247,6 @@ public com.google.protobuf.Int64ValueOrBuilder getPlaintextCrc32COrBuilder() {
    * was left unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If
    * you've set [AsymmetricDecryptRequest.ciphertext_crc32c][google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext_crc32c] but this field is
    * still false, discard the response and perform a limited number of retries.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>bool verified_ciphertext_crc32c = 3;</code>
@@ -254,6 +258,42 @@ public boolean getVerifiedCiphertextCrc32C() {
     return verifiedCiphertextCrc32C_;
   }
 
+  public static final int PROTECTION_LEVEL_FIELD_NUMBER = 4;
+  private int protectionLevel_;
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  @java.lang.Override
+  public int getProtectionLevelValue() {
+    return protectionLevel_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+   *
+   * @return The protectionLevel.
+   */
+  @java.lang.Override
+  public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+    @SuppressWarnings("deprecation")
+    com.google.cloud.kms.v1.ProtectionLevel result =
+        com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+    return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -277,6 +317,10 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
     if (verifiedCiphertextCrc32C_ != false) {
       output.writeBool(3, verifiedCiphertextCrc32C_);
     }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      output.writeEnum(4, protectionLevel_);
+    }
     unknownFields.writeTo(output);
   }
 
@@ -295,6 +339,10 @@ public int getSerializedSize() {
     if (verifiedCiphertextCrc32C_ != false) {
       size += com.google.protobuf.CodedOutputStream.computeBoolSize(3, verifiedCiphertextCrc32C_);
     }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      size += com.google.protobuf.CodedOutputStream.computeEnumSize(4, protectionLevel_);
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -317,6 +365,7 @@ public boolean equals(final java.lang.Object obj) {
       if (!getPlaintextCrc32C().equals(other.getPlaintextCrc32C())) return false;
     }
     if (getVerifiedCiphertextCrc32C() != other.getVerifiedCiphertextCrc32C()) return false;
+    if (protectionLevel_ != other.protectionLevel_) return false;
     if (!unknownFields.equals(other.unknownFields)) return false;
     return true;
   }
@@ -336,6 +385,8 @@ public int hashCode() {
     }
     hash = (37 * hash) + VERIFIED_CIPHERTEXT_CRC32C_FIELD_NUMBER;
     hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getVerifiedCiphertextCrc32C());
+    hash = (37 * hash) + PROTECTION_LEVEL_FIELD_NUMBER;
+    hash = (53 * hash) + protectionLevel_;
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -491,6 +542,8 @@ public Builder clear() {
       }
       verifiedCiphertextCrc32C_ = false;
 
+      protectionLevel_ = 0;
+
       return this;
     }
 
@@ -525,6 +578,7 @@ public com.google.cloud.kms.v1.AsymmetricDecryptResponse buildPartial() {
         result.plaintextCrc32C_ = plaintextCrc32CBuilder_.build();
       }
       result.verifiedCiphertextCrc32C_ = verifiedCiphertextCrc32C_;
+      result.protectionLevel_ = protectionLevel_;
       onBuilt();
       return result;
     }
@@ -584,6 +638,9 @@ public Builder mergeFrom(com.google.cloud.kms.v1.AsymmetricDecryptResponse other
       if (other.getVerifiedCiphertextCrc32C() != false) {
         setVerifiedCiphertextCrc32C(other.getVerifiedCiphertextCrc32C());
       }
+      if (other.protectionLevel_ != 0) {
+        setProtectionLevelValue(other.getProtectionLevelValue());
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -690,7 +747,6 @@ public Builder clearPlaintext() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -715,7 +771,6 @@ public boolean hasPlaintextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -746,7 +801,6 @@ public com.google.protobuf.Int64Value getPlaintextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -779,7 +833,6 @@ public Builder setPlaintextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -809,7 +862,6 @@ public Builder setPlaintextCrc32C(com.google.protobuf.Int64Value.Builder builder
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -846,7 +898,6 @@ public Builder mergePlaintextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -877,7 +928,6 @@ public Builder clearPlaintextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -902,7 +952,6 @@ public com.google.protobuf.Int64Value.Builder getPlaintextCrc32CBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -931,7 +980,6 @@ public com.google.protobuf.Int64ValueOrBuilder getPlaintextCrc32COrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -966,7 +1014,6 @@ public com.google.protobuf.Int64ValueOrBuilder getPlaintextCrc32COrBuilder() {
      * was left unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If
      * you've set [AsymmetricDecryptRequest.ciphertext_crc32c][google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext_crc32c] but this field is
      * still false, discard the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_ciphertext_crc32c = 3;</code>
@@ -989,7 +1036,6 @@ public boolean getVerifiedCiphertextCrc32C() {
      * was left unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If
      * you've set [AsymmetricDecryptRequest.ciphertext_crc32c][google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext_crc32c] but this field is
      * still false, discard the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_ciphertext_crc32c = 3;</code>
@@ -1015,7 +1061,6 @@ public Builder setVerifiedCiphertextCrc32C(boolean value) {
      * was left unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If
      * you've set [AsymmetricDecryptRequest.ciphertext_crc32c][google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext_crc32c] but this field is
      * still false, discard the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_ciphertext_crc32c = 3;</code>
@@ -1029,6 +1074,97 @@ public Builder clearVerifiedCiphertextCrc32C() {
       return this;
     }
 
+    private int protectionLevel_ = 0;
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+     *
+     * @return The enum numeric value on the wire for protectionLevel.
+     */
+    @java.lang.Override
+    public int getProtectionLevelValue() {
+      return protectionLevel_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+     *
+     * @param value The enum numeric value on the wire for protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevelValue(int value) {
+
+      protectionLevel_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+     *
+     * @return The protectionLevel.
+     */
+    @java.lang.Override
+    public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+      @SuppressWarnings("deprecation")
+      com.google.cloud.kms.v1.ProtectionLevel result =
+          com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+      return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+     *
+     * @param value The protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevel(com.google.cloud.kms.v1.ProtectionLevel value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      protectionLevel_ = value.getNumber();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearProtectionLevel() {
+
+      protectionLevel_ = 0;
+      onChanged();
+      return this;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptResponseOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptResponseOrBuilder.java
index 6cc2c01f..8270f28c 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptResponseOrBuilder.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricDecryptResponseOrBuilder.java
@@ -51,7 +51,6 @@ public interface AsymmetricDecryptResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -74,7 +73,6 @@ public interface AsymmetricDecryptResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -97,7 +95,6 @@ public interface AsymmetricDecryptResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -116,7 +113,6 @@ public interface AsymmetricDecryptResponseOrBuilder
    * was left unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If
    * you've set [AsymmetricDecryptRequest.ciphertext_crc32c][google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext_crc32c] but this field is
    * still false, discard the response and perform a limited number of retries.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>bool verified_ciphertext_crc32c = 3;</code>
@@ -124,4 +120,29 @@ public interface AsymmetricDecryptResponseOrBuilder
    * @return The verifiedCiphertextCrc32c.
    */
   boolean getVerifiedCiphertextCrc32C();
+
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  int getProtectionLevelValue();
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+   *
+   * @return The protectionLevel.
+   */
+  com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel();
 }
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignRequest.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignRequest.java
index c6e07790..2f04d9b0 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignRequest.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignRequest.java
@@ -265,7 +265,6 @@ public com.google.cloud.kms.v1.DigestOrBuilder getDigestOrBuilder() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value digest_crc32c = 4 [(.google.api.field_behavior) = OPTIONAL];
@@ -294,7 +293,6 @@ public boolean hasDigestCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value digest_crc32c = 4 [(.google.api.field_behavior) = OPTIONAL];
@@ -325,7 +323,6 @@ public com.google.protobuf.Int64Value getDigestCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value digest_crc32c = 4 [(.google.api.field_behavior) = OPTIONAL];
@@ -1053,7 +1050,6 @@ public com.google.cloud.kms.v1.DigestOrBuilder getDigestOrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1082,7 +1078,6 @@ public boolean hasDigestCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1117,7 +1112,6 @@ public com.google.protobuf.Int64Value getDigestCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1154,7 +1148,6 @@ public Builder setDigestCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1188,7 +1181,6 @@ public Builder setDigestCrc32C(com.google.protobuf.Int64Value.Builder builderFor
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1229,7 +1221,6 @@ public Builder mergeDigestCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1264,7 +1255,6 @@ public Builder clearDigestCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1293,7 +1283,6 @@ public com.google.protobuf.Int64Value.Builder getDigestCrc32CBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1326,7 +1315,6 @@ public com.google.protobuf.Int64ValueOrBuilder getDigestCrc32COrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignRequestOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignRequestOrBuilder.java
index c2a41dfe..8d622feb 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignRequestOrBuilder.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignRequestOrBuilder.java
@@ -110,7 +110,6 @@ public interface AsymmetricSignRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value digest_crc32c = 4 [(.google.api.field_behavior) = OPTIONAL];
@@ -136,7 +135,6 @@ public interface AsymmetricSignRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value digest_crc32c = 4 [(.google.api.field_behavior) = OPTIONAL];
@@ -162,7 +160,6 @@ public interface AsymmetricSignRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value digest_crc32c = 4 [(.google.api.field_behavior) = OPTIONAL];
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignResponse.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignResponse.java
index 6c1e9c3a..49035590 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignResponse.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignResponse.java
@@ -40,6 +40,7 @@ private AsymmetricSignResponse(com.google.protobuf.GeneratedMessageV3.Builder<?>
   private AsymmetricSignResponse() {
     signature_ = com.google.protobuf.ByteString.EMPTY;
     name_ = "";
+    protectionLevel_ = 0;
   }
 
   @java.lang.Override
@@ -103,6 +104,13 @@ private AsymmetricSignResponse(
               name_ = s;
               break;
             }
+          case 48:
+            {
+              int rawValue = input.readEnum();
+
+              protectionLevel_ = rawValue;
+              break;
+            }
           default:
             {
               if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
@@ -172,7 +180,6 @@ public com.google.protobuf.ByteString getSignature() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -198,7 +205,6 @@ public boolean hasSignatureCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -226,7 +232,6 @@ public com.google.protobuf.Int64Value getSignatureCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -250,7 +255,6 @@ public com.google.protobuf.Int64ValueOrBuilder getSignatureCrc32COrBuilder() {
    * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
    * set [AsymmetricSignRequest.digest_crc32c][google.cloud.kms.v1.AsymmetricSignRequest.digest_crc32c] but this field is still false,
    * discard the response and perform a limited number of retries.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>bool verified_digest_crc32c = 3;</code>
@@ -270,7 +274,6 @@ public boolean getVerifiedDigestCrc32C() {
    * <pre>
    * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
    * this field to verify that the intended resource was used for signing.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>string name = 4;</code>
@@ -295,7 +298,6 @@ public java.lang.String getName() {
    * <pre>
    * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
    * this field to verify that the intended resource was used for signing.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>string name = 4;</code>
@@ -315,6 +317,42 @@ public com.google.protobuf.ByteString getNameBytes() {
     }
   }
 
+  public static final int PROTECTION_LEVEL_FIELD_NUMBER = 6;
+  private int protectionLevel_;
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  @java.lang.Override
+  public int getProtectionLevelValue() {
+    return protectionLevel_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+   *
+   * @return The protectionLevel.
+   */
+  @java.lang.Override
+  public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+    @SuppressWarnings("deprecation")
+    com.google.cloud.kms.v1.ProtectionLevel result =
+        com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+    return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -341,6 +379,10 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
     if (!getNameBytes().isEmpty()) {
       com.google.protobuf.GeneratedMessageV3.writeString(output, 4, name_);
     }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      output.writeEnum(6, protectionLevel_);
+    }
     unknownFields.writeTo(output);
   }
 
@@ -362,6 +404,10 @@ public int getSerializedSize() {
     if (!getNameBytes().isEmpty()) {
       size += com.google.protobuf.GeneratedMessageV3.computeStringSize(4, name_);
     }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      size += com.google.protobuf.CodedOutputStream.computeEnumSize(6, protectionLevel_);
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -385,6 +431,7 @@ public boolean equals(final java.lang.Object obj) {
     }
     if (getVerifiedDigestCrc32C() != other.getVerifiedDigestCrc32C()) return false;
     if (!getName().equals(other.getName())) return false;
+    if (protectionLevel_ != other.protectionLevel_) return false;
     if (!unknownFields.equals(other.unknownFields)) return false;
     return true;
   }
@@ -406,6 +453,8 @@ public int hashCode() {
     hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getVerifiedDigestCrc32C());
     hash = (37 * hash) + NAME_FIELD_NUMBER;
     hash = (53 * hash) + getName().hashCode();
+    hash = (37 * hash) + PROTECTION_LEVEL_FIELD_NUMBER;
+    hash = (53 * hash) + protectionLevel_;
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -563,6 +612,8 @@ public Builder clear() {
 
       name_ = "";
 
+      protectionLevel_ = 0;
+
       return this;
     }
 
@@ -598,6 +649,7 @@ public com.google.cloud.kms.v1.AsymmetricSignResponse buildPartial() {
       }
       result.verifiedDigestCrc32C_ = verifiedDigestCrc32C_;
       result.name_ = name_;
+      result.protectionLevel_ = protectionLevel_;
       onBuilt();
       return result;
     }
@@ -660,6 +712,9 @@ public Builder mergeFrom(com.google.cloud.kms.v1.AsymmetricSignResponse other) {
         name_ = other.name_;
         onChanged();
       }
+      if (other.protectionLevel_ != 0) {
+        setProtectionLevelValue(other.getProtectionLevelValue());
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -765,7 +820,6 @@ public Builder clearSignature() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -790,7 +844,6 @@ public boolean hasSignatureCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -821,7 +874,6 @@ public com.google.protobuf.Int64Value getSignatureCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -854,7 +906,6 @@ public Builder setSignatureCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -884,7 +935,6 @@ public Builder setSignatureCrc32C(com.google.protobuf.Int64Value.Builder builder
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -921,7 +971,6 @@ public Builder mergeSignatureCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -952,7 +1001,6 @@ public Builder clearSignatureCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -977,7 +1025,6 @@ public com.google.protobuf.Int64Value.Builder getSignatureCrc32CBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -1006,7 +1053,6 @@ public com.google.protobuf.Int64ValueOrBuilder getSignatureCrc32COrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -1041,7 +1087,6 @@ public com.google.protobuf.Int64ValueOrBuilder getSignatureCrc32COrBuilder() {
      * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
      * set [AsymmetricSignRequest.digest_crc32c][google.cloud.kms.v1.AsymmetricSignRequest.digest_crc32c] but this field is still false,
      * discard the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_digest_crc32c = 3;</code>
@@ -1064,7 +1109,6 @@ public boolean getVerifiedDigestCrc32C() {
      * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
      * set [AsymmetricSignRequest.digest_crc32c][google.cloud.kms.v1.AsymmetricSignRequest.digest_crc32c] but this field is still false,
      * discard the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_digest_crc32c = 3;</code>
@@ -1090,7 +1134,6 @@ public Builder setVerifiedDigestCrc32C(boolean value) {
      * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
      * set [AsymmetricSignRequest.digest_crc32c][google.cloud.kms.v1.AsymmetricSignRequest.digest_crc32c] but this field is still false,
      * discard the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_digest_crc32c = 3;</code>
@@ -1111,7 +1154,6 @@ public Builder clearVerifiedDigestCrc32C() {
      * <pre>
      * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
      * this field to verify that the intended resource was used for signing.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>string name = 4;</code>
@@ -1135,7 +1177,6 @@ public java.lang.String getName() {
      * <pre>
      * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
      * this field to verify that the intended resource was used for signing.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>string name = 4;</code>
@@ -1159,7 +1200,6 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
      * this field to verify that the intended resource was used for signing.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>string name = 4;</code>
@@ -1182,7 +1222,6 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
      * this field to verify that the intended resource was used for signing.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>string name = 4;</code>
@@ -1201,7 +1240,6 @@ public Builder clearName() {
      * <pre>
      * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
      * this field to verify that the intended resource was used for signing.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>string name = 4;</code>
@@ -1220,6 +1258,97 @@ public Builder setNameBytes(com.google.protobuf.ByteString value) {
       return this;
     }
 
+    private int protectionLevel_ = 0;
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+     *
+     * @return The enum numeric value on the wire for protectionLevel.
+     */
+    @java.lang.Override
+    public int getProtectionLevelValue() {
+      return protectionLevel_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+     *
+     * @param value The enum numeric value on the wire for protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevelValue(int value) {
+
+      protectionLevel_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+     *
+     * @return The protectionLevel.
+     */
+    @java.lang.Override
+    public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+      @SuppressWarnings("deprecation")
+      com.google.cloud.kms.v1.ProtectionLevel result =
+          com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+      return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+     *
+     * @param value The protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevel(com.google.cloud.kms.v1.ProtectionLevel value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      protectionLevel_ = value.getNumber();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearProtectionLevel() {
+
+      protectionLevel_ = 0;
+      onChanged();
+      return this;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignResponseOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignResponseOrBuilder.java
index f176c76a..da68b228 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignResponseOrBuilder.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/AsymmetricSignResponseOrBuilder.java
@@ -51,7 +51,6 @@ public interface AsymmetricSignResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -74,7 +73,6 @@ public interface AsymmetricSignResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -97,7 +95,6 @@ public interface AsymmetricSignResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value signature_crc32c = 2;</code>
@@ -116,7 +113,6 @@ public interface AsymmetricSignResponseOrBuilder
    * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
    * set [AsymmetricSignRequest.digest_crc32c][google.cloud.kms.v1.AsymmetricSignRequest.digest_crc32c] but this field is still false,
    * discard the response and perform a limited number of retries.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>bool verified_digest_crc32c = 3;</code>
@@ -131,7 +127,6 @@ public interface AsymmetricSignResponseOrBuilder
    * <pre>
    * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
    * this field to verify that the intended resource was used for signing.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>string name = 4;</code>
@@ -145,7 +140,6 @@ public interface AsymmetricSignResponseOrBuilder
    * <pre>
    * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
    * this field to verify that the intended resource was used for signing.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>string name = 4;</code>
@@ -153,4 +147,29 @@ public interface AsymmetricSignResponseOrBuilder
    * @return The bytes for name.
    */
   com.google.protobuf.ByteString getNameBytes();
+
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  int getProtectionLevelValue();
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+   *
+   * @return The protectionLevel.
+   */
+  com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel();
 }
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKey.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKey.java
index 34f5f321..7cdd6c3f 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKey.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKey.java
@@ -177,6 +177,26 @@ private CryptoKey(
                 versionTemplate_ = subBuilder.buildPartial();
               }
 
+              break;
+            }
+          case 104:
+            {
+              importOnly_ = input.readBool();
+              break;
+            }
+          case 114:
+            {
+              com.google.protobuf.Duration.Builder subBuilder = null;
+              if (destroyScheduledDuration_ != null) {
+                subBuilder = destroyScheduledDuration_.toBuilder();
+              }
+              destroyScheduledDuration_ =
+                  input.readMessage(com.google.protobuf.Duration.parser(), extensionRegistry);
+              if (subBuilder != null) {
+                subBuilder.mergeFrom(destroyScheduledDuration_);
+                destroyScheduledDuration_ = subBuilder.buildPartial();
+              }
+
               break;
             }
           default:
@@ -283,6 +303,17 @@ public enum CryptoKeyPurpose implements com.google.protobuf.ProtocolMessageEnum
      * <code>ASYMMETRIC_DECRYPT = 6;</code>
      */
     ASYMMETRIC_DECRYPT(6),
+    /**
+     *
+     *
+     * <pre>
+     * [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used with
+     * [MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
+     * </pre>
+     *
+     * <code>MAC = 9;</code>
+     */
+    MAC(9),
     UNRECOGNIZED(-1),
     ;
 
@@ -332,6 +363,17 @@ public enum CryptoKeyPurpose implements com.google.protobuf.ProtocolMessageEnum
      * <code>ASYMMETRIC_DECRYPT = 6;</code>
      */
     public static final int ASYMMETRIC_DECRYPT_VALUE = 6;
+    /**
+     *
+     *
+     * <pre>
+     * [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used with
+     * [MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
+     * </pre>
+     *
+     * <code>MAC = 9;</code>
+     */
+    public static final int MAC_VALUE = 9;
 
     public final int getNumber() {
       if (this == UNRECOGNIZED) {
@@ -365,6 +407,8 @@ public static CryptoKeyPurpose forNumber(int value) {
           return ASYMMETRIC_SIGN;
         case 6:
           return ASYMMETRIC_DECRYPT;
+        case 9:
+          return MAC;
         default:
           return null;
       }
@@ -984,6 +1028,90 @@ public java.lang.String getLabelsOrThrow(java.lang.String key) {
     return map.get(key);
   }
 
+  public static final int IMPORT_ONLY_FIELD_NUMBER = 13;
+  private boolean importOnly_;
+  /**
+   *
+   *
+   * <pre>
+   * Immutable. Whether this key may contain imported versions only.
+   * </pre>
+   *
+   * <code>bool import_only = 13 [(.google.api.field_behavior) = IMMUTABLE];</code>
+   *
+   * @return The importOnly.
+   */
+  @java.lang.Override
+  public boolean getImportOnly() {
+    return importOnly_;
+  }
+
+  public static final int DESTROY_SCHEDULED_DURATION_FIELD_NUMBER = 14;
+  private com.google.protobuf.Duration destroyScheduledDuration_;
+  /**
+   *
+   *
+   * <pre>
+   * Immutable. The period of time that versions of this key spend in the
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * state before transitioning to
+   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+   * specified at creation time, the default duration is 24 hours.
+   * </pre>
+   *
+   * <code>
+   * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+   * </code>
+   *
+   * @return Whether the destroyScheduledDuration field is set.
+   */
+  @java.lang.Override
+  public boolean hasDestroyScheduledDuration() {
+    return destroyScheduledDuration_ != null;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Immutable. The period of time that versions of this key spend in the
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * state before transitioning to
+   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+   * specified at creation time, the default duration is 24 hours.
+   * </pre>
+   *
+   * <code>
+   * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+   * </code>
+   *
+   * @return The destroyScheduledDuration.
+   */
+  @java.lang.Override
+  public com.google.protobuf.Duration getDestroyScheduledDuration() {
+    return destroyScheduledDuration_ == null
+        ? com.google.protobuf.Duration.getDefaultInstance()
+        : destroyScheduledDuration_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Immutable. The period of time that versions of this key spend in the
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * state before transitioning to
+   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+   * specified at creation time, the default duration is 24 hours.
+   * </pre>
+   *
+   * <code>
+   * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+   * </code>
+   */
+  @java.lang.Override
+  public com.google.protobuf.DurationOrBuilder getDestroyScheduledDurationOrBuilder() {
+    return getDestroyScheduledDuration();
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -1023,6 +1151,12 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
     if (versionTemplate_ != null) {
       output.writeMessage(11, getVersionTemplate());
     }
+    if (importOnly_ != false) {
+      output.writeBool(13, importOnly_);
+    }
+    if (destroyScheduledDuration_ != null) {
+      output.writeMessage(14, getDestroyScheduledDuration());
+    }
     unknownFields.writeTo(output);
   }
 
@@ -1067,6 +1201,14 @@ public int getSerializedSize() {
     if (versionTemplate_ != null) {
       size += com.google.protobuf.CodedOutputStream.computeMessageSize(11, getVersionTemplate());
     }
+    if (importOnly_ != false) {
+      size += com.google.protobuf.CodedOutputStream.computeBoolSize(13, importOnly_);
+    }
+    if (destroyScheduledDuration_ != null) {
+      size +=
+          com.google.protobuf.CodedOutputStream.computeMessageSize(
+              14, getDestroyScheduledDuration());
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -1101,6 +1243,11 @@ public boolean equals(final java.lang.Object obj) {
       if (!getVersionTemplate().equals(other.getVersionTemplate())) return false;
     }
     if (!internalGetLabels().equals(other.internalGetLabels())) return false;
+    if (getImportOnly() != other.getImportOnly()) return false;
+    if (hasDestroyScheduledDuration() != other.hasDestroyScheduledDuration()) return false;
+    if (hasDestroyScheduledDuration()) {
+      if (!getDestroyScheduledDuration().equals(other.getDestroyScheduledDuration())) return false;
+    }
     if (!getRotationScheduleCase().equals(other.getRotationScheduleCase())) return false;
     switch (rotationScheduleCase_) {
       case 8:
@@ -1144,6 +1291,12 @@ public int hashCode() {
       hash = (37 * hash) + LABELS_FIELD_NUMBER;
       hash = (53 * hash) + internalGetLabels().hashCode();
     }
+    hash = (37 * hash) + IMPORT_ONLY_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getImportOnly());
+    if (hasDestroyScheduledDuration()) {
+      hash = (37 * hash) + DESTROY_SCHEDULED_DURATION_FIELD_NUMBER;
+      hash = (53 * hash) + getDestroyScheduledDuration().hashCode();
+    }
     switch (rotationScheduleCase_) {
       case 8:
         hash = (37 * hash) + ROTATION_PERIOD_FIELD_NUMBER;
@@ -1348,6 +1501,14 @@ public Builder clear() {
         versionTemplateBuilder_ = null;
       }
       internalGetMutableLabels().clear();
+      importOnly_ = false;
+
+      if (destroyScheduledDurationBuilder_ == null) {
+        destroyScheduledDuration_ = null;
+      } else {
+        destroyScheduledDuration_ = null;
+        destroyScheduledDurationBuilder_ = null;
+      }
       rotationScheduleCase_ = 0;
       rotationSchedule_ = null;
       return this;
@@ -1408,6 +1569,12 @@ public com.google.cloud.kms.v1.CryptoKey buildPartial() {
       }
       result.labels_ = internalGetLabels();
       result.labels_.makeImmutable();
+      result.importOnly_ = importOnly_;
+      if (destroyScheduledDurationBuilder_ == null) {
+        result.destroyScheduledDuration_ = destroyScheduledDuration_;
+      } else {
+        result.destroyScheduledDuration_ = destroyScheduledDurationBuilder_.build();
+      }
       result.rotationScheduleCase_ = rotationScheduleCase_;
       onBuilt();
       return result;
@@ -1478,6 +1645,12 @@ public Builder mergeFrom(com.google.cloud.kms.v1.CryptoKey other) {
         mergeVersionTemplate(other.getVersionTemplate());
       }
       internalGetMutableLabels().mergeFrom(other.internalGetLabels());
+      if (other.getImportOnly() != false) {
+        setImportOnly(other.getImportOnly());
+      }
+      if (other.hasDestroyScheduledDuration()) {
+        mergeDestroyScheduledDuration(other.getDestroyScheduledDuration());
+      }
       switch (other.getRotationScheduleCase()) {
         case ROTATION_PERIOD:
           {
@@ -3120,6 +3293,298 @@ public Builder putAllLabels(java.util.Map<java.lang.String, java.lang.String> va
       return this;
     }
 
+    private boolean importOnly_;
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. Whether this key may contain imported versions only.
+     * </pre>
+     *
+     * <code>bool import_only = 13 [(.google.api.field_behavior) = IMMUTABLE];</code>
+     *
+     * @return The importOnly.
+     */
+    @java.lang.Override
+    public boolean getImportOnly() {
+      return importOnly_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. Whether this key may contain imported versions only.
+     * </pre>
+     *
+     * <code>bool import_only = 13 [(.google.api.field_behavior) = IMMUTABLE];</code>
+     *
+     * @param value The importOnly to set.
+     * @return This builder for chaining.
+     */
+    public Builder setImportOnly(boolean value) {
+
+      importOnly_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. Whether this key may contain imported versions only.
+     * </pre>
+     *
+     * <code>bool import_only = 13 [(.google.api.field_behavior) = IMMUTABLE];</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearImportOnly() {
+
+      importOnly_ = false;
+      onChanged();
+      return this;
+    }
+
+    private com.google.protobuf.Duration destroyScheduledDuration_;
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Duration,
+            com.google.protobuf.Duration.Builder,
+            com.google.protobuf.DurationOrBuilder>
+        destroyScheduledDurationBuilder_;
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. The period of time that versions of this key spend in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state before transitioning to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+     * specified at creation time, the default duration is 24 hours.
+     * </pre>
+     *
+     * <code>
+     * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+     * </code>
+     *
+     * @return Whether the destroyScheduledDuration field is set.
+     */
+    public boolean hasDestroyScheduledDuration() {
+      return destroyScheduledDurationBuilder_ != null || destroyScheduledDuration_ != null;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. The period of time that versions of this key spend in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state before transitioning to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+     * specified at creation time, the default duration is 24 hours.
+     * </pre>
+     *
+     * <code>
+     * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+     * </code>
+     *
+     * @return The destroyScheduledDuration.
+     */
+    public com.google.protobuf.Duration getDestroyScheduledDuration() {
+      if (destroyScheduledDurationBuilder_ == null) {
+        return destroyScheduledDuration_ == null
+            ? com.google.protobuf.Duration.getDefaultInstance()
+            : destroyScheduledDuration_;
+      } else {
+        return destroyScheduledDurationBuilder_.getMessage();
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. The period of time that versions of this key spend in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state before transitioning to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+     * specified at creation time, the default duration is 24 hours.
+     * </pre>
+     *
+     * <code>
+     * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+     * </code>
+     */
+    public Builder setDestroyScheduledDuration(com.google.protobuf.Duration value) {
+      if (destroyScheduledDurationBuilder_ == null) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+        destroyScheduledDuration_ = value;
+        onChanged();
+      } else {
+        destroyScheduledDurationBuilder_.setMessage(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. The period of time that versions of this key spend in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state before transitioning to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+     * specified at creation time, the default duration is 24 hours.
+     * </pre>
+     *
+     * <code>
+     * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+     * </code>
+     */
+    public Builder setDestroyScheduledDuration(
+        com.google.protobuf.Duration.Builder builderForValue) {
+      if (destroyScheduledDurationBuilder_ == null) {
+        destroyScheduledDuration_ = builderForValue.build();
+        onChanged();
+      } else {
+        destroyScheduledDurationBuilder_.setMessage(builderForValue.build());
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. The period of time that versions of this key spend in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state before transitioning to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+     * specified at creation time, the default duration is 24 hours.
+     * </pre>
+     *
+     * <code>
+     * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+     * </code>
+     */
+    public Builder mergeDestroyScheduledDuration(com.google.protobuf.Duration value) {
+      if (destroyScheduledDurationBuilder_ == null) {
+        if (destroyScheduledDuration_ != null) {
+          destroyScheduledDuration_ =
+              com.google.protobuf.Duration.newBuilder(destroyScheduledDuration_)
+                  .mergeFrom(value)
+                  .buildPartial();
+        } else {
+          destroyScheduledDuration_ = value;
+        }
+        onChanged();
+      } else {
+        destroyScheduledDurationBuilder_.mergeFrom(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. The period of time that versions of this key spend in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state before transitioning to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+     * specified at creation time, the default duration is 24 hours.
+     * </pre>
+     *
+     * <code>
+     * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+     * </code>
+     */
+    public Builder clearDestroyScheduledDuration() {
+      if (destroyScheduledDurationBuilder_ == null) {
+        destroyScheduledDuration_ = null;
+        onChanged();
+      } else {
+        destroyScheduledDuration_ = null;
+        destroyScheduledDurationBuilder_ = null;
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. The period of time that versions of this key spend in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state before transitioning to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+     * specified at creation time, the default duration is 24 hours.
+     * </pre>
+     *
+     * <code>
+     * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+     * </code>
+     */
+    public com.google.protobuf.Duration.Builder getDestroyScheduledDurationBuilder() {
+
+      onChanged();
+      return getDestroyScheduledDurationFieldBuilder().getBuilder();
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. The period of time that versions of this key spend in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state before transitioning to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+     * specified at creation time, the default duration is 24 hours.
+     * </pre>
+     *
+     * <code>
+     * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+     * </code>
+     */
+    public com.google.protobuf.DurationOrBuilder getDestroyScheduledDurationOrBuilder() {
+      if (destroyScheduledDurationBuilder_ != null) {
+        return destroyScheduledDurationBuilder_.getMessageOrBuilder();
+      } else {
+        return destroyScheduledDuration_ == null
+            ? com.google.protobuf.Duration.getDefaultInstance()
+            : destroyScheduledDuration_;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. The period of time that versions of this key spend in the
+     * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+     * state before transitioning to
+     * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+     * specified at creation time, the default duration is 24 hours.
+     * </pre>
+     *
+     * <code>
+     * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+     * </code>
+     */
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Duration,
+            com.google.protobuf.Duration.Builder,
+            com.google.protobuf.DurationOrBuilder>
+        getDestroyScheduledDurationFieldBuilder() {
+      if (destroyScheduledDurationBuilder_ == null) {
+        destroyScheduledDurationBuilder_ =
+            new com.google.protobuf.SingleFieldBuilderV3<
+                com.google.protobuf.Duration,
+                com.google.protobuf.Duration.Builder,
+                com.google.protobuf.DurationOrBuilder>(
+                getDestroyScheduledDuration(), getParentForChildren(), isClean());
+        destroyScheduledDuration_ = null;
+      }
+      return destroyScheduledDurationBuilder_;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKeyOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKeyOrBuilder.java
index 59588b8d..366dc5e7 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKeyOrBuilder.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKeyOrBuilder.java
@@ -397,5 +397,71 @@ public interface CryptoKeyOrBuilder
    */
   java.lang.String getLabelsOrThrow(java.lang.String key);
 
+  /**
+   *
+   *
+   * <pre>
+   * Immutable. Whether this key may contain imported versions only.
+   * </pre>
+   *
+   * <code>bool import_only = 13 [(.google.api.field_behavior) = IMMUTABLE];</code>
+   *
+   * @return The importOnly.
+   */
+  boolean getImportOnly();
+
+  /**
+   *
+   *
+   * <pre>
+   * Immutable. The period of time that versions of this key spend in the
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * state before transitioning to
+   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+   * specified at creation time, the default duration is 24 hours.
+   * </pre>
+   *
+   * <code>
+   * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+   * </code>
+   *
+   * @return Whether the destroyScheduledDuration field is set.
+   */
+  boolean hasDestroyScheduledDuration();
+  /**
+   *
+   *
+   * <pre>
+   * Immutable. The period of time that versions of this key spend in the
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * state before transitioning to
+   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+   * specified at creation time, the default duration is 24 hours.
+   * </pre>
+   *
+   * <code>
+   * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+   * </code>
+   *
+   * @return The destroyScheduledDuration.
+   */
+  com.google.protobuf.Duration getDestroyScheduledDuration();
+  /**
+   *
+   *
+   * <pre>
+   * Immutable. The period of time that versions of this key spend in the
+   * [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+   * state before transitioning to
+   * [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+   * specified at creation time, the default duration is 24 hours.
+   * </pre>
+   *
+   * <code>
+   * .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
+   * </code>
+   */
+  com.google.protobuf.DurationOrBuilder getDestroyScheduledDurationOrBuilder();
+
   public com.google.cloud.kms.v1.CryptoKey.RotationScheduleCase getRotationScheduleCase();
 }
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKeyVersion.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKeyVersion.java
index 694d6748..eda6c568 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKeyVersion.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/CryptoKeyVersion.java
@@ -293,6 +293,10 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN].
    * The fields in the name after "EC_SIGN_" correspond to the following
    * parameters: elliptic curve, digest algorithm.
+   * Algorithms beginning with "HMAC_" are usable with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+   * [MAC][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.MAC].
+   * The suffix following "HMAC_" corresponds to the hash algorithm being used
+   * (eg. SHA256).
    * For more information, see [Key purposes and algorithms]
    * (https://cloud.google.com/kms/docs/algorithms).
    * </pre>
@@ -471,6 +475,16 @@ public enum CryptoKeyVersionAlgorithm implements com.google.protobuf.ProtocolMes
      * <code>EC_SIGN_SECP256K1_SHA256 = 31;</code>
      */
     EC_SIGN_SECP256K1_SHA256(31),
+    /**
+     *
+     *
+     * <pre>
+     * HMAC-SHA256 signing with a 256 bit key.
+     * </pre>
+     *
+     * <code>HMAC_SHA256 = 32;</code>
+     */
+    HMAC_SHA256(32),
     /**
      *
      *
@@ -655,6 +669,16 @@ public enum CryptoKeyVersionAlgorithm implements com.google.protobuf.ProtocolMes
      * <code>EC_SIGN_SECP256K1_SHA256 = 31;</code>
      */
     public static final int EC_SIGN_SECP256K1_SHA256_VALUE = 31;
+    /**
+     *
+     *
+     * <pre>
+     * HMAC-SHA256 signing with a 256 bit key.
+     * </pre>
+     *
+     * <code>HMAC_SHA256 = 32;</code>
+     */
+    public static final int HMAC_SHA256_VALUE = 32;
     /**
      *
      *
@@ -724,6 +748,8 @@ public static CryptoKeyVersionAlgorithm forNumber(int value) {
           return EC_SIGN_P384_SHA384;
         case 31:
           return EC_SIGN_SECP256K1_SHA256;
+        case 32:
+          return HMAC_SHA256;
         case 18:
           return EXTERNAL_SYMMETRIC_ENCRYPTION;
         default:
@@ -840,7 +866,6 @@ public enum CryptoKeyVersionState implements com.google.protobuf.ProtocolMessage
      *
      * <pre>
      * This version is destroyed, and the key material is no longer stored.
-     * A version may not leave this state once entered.
      * </pre>
      *
      * <code>DESTROYED = 3;</code>
@@ -935,7 +960,6 @@ public enum CryptoKeyVersionState implements com.google.protobuf.ProtocolMessage
      *
      * <pre>
      * This version is destroyed, and the key material is no longer stored.
-     * A version may not leave this state once entered.
      * </pre>
      *
      * <code>DESTROYED = 3;</code>
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptRequest.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptRequest.java
index 5278d995..cfe21b4d 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptRequest.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptRequest.java
@@ -265,7 +265,6 @@ public com.google.protobuf.ByteString getAdditionalAuthenticatedData() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -295,7 +294,6 @@ public boolean hasCiphertextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -327,7 +325,6 @@ public com.google.protobuf.Int64Value getCiphertextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -359,7 +356,6 @@ public com.google.protobuf.Int64ValueOrBuilder getCiphertextCrc32COrBuilder() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -390,7 +386,6 @@ public boolean hasAdditionalAuthenticatedDataCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -423,7 +418,6 @@ public com.google.protobuf.Int64Value getAdditionalAuthenticatedDataCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -1107,7 +1101,6 @@ public Builder clearAdditionalAuthenticatedData() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1136,7 +1129,6 @@ public boolean hasCiphertextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1171,7 +1163,6 @@ public com.google.protobuf.Int64Value getCiphertextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1208,7 +1199,6 @@ public Builder setCiphertextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1242,7 +1232,6 @@ public Builder setCiphertextCrc32C(com.google.protobuf.Int64Value.Builder builde
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1283,7 +1272,6 @@ public Builder mergeCiphertextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1318,7 +1306,6 @@ public Builder clearCiphertextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1347,7 +1334,6 @@ public com.google.protobuf.Int64Value.Builder getCiphertextCrc32CBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1380,7 +1366,6 @@ public com.google.protobuf.Int64ValueOrBuilder getCiphertextCrc32COrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1428,7 +1413,6 @@ public com.google.protobuf.Int64ValueOrBuilder getCiphertextCrc32COrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1459,7 +1443,6 @@ public boolean hasAdditionalAuthenticatedDataCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1495,7 +1478,6 @@ public com.google.protobuf.Int64Value getAdditionalAuthenticatedDataCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1533,7 +1515,6 @@ public Builder setAdditionalAuthenticatedDataCrc32C(com.google.protobuf.Int64Val
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1569,7 +1550,6 @@ public Builder setAdditionalAuthenticatedDataCrc32C(
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1611,7 +1591,6 @@ public Builder mergeAdditionalAuthenticatedDataCrc32C(com.google.protobuf.Int64V
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1647,7 +1626,6 @@ public Builder clearAdditionalAuthenticatedDataCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1677,7 +1655,6 @@ public com.google.protobuf.Int64Value.Builder getAdditionalAuthenticatedDataCrc3
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1711,7 +1688,6 @@ public com.google.protobuf.Int64ValueOrBuilder getAdditionalAuthenticatedDataCrc
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptRequestOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptRequestOrBuilder.java
index c9bbad72..6342f226 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptRequestOrBuilder.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptRequestOrBuilder.java
@@ -99,7 +99,6 @@ public interface DecryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -126,7 +125,6 @@ public interface DecryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -153,7 +151,6 @@ public interface DecryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -180,7 +177,6 @@ public interface DecryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -208,7 +204,6 @@ public interface DecryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -236,7 +231,6 @@ public interface DecryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptResponse.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptResponse.java
index cbef74c6..04a70c7a 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptResponse.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptResponse.java
@@ -39,6 +39,7 @@ private DecryptResponse(com.google.protobuf.GeneratedMessageV3.Builder<?> builde
 
   private DecryptResponse() {
     plaintext_ = com.google.protobuf.ByteString.EMPTY;
+    protectionLevel_ = 0;
   }
 
   @java.lang.Override
@@ -88,6 +89,18 @@ private DecryptResponse(
                 plaintextCrc32C_ = subBuilder.buildPartial();
               }
 
+              break;
+            }
+          case 24:
+            {
+              usedPrimary_ = input.readBool();
+              break;
+            }
+          case 32:
+            {
+              int rawValue = input.readEnum();
+
+              protectionLevel_ = rawValue;
               break;
             }
           default:
@@ -161,7 +174,6 @@ public com.google.protobuf.ByteString getPlaintext() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -189,7 +201,6 @@ public boolean hasPlaintextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -219,7 +230,6 @@ public com.google.protobuf.Int64Value getPlaintextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -229,6 +239,60 @@ public com.google.protobuf.Int64ValueOrBuilder getPlaintextCrc32COrBuilder() {
     return getPlaintextCrc32C();
   }
 
+  public static final int USED_PRIMARY_FIELD_NUMBER = 3;
+  private boolean usedPrimary_;
+  /**
+   *
+   *
+   * <pre>
+   * Whether the Decryption was performed using the primary key version.
+   * </pre>
+   *
+   * <code>bool used_primary = 3;</code>
+   *
+   * @return The usedPrimary.
+   */
+  @java.lang.Override
+  public boolean getUsedPrimary() {
+    return usedPrimary_;
+  }
+
+  public static final int PROTECTION_LEVEL_FIELD_NUMBER = 4;
+  private int protectionLevel_;
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  @java.lang.Override
+  public int getProtectionLevelValue() {
+    return protectionLevel_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+   *
+   * @return The protectionLevel.
+   */
+  @java.lang.Override
+  public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+    @SuppressWarnings("deprecation")
+    com.google.cloud.kms.v1.ProtectionLevel result =
+        com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+    return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -249,6 +313,13 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
     if (plaintextCrc32C_ != null) {
       output.writeMessage(2, getPlaintextCrc32C());
     }
+    if (usedPrimary_ != false) {
+      output.writeBool(3, usedPrimary_);
+    }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      output.writeEnum(4, protectionLevel_);
+    }
     unknownFields.writeTo(output);
   }
 
@@ -264,6 +335,13 @@ public int getSerializedSize() {
     if (plaintextCrc32C_ != null) {
       size += com.google.protobuf.CodedOutputStream.computeMessageSize(2, getPlaintextCrc32C());
     }
+    if (usedPrimary_ != false) {
+      size += com.google.protobuf.CodedOutputStream.computeBoolSize(3, usedPrimary_);
+    }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      size += com.google.protobuf.CodedOutputStream.computeEnumSize(4, protectionLevel_);
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -284,6 +362,8 @@ public boolean equals(final java.lang.Object obj) {
     if (hasPlaintextCrc32C()) {
       if (!getPlaintextCrc32C().equals(other.getPlaintextCrc32C())) return false;
     }
+    if (getUsedPrimary() != other.getUsedPrimary()) return false;
+    if (protectionLevel_ != other.protectionLevel_) return false;
     if (!unknownFields.equals(other.unknownFields)) return false;
     return true;
   }
@@ -301,6 +381,10 @@ public int hashCode() {
       hash = (37 * hash) + PLAINTEXT_CRC32C_FIELD_NUMBER;
       hash = (53 * hash) + getPlaintextCrc32C().hashCode();
     }
+    hash = (37 * hash) + USED_PRIMARY_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getUsedPrimary());
+    hash = (37 * hash) + PROTECTION_LEVEL_FIELD_NUMBER;
+    hash = (53 * hash) + protectionLevel_;
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -454,6 +538,10 @@ public Builder clear() {
         plaintextCrc32C_ = null;
         plaintextCrc32CBuilder_ = null;
       }
+      usedPrimary_ = false;
+
+      protectionLevel_ = 0;
+
       return this;
     }
 
@@ -487,6 +575,8 @@ public com.google.cloud.kms.v1.DecryptResponse buildPartial() {
       } else {
         result.plaintextCrc32C_ = plaintextCrc32CBuilder_.build();
       }
+      result.usedPrimary_ = usedPrimary_;
+      result.protectionLevel_ = protectionLevel_;
       onBuilt();
       return result;
     }
@@ -542,6 +632,12 @@ public Builder mergeFrom(com.google.cloud.kms.v1.DecryptResponse other) {
       if (other.hasPlaintextCrc32C()) {
         mergePlaintextCrc32C(other.getPlaintextCrc32C());
       }
+      if (other.getUsedPrimary() != false) {
+        setUsedPrimary(other.getUsedPrimary());
+      }
+      if (other.protectionLevel_ != 0) {
+        setProtectionLevelValue(other.getProtectionLevelValue());
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -649,7 +745,6 @@ public Builder clearPlaintext() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -676,7 +771,6 @@ public boolean hasPlaintextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -709,7 +803,6 @@ public com.google.protobuf.Int64Value getPlaintextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -744,7 +837,6 @@ public Builder setPlaintextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -776,7 +868,6 @@ public Builder setPlaintextCrc32C(com.google.protobuf.Int64Value.Builder builder
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -815,7 +906,6 @@ public Builder mergePlaintextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -848,7 +938,6 @@ public Builder clearPlaintextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -875,7 +964,6 @@ public com.google.protobuf.Int64Value.Builder getPlaintextCrc32CBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -906,7 +994,6 @@ public com.google.protobuf.Int64ValueOrBuilder getPlaintextCrc32COrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -928,6 +1015,149 @@ public com.google.protobuf.Int64ValueOrBuilder getPlaintextCrc32COrBuilder() {
       return plaintextCrc32CBuilder_;
     }
 
+    private boolean usedPrimary_;
+    /**
+     *
+     *
+     * <pre>
+     * Whether the Decryption was performed using the primary key version.
+     * </pre>
+     *
+     * <code>bool used_primary = 3;</code>
+     *
+     * @return The usedPrimary.
+     */
+    @java.lang.Override
+    public boolean getUsedPrimary() {
+      return usedPrimary_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Whether the Decryption was performed using the primary key version.
+     * </pre>
+     *
+     * <code>bool used_primary = 3;</code>
+     *
+     * @param value The usedPrimary to set.
+     * @return This builder for chaining.
+     */
+    public Builder setUsedPrimary(boolean value) {
+
+      usedPrimary_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Whether the Decryption was performed using the primary key version.
+     * </pre>
+     *
+     * <code>bool used_primary = 3;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearUsedPrimary() {
+
+      usedPrimary_ = false;
+      onChanged();
+      return this;
+    }
+
+    private int protectionLevel_ = 0;
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+     *
+     * @return The enum numeric value on the wire for protectionLevel.
+     */
+    @java.lang.Override
+    public int getProtectionLevelValue() {
+      return protectionLevel_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+     *
+     * @param value The enum numeric value on the wire for protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevelValue(int value) {
+
+      protectionLevel_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+     *
+     * @return The protectionLevel.
+     */
+    @java.lang.Override
+    public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+      @SuppressWarnings("deprecation")
+      com.google.cloud.kms.v1.ProtectionLevel result =
+          com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+      return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+     *
+     * @param value The protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevel(com.google.cloud.kms.v1.ProtectionLevel value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      protectionLevel_ = value.getNumber();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearProtectionLevel() {
+
+      protectionLevel_ = 0;
+      onChanged();
+      return this;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptResponseOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptResponseOrBuilder.java
index 2f8d5816..e775bb44 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptResponseOrBuilder.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/DecryptResponseOrBuilder.java
@@ -53,7 +53,6 @@ public interface DecryptResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -78,7 +77,6 @@ public interface DecryptResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
@@ -103,10 +101,47 @@ public interface DecryptResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value plaintext_crc32c = 2;</code>
    */
   com.google.protobuf.Int64ValueOrBuilder getPlaintextCrc32COrBuilder();
+
+  /**
+   *
+   *
+   * <pre>
+   * Whether the Decryption was performed using the primary key version.
+   * </pre>
+   *
+   * <code>bool used_primary = 3;</code>
+   *
+   * @return The usedPrimary.
+   */
+  boolean getUsedPrimary();
+
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  int getProtectionLevelValue();
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 4;</code>
+   *
+   * @return The protectionLevel.
+   */
+  com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel();
 }
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptRequest.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptRequest.java
index 1225c186..d55da426 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptRequest.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptRequest.java
@@ -280,7 +280,6 @@ public com.google.protobuf.ByteString getAdditionalAuthenticatedData() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -310,7 +309,6 @@ public boolean hasPlaintextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -342,7 +340,6 @@ public com.google.protobuf.Int64Value getPlaintextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -374,7 +371,6 @@ public com.google.protobuf.Int64ValueOrBuilder getPlaintextCrc32COrBuilder() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -405,7 +401,6 @@ public boolean hasAdditionalAuthenticatedDataCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -438,7 +433,6 @@ public com.google.protobuf.Int64Value getAdditionalAuthenticatedDataCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -1165,7 +1159,6 @@ public Builder clearAdditionalAuthenticatedData() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1194,7 +1187,6 @@ public boolean hasPlaintextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1229,7 +1221,6 @@ public com.google.protobuf.Int64Value getPlaintextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1266,7 +1257,6 @@ public Builder setPlaintextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1300,7 +1290,6 @@ public Builder setPlaintextCrc32C(com.google.protobuf.Int64Value.Builder builder
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1341,7 +1330,6 @@ public Builder mergePlaintextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1376,7 +1364,6 @@ public Builder clearPlaintextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1405,7 +1392,6 @@ public com.google.protobuf.Int64Value.Builder getPlaintextCrc32CBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1438,7 +1424,6 @@ public com.google.protobuf.Int64ValueOrBuilder getPlaintextCrc32COrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1486,7 +1471,6 @@ public com.google.protobuf.Int64ValueOrBuilder getPlaintextCrc32COrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1517,7 +1501,6 @@ public boolean hasAdditionalAuthenticatedDataCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1553,7 +1536,6 @@ public com.google.protobuf.Int64Value getAdditionalAuthenticatedDataCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1591,7 +1573,6 @@ public Builder setAdditionalAuthenticatedDataCrc32C(com.google.protobuf.Int64Val
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1627,7 +1608,6 @@ public Builder setAdditionalAuthenticatedDataCrc32C(
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1669,7 +1649,6 @@ public Builder mergeAdditionalAuthenticatedDataCrc32C(com.google.protobuf.Int64V
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1705,7 +1684,6 @@ public Builder clearAdditionalAuthenticatedDataCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1735,7 +1713,6 @@ public com.google.protobuf.Int64Value.Builder getAdditionalAuthenticatedDataCrc3
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
@@ -1769,7 +1746,6 @@ public com.google.protobuf.Int64ValueOrBuilder getAdditionalAuthenticatedDataCrc
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptRequestOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptRequestOrBuilder.java
index b0f7e922..9a871aa7 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptRequestOrBuilder.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptRequestOrBuilder.java
@@ -114,7 +114,6 @@ public interface EncryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -141,7 +140,6 @@ public interface EncryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -168,7 +166,6 @@ public interface EncryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -195,7 +192,6 @@ public interface EncryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -223,7 +219,6 @@ public interface EncryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
@@ -251,7 +246,6 @@ public interface EncryptRequestOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptResponse.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptResponse.java
index 72f065c4..5826b1a9 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptResponse.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptResponse.java
@@ -40,6 +40,7 @@ private EncryptResponse(com.google.protobuf.GeneratedMessageV3.Builder<?> builde
   private EncryptResponse() {
     name_ = "";
     ciphertext_ = com.google.protobuf.ByteString.EMPTY;
+    protectionLevel_ = 0;
   }
 
   @java.lang.Override
@@ -108,6 +109,13 @@ private EncryptResponse(
               verifiedAdditionalAuthenticatedDataCrc32C_ = input.readBool();
               break;
             }
+          case 56:
+            {
+              int rawValue = input.readEnum();
+
+              protectionLevel_ = rawValue;
+              break;
+            }
           default:
             {
               if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
@@ -228,7 +236,6 @@ public com.google.protobuf.ByteString getCiphertext() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -254,7 +261,6 @@ public boolean hasCiphertextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -282,7 +288,6 @@ public com.google.protobuf.Int64Value getCiphertextCrc32C() {
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -306,7 +311,6 @@ public com.google.protobuf.Int64ValueOrBuilder getCiphertextCrc32COrBuilder() {
    * that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
    * [EncryptRequest.plaintext_crc32c][google.cloud.kms.v1.EncryptRequest.plaintext_crc32c] but this field is still false, discard
    * the response and perform a limited number of retries.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>bool verified_plaintext_crc32c = 5;</code>
@@ -333,7 +337,6 @@ public boolean getVerifiedPlaintextCrc32C() {
    * that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
    * [EncryptRequest.additional_authenticated_data_crc32c][google.cloud.kms.v1.EncryptRequest.additional_authenticated_data_crc32c] but this field is
    * still false, discard the response and perform a limited number of retries.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>bool verified_additional_authenticated_data_crc32c = 6;</code>
@@ -345,6 +348,42 @@ public boolean getVerifiedAdditionalAuthenticatedDataCrc32C() {
     return verifiedAdditionalAuthenticatedDataCrc32C_;
   }
 
+  public static final int PROTECTION_LEVEL_FIELD_NUMBER = 7;
+  private int protectionLevel_;
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 7;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  @java.lang.Override
+  public int getProtectionLevelValue() {
+    return protectionLevel_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 7;</code>
+   *
+   * @return The protectionLevel.
+   */
+  @java.lang.Override
+  public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+    @SuppressWarnings("deprecation")
+    com.google.cloud.kms.v1.ProtectionLevel result =
+        com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+    return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -374,6 +413,10 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
     if (verifiedAdditionalAuthenticatedDataCrc32C_ != false) {
       output.writeBool(6, verifiedAdditionalAuthenticatedDataCrc32C_);
     }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      output.writeEnum(7, protectionLevel_);
+    }
     unknownFields.writeTo(output);
   }
 
@@ -400,6 +443,10 @@ public int getSerializedSize() {
           com.google.protobuf.CodedOutputStream.computeBoolSize(
               6, verifiedAdditionalAuthenticatedDataCrc32C_);
     }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      size += com.google.protobuf.CodedOutputStream.computeEnumSize(7, protectionLevel_);
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -424,6 +471,7 @@ public boolean equals(final java.lang.Object obj) {
     if (getVerifiedPlaintextCrc32C() != other.getVerifiedPlaintextCrc32C()) return false;
     if (getVerifiedAdditionalAuthenticatedDataCrc32C()
         != other.getVerifiedAdditionalAuthenticatedDataCrc32C()) return false;
+    if (protectionLevel_ != other.protectionLevel_) return false;
     if (!unknownFields.equals(other.unknownFields)) return false;
     return true;
   }
@@ -450,6 +498,8 @@ public int hashCode() {
         (53 * hash)
             + com.google.protobuf.Internal.hashBoolean(
                 getVerifiedAdditionalAuthenticatedDataCrc32C());
+    hash = (37 * hash) + PROTECTION_LEVEL_FIELD_NUMBER;
+    hash = (53 * hash) + protectionLevel_;
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -609,6 +659,8 @@ public Builder clear() {
 
       verifiedAdditionalAuthenticatedDataCrc32C_ = false;
 
+      protectionLevel_ = 0;
+
       return this;
     }
 
@@ -646,6 +698,7 @@ public com.google.cloud.kms.v1.EncryptResponse buildPartial() {
       result.verifiedPlaintextCrc32C_ = verifiedPlaintextCrc32C_;
       result.verifiedAdditionalAuthenticatedDataCrc32C_ =
           verifiedAdditionalAuthenticatedDataCrc32C_;
+      result.protectionLevel_ = protectionLevel_;
       onBuilt();
       return result;
     }
@@ -712,6 +765,9 @@ public Builder mergeFrom(com.google.cloud.kms.v1.EncryptResponse other) {
         setVerifiedAdditionalAuthenticatedDataCrc32C(
             other.getVerifiedAdditionalAuthenticatedDataCrc32C());
       }
+      if (other.protectionLevel_ != 0) {
+        setProtectionLevelValue(other.getProtectionLevelValue());
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -928,7 +984,6 @@ public Builder clearCiphertext() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -953,7 +1008,6 @@ public boolean hasCiphertextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -984,7 +1038,6 @@ public com.google.protobuf.Int64Value getCiphertextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -1017,7 +1070,6 @@ public Builder setCiphertextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -1047,7 +1099,6 @@ public Builder setCiphertextCrc32C(com.google.protobuf.Int64Value.Builder builde
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -1084,7 +1135,6 @@ public Builder mergeCiphertextCrc32C(com.google.protobuf.Int64Value value) {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -1115,7 +1165,6 @@ public Builder clearCiphertextCrc32C() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -1140,7 +1189,6 @@ public com.google.protobuf.Int64Value.Builder getCiphertextCrc32CBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -1169,7 +1217,6 @@ public com.google.protobuf.Int64ValueOrBuilder getCiphertextCrc32COrBuilder() {
      * different languages. However, it is a non-negative integer, which will
      * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
      * that support this type.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -1204,7 +1251,6 @@ public com.google.protobuf.Int64ValueOrBuilder getCiphertextCrc32COrBuilder() {
      * that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
      * [EncryptRequest.plaintext_crc32c][google.cloud.kms.v1.EncryptRequest.plaintext_crc32c] but this field is still false, discard
      * the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_plaintext_crc32c = 5;</code>
@@ -1227,7 +1273,6 @@ public boolean getVerifiedPlaintextCrc32C() {
      * that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
      * [EncryptRequest.plaintext_crc32c][google.cloud.kms.v1.EncryptRequest.plaintext_crc32c] but this field is still false, discard
      * the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_plaintext_crc32c = 5;</code>
@@ -1253,7 +1298,6 @@ public Builder setVerifiedPlaintextCrc32C(boolean value) {
      * that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
      * [EncryptRequest.plaintext_crc32c][google.cloud.kms.v1.EncryptRequest.plaintext_crc32c] but this field is still false, discard
      * the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_plaintext_crc32c = 5;</code>
@@ -1281,7 +1325,6 @@ public Builder clearVerifiedPlaintextCrc32C() {
      * that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
      * [EncryptRequest.additional_authenticated_data_crc32c][google.cloud.kms.v1.EncryptRequest.additional_authenticated_data_crc32c] but this field is
      * still false, discard the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_additional_authenticated_data_crc32c = 6;</code>
@@ -1305,7 +1348,6 @@ public boolean getVerifiedAdditionalAuthenticatedDataCrc32C() {
      * that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
      * [EncryptRequest.additional_authenticated_data_crc32c][google.cloud.kms.v1.EncryptRequest.additional_authenticated_data_crc32c] but this field is
      * still false, discard the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_additional_authenticated_data_crc32c = 6;</code>
@@ -1332,7 +1374,6 @@ public Builder setVerifiedAdditionalAuthenticatedDataCrc32C(boolean value) {
      * that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
      * [EncryptRequest.additional_authenticated_data_crc32c][google.cloud.kms.v1.EncryptRequest.additional_authenticated_data_crc32c] but this field is
      * still false, discard the response and perform a limited number of retries.
-     * NOTE: This field is in Beta.
      * </pre>
      *
      * <code>bool verified_additional_authenticated_data_crc32c = 6;</code>
@@ -1346,6 +1387,97 @@ public Builder clearVerifiedAdditionalAuthenticatedDataCrc32C() {
       return this;
     }
 
+    private int protectionLevel_ = 0;
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 7;</code>
+     *
+     * @return The enum numeric value on the wire for protectionLevel.
+     */
+    @java.lang.Override
+    public int getProtectionLevelValue() {
+      return protectionLevel_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 7;</code>
+     *
+     * @param value The enum numeric value on the wire for protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevelValue(int value) {
+
+      protectionLevel_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 7;</code>
+     *
+     * @return The protectionLevel.
+     */
+    @java.lang.Override
+    public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+      @SuppressWarnings("deprecation")
+      com.google.cloud.kms.v1.ProtectionLevel result =
+          com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+      return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 7;</code>
+     *
+     * @param value The protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevel(com.google.cloud.kms.v1.ProtectionLevel value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      protectionLevel_ = value.getNumber();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 7;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearProtectionLevel() {
+
+      protectionLevel_ = 0;
+      onChanged();
+      return this;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptResponseOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptResponseOrBuilder.java
index 31e9ce68..14279517 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptResponseOrBuilder.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptResponseOrBuilder.java
@@ -78,7 +78,6 @@ public interface EncryptResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -101,7 +100,6 @@ public interface EncryptResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -124,7 +122,6 @@ public interface EncryptResponseOrBuilder
    * different languages. However, it is a non-negative integer, which will
    * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
    * that support this type.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>.google.protobuf.Int64Value ciphertext_crc32c = 4;</code>
@@ -143,7 +140,6 @@ public interface EncryptResponseOrBuilder
    * that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
    * [EncryptRequest.plaintext_crc32c][google.cloud.kms.v1.EncryptRequest.plaintext_crc32c] but this field is still false, discard
    * the response and perform a limited number of retries.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>bool verified_plaintext_crc32c = 5;</code>
@@ -165,7 +161,6 @@ public interface EncryptResponseOrBuilder
    * that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
    * [EncryptRequest.additional_authenticated_data_crc32c][google.cloud.kms.v1.EncryptRequest.additional_authenticated_data_crc32c] but this field is
    * still false, discard the response and perform a limited number of retries.
-   * NOTE: This field is in Beta.
    * </pre>
    *
    * <code>bool verified_additional_authenticated_data_crc32c = 6;</code>
@@ -173,4 +168,29 @@ public interface EncryptResponseOrBuilder
    * @return The verifiedAdditionalAuthenticatedDataCrc32c.
    */
   boolean getVerifiedAdditionalAuthenticatedDataCrc32C();
+
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 7;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  int getProtectionLevelValue();
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 7;</code>
+   *
+   * @return The protectionLevel.
+   */
+  com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel();
 }
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesRequest.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesRequest.java
new file mode 100644
index 00000000..99380a76
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesRequest.java
@@ -0,0 +1,896 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+/**
+ *
+ *
+ * <pre>
+ * Request message for [KeyManagementService.GenerateRandomBytes][google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes].
+ * </pre>
+ *
+ * Protobuf type {@code google.cloud.kms.v1.GenerateRandomBytesRequest}
+ */
+public final class GenerateRandomBytesRequest extends com.google.protobuf.GeneratedMessageV3
+    implements
+    // @@protoc_insertion_point(message_implements:google.cloud.kms.v1.GenerateRandomBytesRequest)
+    GenerateRandomBytesRequestOrBuilder {
+  private static final long serialVersionUID = 0L;
+  // Use GenerateRandomBytesRequest.newBuilder() to construct.
+  private GenerateRandomBytesRequest(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+    super(builder);
+  }
+
+  private GenerateRandomBytesRequest() {
+    location_ = "";
+    protectionLevel_ = 0;
+  }
+
+  @java.lang.Override
+  @SuppressWarnings({"unused"})
+  protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
+    return new GenerateRandomBytesRequest();
+  }
+
+  @java.lang.Override
+  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
+    return this.unknownFields;
+  }
+
+  private GenerateRandomBytesRequest(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    this();
+    if (extensionRegistry == null) {
+      throw new java.lang.NullPointerException();
+    }
+    com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+        com.google.protobuf.UnknownFieldSet.newBuilder();
+    try {
+      boolean done = false;
+      while (!done) {
+        int tag = input.readTag();
+        switch (tag) {
+          case 0:
+            done = true;
+            break;
+          case 10:
+            {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              location_ = s;
+              break;
+            }
+          case 16:
+            {
+              lengthBytes_ = input.readInt32();
+              break;
+            }
+          case 24:
+            {
+              int rawValue = input.readEnum();
+
+              protectionLevel_ = rawValue;
+              break;
+            }
+          default:
+            {
+              if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
+                done = true;
+              }
+              break;
+            }
+        }
+      }
+    } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+      throw e.setUnfinishedMessage(this);
+    } catch (java.io.IOException e) {
+      throw new com.google.protobuf.InvalidProtocolBufferException(e).setUnfinishedMessage(this);
+    } finally {
+      this.unknownFields = unknownFields.build();
+      makeExtensionsImmutable();
+    }
+  }
+
+  public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_GenerateRandomBytesRequest_descriptor;
+  }
+
+  @java.lang.Override
+  protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internalGetFieldAccessorTable() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_GenerateRandomBytesRequest_fieldAccessorTable
+        .ensureFieldAccessorsInitialized(
+            com.google.cloud.kms.v1.GenerateRandomBytesRequest.class,
+            com.google.cloud.kms.v1.GenerateRandomBytesRequest.Builder.class);
+  }
+
+  public static final int LOCATION_FIELD_NUMBER = 1;
+  private volatile java.lang.Object location_;
+  /**
+   *
+   *
+   * <pre>
+   * The project-specific location in which to generate random bytes.
+   * For example, "projects/my-project/locations/us-central1".
+   * </pre>
+   *
+   * <code>string location = 1;</code>
+   *
+   * @return The location.
+   */
+  @java.lang.Override
+  public java.lang.String getLocation() {
+    java.lang.Object ref = location_;
+    if (ref instanceof java.lang.String) {
+      return (java.lang.String) ref;
+    } else {
+      com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+      java.lang.String s = bs.toStringUtf8();
+      location_ = s;
+      return s;
+    }
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The project-specific location in which to generate random bytes.
+   * For example, "projects/my-project/locations/us-central1".
+   * </pre>
+   *
+   * <code>string location = 1;</code>
+   *
+   * @return The bytes for location.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getLocationBytes() {
+    java.lang.Object ref = location_;
+    if (ref instanceof java.lang.String) {
+      com.google.protobuf.ByteString b =
+          com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+      location_ = b;
+      return b;
+    } else {
+      return (com.google.protobuf.ByteString) ref;
+    }
+  }
+
+  public static final int LENGTH_BYTES_FIELD_NUMBER = 2;
+  private int lengthBytes_;
+  /**
+   *
+   *
+   * <pre>
+   * The length in bytes of the amount of randomness to retrieve.  Minimum 8
+   * bytes, maximum 1024 bytes.
+   * </pre>
+   *
+   * <code>int32 length_bytes = 2;</code>
+   *
+   * @return The lengthBytes.
+   */
+  @java.lang.Override
+  public int getLengthBytes() {
+    return lengthBytes_;
+  }
+
+  public static final int PROTECTION_LEVEL_FIELD_NUMBER = 3;
+  private int protectionLevel_;
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Defaults to
+   * [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 3;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  @java.lang.Override
+  public int getProtectionLevelValue() {
+    return protectionLevel_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Defaults to
+   * [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 3;</code>
+   *
+   * @return The protectionLevel.
+   */
+  @java.lang.Override
+  public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+    @SuppressWarnings("deprecation")
+    com.google.cloud.kms.v1.ProtectionLevel result =
+        com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+    return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+  }
+
+  private byte memoizedIsInitialized = -1;
+
+  @java.lang.Override
+  public final boolean isInitialized() {
+    byte isInitialized = memoizedIsInitialized;
+    if (isInitialized == 1) return true;
+    if (isInitialized == 0) return false;
+
+    memoizedIsInitialized = 1;
+    return true;
+  }
+
+  @java.lang.Override
+  public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io.IOException {
+    if (!getLocationBytes().isEmpty()) {
+      com.google.protobuf.GeneratedMessageV3.writeString(output, 1, location_);
+    }
+    if (lengthBytes_ != 0) {
+      output.writeInt32(2, lengthBytes_);
+    }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      output.writeEnum(3, protectionLevel_);
+    }
+    unknownFields.writeTo(output);
+  }
+
+  @java.lang.Override
+  public int getSerializedSize() {
+    int size = memoizedSize;
+    if (size != -1) return size;
+
+    size = 0;
+    if (!getLocationBytes().isEmpty()) {
+      size += com.google.protobuf.GeneratedMessageV3.computeStringSize(1, location_);
+    }
+    if (lengthBytes_ != 0) {
+      size += com.google.protobuf.CodedOutputStream.computeInt32Size(2, lengthBytes_);
+    }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      size += com.google.protobuf.CodedOutputStream.computeEnumSize(3, protectionLevel_);
+    }
+    size += unknownFields.getSerializedSize();
+    memoizedSize = size;
+    return size;
+  }
+
+  @java.lang.Override
+  public boolean equals(final java.lang.Object obj) {
+    if (obj == this) {
+      return true;
+    }
+    if (!(obj instanceof com.google.cloud.kms.v1.GenerateRandomBytesRequest)) {
+      return super.equals(obj);
+    }
+    com.google.cloud.kms.v1.GenerateRandomBytesRequest other =
+        (com.google.cloud.kms.v1.GenerateRandomBytesRequest) obj;
+
+    if (!getLocation().equals(other.getLocation())) return false;
+    if (getLengthBytes() != other.getLengthBytes()) return false;
+    if (protectionLevel_ != other.protectionLevel_) return false;
+    if (!unknownFields.equals(other.unknownFields)) return false;
+    return true;
+  }
+
+  @java.lang.Override
+  public int hashCode() {
+    if (memoizedHashCode != 0) {
+      return memoizedHashCode;
+    }
+    int hash = 41;
+    hash = (19 * hash) + getDescriptor().hashCode();
+    hash = (37 * hash) + LOCATION_FIELD_NUMBER;
+    hash = (53 * hash) + getLocation().hashCode();
+    hash = (37 * hash) + LENGTH_BYTES_FIELD_NUMBER;
+    hash = (53 * hash) + getLengthBytes();
+    hash = (37 * hash) + PROTECTION_LEVEL_FIELD_NUMBER;
+    hash = (53 * hash) + protectionLevel_;
+    hash = (29 * hash) + unknownFields.hashCode();
+    memoizedHashCode = hash;
+    return hash;
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseFrom(
+      java.nio.ByteBuffer data) throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseFrom(
+      java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseFrom(
+      com.google.protobuf.ByteString data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseFrom(
+      com.google.protobuf.ByteString data,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseFrom(byte[] data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseFrom(
+      byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseDelimitedFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseDelimitedFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseFrom(
+      com.google.protobuf.CodedInputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest parseFrom(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  @java.lang.Override
+  public Builder newBuilderForType() {
+    return newBuilder();
+  }
+
+  public static Builder newBuilder() {
+    return DEFAULT_INSTANCE.toBuilder();
+  }
+
+  public static Builder newBuilder(com.google.cloud.kms.v1.GenerateRandomBytesRequest prototype) {
+    return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
+  }
+
+  @java.lang.Override
+  public Builder toBuilder() {
+    return this == DEFAULT_INSTANCE ? new Builder() : new Builder().mergeFrom(this);
+  }
+
+  @java.lang.Override
+  protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+    Builder builder = new Builder(parent);
+    return builder;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Request message for [KeyManagementService.GenerateRandomBytes][google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes].
+   * </pre>
+   *
+   * Protobuf type {@code google.cloud.kms.v1.GenerateRandomBytesRequest}
+   */
+  public static final class Builder extends com.google.protobuf.GeneratedMessageV3.Builder<Builder>
+      implements
+      // @@protoc_insertion_point(builder_implements:google.cloud.kms.v1.GenerateRandomBytesRequest)
+      com.google.cloud.kms.v1.GenerateRandomBytesRequestOrBuilder {
+    public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_GenerateRandomBytesRequest_descriptor;
+    }
+
+    @java.lang.Override
+    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_GenerateRandomBytesRequest_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              com.google.cloud.kms.v1.GenerateRandomBytesRequest.class,
+              com.google.cloud.kms.v1.GenerateRandomBytesRequest.Builder.class);
+    }
+
+    // Construct using com.google.cloud.kms.v1.GenerateRandomBytesRequest.newBuilder()
+    private Builder() {
+      maybeForceBuilderInitialization();
+    }
+
+    private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+      super(parent);
+      maybeForceBuilderInitialization();
+    }
+
+    private void maybeForceBuilderInitialization() {
+      if (com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders) {}
+    }
+
+    @java.lang.Override
+    public Builder clear() {
+      super.clear();
+      location_ = "";
+
+      lengthBytes_ = 0;
+
+      protectionLevel_ = 0;
+
+      return this;
+    }
+
+    @java.lang.Override
+    public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_GenerateRandomBytesRequest_descriptor;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.GenerateRandomBytesRequest getDefaultInstanceForType() {
+      return com.google.cloud.kms.v1.GenerateRandomBytesRequest.getDefaultInstance();
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.GenerateRandomBytesRequest build() {
+      com.google.cloud.kms.v1.GenerateRandomBytesRequest result = buildPartial();
+      if (!result.isInitialized()) {
+        throw newUninitializedMessageException(result);
+      }
+      return result;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.GenerateRandomBytesRequest buildPartial() {
+      com.google.cloud.kms.v1.GenerateRandomBytesRequest result =
+          new com.google.cloud.kms.v1.GenerateRandomBytesRequest(this);
+      result.location_ = location_;
+      result.lengthBytes_ = lengthBytes_;
+      result.protectionLevel_ = protectionLevel_;
+      onBuilt();
+      return result;
+    }
+
+    @java.lang.Override
+    public Builder clone() {
+      return super.clone();
+    }
+
+    @java.lang.Override
+    public Builder setField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.setField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
+      return super.clearField(field);
+    }
+
+    @java.lang.Override
+    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
+      return super.clearOneof(oneof);
+    }
+
+    @java.lang.Override
+    public Builder setRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
+      return super.setRepeatedField(field, index, value);
+    }
+
+    @java.lang.Override
+    public Builder addRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.addRepeatedField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(com.google.protobuf.Message other) {
+      if (other instanceof com.google.cloud.kms.v1.GenerateRandomBytesRequest) {
+        return mergeFrom((com.google.cloud.kms.v1.GenerateRandomBytesRequest) other);
+      } else {
+        super.mergeFrom(other);
+        return this;
+      }
+    }
+
+    public Builder mergeFrom(com.google.cloud.kms.v1.GenerateRandomBytesRequest other) {
+      if (other == com.google.cloud.kms.v1.GenerateRandomBytesRequest.getDefaultInstance())
+        return this;
+      if (!other.getLocation().isEmpty()) {
+        location_ = other.location_;
+        onChanged();
+      }
+      if (other.getLengthBytes() != 0) {
+        setLengthBytes(other.getLengthBytes());
+      }
+      if (other.protectionLevel_ != 0) {
+        setProtectionLevelValue(other.getProtectionLevelValue());
+      }
+      this.mergeUnknownFields(other.unknownFields);
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final boolean isInitialized() {
+      return true;
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      com.google.cloud.kms.v1.GenerateRandomBytesRequest parsedMessage = null;
+      try {
+        parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        parsedMessage =
+            (com.google.cloud.kms.v1.GenerateRandomBytesRequest) e.getUnfinishedMessage();
+        throw e.unwrapIOException();
+      } finally {
+        if (parsedMessage != null) {
+          mergeFrom(parsedMessage);
+        }
+      }
+      return this;
+    }
+
+    private java.lang.Object location_ = "";
+    /**
+     *
+     *
+     * <pre>
+     * The project-specific location in which to generate random bytes.
+     * For example, "projects/my-project/locations/us-central1".
+     * </pre>
+     *
+     * <code>string location = 1;</code>
+     *
+     * @return The location.
+     */
+    public java.lang.String getLocation() {
+      java.lang.Object ref = location_;
+      if (!(ref instanceof java.lang.String)) {
+        com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        location_ = s;
+        return s;
+      } else {
+        return (java.lang.String) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The project-specific location in which to generate random bytes.
+     * For example, "projects/my-project/locations/us-central1".
+     * </pre>
+     *
+     * <code>string location = 1;</code>
+     *
+     * @return The bytes for location.
+     */
+    public com.google.protobuf.ByteString getLocationBytes() {
+      java.lang.Object ref = location_;
+      if (ref instanceof String) {
+        com.google.protobuf.ByteString b =
+            com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+        location_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The project-specific location in which to generate random bytes.
+     * For example, "projects/my-project/locations/us-central1".
+     * </pre>
+     *
+     * <code>string location = 1;</code>
+     *
+     * @param value The location to set.
+     * @return This builder for chaining.
+     */
+    public Builder setLocation(java.lang.String value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      location_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The project-specific location in which to generate random bytes.
+     * For example, "projects/my-project/locations/us-central1".
+     * </pre>
+     *
+     * <code>string location = 1;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearLocation() {
+
+      location_ = getDefaultInstance().getLocation();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The project-specific location in which to generate random bytes.
+     * For example, "projects/my-project/locations/us-central1".
+     * </pre>
+     *
+     * <code>string location = 1;</code>
+     *
+     * @param value The bytes for location to set.
+     * @return This builder for chaining.
+     */
+    public Builder setLocationBytes(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+      checkByteStringIsUtf8(value);
+
+      location_ = value;
+      onChanged();
+      return this;
+    }
+
+    private int lengthBytes_;
+    /**
+     *
+     *
+     * <pre>
+     * The length in bytes of the amount of randomness to retrieve.  Minimum 8
+     * bytes, maximum 1024 bytes.
+     * </pre>
+     *
+     * <code>int32 length_bytes = 2;</code>
+     *
+     * @return The lengthBytes.
+     */
+    @java.lang.Override
+    public int getLengthBytes() {
+      return lengthBytes_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The length in bytes of the amount of randomness to retrieve.  Minimum 8
+     * bytes, maximum 1024 bytes.
+     * </pre>
+     *
+     * <code>int32 length_bytes = 2;</code>
+     *
+     * @param value The lengthBytes to set.
+     * @return This builder for chaining.
+     */
+    public Builder setLengthBytes(int value) {
+
+      lengthBytes_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The length in bytes of the amount of randomness to retrieve.  Minimum 8
+     * bytes, maximum 1024 bytes.
+     * </pre>
+     *
+     * <code>int32 length_bytes = 2;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearLengthBytes() {
+
+      lengthBytes_ = 0;
+      onChanged();
+      return this;
+    }
+
+    private int protectionLevel_ = 0;
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Defaults to
+     * [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 3;</code>
+     *
+     * @return The enum numeric value on the wire for protectionLevel.
+     */
+    @java.lang.Override
+    public int getProtectionLevelValue() {
+      return protectionLevel_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Defaults to
+     * [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 3;</code>
+     *
+     * @param value The enum numeric value on the wire for protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevelValue(int value) {
+
+      protectionLevel_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Defaults to
+     * [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 3;</code>
+     *
+     * @return The protectionLevel.
+     */
+    @java.lang.Override
+    public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+      @SuppressWarnings("deprecation")
+      com.google.cloud.kms.v1.ProtectionLevel result =
+          com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+      return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Defaults to
+     * [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 3;</code>
+     *
+     * @param value The protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevel(com.google.cloud.kms.v1.ProtectionLevel value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      protectionLevel_ = value.getNumber();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Defaults to
+     * [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 3;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearProtectionLevel() {
+
+      protectionLevel_ = 0;
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.setUnknownFields(unknownFields);
+    }
+
+    @java.lang.Override
+    public final Builder mergeUnknownFields(
+        final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.mergeUnknownFields(unknownFields);
+    }
+
+    // @@protoc_insertion_point(builder_scope:google.cloud.kms.v1.GenerateRandomBytesRequest)
+  }
+
+  // @@protoc_insertion_point(class_scope:google.cloud.kms.v1.GenerateRandomBytesRequest)
+  private static final com.google.cloud.kms.v1.GenerateRandomBytesRequest DEFAULT_INSTANCE;
+
+  static {
+    DEFAULT_INSTANCE = new com.google.cloud.kms.v1.GenerateRandomBytesRequest();
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesRequest getDefaultInstance() {
+    return DEFAULT_INSTANCE;
+  }
+
+  private static final com.google.protobuf.Parser<GenerateRandomBytesRequest> PARSER =
+      new com.google.protobuf.AbstractParser<GenerateRandomBytesRequest>() {
+        @java.lang.Override
+        public GenerateRandomBytesRequest parsePartialFrom(
+            com.google.protobuf.CodedInputStream input,
+            com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+            throws com.google.protobuf.InvalidProtocolBufferException {
+          return new GenerateRandomBytesRequest(input, extensionRegistry);
+        }
+      };
+
+  public static com.google.protobuf.Parser<GenerateRandomBytesRequest> parser() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.protobuf.Parser<GenerateRandomBytesRequest> getParserForType() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.cloud.kms.v1.GenerateRandomBytesRequest getDefaultInstanceForType() {
+    return DEFAULT_INSTANCE;
+  }
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesRequestOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesRequestOrBuilder.java
new file mode 100644
index 00000000..ebd72ff8
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesRequestOrBuilder.java
@@ -0,0 +1,93 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+public interface GenerateRandomBytesRequestOrBuilder
+    extends
+    // @@protoc_insertion_point(interface_extends:google.cloud.kms.v1.GenerateRandomBytesRequest)
+    com.google.protobuf.MessageOrBuilder {
+
+  /**
+   *
+   *
+   * <pre>
+   * The project-specific location in which to generate random bytes.
+   * For example, "projects/my-project/locations/us-central1".
+   * </pre>
+   *
+   * <code>string location = 1;</code>
+   *
+   * @return The location.
+   */
+  java.lang.String getLocation();
+  /**
+   *
+   *
+   * <pre>
+   * The project-specific location in which to generate random bytes.
+   * For example, "projects/my-project/locations/us-central1".
+   * </pre>
+   *
+   * <code>string location = 1;</code>
+   *
+   * @return The bytes for location.
+   */
+  com.google.protobuf.ByteString getLocationBytes();
+
+  /**
+   *
+   *
+   * <pre>
+   * The length in bytes of the amount of randomness to retrieve.  Minimum 8
+   * bytes, maximum 1024 bytes.
+   * </pre>
+   *
+   * <code>int32 length_bytes = 2;</code>
+   *
+   * @return The lengthBytes.
+   */
+  int getLengthBytes();
+
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Defaults to
+   * [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 3;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  int getProtectionLevelValue();
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Defaults to
+   * [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 3;</code>
+   *
+   * @return The protectionLevel.
+   */
+  com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel();
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesResponse.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesResponse.java
new file mode 100644
index 00000000..94788fd0
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesResponse.java
@@ -0,0 +1,945 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+/**
+ *
+ *
+ * <pre>
+ * Response message for [KeyManagementService.GenerateRandomBytes][google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes].
+ * </pre>
+ *
+ * Protobuf type {@code google.cloud.kms.v1.GenerateRandomBytesResponse}
+ */
+public final class GenerateRandomBytesResponse extends com.google.protobuf.GeneratedMessageV3
+    implements
+    // @@protoc_insertion_point(message_implements:google.cloud.kms.v1.GenerateRandomBytesResponse)
+    GenerateRandomBytesResponseOrBuilder {
+  private static final long serialVersionUID = 0L;
+  // Use GenerateRandomBytesResponse.newBuilder() to construct.
+  private GenerateRandomBytesResponse(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+    super(builder);
+  }
+
+  private GenerateRandomBytesResponse() {
+    data_ = com.google.protobuf.ByteString.EMPTY;
+  }
+
+  @java.lang.Override
+  @SuppressWarnings({"unused"})
+  protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
+    return new GenerateRandomBytesResponse();
+  }
+
+  @java.lang.Override
+  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
+    return this.unknownFields;
+  }
+
+  private GenerateRandomBytesResponse(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    this();
+    if (extensionRegistry == null) {
+      throw new java.lang.NullPointerException();
+    }
+    com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+        com.google.protobuf.UnknownFieldSet.newBuilder();
+    try {
+      boolean done = false;
+      while (!done) {
+        int tag = input.readTag();
+        switch (tag) {
+          case 0:
+            done = true;
+            break;
+          case 10:
+            {
+              data_ = input.readBytes();
+              break;
+            }
+          case 26:
+            {
+              com.google.protobuf.Int64Value.Builder subBuilder = null;
+              if (dataCrc32C_ != null) {
+                subBuilder = dataCrc32C_.toBuilder();
+              }
+              dataCrc32C_ =
+                  input.readMessage(com.google.protobuf.Int64Value.parser(), extensionRegistry);
+              if (subBuilder != null) {
+                subBuilder.mergeFrom(dataCrc32C_);
+                dataCrc32C_ = subBuilder.buildPartial();
+              }
+
+              break;
+            }
+          default:
+            {
+              if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
+                done = true;
+              }
+              break;
+            }
+        }
+      }
+    } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+      throw e.setUnfinishedMessage(this);
+    } catch (java.io.IOException e) {
+      throw new com.google.protobuf.InvalidProtocolBufferException(e).setUnfinishedMessage(this);
+    } finally {
+      this.unknownFields = unknownFields.build();
+      makeExtensionsImmutable();
+    }
+  }
+
+  public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_GenerateRandomBytesResponse_descriptor;
+  }
+
+  @java.lang.Override
+  protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internalGetFieldAccessorTable() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_GenerateRandomBytesResponse_fieldAccessorTable
+        .ensureFieldAccessorsInitialized(
+            com.google.cloud.kms.v1.GenerateRandomBytesResponse.class,
+            com.google.cloud.kms.v1.GenerateRandomBytesResponse.Builder.class);
+  }
+
+  public static final int DATA_FIELD_NUMBER = 1;
+  private com.google.protobuf.ByteString data_;
+  /**
+   *
+   *
+   * <pre>
+   * The generated data.
+   * </pre>
+   *
+   * <code>bytes data = 1;</code>
+   *
+   * @return The data.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getData() {
+    return data_;
+  }
+
+  public static final int DATA_CRC32C_FIELD_NUMBER = 3;
+  private com.google.protobuf.Int64Value dataCrc32C_;
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+   * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+   *
+   * @return Whether the dataCrc32c field is set.
+   */
+  @java.lang.Override
+  public boolean hasDataCrc32C() {
+    return dataCrc32C_ != null;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+   * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+   *
+   * @return The dataCrc32c.
+   */
+  @java.lang.Override
+  public com.google.protobuf.Int64Value getDataCrc32C() {
+    return dataCrc32C_ == null ? com.google.protobuf.Int64Value.getDefaultInstance() : dataCrc32C_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+   * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+   */
+  @java.lang.Override
+  public com.google.protobuf.Int64ValueOrBuilder getDataCrc32COrBuilder() {
+    return getDataCrc32C();
+  }
+
+  private byte memoizedIsInitialized = -1;
+
+  @java.lang.Override
+  public final boolean isInitialized() {
+    byte isInitialized = memoizedIsInitialized;
+    if (isInitialized == 1) return true;
+    if (isInitialized == 0) return false;
+
+    memoizedIsInitialized = 1;
+    return true;
+  }
+
+  @java.lang.Override
+  public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io.IOException {
+    if (!data_.isEmpty()) {
+      output.writeBytes(1, data_);
+    }
+    if (dataCrc32C_ != null) {
+      output.writeMessage(3, getDataCrc32C());
+    }
+    unknownFields.writeTo(output);
+  }
+
+  @java.lang.Override
+  public int getSerializedSize() {
+    int size = memoizedSize;
+    if (size != -1) return size;
+
+    size = 0;
+    if (!data_.isEmpty()) {
+      size += com.google.protobuf.CodedOutputStream.computeBytesSize(1, data_);
+    }
+    if (dataCrc32C_ != null) {
+      size += com.google.protobuf.CodedOutputStream.computeMessageSize(3, getDataCrc32C());
+    }
+    size += unknownFields.getSerializedSize();
+    memoizedSize = size;
+    return size;
+  }
+
+  @java.lang.Override
+  public boolean equals(final java.lang.Object obj) {
+    if (obj == this) {
+      return true;
+    }
+    if (!(obj instanceof com.google.cloud.kms.v1.GenerateRandomBytesResponse)) {
+      return super.equals(obj);
+    }
+    com.google.cloud.kms.v1.GenerateRandomBytesResponse other =
+        (com.google.cloud.kms.v1.GenerateRandomBytesResponse) obj;
+
+    if (!getData().equals(other.getData())) return false;
+    if (hasDataCrc32C() != other.hasDataCrc32C()) return false;
+    if (hasDataCrc32C()) {
+      if (!getDataCrc32C().equals(other.getDataCrc32C())) return false;
+    }
+    if (!unknownFields.equals(other.unknownFields)) return false;
+    return true;
+  }
+
+  @java.lang.Override
+  public int hashCode() {
+    if (memoizedHashCode != 0) {
+      return memoizedHashCode;
+    }
+    int hash = 41;
+    hash = (19 * hash) + getDescriptor().hashCode();
+    hash = (37 * hash) + DATA_FIELD_NUMBER;
+    hash = (53 * hash) + getData().hashCode();
+    if (hasDataCrc32C()) {
+      hash = (37 * hash) + DATA_CRC32C_FIELD_NUMBER;
+      hash = (53 * hash) + getDataCrc32C().hashCode();
+    }
+    hash = (29 * hash) + unknownFields.hashCode();
+    memoizedHashCode = hash;
+    return hash;
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseFrom(
+      java.nio.ByteBuffer data) throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseFrom(
+      java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseFrom(
+      com.google.protobuf.ByteString data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseFrom(
+      com.google.protobuf.ByteString data,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseFrom(byte[] data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseFrom(
+      byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseDelimitedFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseDelimitedFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseFrom(
+      com.google.protobuf.CodedInputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse parseFrom(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  @java.lang.Override
+  public Builder newBuilderForType() {
+    return newBuilder();
+  }
+
+  public static Builder newBuilder() {
+    return DEFAULT_INSTANCE.toBuilder();
+  }
+
+  public static Builder newBuilder(com.google.cloud.kms.v1.GenerateRandomBytesResponse prototype) {
+    return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
+  }
+
+  @java.lang.Override
+  public Builder toBuilder() {
+    return this == DEFAULT_INSTANCE ? new Builder() : new Builder().mergeFrom(this);
+  }
+
+  @java.lang.Override
+  protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+    Builder builder = new Builder(parent);
+    return builder;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Response message for [KeyManagementService.GenerateRandomBytes][google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes].
+   * </pre>
+   *
+   * Protobuf type {@code google.cloud.kms.v1.GenerateRandomBytesResponse}
+   */
+  public static final class Builder extends com.google.protobuf.GeneratedMessageV3.Builder<Builder>
+      implements
+      // @@protoc_insertion_point(builder_implements:google.cloud.kms.v1.GenerateRandomBytesResponse)
+      com.google.cloud.kms.v1.GenerateRandomBytesResponseOrBuilder {
+    public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_GenerateRandomBytesResponse_descriptor;
+    }
+
+    @java.lang.Override
+    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_GenerateRandomBytesResponse_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              com.google.cloud.kms.v1.GenerateRandomBytesResponse.class,
+              com.google.cloud.kms.v1.GenerateRandomBytesResponse.Builder.class);
+    }
+
+    // Construct using com.google.cloud.kms.v1.GenerateRandomBytesResponse.newBuilder()
+    private Builder() {
+      maybeForceBuilderInitialization();
+    }
+
+    private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+      super(parent);
+      maybeForceBuilderInitialization();
+    }
+
+    private void maybeForceBuilderInitialization() {
+      if (com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders) {}
+    }
+
+    @java.lang.Override
+    public Builder clear() {
+      super.clear();
+      data_ = com.google.protobuf.ByteString.EMPTY;
+
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32C_ = null;
+      } else {
+        dataCrc32C_ = null;
+        dataCrc32CBuilder_ = null;
+      }
+      return this;
+    }
+
+    @java.lang.Override
+    public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_GenerateRandomBytesResponse_descriptor;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.GenerateRandomBytesResponse getDefaultInstanceForType() {
+      return com.google.cloud.kms.v1.GenerateRandomBytesResponse.getDefaultInstance();
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.GenerateRandomBytesResponse build() {
+      com.google.cloud.kms.v1.GenerateRandomBytesResponse result = buildPartial();
+      if (!result.isInitialized()) {
+        throw newUninitializedMessageException(result);
+      }
+      return result;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.GenerateRandomBytesResponse buildPartial() {
+      com.google.cloud.kms.v1.GenerateRandomBytesResponse result =
+          new com.google.cloud.kms.v1.GenerateRandomBytesResponse(this);
+      result.data_ = data_;
+      if (dataCrc32CBuilder_ == null) {
+        result.dataCrc32C_ = dataCrc32C_;
+      } else {
+        result.dataCrc32C_ = dataCrc32CBuilder_.build();
+      }
+      onBuilt();
+      return result;
+    }
+
+    @java.lang.Override
+    public Builder clone() {
+      return super.clone();
+    }
+
+    @java.lang.Override
+    public Builder setField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.setField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
+      return super.clearField(field);
+    }
+
+    @java.lang.Override
+    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
+      return super.clearOneof(oneof);
+    }
+
+    @java.lang.Override
+    public Builder setRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
+      return super.setRepeatedField(field, index, value);
+    }
+
+    @java.lang.Override
+    public Builder addRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.addRepeatedField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(com.google.protobuf.Message other) {
+      if (other instanceof com.google.cloud.kms.v1.GenerateRandomBytesResponse) {
+        return mergeFrom((com.google.cloud.kms.v1.GenerateRandomBytesResponse) other);
+      } else {
+        super.mergeFrom(other);
+        return this;
+      }
+    }
+
+    public Builder mergeFrom(com.google.cloud.kms.v1.GenerateRandomBytesResponse other) {
+      if (other == com.google.cloud.kms.v1.GenerateRandomBytesResponse.getDefaultInstance())
+        return this;
+      if (other.getData() != com.google.protobuf.ByteString.EMPTY) {
+        setData(other.getData());
+      }
+      if (other.hasDataCrc32C()) {
+        mergeDataCrc32C(other.getDataCrc32C());
+      }
+      this.mergeUnknownFields(other.unknownFields);
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final boolean isInitialized() {
+      return true;
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      com.google.cloud.kms.v1.GenerateRandomBytesResponse parsedMessage = null;
+      try {
+        parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        parsedMessage =
+            (com.google.cloud.kms.v1.GenerateRandomBytesResponse) e.getUnfinishedMessage();
+        throw e.unwrapIOException();
+      } finally {
+        if (parsedMessage != null) {
+          mergeFrom(parsedMessage);
+        }
+      }
+      return this;
+    }
+
+    private com.google.protobuf.ByteString data_ = com.google.protobuf.ByteString.EMPTY;
+    /**
+     *
+     *
+     * <pre>
+     * The generated data.
+     * </pre>
+     *
+     * <code>bytes data = 1;</code>
+     *
+     * @return The data.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString getData() {
+      return data_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The generated data.
+     * </pre>
+     *
+     * <code>bytes data = 1;</code>
+     *
+     * @param value The data to set.
+     * @return This builder for chaining.
+     */
+    public Builder setData(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      data_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The generated data.
+     * </pre>
+     *
+     * <code>bytes data = 1;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearData() {
+
+      data_ = getDefaultInstance().getData();
+      onChanged();
+      return this;
+    }
+
+    private com.google.protobuf.Int64Value dataCrc32C_;
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Int64Value,
+            com.google.protobuf.Int64Value.Builder,
+            com.google.protobuf.Int64ValueOrBuilder>
+        dataCrc32CBuilder_;
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+     * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+     *
+     * @return Whether the dataCrc32c field is set.
+     */
+    public boolean hasDataCrc32C() {
+      return dataCrc32CBuilder_ != null || dataCrc32C_ != null;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+     * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+     *
+     * @return The dataCrc32c.
+     */
+    public com.google.protobuf.Int64Value getDataCrc32C() {
+      if (dataCrc32CBuilder_ == null) {
+        return dataCrc32C_ == null
+            ? com.google.protobuf.Int64Value.getDefaultInstance()
+            : dataCrc32C_;
+      } else {
+        return dataCrc32CBuilder_.getMessage();
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+     * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+     */
+    public Builder setDataCrc32C(com.google.protobuf.Int64Value value) {
+      if (dataCrc32CBuilder_ == null) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+        dataCrc32C_ = value;
+        onChanged();
+      } else {
+        dataCrc32CBuilder_.setMessage(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+     * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+     */
+    public Builder setDataCrc32C(com.google.protobuf.Int64Value.Builder builderForValue) {
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32C_ = builderForValue.build();
+        onChanged();
+      } else {
+        dataCrc32CBuilder_.setMessage(builderForValue.build());
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+     * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+     */
+    public Builder mergeDataCrc32C(com.google.protobuf.Int64Value value) {
+      if (dataCrc32CBuilder_ == null) {
+        if (dataCrc32C_ != null) {
+          dataCrc32C_ =
+              com.google.protobuf.Int64Value.newBuilder(dataCrc32C_)
+                  .mergeFrom(value)
+                  .buildPartial();
+        } else {
+          dataCrc32C_ = value;
+        }
+        onChanged();
+      } else {
+        dataCrc32CBuilder_.mergeFrom(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+     * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+     */
+    public Builder clearDataCrc32C() {
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32C_ = null;
+        onChanged();
+      } else {
+        dataCrc32C_ = null;
+        dataCrc32CBuilder_ = null;
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+     * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+     */
+    public com.google.protobuf.Int64Value.Builder getDataCrc32CBuilder() {
+
+      onChanged();
+      return getDataCrc32CFieldBuilder().getBuilder();
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+     * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+     */
+    public com.google.protobuf.Int64ValueOrBuilder getDataCrc32COrBuilder() {
+      if (dataCrc32CBuilder_ != null) {
+        return dataCrc32CBuilder_.getMessageOrBuilder();
+      } else {
+        return dataCrc32C_ == null
+            ? com.google.protobuf.Int64Value.getDefaultInstance()
+            : dataCrc32C_;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+     * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+     * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+     */
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Int64Value,
+            com.google.protobuf.Int64Value.Builder,
+            com.google.protobuf.Int64ValueOrBuilder>
+        getDataCrc32CFieldBuilder() {
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32CBuilder_ =
+            new com.google.protobuf.SingleFieldBuilderV3<
+                com.google.protobuf.Int64Value,
+                com.google.protobuf.Int64Value.Builder,
+                com.google.protobuf.Int64ValueOrBuilder>(
+                getDataCrc32C(), getParentForChildren(), isClean());
+        dataCrc32C_ = null;
+      }
+      return dataCrc32CBuilder_;
+    }
+
+    @java.lang.Override
+    public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.setUnknownFields(unknownFields);
+    }
+
+    @java.lang.Override
+    public final Builder mergeUnknownFields(
+        final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.mergeUnknownFields(unknownFields);
+    }
+
+    // @@protoc_insertion_point(builder_scope:google.cloud.kms.v1.GenerateRandomBytesResponse)
+  }
+
+  // @@protoc_insertion_point(class_scope:google.cloud.kms.v1.GenerateRandomBytesResponse)
+  private static final com.google.cloud.kms.v1.GenerateRandomBytesResponse DEFAULT_INSTANCE;
+
+  static {
+    DEFAULT_INSTANCE = new com.google.cloud.kms.v1.GenerateRandomBytesResponse();
+  }
+
+  public static com.google.cloud.kms.v1.GenerateRandomBytesResponse getDefaultInstance() {
+    return DEFAULT_INSTANCE;
+  }
+
+  private static final com.google.protobuf.Parser<GenerateRandomBytesResponse> PARSER =
+      new com.google.protobuf.AbstractParser<GenerateRandomBytesResponse>() {
+        @java.lang.Override
+        public GenerateRandomBytesResponse parsePartialFrom(
+            com.google.protobuf.CodedInputStream input,
+            com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+            throws com.google.protobuf.InvalidProtocolBufferException {
+          return new GenerateRandomBytesResponse(input, extensionRegistry);
+        }
+      };
+
+  public static com.google.protobuf.Parser<GenerateRandomBytesResponse> parser() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.protobuf.Parser<GenerateRandomBytesResponse> getParserForType() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.cloud.kms.v1.GenerateRandomBytesResponse getDefaultInstanceForType() {
+    return DEFAULT_INSTANCE;
+  }
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesResponseOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesResponseOrBuilder.java
new file mode 100644
index 00000000..6456d094
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesResponseOrBuilder.java
@@ -0,0 +1,103 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+public interface GenerateRandomBytesResponseOrBuilder
+    extends
+    // @@protoc_insertion_point(interface_extends:google.cloud.kms.v1.GenerateRandomBytesResponse)
+    com.google.protobuf.MessageOrBuilder {
+
+  /**
+   *
+   *
+   * <pre>
+   * The generated data.
+   * </pre>
+   *
+   * <code>bytes data = 1;</code>
+   *
+   * @return The data.
+   */
+  com.google.protobuf.ByteString getData();
+
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+   * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+   *
+   * @return Whether the dataCrc32c field is set.
+   */
+  boolean hasDataCrc32C();
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+   * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+   *
+   * @return The dataCrc32c.
+   */
+  com.google.protobuf.Int64Value getDataCrc32C();
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+   * [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+   * CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3;</code>
+   */
+  com.google.protobuf.Int64ValueOrBuilder getDataCrc32COrBuilder();
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KmsProto.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KmsProto.java
index c5e62001..3d204064 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KmsProto.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KmsProto.java
@@ -107,6 +107,18 @@ public static void registerAllExtensions(com.google.protobuf.ExtensionRegistry r
       internal_static_google_cloud_kms_v1_UpdateCryptoKeyVersionRequest_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internal_static_google_cloud_kms_v1_UpdateCryptoKeyVersionRequest_fieldAccessorTable;
+  static final com.google.protobuf.Descriptors.Descriptor
+      internal_static_google_cloud_kms_v1_UpdateCryptoKeyPrimaryVersionRequest_descriptor;
+  static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internal_static_google_cloud_kms_v1_UpdateCryptoKeyPrimaryVersionRequest_fieldAccessorTable;
+  static final com.google.protobuf.Descriptors.Descriptor
+      internal_static_google_cloud_kms_v1_DestroyCryptoKeyVersionRequest_descriptor;
+  static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internal_static_google_cloud_kms_v1_DestroyCryptoKeyVersionRequest_fieldAccessorTable;
+  static final com.google.protobuf.Descriptors.Descriptor
+      internal_static_google_cloud_kms_v1_RestoreCryptoKeyVersionRequest_descriptor;
+  static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internal_static_google_cloud_kms_v1_RestoreCryptoKeyVersionRequest_fieldAccessorTable;
   static final com.google.protobuf.Descriptors.Descriptor
       internal_static_google_cloud_kms_v1_EncryptRequest_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
@@ -124,13 +136,25 @@ public static void registerAllExtensions(com.google.protobuf.ExtensionRegistry r
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internal_static_google_cloud_kms_v1_AsymmetricDecryptRequest_fieldAccessorTable;
   static final com.google.protobuf.Descriptors.Descriptor
-      internal_static_google_cloud_kms_v1_DecryptResponse_descriptor;
+      internal_static_google_cloud_kms_v1_MacSignRequest_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
-      internal_static_google_cloud_kms_v1_DecryptResponse_fieldAccessorTable;
+      internal_static_google_cloud_kms_v1_MacSignRequest_fieldAccessorTable;
+  static final com.google.protobuf.Descriptors.Descriptor
+      internal_static_google_cloud_kms_v1_MacVerifyRequest_descriptor;
+  static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internal_static_google_cloud_kms_v1_MacVerifyRequest_fieldAccessorTable;
+  static final com.google.protobuf.Descriptors.Descriptor
+      internal_static_google_cloud_kms_v1_GenerateRandomBytesRequest_descriptor;
+  static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internal_static_google_cloud_kms_v1_GenerateRandomBytesRequest_fieldAccessorTable;
   static final com.google.protobuf.Descriptors.Descriptor
       internal_static_google_cloud_kms_v1_EncryptResponse_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internal_static_google_cloud_kms_v1_EncryptResponse_fieldAccessorTable;
+  static final com.google.protobuf.Descriptors.Descriptor
+      internal_static_google_cloud_kms_v1_DecryptResponse_descriptor;
+  static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internal_static_google_cloud_kms_v1_DecryptResponse_fieldAccessorTable;
   static final com.google.protobuf.Descriptors.Descriptor
       internal_static_google_cloud_kms_v1_AsymmetricSignResponse_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
@@ -140,17 +164,17 @@ public static void registerAllExtensions(com.google.protobuf.ExtensionRegistry r
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internal_static_google_cloud_kms_v1_AsymmetricDecryptResponse_fieldAccessorTable;
   static final com.google.protobuf.Descriptors.Descriptor
-      internal_static_google_cloud_kms_v1_UpdateCryptoKeyPrimaryVersionRequest_descriptor;
+      internal_static_google_cloud_kms_v1_MacSignResponse_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
-      internal_static_google_cloud_kms_v1_UpdateCryptoKeyPrimaryVersionRequest_fieldAccessorTable;
+      internal_static_google_cloud_kms_v1_MacSignResponse_fieldAccessorTable;
   static final com.google.protobuf.Descriptors.Descriptor
-      internal_static_google_cloud_kms_v1_DestroyCryptoKeyVersionRequest_descriptor;
+      internal_static_google_cloud_kms_v1_MacVerifyResponse_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
-      internal_static_google_cloud_kms_v1_DestroyCryptoKeyVersionRequest_fieldAccessorTable;
+      internal_static_google_cloud_kms_v1_MacVerifyResponse_fieldAccessorTable;
   static final com.google.protobuf.Descriptors.Descriptor
-      internal_static_google_cloud_kms_v1_RestoreCryptoKeyVersionRequest_descriptor;
+      internal_static_google_cloud_kms_v1_GenerateRandomBytesResponse_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
-      internal_static_google_cloud_kms_v1_RestoreCryptoKeyVersionRequest_fieldAccessorTable;
+      internal_static_google_cloud_kms_v1_GenerateRandomBytesResponse_fieldAccessorTable;
   static final com.google.protobuf.Descriptors.Descriptor
       internal_static_google_cloud_kms_v1_Digest_descriptor;
   static final com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
@@ -251,182 +275,230 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "rsionRequest\022F\n\022crypto_key_version\030\001 \001(\013"
           + "2%.google.cloud.kms.v1.CryptoKeyVersionB"
           + "\003\340A\002\0224\n\013update_mask\030\002 \001(\0132\032.google.proto"
-          + "buf.FieldMaskB\003\340A\002\"\371\001\n\016EncryptRequest\022\027\n"
-          + "\004name\030\001 \001(\tB\t\340A\002\372A\003\n\001*\022\026\n\tplaintext\030\002 \001("
-          + "\014B\003\340A\002\022*\n\035additional_authenticated_data\030"
-          + "\003 \001(\014B\003\340A\001\022:\n\020plaintext_crc32c\030\007 \001(\0132\033.g"
-          + "oogle.protobuf.Int64ValueB\003\340A\001\022N\n$additi"
-          + "onal_authenticated_data_crc32c\030\010 \001(\0132\033.g"
-          + "oogle.protobuf.Int64ValueB\003\340A\001\"\233\002\n\016Decry"
-          + "ptRequest\0227\n\004name\030\001 \001(\tB)\340A\002\372A#\n!cloudkm"
-          + "s.googleapis.com/CryptoKey\022\027\n\nciphertext"
-          + "\030\002 \001(\014B\003\340A\002\022*\n\035additional_authenticated_"
-          + "data\030\003 \001(\014B\003\340A\001\022;\n\021ciphertext_crc32c\030\005 \001"
-          + "(\0132\033.google.protobuf.Int64ValueB\003\340A\001\022N\n$"
-          + "additional_authenticated_data_crc32c\030\006 \001"
-          + "(\0132\033.google.protobuf.Int64ValueB\003\340A\001\"\302\001\n"
-          + "\025AsymmetricSignRequest\022>\n\004name\030\001 \001(\tB0\340A"
-          + "\002\372A*\n(cloudkms.googleapis.com/CryptoKeyV"
-          + "ersion\0220\n\006digest\030\003 \001(\0132\033.google.cloud.km"
-          + "s.v1.DigestB\003\340A\002\0227\n\rdigest_crc32c\030\004 \001(\0132"
-          + "\033.google.protobuf.Int64ValueB\003\340A\001\"\260\001\n\030As"
-          + "ymmetricDecryptRequest\022>\n\004name\030\001 \001(\tB0\340A"
-          + "\002\372A*\n(cloudkms.googleapis.com/CryptoKeyV"
-          + "ersion\022\027\n\nciphertext\030\003 \001(\014B\003\340A\002\022;\n\021ciphe"
-          + "rtext_crc32c\030\004 \001(\0132\033.google.protobuf.Int"
-          + "64ValueB\003\340A\001\"[\n\017DecryptResponse\022\021\n\tplain"
-          + "text\030\001 \001(\014\0225\n\020plaintext_crc32c\030\002 \001(\0132\033.g"
-          + "oogle.protobuf.Int64Value\"\305\001\n\017EncryptRes"
+          + "buf.FieldMaskB\003\340A\002\"\203\001\n$UpdateCryptoKeyPr"
+          + "imaryVersionRequest\0227\n\004name\030\001 \001(\tB)\340A\002\372A"
+          + "#\n!cloudkms.googleapis.com/CryptoKey\022\"\n\025"
+          + "crypto_key_version_id\030\002 \001(\tB\003\340A\002\"`\n\036Dest"
+          + "royCryptoKeyVersionRequest\022>\n\004name\030\001 \001(\t"
+          + "B0\340A\002\372A*\n(cloudkms.googleapis.com/Crypto"
+          + "KeyVersion\"`\n\036RestoreCryptoKeyVersionReq"
+          + "uest\022>\n\004name\030\001 \001(\tB0\340A\002\372A*\n(cloudkms.goo"
+          + "gleapis.com/CryptoKeyVersion\"\371\001\n\016Encrypt"
+          + "Request\022\027\n\004name\030\001 \001(\tB\t\340A\002\372A\003\n\001*\022\026\n\tplai"
+          + "ntext\030\002 \001(\014B\003\340A\002\022*\n\035additional_authentic"
+          + "ated_data\030\003 \001(\014B\003\340A\001\022:\n\020plaintext_crc32c"
+          + "\030\007 \001(\0132\033.google.protobuf.Int64ValueB\003\340A\001"
+          + "\022N\n$additional_authenticated_data_crc32c"
+          + "\030\010 \001(\0132\033.google.protobuf.Int64ValueB\003\340A\001"
+          + "\"\233\002\n\016DecryptRequest\0227\n\004name\030\001 \001(\tB)\340A\002\372A"
+          + "#\n!cloudkms.googleapis.com/CryptoKey\022\027\n\n"
+          + "ciphertext\030\002 \001(\014B\003\340A\002\022*\n\035additional_auth"
+          + "enticated_data\030\003 \001(\014B\003\340A\001\022;\n\021ciphertext_"
+          + "crc32c\030\005 \001(\0132\033.google.protobuf.Int64Valu"
+          + "eB\003\340A\001\022N\n$additional_authenticated_data_"
+          + "crc32c\030\006 \001(\0132\033.google.protobuf.Int64Valu"
+          + "eB\003\340A\001\"\302\001\n\025AsymmetricSignRequest\022>\n\004name"
+          + "\030\001 \001(\tB0\340A\002\372A*\n(cloudkms.googleapis.com/"
+          + "CryptoKeyVersion\0220\n\006digest\030\003 \001(\0132\033.googl"
+          + "e.cloud.kms.v1.DigestB\003\340A\002\0227\n\rdigest_crc"
+          + "32c\030\004 \001(\0132\033.google.protobuf.Int64ValueB\003"
+          + "\340A\001\"\260\001\n\030AsymmetricDecryptRequest\022>\n\004name"
+          + "\030\001 \001(\tB0\340A\002\372A*\n(cloudkms.googleapis.com/"
+          + "CryptoKeyVersion\022\027\n\nciphertext\030\003 \001(\014B\003\340A"
+          + "\002\022;\n\021ciphertext_crc32c\030\004 \001(\0132\033.google.pr"
+          + "otobuf.Int64ValueB\003\340A\001\"\232\001\n\016MacSignReques"
+          + "t\022>\n\004name\030\001 \001(\tB0\340A\002\372A*\n(cloudkms.google"
+          + "apis.com/CryptoKeyVersion\022\021\n\004data\030\002 \001(\014B"
+          + "\003\340A\002\0225\n\013data_crc32c\030\003 \001(\0132\033.google.proto"
+          + "buf.Int64ValueB\003\340A\001\"\344\001\n\020MacVerifyRequest"
+          + "\022>\n\004name\030\001 \001(\tB0\340A\002\372A*\n(cloudkms.googlea"
+          + "pis.com/CryptoKeyVersion\022\021\n\004data\030\002 \001(\014B\003"
+          + "\340A\002\0225\n\013data_crc32c\030\003 \001(\0132\033.google.protob"
+          + "uf.Int64ValueB\003\340A\001\022\020\n\003mac\030\004 \001(\014B\003\340A\002\0224\n\n"
+          + "mac_crc32c\030\005 \001(\0132\033.google.protobuf.Int64"
+          + "ValueB\003\340A\001\"\204\001\n\032GenerateRandomBytesReques"
+          + "t\022\020\n\010location\030\001 \001(\t\022\024\n\014length_bytes\030\002 \001("
+          + "\005\022>\n\020protection_level\030\003 \001(\0162$.google.clo"
+          + "ud.kms.v1.ProtectionLevel\"\205\002\n\017EncryptRes"
           + "ponse\022\014\n\004name\030\001 \001(\t\022\022\n\nciphertext\030\002 \001(\014\022"
           + "6\n\021ciphertext_crc32c\030\004 \001(\0132\033.google.prot"
           + "obuf.Int64Value\022!\n\031verified_plaintext_cr"
           + "c32c\030\005 \001(\010\0225\n-verified_additional_authen"
-          + "ticated_data_crc32c\030\006 \001(\010\"\220\001\n\026Asymmetric"
-          + "SignResponse\022\021\n\tsignature\030\001 \001(\014\0225\n\020signa"
-          + "ture_crc32c\030\002 \001(\0132\033.google.protobuf.Int6"
-          + "4Value\022\036\n\026verified_digest_crc32c\030\003 \001(\010\022\014"
-          + "\n\004name\030\004 \001(\t\"\211\001\n\031AsymmetricDecryptRespon"
-          + "se\022\021\n\tplaintext\030\001 \001(\014\0225\n\020plaintext_crc32"
-          + "c\030\002 \001(\0132\033.google.protobuf.Int64Value\022\"\n\032"
-          + "verified_ciphertext_crc32c\030\003 \001(\010\"\203\001\n$Upd"
-          + "ateCryptoKeyPrimaryVersionRequest\0227\n\004nam"
-          + "e\030\001 \001(\tB)\340A\002\372A#\n!cloudkms.googleapis.com"
-          + "/CryptoKey\022\"\n\025crypto_key_version_id\030\002 \001("
-          + "\tB\003\340A\002\"`\n\036DestroyCryptoKeyVersionRequest"
-          + "\022>\n\004name\030\001 \001(\tB0\340A\002\372A*\n(cloudkms.googlea"
-          + "pis.com/CryptoKeyVersion\"`\n\036RestoreCrypt"
-          + "oKeyVersionRequest\022>\n\004name\030\001 \001(\tB0\340A\002\372A*"
-          + "\n(cloudkms.googleapis.com/CryptoKeyVersi"
-          + "on\"H\n\006Digest\022\020\n\006sha256\030\001 \001(\014H\000\022\020\n\006sha384"
-          + "\030\002 \001(\014H\000\022\020\n\006sha512\030\003 \001(\014H\000B\010\n\006digest\"@\n\020"
-          + "LocationMetadata\022\025\n\rhsm_available\030\001 \001(\010\022"
-          + "\025\n\rekm_available\030\002 \001(\0102\206&\n\024KeyManagement"
-          + "Service\022\242\001\n\014ListKeyRings\022(.google.cloud."
-          + "kms.v1.ListKeyRingsRequest\032).google.clou"
-          + "d.kms.v1.ListKeyRingsResponse\"=\202\323\344\223\002.\022,/"
-          + "v1/{parent=projects/*/locations/*}/keyRi"
-          + "ngs\332A\006parent\022\265\001\n\016ListCryptoKeys\022*.google"
-          + ".cloud.kms.v1.ListCryptoKeysRequest\032+.go"
-          + "ogle.cloud.kms.v1.ListCryptoKeysResponse"
-          + "\"J\202\323\344\223\002;\0229/v1/{parent=projects/*/locatio"
-          + "ns/*/keyRings/*}/cryptoKeys\332A\006parent\022\336\001\n"
-          + "\025ListCryptoKeyVersions\0221.google.cloud.km"
-          + "s.v1.ListCryptoKeyVersionsRequest\0322.goog"
-          + "le.cloud.kms.v1.ListCryptoKeyVersionsRes"
-          + "ponse\"^\202\323\344\223\002O\022M/v1/{parent=projects/*/lo"
-          + "cations/*/keyRings/*/cryptoKeys/*}/crypt"
-          + "oKeyVersions\332A\006parent\022\265\001\n\016ListImportJobs"
-          + "\022*.google.cloud.kms.v1.ListImportJobsReq"
-          + "uest\032+.google.cloud.kms.v1.ListImportJob"
-          + "sResponse\"J\202\323\344\223\002;\0229/v1/{parent=projects/"
-          + "*/locations/*/keyRings/*}/importJobs\332A\006p"
-          + "arent\022\217\001\n\nGetKeyRing\022&.google.cloud.kms."
-          + "v1.GetKeyRingRequest\032\034.google.cloud.kms."
-          + "v1.KeyRing\";\202\323\344\223\002.\022,/v1/{name=projects/*"
-          + "/locations/*/keyRings/*}\332A\004name\022\242\001\n\014GetC"
-          + "ryptoKey\022(.google.cloud.kms.v1.GetCrypto"
-          + "KeyRequest\032\036.google.cloud.kms.v1.CryptoK"
-          + "ey\"H\202\323\344\223\002;\0229/v1/{name=projects/*/locatio"
-          + "ns/*/keyRings/*/cryptoKeys/*}\332A\004name\022\313\001\n"
-          + "\023GetCryptoKeyVersion\022/.google.cloud.kms."
-          + "v1.GetCryptoKeyVersionRequest\032%.google.c"
-          + "loud.kms.v1.CryptoKeyVersion\"\\\202\323\344\223\002O\022M/v"
-          + "1/{name=projects/*/locations/*/keyRings/"
-          + "*/cryptoKeys/*/cryptoKeyVersions/*}\332A\004na"
-          + "me\022\300\001\n\014GetPublicKey\022(.google.cloud.kms.v"
-          + "1.GetPublicKeyRequest\032\036.google.cloud.kms"
-          + ".v1.PublicKey\"f\202\323\344\223\002Y\022W/v1/{name=project"
-          + "s/*/locations/*/keyRings/*/cryptoKeys/*/"
-          + "cryptoKeyVersions/*}/publicKey\332A\004name\022\242\001"
-          + "\n\014GetImportJob\022(.google.cloud.kms.v1.Get"
-          + "ImportJobRequest\032\036.google.cloud.kms.v1.I"
-          + "mportJob\"H\202\323\344\223\002;\0229/v1/{name=projects/*/l"
-          + "ocations/*/keyRings/*/importJobs/*}\332A\004na"
-          + "me\022\266\001\n\rCreateKeyRing\022).google.cloud.kms."
-          + "v1.CreateKeyRingRequest\032\034.google.cloud.k"
-          + "ms.v1.KeyRing\"\\\202\323\344\223\0028\",/v1/{parent=proje"
-          + "cts/*/locations/*}/keyRings:\010key_ring\332A\033"
-          + "parent,key_ring_id,key_ring\022\317\001\n\017CreateCr"
-          + "yptoKey\022+.google.cloud.kms.v1.CreateCryp"
-          + "toKeyRequest\032\036.google.cloud.kms.v1.Crypt"
-          + "oKey\"o\202\323\344\223\002G\"9/v1/{parent=projects/*/loc"
-          + "ations/*/keyRings/*}/cryptoKeys:\ncrypto_"
-          + "key\332A\037parent,crypto_key_id,crypto_key\022\373\001"
-          + "\n\026CreateCryptoKeyVersion\0222.google.cloud."
-          + "kms.v1.CreateCryptoKeyVersionRequest\032%.g"
-          + "oogle.cloud.kms.v1.CryptoKeyVersion\"\205\001\202\323"
-          + "\344\223\002c\"M/v1/{parent=projects/*/locations/*"
-          + "/keyRings/*/cryptoKeys/*}/cryptoKeyVersi"
-          + "ons:\022crypto_key_version\332A\031parent,crypto_"
-          + "key_version\022\324\001\n\026ImportCryptoKeyVersion\0222"
-          + ".google.cloud.kms.v1.ImportCryptoKeyVers"
-          + "ionRequest\032%.google.cloud.kms.v1.CryptoK"
-          + "eyVersion\"_\202\323\344\223\002Y\"T/v1/{parent=projects/"
-          + "*/locations/*/keyRings/*/cryptoKeys/*}/c"
-          + "ryptoKeyVersions:import:\001*\022\317\001\n\017CreateImp"
-          + "ortJob\022+.google.cloud.kms.v1.CreateImpor"
-          + "tJobRequest\032\036.google.cloud.kms.v1.Import"
-          + "Job\"o\202\323\344\223\002G\"9/v1/{parent=projects/*/loca"
-          + "tions/*/keyRings/*}/importJobs:\nimport_j"
-          + "ob\332A\037parent,import_job_id,import_job\022\321\001\n"
-          + "\017UpdateCryptoKey\022+.google.cloud.kms.v1.U"
-          + "pdateCryptoKeyRequest\032\036.google.cloud.kms"
-          + ".v1.CryptoKey\"q\202\323\344\223\002R2D/v1/{crypto_key.n"
-          + "ame=projects/*/locations/*/keyRings/*/cr"
-          + "yptoKeys/*}:\ncrypto_key\332A\026crypto_key,upd"
-          + "ate_mask\022\223\002\n\026UpdateCryptoKeyVersion\0222.go"
-          + "ogle.cloud.kms.v1.UpdateCryptoKeyVersion"
-          + "Request\032%.google.cloud.kms.v1.CryptoKeyV"
-          + "ersion\"\235\001\202\323\344\223\002v2`/v1/{crypto_key_version"
-          + ".name=projects/*/locations/*/keyRings/*/"
-          + "cryptoKeys/*/cryptoKeyVersions/*}:\022crypt"
-          + "o_key_version\332A\036crypto_key_version,updat"
-          + "e_mask\022\264\001\n\007Encrypt\022#.google.cloud.kms.v1"
-          + ".EncryptRequest\032$.google.cloud.kms.v1.En"
-          + "cryptResponse\"^\202\323\344\223\002G\"B/v1/{name=project"
-          + "s/*/locations/*/keyRings/*/cryptoKeys/**"
-          + "}:encrypt:\001*\332A\016name,plaintext\022\264\001\n\007Decryp"
-          + "t\022#.google.cloud.kms.v1.DecryptRequest\032$"
-          + ".google.cloud.kms.v1.DecryptResponse\"^\202\323"
-          + "\344\223\002F\"A/v1/{name=projects/*/locations/*/k"
-          + "eyRings/*/cryptoKeys/*}:decrypt:\001*\332A\017nam"
-          + "e,ciphertext\022\340\001\n\016AsymmetricSign\022*.google"
-          + ".cloud.kms.v1.AsymmetricSignRequest\032+.go"
-          + "ogle.cloud.kms.v1.AsymmetricSignResponse"
-          + "\"u\202\323\344\223\002a\"\\/v1/{name=projects/*/locations"
-          + "/*/keyRings/*/cryptoKeys/*/cryptoKeyVers"
-          + "ions/*}:asymmetricSign:\001*\332A\013name,digest\022"
-          + "\360\001\n\021AsymmetricDecrypt\022-.google.cloud.kms"
-          + ".v1.AsymmetricDecryptRequest\032..google.cl"
-          + "oud.kms.v1.AsymmetricDecryptResponse\"|\202\323"
-          + "\344\223\002d\"_/v1/{name=projects/*/locations/*/k"
-          + "eyRings/*/cryptoKeys/*/cryptoKeyVersions"
-          + "/*}:asymmetricDecrypt:\001*\332A\017name,cipherte"
-          + "xt\022\362\001\n\035UpdateCryptoKeyPrimaryVersion\0229.g"
-          + "oogle.cloud.kms.v1.UpdateCryptoKeyPrimar"
-          + "yVersionRequest\032\036.google.cloud.kms.v1.Cr"
-          + "yptoKey\"v\202\323\344\223\002S\"N/v1/{name=projects/*/lo"
-          + "cations/*/keyRings/*/cryptoKeys/*}:updat"
-          + "ePrimaryVersion:\001*\332A\032name,crypto_key_ver"
-          + "sion_id\022\336\001\n\027DestroyCryptoKeyVersion\0223.go"
-          + "ogle.cloud.kms.v1.DestroyCryptoKeyVersio"
+          + "ticated_data_crc32c\030\006 \001(\010\022>\n\020protection_"
+          + "level\030\007 \001(\0162$.google.cloud.kms.v1.Protec"
+          + "tionLevel\"\261\001\n\017DecryptResponse\022\021\n\tplainte"
+          + "xt\030\001 \001(\014\0225\n\020plaintext_crc32c\030\002 \001(\0132\033.goo"
+          + "gle.protobuf.Int64Value\022\024\n\014used_primary\030"
+          + "\003 \001(\010\022>\n\020protection_level\030\004 \001(\0162$.google"
+          + ".cloud.kms.v1.ProtectionLevel\"\320\001\n\026Asymme"
+          + "tricSignResponse\022\021\n\tsignature\030\001 \001(\014\0225\n\020s"
+          + "ignature_crc32c\030\002 \001(\0132\033.google.protobuf."
+          + "Int64Value\022\036\n\026verified_digest_crc32c\030\003 \001"
+          + "(\010\022\014\n\004name\030\004 \001(\t\022>\n\020protection_level\030\006 \001"
+          + "(\0162$.google.cloud.kms.v1.ProtectionLevel"
+          + "\"\311\001\n\031AsymmetricDecryptResponse\022\021\n\tplaint"
+          + "ext\030\001 \001(\014\0225\n\020plaintext_crc32c\030\002 \001(\0132\033.go"
+          + "ogle.protobuf.Int64Value\022\"\n\032verified_cip"
+          + "hertext_crc32c\030\003 \001(\010\022>\n\020protection_level"
+          + "\030\004 \001(\0162$.google.cloud.kms.v1.ProtectionL"
+          + "evel\"\273\001\n\017MacSignResponse\022\014\n\004name\030\001 \001(\t\022\013"
+          + "\n\003mac\030\002 \001(\014\022/\n\nmac_crc32c\030\003 \001(\0132\033.google"
+          + ".protobuf.Int64Value\022\034\n\024verified_data_cr"
+          + "c32c\030\004 \001(\010\022>\n\020protection_level\030\005 \001(\0162$.g"
+          + "oogle.cloud.kms.v1.ProtectionLevel\"\321\001\n\021M"
+          + "acVerifyResponse\022\014\n\004name\030\001 \001(\t\022\017\n\007succes"
+          + "s\030\002 \001(\010\022\034\n\024verified_data_crc32c\030\003 \001(\010\022\033\n"
+          + "\023verified_mac_crc32c\030\004 \001(\010\022\"\n\032verified_s"
+          + "uccess_integrity\030\005 \001(\010\022>\n\020protection_lev"
+          + "el\030\006 \001(\0162$.google.cloud.kms.v1.Protectio"
+          + "nLevel\"]\n\033GenerateRandomBytesResponse\022\014\n"
+          + "\004data\030\001 \001(\014\0220\n\013data_crc32c\030\003 \001(\0132\033.googl"
+          + "e.protobuf.Int64Value\"H\n\006Digest\022\020\n\006sha25"
+          + "6\030\001 \001(\014H\000\022\020\n\006sha384\030\002 \001(\014H\000\022\020\n\006sha512\030\003 "
+          + "\001(\014H\000B\010\n\006digest\"@\n\020LocationMetadata\022\025\n\rh"
+          + "sm_available\030\001 \001(\010\022\025\n\rekm_available\030\002 \001("
+          + "\0102\206+\n\024KeyManagementService\022\242\001\n\014ListKeyRi"
+          + "ngs\022(.google.cloud.kms.v1.ListKeyRingsRe"
+          + "quest\032).google.cloud.kms.v1.ListKeyRings"
+          + "Response\"=\202\323\344\223\002.\022,/v1/{parent=projects/*"
+          + "/locations/*}/keyRings\332A\006parent\022\265\001\n\016List"
+          + "CryptoKeys\022*.google.cloud.kms.v1.ListCry"
+          + "ptoKeysRequest\032+.google.cloud.kms.v1.Lis"
+          + "tCryptoKeysResponse\"J\202\323\344\223\002;\0229/v1/{parent"
+          + "=projects/*/locations/*/keyRings/*}/cryp"
+          + "toKeys\332A\006parent\022\336\001\n\025ListCryptoKeyVersion"
+          + "s\0221.google.cloud.kms.v1.ListCryptoKeyVer"
+          + "sionsRequest\0322.google.cloud.kms.v1.ListC"
+          + "ryptoKeyVersionsResponse\"^\202\323\344\223\002O\022M/v1/{p"
+          + "arent=projects/*/locations/*/keyRings/*/"
+          + "cryptoKeys/*}/cryptoKeyVersions\332A\006parent"
+          + "\022\265\001\n\016ListImportJobs\022*.google.cloud.kms.v"
+          + "1.ListImportJobsRequest\032+.google.cloud.k"
+          + "ms.v1.ListImportJobsResponse\"J\202\323\344\223\002;\0229/v"
+          + "1/{parent=projects/*/locations/*/keyRing"
+          + "s/*}/importJobs\332A\006parent\022\217\001\n\nGetKeyRing\022"
+          + "&.google.cloud.kms.v1.GetKeyRingRequest\032"
+          + "\034.google.cloud.kms.v1.KeyRing\";\202\323\344\223\002.\022,/"
+          + "v1/{name=projects/*/locations/*/keyRings"
+          + "/*}\332A\004name\022\242\001\n\014GetCryptoKey\022(.google.clo"
+          + "ud.kms.v1.GetCryptoKeyRequest\032\036.google.c"
+          + "loud.kms.v1.CryptoKey\"H\202\323\344\223\002;\0229/v1/{name"
+          + "=projects/*/locations/*/keyRings/*/crypt"
+          + "oKeys/*}\332A\004name\022\313\001\n\023GetCryptoKeyVersion\022"
+          + "/.google.cloud.kms.v1.GetCryptoKeyVersio"
           + "nRequest\032%.google.cloud.kms.v1.CryptoKey"
-          + "Version\"g\202\323\344\223\002Z\"U/v1/{name=projects/*/lo"
+          + "Version\"\\\202\323\344\223\002O\022M/v1/{name=projects/*/lo"
           + "cations/*/keyRings/*/cryptoKeys/*/crypto"
-          + "KeyVersions/*}:destroy:\001*\332A\004name\022\336\001\n\027Res"
-          + "toreCryptoKeyVersion\0223.google.cloud.kms."
-          + "v1.RestoreCryptoKeyVersionRequest\032%.goog"
-          + "le.cloud.kms.v1.CryptoKeyVersion\"g\202\323\344\223\002Z"
-          + "\"U/v1/{name=projects/*/locations/*/keyRi"
-          + "ngs/*/cryptoKeys/*/cryptoKeyVersions/*}:"
-          + "restore:\001*\332A\004name\032t\312A\027cloudkms.googleapi"
-          + "s.com\322AWhttps://www.googleapis.com/auth/"
-          + "cloud-platform,https://www.googleapis.co"
-          + "m/auth/cloudkmsB\214\001\n\027com.google.cloud.kms"
-          + ".v1B\010KmsProtoP\001Z6google.golang.org/genpr"
-          + "oto/googleapis/cloud/kms/v1;kms\370\001\001\252\002\023Goo"
-          + "gle.Cloud.Kms.V1\312\002\023Google\\Cloud\\Kms\\V1b\006"
-          + "proto3"
+          + "KeyVersions/*}\332A\004name\022\300\001\n\014GetPublicKey\022("
+          + ".google.cloud.kms.v1.GetPublicKeyRequest"
+          + "\032\036.google.cloud.kms.v1.PublicKey\"f\202\323\344\223\002Y"
+          + "\022W/v1/{name=projects/*/locations/*/keyRi"
+          + "ngs/*/cryptoKeys/*/cryptoKeyVersions/*}/"
+          + "publicKey\332A\004name\022\242\001\n\014GetImportJob\022(.goog"
+          + "le.cloud.kms.v1.GetImportJobRequest\032\036.go"
+          + "ogle.cloud.kms.v1.ImportJob\"H\202\323\344\223\002;\0229/v1"
+          + "/{name=projects/*/locations/*/keyRings/*"
+          + "/importJobs/*}\332A\004name\022\266\001\n\rCreateKeyRing\022"
+          + ").google.cloud.kms.v1.CreateKeyRingReque"
+          + "st\032\034.google.cloud.kms.v1.KeyRing\"\\\202\323\344\223\0028"
+          + "\",/v1/{parent=projects/*/locations/*}/ke"
+          + "yRings:\010key_ring\332A\033parent,key_ring_id,ke"
+          + "y_ring\022\317\001\n\017CreateCryptoKey\022+.google.clou"
+          + "d.kms.v1.CreateCryptoKeyRequest\032\036.google"
+          + ".cloud.kms.v1.CryptoKey\"o\202\323\344\223\002G\"9/v1/{pa"
+          + "rent=projects/*/locations/*/keyRings/*}/"
+          + "cryptoKeys:\ncrypto_key\332A\037parent,crypto_k"
+          + "ey_id,crypto_key\022\373\001\n\026CreateCryptoKeyVers"
+          + "ion\0222.google.cloud.kms.v1.CreateCryptoKe"
+          + "yVersionRequest\032%.google.cloud.kms.v1.Cr"
+          + "yptoKeyVersion\"\205\001\202\323\344\223\002c\"M/v1/{parent=pro"
+          + "jects/*/locations/*/keyRings/*/cryptoKey"
+          + "s/*}/cryptoKeyVersions:\022crypto_key_versi"
+          + "on\332A\031parent,crypto_key_version\022\324\001\n\026Impor"
+          + "tCryptoKeyVersion\0222.google.cloud.kms.v1."
+          + "ImportCryptoKeyVersionRequest\032%.google.c"
+          + "loud.kms.v1.CryptoKeyVersion\"_\202\323\344\223\002Y\"T/v"
+          + "1/{parent=projects/*/locations/*/keyRing"
+          + "s/*/cryptoKeys/*}/cryptoKeyVersions:impo"
+          + "rt:\001*\022\317\001\n\017CreateImportJob\022+.google.cloud"
+          + ".kms.v1.CreateImportJobRequest\032\036.google."
+          + "cloud.kms.v1.ImportJob\"o\202\323\344\223\002G\"9/v1/{par"
+          + "ent=projects/*/locations/*/keyRings/*}/i"
+          + "mportJobs:\nimport_job\332A\037parent,import_jo"
+          + "b_id,import_job\022\321\001\n\017UpdateCryptoKey\022+.go"
+          + "ogle.cloud.kms.v1.UpdateCryptoKeyRequest"
+          + "\032\036.google.cloud.kms.v1.CryptoKey\"q\202\323\344\223\002R"
+          + "2D/v1/{crypto_key.name=projects/*/locati"
+          + "ons/*/keyRings/*/cryptoKeys/*}:\ncrypto_k"
+          + "ey\332A\026crypto_key,update_mask\022\223\002\n\026UpdateCr"
+          + "yptoKeyVersion\0222.google.cloud.kms.v1.Upd"
+          + "ateCryptoKeyVersionRequest\032%.google.clou"
+          + "d.kms.v1.CryptoKeyVersion\"\235\001\202\323\344\223\002v2`/v1/"
+          + "{crypto_key_version.name=projects/*/loca"
+          + "tions/*/keyRings/*/cryptoKeys/*/cryptoKe"
+          + "yVersions/*}:\022crypto_key_version\332A\036crypt"
+          + "o_key_version,update_mask\022\362\001\n\035UpdateCryp"
+          + "toKeyPrimaryVersion\0229.google.cloud.kms.v"
+          + "1.UpdateCryptoKeyPrimaryVersionRequest\032\036"
+          + ".google.cloud.kms.v1.CryptoKey\"v\202\323\344\223\002S\"N"
+          + "/v1/{name=projects/*/locations/*/keyRing"
+          + "s/*/cryptoKeys/*}:updatePrimaryVersion:\001"
+          + "*\332A\032name,crypto_key_version_id\022\336\001\n\027Destr"
+          + "oyCryptoKeyVersion\0223.google.cloud.kms.v1"
+          + ".DestroyCryptoKeyVersionRequest\032%.google"
+          + ".cloud.kms.v1.CryptoKeyVersion\"g\202\323\344\223\002Z\"U"
+          + "/v1/{name=projects/*/locations/*/keyRing"
+          + "s/*/cryptoKeys/*/cryptoKeyVersions/*}:de"
+          + "stroy:\001*\332A\004name\022\336\001\n\027RestoreCryptoKeyVers"
+          + "ion\0223.google.cloud.kms.v1.RestoreCryptoK"
+          + "eyVersionRequest\032%.google.cloud.kms.v1.C"
+          + "ryptoKeyVersion\"g\202\323\344\223\002Z\"U/v1/{name=proje"
+          + "cts/*/locations/*/keyRings/*/cryptoKeys/"
+          + "*/cryptoKeyVersions/*}:restore:\001*\332A\004name"
+          + "\022\264\001\n\007Encrypt\022#.google.cloud.kms.v1.Encry"
+          + "ptRequest\032$.google.cloud.kms.v1.EncryptR"
+          + "esponse\"^\202\323\344\223\002G\"B/v1/{name=projects/*/lo"
+          + "cations/*/keyRings/*/cryptoKeys/**}:encr"
+          + "ypt:\001*\332A\016name,plaintext\022\264\001\n\007Decrypt\022#.go"
+          + "ogle.cloud.kms.v1.DecryptRequest\032$.googl"
+          + "e.cloud.kms.v1.DecryptResponse\"^\202\323\344\223\002F\"A"
+          + "/v1/{name=projects/*/locations/*/keyRing"
+          + "s/*/cryptoKeys/*}:decrypt:\001*\332A\017name,ciph"
+          + "ertext\022\340\001\n\016AsymmetricSign\022*.google.cloud"
+          + ".kms.v1.AsymmetricSignRequest\032+.google.c"
+          + "loud.kms.v1.AsymmetricSignResponse\"u\202\323\344\223"
+          + "\002a\"\\/v1/{name=projects/*/locations/*/key"
+          + "Rings/*/cryptoKeys/*/cryptoKeyVersions/*"
+          + "}:asymmetricSign:\001*\332A\013name,digest\022\360\001\n\021As"
+          + "ymmetricDecrypt\022-.google.cloud.kms.v1.As"
+          + "ymmetricDecryptRequest\032..google.cloud.km"
+          + "s.v1.AsymmetricDecryptResponse\"|\202\323\344\223\002d\"_"
+          + "/v1/{name=projects/*/locations/*/keyRing"
+          + "s/*/cryptoKeys/*/cryptoKeyVersions/*}:as"
+          + "ymmetricDecrypt:\001*\332A\017name,ciphertext\022\302\001\n"
+          + "\007MacSign\022#.google.cloud.kms.v1.MacSignRe"
+          + "quest\032$.google.cloud.kms.v1.MacSignRespo"
+          + "nse\"l\202\323\344\223\002Z\"U/v1/{name=projects/*/locati"
+          + "ons/*/keyRings/*/cryptoKeys/*/cryptoKeyV"
+          + "ersions/*}:macSign:\001*\332A\tname,data\022\316\001\n\tMa"
+          + "cVerify\022%.google.cloud.kms.v1.MacVerifyR"
+          + "equest\032&.google.cloud.kms.v1.MacVerifyRe"
+          + "sponse\"r\202\323\344\223\002\\\"W/v1/{name=projects/*/loc"
+          + "ations/*/keyRings/*/cryptoKeys/*/cryptoK"
+          + "eyVersions/*}:macVerify:\001*\332A\rname,data,m"
+          + "ac\022\347\001\n\023GenerateRandomBytes\022/.google.clou"
+          + "d.kms.v1.GenerateRandomBytesRequest\0320.go"
+          + "ogle.cloud.kms.v1.GenerateRandomBytesRes"
+          + "ponse\"m\202\323\344\223\002>\"9/v1/{location=projects/*/"
+          + "locations/*}:generateRandomBytes:\001*\332A&lo"
+          + "cation,length_bytes,protection_level\032t\312A"
+          + "\027cloudkms.googleapis.com\322AWhttps://www.g"
+          + "oogleapis.com/auth/cloud-platform,https:"
+          + "//www.googleapis.com/auth/cloudkmsB\214\001\n\027c"
+          + "om.google.cloud.kms.v1B\010KmsProtoP\001Z6goog"
+          + "le.golang.org/genproto/googleapis/cloud/"
+          + "kms/v1;kms\370\001\001\252\002\023Google.Cloud.Kms.V1\312\002\023Go"
+          + "ogle\\Cloud\\Kms\\V1b\006proto3"
     };
     descriptor =
         com.google.protobuf.Descriptors.FileDescriptor.internalBuildGeneratedFileFrom(
@@ -600,8 +672,32 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
             new java.lang.String[] {
               "CryptoKeyVersion", "UpdateMask",
             });
-    internal_static_google_cloud_kms_v1_EncryptRequest_descriptor =
+    internal_static_google_cloud_kms_v1_UpdateCryptoKeyPrimaryVersionRequest_descriptor =
         getDescriptor().getMessageTypes().get(20);
+    internal_static_google_cloud_kms_v1_UpdateCryptoKeyPrimaryVersionRequest_fieldAccessorTable =
+        new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
+            internal_static_google_cloud_kms_v1_UpdateCryptoKeyPrimaryVersionRequest_descriptor,
+            new java.lang.String[] {
+              "Name", "CryptoKeyVersionId",
+            });
+    internal_static_google_cloud_kms_v1_DestroyCryptoKeyVersionRequest_descriptor =
+        getDescriptor().getMessageTypes().get(21);
+    internal_static_google_cloud_kms_v1_DestroyCryptoKeyVersionRequest_fieldAccessorTable =
+        new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
+            internal_static_google_cloud_kms_v1_DestroyCryptoKeyVersionRequest_descriptor,
+            new java.lang.String[] {
+              "Name",
+            });
+    internal_static_google_cloud_kms_v1_RestoreCryptoKeyVersionRequest_descriptor =
+        getDescriptor().getMessageTypes().get(22);
+    internal_static_google_cloud_kms_v1_RestoreCryptoKeyVersionRequest_fieldAccessorTable =
+        new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
+            internal_static_google_cloud_kms_v1_RestoreCryptoKeyVersionRequest_descriptor,
+            new java.lang.String[] {
+              "Name",
+            });
+    internal_static_google_cloud_kms_v1_EncryptRequest_descriptor =
+        getDescriptor().getMessageTypes().get(23);
     internal_static_google_cloud_kms_v1_EncryptRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_cloud_kms_v1_EncryptRequest_descriptor,
@@ -613,7 +709,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "AdditionalAuthenticatedDataCrc32C",
             });
     internal_static_google_cloud_kms_v1_DecryptRequest_descriptor =
-        getDescriptor().getMessageTypes().get(21);
+        getDescriptor().getMessageTypes().get(24);
     internal_static_google_cloud_kms_v1_DecryptRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_cloud_kms_v1_DecryptRequest_descriptor,
@@ -625,7 +721,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "AdditionalAuthenticatedDataCrc32C",
             });
     internal_static_google_cloud_kms_v1_AsymmetricSignRequest_descriptor =
-        getDescriptor().getMessageTypes().get(22);
+        getDescriptor().getMessageTypes().get(25);
     internal_static_google_cloud_kms_v1_AsymmetricSignRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_cloud_kms_v1_AsymmetricSignRequest_descriptor,
@@ -633,23 +729,39 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Name", "Digest", "DigestCrc32C",
             });
     internal_static_google_cloud_kms_v1_AsymmetricDecryptRequest_descriptor =
-        getDescriptor().getMessageTypes().get(23);
+        getDescriptor().getMessageTypes().get(26);
     internal_static_google_cloud_kms_v1_AsymmetricDecryptRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_cloud_kms_v1_AsymmetricDecryptRequest_descriptor,
             new java.lang.String[] {
               "Name", "Ciphertext", "CiphertextCrc32C",
             });
-    internal_static_google_cloud_kms_v1_DecryptResponse_descriptor =
-        getDescriptor().getMessageTypes().get(24);
-    internal_static_google_cloud_kms_v1_DecryptResponse_fieldAccessorTable =
+    internal_static_google_cloud_kms_v1_MacSignRequest_descriptor =
+        getDescriptor().getMessageTypes().get(27);
+    internal_static_google_cloud_kms_v1_MacSignRequest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
-            internal_static_google_cloud_kms_v1_DecryptResponse_descriptor,
+            internal_static_google_cloud_kms_v1_MacSignRequest_descriptor,
             new java.lang.String[] {
-              "Plaintext", "PlaintextCrc32C",
+              "Name", "Data", "DataCrc32C",
+            });
+    internal_static_google_cloud_kms_v1_MacVerifyRequest_descriptor =
+        getDescriptor().getMessageTypes().get(28);
+    internal_static_google_cloud_kms_v1_MacVerifyRequest_fieldAccessorTable =
+        new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
+            internal_static_google_cloud_kms_v1_MacVerifyRequest_descriptor,
+            new java.lang.String[] {
+              "Name", "Data", "DataCrc32C", "Mac", "MacCrc32C",
+            });
+    internal_static_google_cloud_kms_v1_GenerateRandomBytesRequest_descriptor =
+        getDescriptor().getMessageTypes().get(29);
+    internal_static_google_cloud_kms_v1_GenerateRandomBytesRequest_fieldAccessorTable =
+        new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
+            internal_static_google_cloud_kms_v1_GenerateRandomBytesRequest_descriptor,
+            new java.lang.String[] {
+              "Location", "LengthBytes", "ProtectionLevel",
             });
     internal_static_google_cloud_kms_v1_EncryptResponse_descriptor =
-        getDescriptor().getMessageTypes().get(25);
+        getDescriptor().getMessageTypes().get(30);
     internal_static_google_cloud_kms_v1_EncryptResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_cloud_kms_v1_EncryptResponse_descriptor,
@@ -659,49 +771,63 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "CiphertextCrc32C",
               "VerifiedPlaintextCrc32C",
               "VerifiedAdditionalAuthenticatedDataCrc32C",
+              "ProtectionLevel",
+            });
+    internal_static_google_cloud_kms_v1_DecryptResponse_descriptor =
+        getDescriptor().getMessageTypes().get(31);
+    internal_static_google_cloud_kms_v1_DecryptResponse_fieldAccessorTable =
+        new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
+            internal_static_google_cloud_kms_v1_DecryptResponse_descriptor,
+            new java.lang.String[] {
+              "Plaintext", "PlaintextCrc32C", "UsedPrimary", "ProtectionLevel",
             });
     internal_static_google_cloud_kms_v1_AsymmetricSignResponse_descriptor =
-        getDescriptor().getMessageTypes().get(26);
+        getDescriptor().getMessageTypes().get(32);
     internal_static_google_cloud_kms_v1_AsymmetricSignResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_cloud_kms_v1_AsymmetricSignResponse_descriptor,
             new java.lang.String[] {
-              "Signature", "SignatureCrc32C", "VerifiedDigestCrc32C", "Name",
+              "Signature", "SignatureCrc32C", "VerifiedDigestCrc32C", "Name", "ProtectionLevel",
             });
     internal_static_google_cloud_kms_v1_AsymmetricDecryptResponse_descriptor =
-        getDescriptor().getMessageTypes().get(27);
+        getDescriptor().getMessageTypes().get(33);
     internal_static_google_cloud_kms_v1_AsymmetricDecryptResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_cloud_kms_v1_AsymmetricDecryptResponse_descriptor,
             new java.lang.String[] {
-              "Plaintext", "PlaintextCrc32C", "VerifiedCiphertextCrc32C",
+              "Plaintext", "PlaintextCrc32C", "VerifiedCiphertextCrc32C", "ProtectionLevel",
             });
-    internal_static_google_cloud_kms_v1_UpdateCryptoKeyPrimaryVersionRequest_descriptor =
-        getDescriptor().getMessageTypes().get(28);
-    internal_static_google_cloud_kms_v1_UpdateCryptoKeyPrimaryVersionRequest_fieldAccessorTable =
+    internal_static_google_cloud_kms_v1_MacSignResponse_descriptor =
+        getDescriptor().getMessageTypes().get(34);
+    internal_static_google_cloud_kms_v1_MacSignResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
-            internal_static_google_cloud_kms_v1_UpdateCryptoKeyPrimaryVersionRequest_descriptor,
+            internal_static_google_cloud_kms_v1_MacSignResponse_descriptor,
             new java.lang.String[] {
-              "Name", "CryptoKeyVersionId",
+              "Name", "Mac", "MacCrc32C", "VerifiedDataCrc32C", "ProtectionLevel",
             });
-    internal_static_google_cloud_kms_v1_DestroyCryptoKeyVersionRequest_descriptor =
-        getDescriptor().getMessageTypes().get(29);
-    internal_static_google_cloud_kms_v1_DestroyCryptoKeyVersionRequest_fieldAccessorTable =
+    internal_static_google_cloud_kms_v1_MacVerifyResponse_descriptor =
+        getDescriptor().getMessageTypes().get(35);
+    internal_static_google_cloud_kms_v1_MacVerifyResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
-            internal_static_google_cloud_kms_v1_DestroyCryptoKeyVersionRequest_descriptor,
+            internal_static_google_cloud_kms_v1_MacVerifyResponse_descriptor,
             new java.lang.String[] {
               "Name",
+              "Success",
+              "VerifiedDataCrc32C",
+              "VerifiedMacCrc32C",
+              "VerifiedSuccessIntegrity",
+              "ProtectionLevel",
             });
-    internal_static_google_cloud_kms_v1_RestoreCryptoKeyVersionRequest_descriptor =
-        getDescriptor().getMessageTypes().get(30);
-    internal_static_google_cloud_kms_v1_RestoreCryptoKeyVersionRequest_fieldAccessorTable =
+    internal_static_google_cloud_kms_v1_GenerateRandomBytesResponse_descriptor =
+        getDescriptor().getMessageTypes().get(36);
+    internal_static_google_cloud_kms_v1_GenerateRandomBytesResponse_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
-            internal_static_google_cloud_kms_v1_RestoreCryptoKeyVersionRequest_descriptor,
+            internal_static_google_cloud_kms_v1_GenerateRandomBytesResponse_descriptor,
             new java.lang.String[] {
-              "Name",
+              "Data", "DataCrc32C",
             });
     internal_static_google_cloud_kms_v1_Digest_descriptor =
-        getDescriptor().getMessageTypes().get(31);
+        getDescriptor().getMessageTypes().get(37);
     internal_static_google_cloud_kms_v1_Digest_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_cloud_kms_v1_Digest_descriptor,
@@ -709,7 +835,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "Sha256", "Sha384", "Sha512", "Digest",
             });
     internal_static_google_cloud_kms_v1_LocationMetadata_descriptor =
-        getDescriptor().getMessageTypes().get(32);
+        getDescriptor().getMessageTypes().get(38);
     internal_static_google_cloud_kms_v1_LocationMetadata_fieldAccessorTable =
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_cloud_kms_v1_LocationMetadata_descriptor,
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KmsResourcesProto.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KmsResourcesProto.java
index ed9928c4..7b0e98e8 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KmsResourcesProto.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/KmsResourcesProto.java
@@ -86,7 +86,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "create_time\030\002 \001(\0132\032.google.protobuf.Time"
           + "stampB\003\340A\003:a\352A^\n\037cloudkms.googleapis.com"
           + "/KeyRing\022;projects/{project}/locations/{"
-          + "location}/keyRings/{key_ring}\"\206\006\n\tCrypto"
+          + "location}/keyRings/{key_ring}\"\356\006\n\tCrypto"
           + "Key\022\021\n\004name\030\001 \001(\tB\003\340A\003\022;\n\007primary\030\002 \001(\0132"
           + "%.google.cloud.kms.v1.CryptoKeyVersionB\003"
           + "\340A\003\022E\n\007purpose\030\003 \001(\0162/.google.cloud.kms."
@@ -98,112 +98,117 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "\n\020version_template\030\013 \001(\0132-.google.cloud."
           + "kms.v1.CryptoKeyVersionTemplate\022:\n\006label"
           + "s\030\n \003(\0132*.google.cloud.kms.v1.CryptoKey."
-          + "LabelsEntry\032-\n\013LabelsEntry\022\013\n\003key\030\001 \001(\t\022"
-          + "\r\n\005value\030\002 \001(\t:\0028\001\"x\n\020CryptoKeyPurpose\022\""
-          + "\n\036CRYPTO_KEY_PURPOSE_UNSPECIFIED\020\000\022\023\n\017EN"
-          + "CRYPT_DECRYPT\020\001\022\023\n\017ASYMMETRIC_SIGN\020\005\022\026\n\022"
-          + "ASYMMETRIC_DECRYPT\020\006:{\352Ax\n!cloudkms.goog"
-          + "leapis.com/CryptoKey\022Sprojects/{project}"
-          + "/locations/{location}/keyRings/{key_ring"
-          + "}/cryptoKeys/{crypto_key}B\023\n\021rotation_sc"
-          + "hedule\"\263\001\n\030CryptoKeyVersionTemplate\022>\n\020p"
-          + "rotection_level\030\001 \001(\0162$.google.cloud.kms"
-          + ".v1.ProtectionLevel\022W\n\talgorithm\030\003 \001(\0162?"
-          + ".google.cloud.kms.v1.CryptoKeyVersion.Cr"
-          + "yptoKeyVersionAlgorithmB\003\340A\002\"\361\001\n\027KeyOper"
-          + "ationAttestation\022S\n\006format\030\004 \001(\0162>.googl"
-          + "e.cloud.kms.v1.KeyOperationAttestation.A"
-          + "ttestationFormatB\003\340A\003\022\024\n\007content\030\005 \001(\014B\003"
-          + "\340A\003\"k\n\021AttestationFormat\022\"\n\036ATTESTATION_"
-          + "FORMAT_UNSPECIFIED\020\000\022\030\n\024CAVIUM_V1_COMPRE"
-          + "SSED\020\003\022\030\n\024CAVIUM_V2_COMPRESSED\020\004\"\250\016\n\020Cry"
-          + "ptoKeyVersion\022\021\n\004name\030\001 \001(\tB\003\340A\003\022J\n\005stat"
-          + "e\030\003 \001(\0162;.google.cloud.kms.v1.CryptoKeyV"
-          + "ersion.CryptoKeyVersionState\022C\n\020protecti"
-          + "on_level\030\007 \001(\0162$.google.cloud.kms.v1.Pro"
-          + "tectionLevelB\003\340A\003\022W\n\talgorithm\030\n \001(\0162?.g"
-          + "oogle.cloud.kms.v1.CryptoKeyVersion.Cryp"
-          + "toKeyVersionAlgorithmB\003\340A\003\022F\n\013attestatio"
-          + "n\030\010 \001(\0132,.google.cloud.kms.v1.KeyOperati"
-          + "onAttestationB\003\340A\003\0224\n\013create_time\030\004 \001(\0132"
-          + "\032.google.protobuf.TimestampB\003\340A\003\0226\n\rgene"
-          + "rate_time\030\013 \001(\0132\032.google.protobuf.Timest"
-          + "ampB\003\340A\003\0225\n\014destroy_time\030\005 \001(\0132\032.google."
-          + "protobuf.TimestampB\003\340A\003\022;\n\022destroy_event"
-          + "_time\030\006 \001(\0132\032.google.protobuf.TimestampB"
-          + "\003\340A\003\022\027\n\nimport_job\030\016 \001(\tB\003\340A\003\0224\n\013import_"
-          + "time\030\017 \001(\0132\032.google.protobuf.TimestampB\003"
-          + "\340A\003\022\"\n\025import_failure_reason\030\020 \001(\tB\003\340A\003\022"
-          + "^\n!external_protection_level_options\030\021 \001"
-          + "(\01323.google.cloud.kms.v1.ExternalProtect"
-          + "ionLevelOptions\"\335\004\n\031CryptoKeyVersionAlgo"
-          + "rithm\022,\n(CRYPTO_KEY_VERSION_ALGORITHM_UN"
-          + "SPECIFIED\020\000\022\037\n\033GOOGLE_SYMMETRIC_ENCRYPTI"
-          + "ON\020\001\022\034\n\030RSA_SIGN_PSS_2048_SHA256\020\002\022\034\n\030RS"
-          + "A_SIGN_PSS_3072_SHA256\020\003\022\034\n\030RSA_SIGN_PSS"
-          + "_4096_SHA256\020\004\022\034\n\030RSA_SIGN_PSS_4096_SHA5"
-          + "12\020\017\022\036\n\032RSA_SIGN_PKCS1_2048_SHA256\020\005\022\036\n\032"
-          + "RSA_SIGN_PKCS1_3072_SHA256\020\006\022\036\n\032RSA_SIGN"
-          + "_PKCS1_4096_SHA256\020\007\022\036\n\032RSA_SIGN_PKCS1_4"
-          + "096_SHA512\020\020\022 \n\034RSA_DECRYPT_OAEP_2048_SH"
-          + "A256\020\010\022 \n\034RSA_DECRYPT_OAEP_3072_SHA256\020\t"
-          + "\022 \n\034RSA_DECRYPT_OAEP_4096_SHA256\020\n\022 \n\034RS"
-          + "A_DECRYPT_OAEP_4096_SHA512\020\021\022\027\n\023EC_SIGN_"
-          + "P256_SHA256\020\014\022\027\n\023EC_SIGN_P384_SHA384\020\r\022\034"
-          + "\n\030EC_SIGN_SECP256K1_SHA256\020\037\022!\n\035EXTERNAL"
-          + "_SYMMETRIC_ENCRYPTION\020\022\"\301\001\n\025CryptoKeyVer"
-          + "sionState\022(\n$CRYPTO_KEY_VERSION_STATE_UN"
-          + "SPECIFIED\020\000\022\026\n\022PENDING_GENERATION\020\005\022\013\n\007E"
-          + "NABLED\020\001\022\014\n\010DISABLED\020\002\022\r\n\tDESTROYED\020\003\022\025\n"
-          + "\021DESTROY_SCHEDULED\020\004\022\022\n\016PENDING_IMPORT\020\006"
-          + "\022\021\n\rIMPORT_FAILED\020\007\"I\n\024CryptoKeyVersionV"
-          + "iew\022\'\n#CRYPTO_KEY_VERSION_VIEW_UNSPECIFI"
-          + "ED\020\000\022\010\n\004FULL\020\001:\252\001\352A\246\001\n(cloudkms.googleap"
-          + "is.com/CryptoKeyVersion\022zprojects/{proje"
-          + "ct}/locations/{location}/keyRings/{key_r"
-          + "ing}/cryptoKeys/{crypto_key}/cryptoKeyVe"
-          + "rsions/{crypto_key_version}\"\334\002\n\tPublicKe"
-          + "y\022\013\n\003pem\030\001 \001(\t\022R\n\talgorithm\030\002 \001(\0162?.goog"
-          + "le.cloud.kms.v1.CryptoKeyVersion.CryptoK"
-          + "eyVersionAlgorithm\022/\n\npem_crc32c\030\003 \001(\0132\033"
-          + ".google.protobuf.Int64Value\022\014\n\004name\030\004 \001("
-          + "\t:\256\001\352A\252\001\n!cloudkms.googleapis.com/Public"
-          + "Key\022\204\001projects/{project}/locations/{loca"
+          + "LabelsEntry\022\030\n\013import_only\030\r \001(\010B\003\340A\005\022B\n"
+          + "\032destroy_scheduled_duration\030\016 \001(\0132\031.goog"
+          + "le.protobuf.DurationB\003\340A\005\032-\n\013LabelsEntry"
+          + "\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:\0028\001\"\201\001\n\020Cry"
+          + "ptoKeyPurpose\022\"\n\036CRYPTO_KEY_PURPOSE_UNSP"
+          + "ECIFIED\020\000\022\023\n\017ENCRYPT_DECRYPT\020\001\022\023\n\017ASYMME"
+          + "TRIC_SIGN\020\005\022\026\n\022ASYMMETRIC_DECRYPT\020\006\022\007\n\003M"
+          + "AC\020\t:{\352Ax\n!cloudkms.googleapis.com/Crypt"
+          + "oKey\022Sprojects/{project}/locations/{loca"
           + "tion}/keyRings/{key_ring}/cryptoKeys/{cr"
-          + "ypto_key}/cryptoKeyVersions/{crypto_key_"
-          + "version}/publicKey\"\333\007\n\tImportJob\022\021\n\004name"
-          + "\030\001 \001(\tB\003\340A\003\022J\n\rimport_method\030\002 \001(\0162+.goo"
-          + "gle.cloud.kms.v1.ImportJob.ImportMethodB"
-          + "\006\340A\002\340A\005\022F\n\020protection_level\030\t \001(\0162$.goog"
-          + "le.cloud.kms.v1.ProtectionLevelB\006\340A\002\340A\005\022"
-          + "4\n\013create_time\030\003 \001(\0132\032.google.protobuf.T"
-          + "imestampB\003\340A\003\0226\n\rgenerate_time\030\004 \001(\0132\032.g"
-          + "oogle.protobuf.TimestampB\003\340A\003\0224\n\013expire_"
-          + "time\030\005 \001(\0132\032.google.protobuf.TimestampB\003"
-          + "\340A\003\022:\n\021expire_event_time\030\n \001(\0132\032.google."
-          + "protobuf.TimestampB\003\340A\003\022A\n\005state\030\006 \001(\0162-"
-          + ".google.cloud.kms.v1.ImportJob.ImportJob"
-          + "StateB\003\340A\003\022I\n\npublic_key\030\007 \001(\01320.google."
-          + "cloud.kms.v1.ImportJob.WrappingPublicKey"
-          + "B\003\340A\003\022F\n\013attestation\030\010 \001(\0132,.google.clou"
-          + "d.kms.v1.KeyOperationAttestationB\003\340A\003\032 \n"
-          + "\021WrappingPublicKey\022\013\n\003pem\030\001 \001(\t\"m\n\014Impor"
-          + "tMethod\022\035\n\031IMPORT_METHOD_UNSPECIFIED\020\000\022\036"
-          + "\n\032RSA_OAEP_3072_SHA1_AES_256\020\001\022\036\n\032RSA_OA"
-          + "EP_4096_SHA1_AES_256\020\002\"c\n\016ImportJobState"
-          + "\022 \n\034IMPORT_JOB_STATE_UNSPECIFIED\020\000\022\026\n\022PE"
-          + "NDING_GENERATION\020\001\022\n\n\006ACTIVE\020\002\022\013\n\007EXPIRE"
-          + "D\020\003:{\352Ax\n!cloudkms.googleapis.com/Import"
-          + "Job\022Sprojects/{project}/locations/{locat"
-          + "ion}/keyRings/{key_ring}/importJobs/{imp"
-          + "ort_job}\":\n\036ExternalProtectionLevelOptio"
-          + "ns\022\030\n\020external_key_uri\030\001 \001(\t*X\n\017Protecti"
-          + "onLevel\022 \n\034PROTECTION_LEVEL_UNSPECIFIED\020"
-          + "\000\022\014\n\010SOFTWARE\020\001\022\007\n\003HSM\020\002\022\014\n\010EXTERNAL\020\003B\225"
-          + "\001\n\027com.google.cloud.kms.v1B\021KmsResources"
-          + "ProtoP\001Z6google.golang.org/genproto/goog"
-          + "leapis/cloud/kms/v1;kms\370\001\001\252\002\023Google.Clou"
-          + "d.Kms.V1\312\002\023Google\\Cloud\\Kms\\V1b\006proto3"
+          + "ypto_key}B\023\n\021rotation_schedule\"\263\001\n\030Crypt"
+          + "oKeyVersionTemplate\022>\n\020protection_level\030"
+          + "\001 \001(\0162$.google.cloud.kms.v1.ProtectionLe"
+          + "vel\022W\n\talgorithm\030\003 \001(\0162?.google.cloud.km"
+          + "s.v1.CryptoKeyVersion.CryptoKeyVersionAl"
+          + "gorithmB\003\340A\002\"\361\001\n\027KeyOperationAttestation"
+          + "\022S\n\006format\030\004 \001(\0162>.google.cloud.kms.v1.K"
+          + "eyOperationAttestation.AttestationFormat"
+          + "B\003\340A\003\022\024\n\007content\030\005 \001(\014B\003\340A\003\"k\n\021Attestati"
+          + "onFormat\022\"\n\036ATTESTATION_FORMAT_UNSPECIFI"
+          + "ED\020\000\022\030\n\024CAVIUM_V1_COMPRESSED\020\003\022\030\n\024CAVIUM"
+          + "_V2_COMPRESSED\020\004\"\271\016\n\020CryptoKeyVersion\022\021\n"
+          + "\004name\030\001 \001(\tB\003\340A\003\022J\n\005state\030\003 \001(\0162;.google"
+          + ".cloud.kms.v1.CryptoKeyVersion.CryptoKey"
+          + "VersionState\022C\n\020protection_level\030\007 \001(\0162$"
+          + ".google.cloud.kms.v1.ProtectionLevelB\003\340A"
+          + "\003\022W\n\talgorithm\030\n \001(\0162?.google.cloud.kms."
+          + "v1.CryptoKeyVersion.CryptoKeyVersionAlgo"
+          + "rithmB\003\340A\003\022F\n\013attestation\030\010 \001(\0132,.google"
+          + ".cloud.kms.v1.KeyOperationAttestationB\003\340"
+          + "A\003\0224\n\013create_time\030\004 \001(\0132\032.google.protobu"
+          + "f.TimestampB\003\340A\003\0226\n\rgenerate_time\030\013 \001(\0132"
+          + "\032.google.protobuf.TimestampB\003\340A\003\0225\n\014dest"
+          + "roy_time\030\005 \001(\0132\032.google.protobuf.Timesta"
+          + "mpB\003\340A\003\022;\n\022destroy_event_time\030\006 \001(\0132\032.go"
+          + "ogle.protobuf.TimestampB\003\340A\003\022\027\n\nimport_j"
+          + "ob\030\016 \001(\tB\003\340A\003\0224\n\013import_time\030\017 \001(\0132\032.goo"
+          + "gle.protobuf.TimestampB\003\340A\003\022\"\n\025import_fa"
+          + "ilure_reason\030\020 \001(\tB\003\340A\003\022^\n!external_prot"
+          + "ection_level_options\030\021 \001(\01323.google.clou"
+          + "d.kms.v1.ExternalProtectionLevelOptions\""
+          + "\356\004\n\031CryptoKeyVersionAlgorithm\022,\n(CRYPTO_"
+          + "KEY_VERSION_ALGORITHM_UNSPECIFIED\020\000\022\037\n\033G"
+          + "OOGLE_SYMMETRIC_ENCRYPTION\020\001\022\034\n\030RSA_SIGN"
+          + "_PSS_2048_SHA256\020\002\022\034\n\030RSA_SIGN_PSS_3072_"
+          + "SHA256\020\003\022\034\n\030RSA_SIGN_PSS_4096_SHA256\020\004\022\034"
+          + "\n\030RSA_SIGN_PSS_4096_SHA512\020\017\022\036\n\032RSA_SIGN"
+          + "_PKCS1_2048_SHA256\020\005\022\036\n\032RSA_SIGN_PKCS1_3"
+          + "072_SHA256\020\006\022\036\n\032RSA_SIGN_PKCS1_4096_SHA2"
+          + "56\020\007\022\036\n\032RSA_SIGN_PKCS1_4096_SHA512\020\020\022 \n\034"
+          + "RSA_DECRYPT_OAEP_2048_SHA256\020\010\022 \n\034RSA_DE"
+          + "CRYPT_OAEP_3072_SHA256\020\t\022 \n\034RSA_DECRYPT_"
+          + "OAEP_4096_SHA256\020\n\022 \n\034RSA_DECRYPT_OAEP_4"
+          + "096_SHA512\020\021\022\027\n\023EC_SIGN_P256_SHA256\020\014\022\027\n"
+          + "\023EC_SIGN_P384_SHA384\020\r\022\034\n\030EC_SIGN_SECP25"
+          + "6K1_SHA256\020\037\022\017\n\013HMAC_SHA256\020 \022!\n\035EXTERNA"
+          + "L_SYMMETRIC_ENCRYPTION\020\022\"\301\001\n\025CryptoKeyVe"
+          + "rsionState\022(\n$CRYPTO_KEY_VERSION_STATE_U"
+          + "NSPECIFIED\020\000\022\026\n\022PENDING_GENERATION\020\005\022\013\n\007"
+          + "ENABLED\020\001\022\014\n\010DISABLED\020\002\022\r\n\tDESTROYED\020\003\022\025"
+          + "\n\021DESTROY_SCHEDULED\020\004\022\022\n\016PENDING_IMPORT\020"
+          + "\006\022\021\n\rIMPORT_FAILED\020\007\"I\n\024CryptoKeyVersion"
+          + "View\022\'\n#CRYPTO_KEY_VERSION_VIEW_UNSPECIF"
+          + "IED\020\000\022\010\n\004FULL\020\001:\252\001\352A\246\001\n(cloudkms.googlea"
+          + "pis.com/CryptoKeyVersion\022zprojects/{proj"
+          + "ect}/locations/{location}/keyRings/{key_"
+          + "ring}/cryptoKeys/{crypto_key}/cryptoKeyV"
+          + "ersions/{crypto_key_version}\"\234\003\n\tPublicK"
+          + "ey\022\013\n\003pem\030\001 \001(\t\022R\n\talgorithm\030\002 \001(\0162?.goo"
+          + "gle.cloud.kms.v1.CryptoKeyVersion.Crypto"
+          + "KeyVersionAlgorithm\022/\n\npem_crc32c\030\003 \001(\0132"
+          + "\033.google.protobuf.Int64Value\022\014\n\004name\030\004 \001"
+          + "(\t\022>\n\020protection_level\030\005 \001(\0162$.google.cl"
+          + "oud.kms.v1.ProtectionLevel:\256\001\352A\252\001\n!cloud"
+          + "kms.googleapis.com/PublicKey\022\204\001projects/"
+          + "{project}/locations/{location}/keyRings/"
+          + "{key_ring}/cryptoKeys/{crypto_key}/crypt"
+          + "oKeyVersions/{crypto_key_version}/public"
+          + "Key\"\333\007\n\tImportJob\022\021\n\004name\030\001 \001(\tB\003\340A\003\022J\n\r"
+          + "import_method\030\002 \001(\0162+.google.cloud.kms.v"
+          + "1.ImportJob.ImportMethodB\006\340A\002\340A\005\022F\n\020prot"
+          + "ection_level\030\t \001(\0162$.google.cloud.kms.v1"
+          + ".ProtectionLevelB\006\340A\002\340A\005\0224\n\013create_time\030"
+          + "\003 \001(\0132\032.google.protobuf.TimestampB\003\340A\003\0226"
+          + "\n\rgenerate_time\030\004 \001(\0132\032.google.protobuf."
+          + "TimestampB\003\340A\003\0224\n\013expire_time\030\005 \001(\0132\032.go"
+          + "ogle.protobuf.TimestampB\003\340A\003\022:\n\021expire_e"
+          + "vent_time\030\n \001(\0132\032.google.protobuf.Timest"
+          + "ampB\003\340A\003\022A\n\005state\030\006 \001(\0162-.google.cloud.k"
+          + "ms.v1.ImportJob.ImportJobStateB\003\340A\003\022I\n\np"
+          + "ublic_key\030\007 \001(\01320.google.cloud.kms.v1.Im"
+          + "portJob.WrappingPublicKeyB\003\340A\003\022F\n\013attest"
+          + "ation\030\010 \001(\0132,.google.cloud.kms.v1.KeyOpe"
+          + "rationAttestationB\003\340A\003\032 \n\021WrappingPublic"
+          + "Key\022\013\n\003pem\030\001 \001(\t\"m\n\014ImportMethod\022\035\n\031IMPO"
+          + "RT_METHOD_UNSPECIFIED\020\000\022\036\n\032RSA_OAEP_3072"
+          + "_SHA1_AES_256\020\001\022\036\n\032RSA_OAEP_4096_SHA1_AE"
+          + "S_256\020\002\"c\n\016ImportJobState\022 \n\034IMPORT_JOB_"
+          + "STATE_UNSPECIFIED\020\000\022\026\n\022PENDING_GENERATIO"
+          + "N\020\001\022\n\n\006ACTIVE\020\002\022\013\n\007EXPIRED\020\003:{\352Ax\n!cloud"
+          + "kms.googleapis.com/ImportJob\022Sprojects/{"
+          + "project}/locations/{location}/keyRings/{"
+          + "key_ring}/importJobs/{import_job}\":\n\036Ext"
+          + "ernalProtectionLevelOptions\022\030\n\020external_"
+          + "key_uri\030\001 \001(\t*X\n\017ProtectionLevel\022 \n\034PROT"
+          + "ECTION_LEVEL_UNSPECIFIED\020\000\022\014\n\010SOFTWARE\020\001"
+          + "\022\007\n\003HSM\020\002\022\014\n\010EXTERNAL\020\003B\225\001\n\027com.google.c"
+          + "loud.kms.v1B\021KmsResourcesProtoP\001Z6google"
+          + ".golang.org/genproto/googleapis/cloud/km"
+          + "s/v1;kms\370\001\001\252\002\023Google.Cloud.Kms.V1\312\002\023Goog"
+          + "le\\Cloud\\Kms\\V1b\006proto3"
     };
     descriptor =
         com.google.protobuf.Descriptors.FileDescriptor.internalBuildGeneratedFileFrom(
@@ -238,6 +243,8 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "RotationPeriod",
               "VersionTemplate",
               "Labels",
+              "ImportOnly",
+              "DestroyScheduledDuration",
               "RotationSchedule",
             });
     internal_static_google_cloud_kms_v1_CryptoKey_LabelsEntry_descriptor =
@@ -290,7 +297,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
         new com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
             internal_static_google_cloud_kms_v1_PublicKey_descriptor,
             new java.lang.String[] {
-              "Pem", "Algorithm", "PemCrc32C", "Name",
+              "Pem", "Algorithm", "PemCrc32C", "Name", "ProtectionLevel",
             });
     internal_static_google_cloud_kms_v1_ImportJob_descriptor =
         getDescriptor().getMessageTypes().get(6);
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignRequest.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignRequest.java
new file mode 100644
index 00000000..36e5d012
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignRequest.java
@@ -0,0 +1,1175 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+/**
+ *
+ *
+ * <pre>
+ * Request message for [KeyManagementService.MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
+ * </pre>
+ *
+ * Protobuf type {@code google.cloud.kms.v1.MacSignRequest}
+ */
+public final class MacSignRequest extends com.google.protobuf.GeneratedMessageV3
+    implements
+    // @@protoc_insertion_point(message_implements:google.cloud.kms.v1.MacSignRequest)
+    MacSignRequestOrBuilder {
+  private static final long serialVersionUID = 0L;
+  // Use MacSignRequest.newBuilder() to construct.
+  private MacSignRequest(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+    super(builder);
+  }
+
+  private MacSignRequest() {
+    name_ = "";
+    data_ = com.google.protobuf.ByteString.EMPTY;
+  }
+
+  @java.lang.Override
+  @SuppressWarnings({"unused"})
+  protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
+    return new MacSignRequest();
+  }
+
+  @java.lang.Override
+  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
+    return this.unknownFields;
+  }
+
+  private MacSignRequest(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    this();
+    if (extensionRegistry == null) {
+      throw new java.lang.NullPointerException();
+    }
+    com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+        com.google.protobuf.UnknownFieldSet.newBuilder();
+    try {
+      boolean done = false;
+      while (!done) {
+        int tag = input.readTag();
+        switch (tag) {
+          case 0:
+            done = true;
+            break;
+          case 10:
+            {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              name_ = s;
+              break;
+            }
+          case 18:
+            {
+              data_ = input.readBytes();
+              break;
+            }
+          case 26:
+            {
+              com.google.protobuf.Int64Value.Builder subBuilder = null;
+              if (dataCrc32C_ != null) {
+                subBuilder = dataCrc32C_.toBuilder();
+              }
+              dataCrc32C_ =
+                  input.readMessage(com.google.protobuf.Int64Value.parser(), extensionRegistry);
+              if (subBuilder != null) {
+                subBuilder.mergeFrom(dataCrc32C_);
+                dataCrc32C_ = subBuilder.buildPartial();
+              }
+
+              break;
+            }
+          default:
+            {
+              if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
+                done = true;
+              }
+              break;
+            }
+        }
+      }
+    } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+      throw e.setUnfinishedMessage(this);
+    } catch (java.io.IOException e) {
+      throw new com.google.protobuf.InvalidProtocolBufferException(e).setUnfinishedMessage(this);
+    } finally {
+      this.unknownFields = unknownFields.build();
+      makeExtensionsImmutable();
+    }
+  }
+
+  public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_MacSignRequest_descriptor;
+  }
+
+  @java.lang.Override
+  protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internalGetFieldAccessorTable() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_MacSignRequest_fieldAccessorTable
+        .ensureFieldAccessorsInitialized(
+            com.google.cloud.kms.v1.MacSignRequest.class,
+            com.google.cloud.kms.v1.MacSignRequest.Builder.class);
+  }
+
+  public static final int NAME_FIELD_NUMBER = 1;
+  private volatile java.lang.Object name_;
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The name.
+   */
+  @java.lang.Override
+  public java.lang.String getName() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      return (java.lang.String) ref;
+    } else {
+      com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+      java.lang.String s = bs.toStringUtf8();
+      name_ = s;
+      return s;
+    }
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The bytes for name.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getNameBytes() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      com.google.protobuf.ByteString b =
+          com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+      name_ = b;
+      return b;
+    } else {
+      return (com.google.protobuf.ByteString) ref;
+    }
+  }
+
+  public static final int DATA_FIELD_NUMBER = 2;
+  private com.google.protobuf.ByteString data_;
+  /**
+   *
+   *
+   * <pre>
+   * Required. The data to sign. The MAC tag is computed over this data field based on
+   * the specific algorithm.
+   * </pre>
+   *
+   * <code>bytes data = 2 [(.google.api.field_behavior) = REQUIRED];</code>
+   *
+   * @return The data.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getData() {
+    return data_;
+  }
+
+  public static final int DATA_CRC32C_FIELD_NUMBER = 3;
+  private com.google.protobuf.Int64Value dataCrc32C_;
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+   * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return Whether the dataCrc32c field is set.
+   */
+  @java.lang.Override
+  public boolean hasDataCrc32C() {
+    return dataCrc32C_ != null;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+   * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return The dataCrc32c.
+   */
+  @java.lang.Override
+  public com.google.protobuf.Int64Value getDataCrc32C() {
+    return dataCrc32C_ == null ? com.google.protobuf.Int64Value.getDefaultInstance() : dataCrc32C_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+   * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   */
+  @java.lang.Override
+  public com.google.protobuf.Int64ValueOrBuilder getDataCrc32COrBuilder() {
+    return getDataCrc32C();
+  }
+
+  private byte memoizedIsInitialized = -1;
+
+  @java.lang.Override
+  public final boolean isInitialized() {
+    byte isInitialized = memoizedIsInitialized;
+    if (isInitialized == 1) return true;
+    if (isInitialized == 0) return false;
+
+    memoizedIsInitialized = 1;
+    return true;
+  }
+
+  @java.lang.Override
+  public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io.IOException {
+    if (!getNameBytes().isEmpty()) {
+      com.google.protobuf.GeneratedMessageV3.writeString(output, 1, name_);
+    }
+    if (!data_.isEmpty()) {
+      output.writeBytes(2, data_);
+    }
+    if (dataCrc32C_ != null) {
+      output.writeMessage(3, getDataCrc32C());
+    }
+    unknownFields.writeTo(output);
+  }
+
+  @java.lang.Override
+  public int getSerializedSize() {
+    int size = memoizedSize;
+    if (size != -1) return size;
+
+    size = 0;
+    if (!getNameBytes().isEmpty()) {
+      size += com.google.protobuf.GeneratedMessageV3.computeStringSize(1, name_);
+    }
+    if (!data_.isEmpty()) {
+      size += com.google.protobuf.CodedOutputStream.computeBytesSize(2, data_);
+    }
+    if (dataCrc32C_ != null) {
+      size += com.google.protobuf.CodedOutputStream.computeMessageSize(3, getDataCrc32C());
+    }
+    size += unknownFields.getSerializedSize();
+    memoizedSize = size;
+    return size;
+  }
+
+  @java.lang.Override
+  public boolean equals(final java.lang.Object obj) {
+    if (obj == this) {
+      return true;
+    }
+    if (!(obj instanceof com.google.cloud.kms.v1.MacSignRequest)) {
+      return super.equals(obj);
+    }
+    com.google.cloud.kms.v1.MacSignRequest other = (com.google.cloud.kms.v1.MacSignRequest) obj;
+
+    if (!getName().equals(other.getName())) return false;
+    if (!getData().equals(other.getData())) return false;
+    if (hasDataCrc32C() != other.hasDataCrc32C()) return false;
+    if (hasDataCrc32C()) {
+      if (!getDataCrc32C().equals(other.getDataCrc32C())) return false;
+    }
+    if (!unknownFields.equals(other.unknownFields)) return false;
+    return true;
+  }
+
+  @java.lang.Override
+  public int hashCode() {
+    if (memoizedHashCode != 0) {
+      return memoizedHashCode;
+    }
+    int hash = 41;
+    hash = (19 * hash) + getDescriptor().hashCode();
+    hash = (37 * hash) + NAME_FIELD_NUMBER;
+    hash = (53 * hash) + getName().hashCode();
+    hash = (37 * hash) + DATA_FIELD_NUMBER;
+    hash = (53 * hash) + getData().hashCode();
+    if (hasDataCrc32C()) {
+      hash = (37 * hash) + DATA_CRC32C_FIELD_NUMBER;
+      hash = (53 * hash) + getDataCrc32C().hashCode();
+    }
+    hash = (29 * hash) + unknownFields.hashCode();
+    memoizedHashCode = hash;
+    return hash;
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseFrom(java.nio.ByteBuffer data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseFrom(
+      java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseFrom(
+      com.google.protobuf.ByteString data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseFrom(
+      com.google.protobuf.ByteString data,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseFrom(byte[] data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseFrom(
+      byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseFrom(java.io.InputStream input)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseDelimitedFrom(java.io.InputStream input)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseDelimitedFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseFrom(
+      com.google.protobuf.CodedInputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest parseFrom(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  @java.lang.Override
+  public Builder newBuilderForType() {
+    return newBuilder();
+  }
+
+  public static Builder newBuilder() {
+    return DEFAULT_INSTANCE.toBuilder();
+  }
+
+  public static Builder newBuilder(com.google.cloud.kms.v1.MacSignRequest prototype) {
+    return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
+  }
+
+  @java.lang.Override
+  public Builder toBuilder() {
+    return this == DEFAULT_INSTANCE ? new Builder() : new Builder().mergeFrom(this);
+  }
+
+  @java.lang.Override
+  protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+    Builder builder = new Builder(parent);
+    return builder;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Request message for [KeyManagementService.MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
+   * </pre>
+   *
+   * Protobuf type {@code google.cloud.kms.v1.MacSignRequest}
+   */
+  public static final class Builder extends com.google.protobuf.GeneratedMessageV3.Builder<Builder>
+      implements
+      // @@protoc_insertion_point(builder_implements:google.cloud.kms.v1.MacSignRequest)
+      com.google.cloud.kms.v1.MacSignRequestOrBuilder {
+    public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacSignRequest_descriptor;
+    }
+
+    @java.lang.Override
+    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacSignRequest_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              com.google.cloud.kms.v1.MacSignRequest.class,
+              com.google.cloud.kms.v1.MacSignRequest.Builder.class);
+    }
+
+    // Construct using com.google.cloud.kms.v1.MacSignRequest.newBuilder()
+    private Builder() {
+      maybeForceBuilderInitialization();
+    }
+
+    private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+      super(parent);
+      maybeForceBuilderInitialization();
+    }
+
+    private void maybeForceBuilderInitialization() {
+      if (com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders) {}
+    }
+
+    @java.lang.Override
+    public Builder clear() {
+      super.clear();
+      name_ = "";
+
+      data_ = com.google.protobuf.ByteString.EMPTY;
+
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32C_ = null;
+      } else {
+        dataCrc32C_ = null;
+        dataCrc32CBuilder_ = null;
+      }
+      return this;
+    }
+
+    @java.lang.Override
+    public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacSignRequest_descriptor;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacSignRequest getDefaultInstanceForType() {
+      return com.google.cloud.kms.v1.MacSignRequest.getDefaultInstance();
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacSignRequest build() {
+      com.google.cloud.kms.v1.MacSignRequest result = buildPartial();
+      if (!result.isInitialized()) {
+        throw newUninitializedMessageException(result);
+      }
+      return result;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacSignRequest buildPartial() {
+      com.google.cloud.kms.v1.MacSignRequest result =
+          new com.google.cloud.kms.v1.MacSignRequest(this);
+      result.name_ = name_;
+      result.data_ = data_;
+      if (dataCrc32CBuilder_ == null) {
+        result.dataCrc32C_ = dataCrc32C_;
+      } else {
+        result.dataCrc32C_ = dataCrc32CBuilder_.build();
+      }
+      onBuilt();
+      return result;
+    }
+
+    @java.lang.Override
+    public Builder clone() {
+      return super.clone();
+    }
+
+    @java.lang.Override
+    public Builder setField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.setField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
+      return super.clearField(field);
+    }
+
+    @java.lang.Override
+    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
+      return super.clearOneof(oneof);
+    }
+
+    @java.lang.Override
+    public Builder setRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
+      return super.setRepeatedField(field, index, value);
+    }
+
+    @java.lang.Override
+    public Builder addRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.addRepeatedField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(com.google.protobuf.Message other) {
+      if (other instanceof com.google.cloud.kms.v1.MacSignRequest) {
+        return mergeFrom((com.google.cloud.kms.v1.MacSignRequest) other);
+      } else {
+        super.mergeFrom(other);
+        return this;
+      }
+    }
+
+    public Builder mergeFrom(com.google.cloud.kms.v1.MacSignRequest other) {
+      if (other == com.google.cloud.kms.v1.MacSignRequest.getDefaultInstance()) return this;
+      if (!other.getName().isEmpty()) {
+        name_ = other.name_;
+        onChanged();
+      }
+      if (other.getData() != com.google.protobuf.ByteString.EMPTY) {
+        setData(other.getData());
+      }
+      if (other.hasDataCrc32C()) {
+        mergeDataCrc32C(other.getDataCrc32C());
+      }
+      this.mergeUnknownFields(other.unknownFields);
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final boolean isInitialized() {
+      return true;
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      com.google.cloud.kms.v1.MacSignRequest parsedMessage = null;
+      try {
+        parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        parsedMessage = (com.google.cloud.kms.v1.MacSignRequest) e.getUnfinishedMessage();
+        throw e.unwrapIOException();
+      } finally {
+        if (parsedMessage != null) {
+          mergeFrom(parsedMessage);
+        }
+      }
+      return this;
+    }
+
+    private java.lang.Object name_ = "";
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return The name.
+     */
+    public java.lang.String getName() {
+      java.lang.Object ref = name_;
+      if (!(ref instanceof java.lang.String)) {
+        com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        name_ = s;
+        return s;
+      } else {
+        return (java.lang.String) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return The bytes for name.
+     */
+    public com.google.protobuf.ByteString getNameBytes() {
+      java.lang.Object ref = name_;
+      if (ref instanceof String) {
+        com.google.protobuf.ByteString b =
+            com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+        name_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @param value The name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setName(java.lang.String value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearName() {
+
+      name_ = getDefaultInstance().getName();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @param value The bytes for name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setNameBytes(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+      checkByteStringIsUtf8(value);
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+
+    private com.google.protobuf.ByteString data_ = com.google.protobuf.ByteString.EMPTY;
+    /**
+     *
+     *
+     * <pre>
+     * Required. The data to sign. The MAC tag is computed over this data field based on
+     * the specific algorithm.
+     * </pre>
+     *
+     * <code>bytes data = 2 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @return The data.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString getData() {
+      return data_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The data to sign. The MAC tag is computed over this data field based on
+     * the specific algorithm.
+     * </pre>
+     *
+     * <code>bytes data = 2 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @param value The data to set.
+     * @return This builder for chaining.
+     */
+    public Builder setData(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      data_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The data to sign. The MAC tag is computed over this data field based on
+     * the specific algorithm.
+     * </pre>
+     *
+     * <code>bytes data = 2 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearData() {
+
+      data_ = getDefaultInstance().getData();
+      onChanged();
+      return this;
+    }
+
+    private com.google.protobuf.Int64Value dataCrc32C_;
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Int64Value,
+            com.google.protobuf.Int64Value.Builder,
+            com.google.protobuf.Int64ValueOrBuilder>
+        dataCrc32CBuilder_;
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     *
+     * @return Whether the dataCrc32c field is set.
+     */
+    public boolean hasDataCrc32C() {
+      return dataCrc32CBuilder_ != null || dataCrc32C_ != null;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     *
+     * @return The dataCrc32c.
+     */
+    public com.google.protobuf.Int64Value getDataCrc32C() {
+      if (dataCrc32CBuilder_ == null) {
+        return dataCrc32C_ == null
+            ? com.google.protobuf.Int64Value.getDefaultInstance()
+            : dataCrc32C_;
+      } else {
+        return dataCrc32CBuilder_.getMessage();
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder setDataCrc32C(com.google.protobuf.Int64Value value) {
+      if (dataCrc32CBuilder_ == null) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+        dataCrc32C_ = value;
+        onChanged();
+      } else {
+        dataCrc32CBuilder_.setMessage(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder setDataCrc32C(com.google.protobuf.Int64Value.Builder builderForValue) {
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32C_ = builderForValue.build();
+        onChanged();
+      } else {
+        dataCrc32CBuilder_.setMessage(builderForValue.build());
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder mergeDataCrc32C(com.google.protobuf.Int64Value value) {
+      if (dataCrc32CBuilder_ == null) {
+        if (dataCrc32C_ != null) {
+          dataCrc32C_ =
+              com.google.protobuf.Int64Value.newBuilder(dataCrc32C_)
+                  .mergeFrom(value)
+                  .buildPartial();
+        } else {
+          dataCrc32C_ = value;
+        }
+        onChanged();
+      } else {
+        dataCrc32CBuilder_.mergeFrom(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder clearDataCrc32C() {
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32C_ = null;
+        onChanged();
+      } else {
+        dataCrc32C_ = null;
+        dataCrc32CBuilder_ = null;
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public com.google.protobuf.Int64Value.Builder getDataCrc32CBuilder() {
+
+      onChanged();
+      return getDataCrc32CFieldBuilder().getBuilder();
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public com.google.protobuf.Int64ValueOrBuilder getDataCrc32COrBuilder() {
+      if (dataCrc32CBuilder_ != null) {
+        return dataCrc32CBuilder_.getMessageOrBuilder();
+      } else {
+        return dataCrc32C_ == null
+            ? com.google.protobuf.Int64Value.getDefaultInstance()
+            : dataCrc32C_;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Int64Value,
+            com.google.protobuf.Int64Value.Builder,
+            com.google.protobuf.Int64ValueOrBuilder>
+        getDataCrc32CFieldBuilder() {
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32CBuilder_ =
+            new com.google.protobuf.SingleFieldBuilderV3<
+                com.google.protobuf.Int64Value,
+                com.google.protobuf.Int64Value.Builder,
+                com.google.protobuf.Int64ValueOrBuilder>(
+                getDataCrc32C(), getParentForChildren(), isClean());
+        dataCrc32C_ = null;
+      }
+      return dataCrc32CBuilder_;
+    }
+
+    @java.lang.Override
+    public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.setUnknownFields(unknownFields);
+    }
+
+    @java.lang.Override
+    public final Builder mergeUnknownFields(
+        final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.mergeUnknownFields(unknownFields);
+    }
+
+    // @@protoc_insertion_point(builder_scope:google.cloud.kms.v1.MacSignRequest)
+  }
+
+  // @@protoc_insertion_point(class_scope:google.cloud.kms.v1.MacSignRequest)
+  private static final com.google.cloud.kms.v1.MacSignRequest DEFAULT_INSTANCE;
+
+  static {
+    DEFAULT_INSTANCE = new com.google.cloud.kms.v1.MacSignRequest();
+  }
+
+  public static com.google.cloud.kms.v1.MacSignRequest getDefaultInstance() {
+    return DEFAULT_INSTANCE;
+  }
+
+  private static final com.google.protobuf.Parser<MacSignRequest> PARSER =
+      new com.google.protobuf.AbstractParser<MacSignRequest>() {
+        @java.lang.Override
+        public MacSignRequest parsePartialFrom(
+            com.google.protobuf.CodedInputStream input,
+            com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+            throws com.google.protobuf.InvalidProtocolBufferException {
+          return new MacSignRequest(input, extensionRegistry);
+        }
+      };
+
+  public static com.google.protobuf.Parser<MacSignRequest> parser() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.protobuf.Parser<MacSignRequest> getParserForType() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.cloud.kms.v1.MacSignRequest getDefaultInstanceForType() {
+    return DEFAULT_INSTANCE;
+  }
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignRequestOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignRequestOrBuilder.java
new file mode 100644
index 00000000..271ae7a0
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignRequestOrBuilder.java
@@ -0,0 +1,142 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+public interface MacSignRequestOrBuilder
+    extends
+    // @@protoc_insertion_point(interface_extends:google.cloud.kms.v1.MacSignRequest)
+    com.google.protobuf.MessageOrBuilder {
+
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The name.
+   */
+  java.lang.String getName();
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The bytes for name.
+   */
+  com.google.protobuf.ByteString getNameBytes();
+
+  /**
+   *
+   *
+   * <pre>
+   * Required. The data to sign. The MAC tag is computed over this data field based on
+   * the specific algorithm.
+   * </pre>
+   *
+   * <code>bytes data = 2 [(.google.api.field_behavior) = REQUIRED];</code>
+   *
+   * @return The data.
+   */
+  com.google.protobuf.ByteString getData();
+
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+   * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return Whether the dataCrc32c field is set.
+   */
+  boolean hasDataCrc32C();
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+   * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return The dataCrc32c.
+   */
+  com.google.protobuf.Int64Value getDataCrc32C();
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+   * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   */
+  com.google.protobuf.Int64ValueOrBuilder getDataCrc32COrBuilder();
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignResponse.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignResponse.java
new file mode 100644
index 00000000..7ae85711
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignResponse.java
@@ -0,0 +1,1396 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+/**
+ *
+ *
+ * <pre>
+ * Response message for [KeyManagementService.MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
+ * </pre>
+ *
+ * Protobuf type {@code google.cloud.kms.v1.MacSignResponse}
+ */
+public final class MacSignResponse extends com.google.protobuf.GeneratedMessageV3
+    implements
+    // @@protoc_insertion_point(message_implements:google.cloud.kms.v1.MacSignResponse)
+    MacSignResponseOrBuilder {
+  private static final long serialVersionUID = 0L;
+  // Use MacSignResponse.newBuilder() to construct.
+  private MacSignResponse(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+    super(builder);
+  }
+
+  private MacSignResponse() {
+    name_ = "";
+    mac_ = com.google.protobuf.ByteString.EMPTY;
+    protectionLevel_ = 0;
+  }
+
+  @java.lang.Override
+  @SuppressWarnings({"unused"})
+  protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
+    return new MacSignResponse();
+  }
+
+  @java.lang.Override
+  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
+    return this.unknownFields;
+  }
+
+  private MacSignResponse(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    this();
+    if (extensionRegistry == null) {
+      throw new java.lang.NullPointerException();
+    }
+    com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+        com.google.protobuf.UnknownFieldSet.newBuilder();
+    try {
+      boolean done = false;
+      while (!done) {
+        int tag = input.readTag();
+        switch (tag) {
+          case 0:
+            done = true;
+            break;
+          case 10:
+            {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              name_ = s;
+              break;
+            }
+          case 18:
+            {
+              mac_ = input.readBytes();
+              break;
+            }
+          case 26:
+            {
+              com.google.protobuf.Int64Value.Builder subBuilder = null;
+              if (macCrc32C_ != null) {
+                subBuilder = macCrc32C_.toBuilder();
+              }
+              macCrc32C_ =
+                  input.readMessage(com.google.protobuf.Int64Value.parser(), extensionRegistry);
+              if (subBuilder != null) {
+                subBuilder.mergeFrom(macCrc32C_);
+                macCrc32C_ = subBuilder.buildPartial();
+              }
+
+              break;
+            }
+          case 32:
+            {
+              verifiedDataCrc32C_ = input.readBool();
+              break;
+            }
+          case 40:
+            {
+              int rawValue = input.readEnum();
+
+              protectionLevel_ = rawValue;
+              break;
+            }
+          default:
+            {
+              if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
+                done = true;
+              }
+              break;
+            }
+        }
+      }
+    } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+      throw e.setUnfinishedMessage(this);
+    } catch (java.io.IOException e) {
+      throw new com.google.protobuf.InvalidProtocolBufferException(e).setUnfinishedMessage(this);
+    } finally {
+      this.unknownFields = unknownFields.build();
+      makeExtensionsImmutable();
+    }
+  }
+
+  public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_MacSignResponse_descriptor;
+  }
+
+  @java.lang.Override
+  protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internalGetFieldAccessorTable() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_MacSignResponse_fieldAccessorTable
+        .ensureFieldAccessorsInitialized(
+            com.google.cloud.kms.v1.MacSignResponse.class,
+            com.google.cloud.kms.v1.MacSignResponse.Builder.class);
+  }
+
+  public static final int NAME_FIELD_NUMBER = 1;
+  private volatile java.lang.Object name_;
+  /**
+   *
+   *
+   * <pre>
+   * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
+   * this field to verify that the intended resource was used for signing.
+   * </pre>
+   *
+   * <code>string name = 1;</code>
+   *
+   * @return The name.
+   */
+  @java.lang.Override
+  public java.lang.String getName() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      return (java.lang.String) ref;
+    } else {
+      com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+      java.lang.String s = bs.toStringUtf8();
+      name_ = s;
+      return s;
+    }
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
+   * this field to verify that the intended resource was used for signing.
+   * </pre>
+   *
+   * <code>string name = 1;</code>
+   *
+   * @return The bytes for name.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getNameBytes() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      com.google.protobuf.ByteString b =
+          com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+      name_ = b;
+      return b;
+    } else {
+      return (com.google.protobuf.ByteString) ref;
+    }
+  }
+
+  public static final int MAC_FIELD_NUMBER = 2;
+  private com.google.protobuf.ByteString mac_;
+  /**
+   *
+   *
+   * <pre>
+   * The created signature.
+   * </pre>
+   *
+   * <code>bytes mac = 2;</code>
+   *
+   * @return The mac.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getMac() {
+    return mac_;
+  }
+
+  public static final int MAC_CRC32C_FIELD_NUMBER = 3;
+  private com.google.protobuf.Int64Value macCrc32C_;
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+   * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+   *
+   * @return Whether the macCrc32c field is set.
+   */
+  @java.lang.Override
+  public boolean hasMacCrc32C() {
+    return macCrc32C_ != null;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+   * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+   *
+   * @return The macCrc32c.
+   */
+  @java.lang.Override
+  public com.google.protobuf.Int64Value getMacCrc32C() {
+    return macCrc32C_ == null ? com.google.protobuf.Int64Value.getDefaultInstance() : macCrc32C_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+   * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+   */
+  @java.lang.Override
+  public com.google.protobuf.Int64ValueOrBuilder getMacCrc32COrBuilder() {
+    return getMacCrc32C();
+  }
+
+  public static final int VERIFIED_DATA_CRC32C_FIELD_NUMBER = 4;
+  private boolean verifiedDataCrc32C_;
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A flag indicating whether
+   * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was received by
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+   * [data][google.cloud.kms.v1.MacSignRequest.data]. A false value of this field
+   * indicates either that [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was left
+   * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+   * set [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] but this field is still false,
+   * discard the response and perform a limited number of retries.
+   * </pre>
+   *
+   * <code>bool verified_data_crc32c = 4;</code>
+   *
+   * @return The verifiedDataCrc32c.
+   */
+  @java.lang.Override
+  public boolean getVerifiedDataCrc32C() {
+    return verifiedDataCrc32C_;
+  }
+
+  public static final int PROTECTION_LEVEL_FIELD_NUMBER = 5;
+  private int protectionLevel_;
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  @java.lang.Override
+  public int getProtectionLevelValue() {
+    return protectionLevel_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+   *
+   * @return The protectionLevel.
+   */
+  @java.lang.Override
+  public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+    @SuppressWarnings("deprecation")
+    com.google.cloud.kms.v1.ProtectionLevel result =
+        com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+    return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+  }
+
+  private byte memoizedIsInitialized = -1;
+
+  @java.lang.Override
+  public final boolean isInitialized() {
+    byte isInitialized = memoizedIsInitialized;
+    if (isInitialized == 1) return true;
+    if (isInitialized == 0) return false;
+
+    memoizedIsInitialized = 1;
+    return true;
+  }
+
+  @java.lang.Override
+  public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io.IOException {
+    if (!getNameBytes().isEmpty()) {
+      com.google.protobuf.GeneratedMessageV3.writeString(output, 1, name_);
+    }
+    if (!mac_.isEmpty()) {
+      output.writeBytes(2, mac_);
+    }
+    if (macCrc32C_ != null) {
+      output.writeMessage(3, getMacCrc32C());
+    }
+    if (verifiedDataCrc32C_ != false) {
+      output.writeBool(4, verifiedDataCrc32C_);
+    }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      output.writeEnum(5, protectionLevel_);
+    }
+    unknownFields.writeTo(output);
+  }
+
+  @java.lang.Override
+  public int getSerializedSize() {
+    int size = memoizedSize;
+    if (size != -1) return size;
+
+    size = 0;
+    if (!getNameBytes().isEmpty()) {
+      size += com.google.protobuf.GeneratedMessageV3.computeStringSize(1, name_);
+    }
+    if (!mac_.isEmpty()) {
+      size += com.google.protobuf.CodedOutputStream.computeBytesSize(2, mac_);
+    }
+    if (macCrc32C_ != null) {
+      size += com.google.protobuf.CodedOutputStream.computeMessageSize(3, getMacCrc32C());
+    }
+    if (verifiedDataCrc32C_ != false) {
+      size += com.google.protobuf.CodedOutputStream.computeBoolSize(4, verifiedDataCrc32C_);
+    }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      size += com.google.protobuf.CodedOutputStream.computeEnumSize(5, protectionLevel_);
+    }
+    size += unknownFields.getSerializedSize();
+    memoizedSize = size;
+    return size;
+  }
+
+  @java.lang.Override
+  public boolean equals(final java.lang.Object obj) {
+    if (obj == this) {
+      return true;
+    }
+    if (!(obj instanceof com.google.cloud.kms.v1.MacSignResponse)) {
+      return super.equals(obj);
+    }
+    com.google.cloud.kms.v1.MacSignResponse other = (com.google.cloud.kms.v1.MacSignResponse) obj;
+
+    if (!getName().equals(other.getName())) return false;
+    if (!getMac().equals(other.getMac())) return false;
+    if (hasMacCrc32C() != other.hasMacCrc32C()) return false;
+    if (hasMacCrc32C()) {
+      if (!getMacCrc32C().equals(other.getMacCrc32C())) return false;
+    }
+    if (getVerifiedDataCrc32C() != other.getVerifiedDataCrc32C()) return false;
+    if (protectionLevel_ != other.protectionLevel_) return false;
+    if (!unknownFields.equals(other.unknownFields)) return false;
+    return true;
+  }
+
+  @java.lang.Override
+  public int hashCode() {
+    if (memoizedHashCode != 0) {
+      return memoizedHashCode;
+    }
+    int hash = 41;
+    hash = (19 * hash) + getDescriptor().hashCode();
+    hash = (37 * hash) + NAME_FIELD_NUMBER;
+    hash = (53 * hash) + getName().hashCode();
+    hash = (37 * hash) + MAC_FIELD_NUMBER;
+    hash = (53 * hash) + getMac().hashCode();
+    if (hasMacCrc32C()) {
+      hash = (37 * hash) + MAC_CRC32C_FIELD_NUMBER;
+      hash = (53 * hash) + getMacCrc32C().hashCode();
+    }
+    hash = (37 * hash) + VERIFIED_DATA_CRC32C_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getVerifiedDataCrc32C());
+    hash = (37 * hash) + PROTECTION_LEVEL_FIELD_NUMBER;
+    hash = (53 * hash) + protectionLevel_;
+    hash = (29 * hash) + unknownFields.hashCode();
+    memoizedHashCode = hash;
+    return hash;
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseFrom(java.nio.ByteBuffer data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseFrom(
+      java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseFrom(
+      com.google.protobuf.ByteString data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseFrom(
+      com.google.protobuf.ByteString data,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseFrom(byte[] data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseFrom(
+      byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseFrom(java.io.InputStream input)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseDelimitedFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseDelimitedFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseFrom(
+      com.google.protobuf.CodedInputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse parseFrom(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  @java.lang.Override
+  public Builder newBuilderForType() {
+    return newBuilder();
+  }
+
+  public static Builder newBuilder() {
+    return DEFAULT_INSTANCE.toBuilder();
+  }
+
+  public static Builder newBuilder(com.google.cloud.kms.v1.MacSignResponse prototype) {
+    return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
+  }
+
+  @java.lang.Override
+  public Builder toBuilder() {
+    return this == DEFAULT_INSTANCE ? new Builder() : new Builder().mergeFrom(this);
+  }
+
+  @java.lang.Override
+  protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+    Builder builder = new Builder(parent);
+    return builder;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Response message for [KeyManagementService.MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
+   * </pre>
+   *
+   * Protobuf type {@code google.cloud.kms.v1.MacSignResponse}
+   */
+  public static final class Builder extends com.google.protobuf.GeneratedMessageV3.Builder<Builder>
+      implements
+      // @@protoc_insertion_point(builder_implements:google.cloud.kms.v1.MacSignResponse)
+      com.google.cloud.kms.v1.MacSignResponseOrBuilder {
+    public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacSignResponse_descriptor;
+    }
+
+    @java.lang.Override
+    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacSignResponse_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              com.google.cloud.kms.v1.MacSignResponse.class,
+              com.google.cloud.kms.v1.MacSignResponse.Builder.class);
+    }
+
+    // Construct using com.google.cloud.kms.v1.MacSignResponse.newBuilder()
+    private Builder() {
+      maybeForceBuilderInitialization();
+    }
+
+    private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+      super(parent);
+      maybeForceBuilderInitialization();
+    }
+
+    private void maybeForceBuilderInitialization() {
+      if (com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders) {}
+    }
+
+    @java.lang.Override
+    public Builder clear() {
+      super.clear();
+      name_ = "";
+
+      mac_ = com.google.protobuf.ByteString.EMPTY;
+
+      if (macCrc32CBuilder_ == null) {
+        macCrc32C_ = null;
+      } else {
+        macCrc32C_ = null;
+        macCrc32CBuilder_ = null;
+      }
+      verifiedDataCrc32C_ = false;
+
+      protectionLevel_ = 0;
+
+      return this;
+    }
+
+    @java.lang.Override
+    public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacSignResponse_descriptor;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacSignResponse getDefaultInstanceForType() {
+      return com.google.cloud.kms.v1.MacSignResponse.getDefaultInstance();
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacSignResponse build() {
+      com.google.cloud.kms.v1.MacSignResponse result = buildPartial();
+      if (!result.isInitialized()) {
+        throw newUninitializedMessageException(result);
+      }
+      return result;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacSignResponse buildPartial() {
+      com.google.cloud.kms.v1.MacSignResponse result =
+          new com.google.cloud.kms.v1.MacSignResponse(this);
+      result.name_ = name_;
+      result.mac_ = mac_;
+      if (macCrc32CBuilder_ == null) {
+        result.macCrc32C_ = macCrc32C_;
+      } else {
+        result.macCrc32C_ = macCrc32CBuilder_.build();
+      }
+      result.verifiedDataCrc32C_ = verifiedDataCrc32C_;
+      result.protectionLevel_ = protectionLevel_;
+      onBuilt();
+      return result;
+    }
+
+    @java.lang.Override
+    public Builder clone() {
+      return super.clone();
+    }
+
+    @java.lang.Override
+    public Builder setField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.setField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
+      return super.clearField(field);
+    }
+
+    @java.lang.Override
+    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
+      return super.clearOneof(oneof);
+    }
+
+    @java.lang.Override
+    public Builder setRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
+      return super.setRepeatedField(field, index, value);
+    }
+
+    @java.lang.Override
+    public Builder addRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.addRepeatedField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(com.google.protobuf.Message other) {
+      if (other instanceof com.google.cloud.kms.v1.MacSignResponse) {
+        return mergeFrom((com.google.cloud.kms.v1.MacSignResponse) other);
+      } else {
+        super.mergeFrom(other);
+        return this;
+      }
+    }
+
+    public Builder mergeFrom(com.google.cloud.kms.v1.MacSignResponse other) {
+      if (other == com.google.cloud.kms.v1.MacSignResponse.getDefaultInstance()) return this;
+      if (!other.getName().isEmpty()) {
+        name_ = other.name_;
+        onChanged();
+      }
+      if (other.getMac() != com.google.protobuf.ByteString.EMPTY) {
+        setMac(other.getMac());
+      }
+      if (other.hasMacCrc32C()) {
+        mergeMacCrc32C(other.getMacCrc32C());
+      }
+      if (other.getVerifiedDataCrc32C() != false) {
+        setVerifiedDataCrc32C(other.getVerifiedDataCrc32C());
+      }
+      if (other.protectionLevel_ != 0) {
+        setProtectionLevelValue(other.getProtectionLevelValue());
+      }
+      this.mergeUnknownFields(other.unknownFields);
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final boolean isInitialized() {
+      return true;
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      com.google.cloud.kms.v1.MacSignResponse parsedMessage = null;
+      try {
+        parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        parsedMessage = (com.google.cloud.kms.v1.MacSignResponse) e.getUnfinishedMessage();
+        throw e.unwrapIOException();
+      } finally {
+        if (parsedMessage != null) {
+          mergeFrom(parsedMessage);
+        }
+      }
+      return this;
+    }
+
+    private java.lang.Object name_ = "";
+    /**
+     *
+     *
+     * <pre>
+     * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
+     * this field to verify that the intended resource was used for signing.
+     * </pre>
+     *
+     * <code>string name = 1;</code>
+     *
+     * @return The name.
+     */
+    public java.lang.String getName() {
+      java.lang.Object ref = name_;
+      if (!(ref instanceof java.lang.String)) {
+        com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        name_ = s;
+        return s;
+      } else {
+        return (java.lang.String) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
+     * this field to verify that the intended resource was used for signing.
+     * </pre>
+     *
+     * <code>string name = 1;</code>
+     *
+     * @return The bytes for name.
+     */
+    public com.google.protobuf.ByteString getNameBytes() {
+      java.lang.Object ref = name_;
+      if (ref instanceof String) {
+        com.google.protobuf.ByteString b =
+            com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+        name_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
+     * this field to verify that the intended resource was used for signing.
+     * </pre>
+     *
+     * <code>string name = 1;</code>
+     *
+     * @param value The name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setName(java.lang.String value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
+     * this field to verify that the intended resource was used for signing.
+     * </pre>
+     *
+     * <code>string name = 1;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearName() {
+
+      name_ = getDefaultInstance().getName();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
+     * this field to verify that the intended resource was used for signing.
+     * </pre>
+     *
+     * <code>string name = 1;</code>
+     *
+     * @param value The bytes for name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setNameBytes(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+      checkByteStringIsUtf8(value);
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+
+    private com.google.protobuf.ByteString mac_ = com.google.protobuf.ByteString.EMPTY;
+    /**
+     *
+     *
+     * <pre>
+     * The created signature.
+     * </pre>
+     *
+     * <code>bytes mac = 2;</code>
+     *
+     * @return The mac.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString getMac() {
+      return mac_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The created signature.
+     * </pre>
+     *
+     * <code>bytes mac = 2;</code>
+     *
+     * @param value The mac to set.
+     * @return This builder for chaining.
+     */
+    public Builder setMac(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      mac_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The created signature.
+     * </pre>
+     *
+     * <code>bytes mac = 2;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearMac() {
+
+      mac_ = getDefaultInstance().getMac();
+      onChanged();
+      return this;
+    }
+
+    private com.google.protobuf.Int64Value macCrc32C_;
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Int64Value,
+            com.google.protobuf.Int64Value.Builder,
+            com.google.protobuf.Int64ValueOrBuilder>
+        macCrc32CBuilder_;
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+     * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+     *
+     * @return Whether the macCrc32c field is set.
+     */
+    public boolean hasMacCrc32C() {
+      return macCrc32CBuilder_ != null || macCrc32C_ != null;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+     * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+     *
+     * @return The macCrc32c.
+     */
+    public com.google.protobuf.Int64Value getMacCrc32C() {
+      if (macCrc32CBuilder_ == null) {
+        return macCrc32C_ == null
+            ? com.google.protobuf.Int64Value.getDefaultInstance()
+            : macCrc32C_;
+      } else {
+        return macCrc32CBuilder_.getMessage();
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+     * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+     */
+    public Builder setMacCrc32C(com.google.protobuf.Int64Value value) {
+      if (macCrc32CBuilder_ == null) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+        macCrc32C_ = value;
+        onChanged();
+      } else {
+        macCrc32CBuilder_.setMessage(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+     * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+     */
+    public Builder setMacCrc32C(com.google.protobuf.Int64Value.Builder builderForValue) {
+      if (macCrc32CBuilder_ == null) {
+        macCrc32C_ = builderForValue.build();
+        onChanged();
+      } else {
+        macCrc32CBuilder_.setMessage(builderForValue.build());
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+     * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+     */
+    public Builder mergeMacCrc32C(com.google.protobuf.Int64Value value) {
+      if (macCrc32CBuilder_ == null) {
+        if (macCrc32C_ != null) {
+          macCrc32C_ =
+              com.google.protobuf.Int64Value.newBuilder(macCrc32C_).mergeFrom(value).buildPartial();
+        } else {
+          macCrc32C_ = value;
+        }
+        onChanged();
+      } else {
+        macCrc32CBuilder_.mergeFrom(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+     * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+     */
+    public Builder clearMacCrc32C() {
+      if (macCrc32CBuilder_ == null) {
+        macCrc32C_ = null;
+        onChanged();
+      } else {
+        macCrc32C_ = null;
+        macCrc32CBuilder_ = null;
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+     * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+     */
+    public com.google.protobuf.Int64Value.Builder getMacCrc32CBuilder() {
+
+      onChanged();
+      return getMacCrc32CFieldBuilder().getBuilder();
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+     * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+     */
+    public com.google.protobuf.Int64ValueOrBuilder getMacCrc32COrBuilder() {
+      if (macCrc32CBuilder_ != null) {
+        return macCrc32CBuilder_.getMessageOrBuilder();
+      } else {
+        return macCrc32C_ == null
+            ? com.google.protobuf.Int64Value.getDefaultInstance()
+            : macCrc32C_;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A CRC32C checksum of the returned
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+     * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+     * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+     * results to this field. Discard the response in case of non-matching
+     * checksum values, and perform a limited number of retries. A persistent
+     * mismatch may indicate an issue in your computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+     */
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Int64Value,
+            com.google.protobuf.Int64Value.Builder,
+            com.google.protobuf.Int64ValueOrBuilder>
+        getMacCrc32CFieldBuilder() {
+      if (macCrc32CBuilder_ == null) {
+        macCrc32CBuilder_ =
+            new com.google.protobuf.SingleFieldBuilderV3<
+                com.google.protobuf.Int64Value,
+                com.google.protobuf.Int64Value.Builder,
+                com.google.protobuf.Int64ValueOrBuilder>(
+                getMacCrc32C(), getParentForChildren(), isClean());
+        macCrc32C_ = null;
+      }
+      return macCrc32CBuilder_;
+    }
+
+    private boolean verifiedDataCrc32C_;
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A flag indicating whether
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was received by
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+     * [data][google.cloud.kms.v1.MacSignRequest.data]. A false value of this field
+     * indicates either that [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was left
+     * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+     * set [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] but this field is still false,
+     * discard the response and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_data_crc32c = 4;</code>
+     *
+     * @return The verifiedDataCrc32c.
+     */
+    @java.lang.Override
+    public boolean getVerifiedDataCrc32C() {
+      return verifiedDataCrc32C_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A flag indicating whether
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was received by
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+     * [data][google.cloud.kms.v1.MacSignRequest.data]. A false value of this field
+     * indicates either that [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was left
+     * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+     * set [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] but this field is still false,
+     * discard the response and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_data_crc32c = 4;</code>
+     *
+     * @param value The verifiedDataCrc32c to set.
+     * @return This builder for chaining.
+     */
+    public Builder setVerifiedDataCrc32C(boolean value) {
+
+      verifiedDataCrc32C_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A flag indicating whether
+     * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was received by
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+     * [data][google.cloud.kms.v1.MacSignRequest.data]. A false value of this field
+     * indicates either that [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was left
+     * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+     * set [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] but this field is still false,
+     * discard the response and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_data_crc32c = 4;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearVerifiedDataCrc32C() {
+
+      verifiedDataCrc32C_ = false;
+      onChanged();
+      return this;
+    }
+
+    private int protectionLevel_ = 0;
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+     *
+     * @return The enum numeric value on the wire for protectionLevel.
+     */
+    @java.lang.Override
+    public int getProtectionLevelValue() {
+      return protectionLevel_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+     *
+     * @param value The enum numeric value on the wire for protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevelValue(int value) {
+
+      protectionLevel_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+     *
+     * @return The protectionLevel.
+     */
+    @java.lang.Override
+    public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+      @SuppressWarnings("deprecation")
+      com.google.cloud.kms.v1.ProtectionLevel result =
+          com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+      return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+     *
+     * @param value The protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevel(com.google.cloud.kms.v1.ProtectionLevel value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      protectionLevel_ = value.getNumber();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearProtectionLevel() {
+
+      protectionLevel_ = 0;
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.setUnknownFields(unknownFields);
+    }
+
+    @java.lang.Override
+    public final Builder mergeUnknownFields(
+        final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.mergeUnknownFields(unknownFields);
+    }
+
+    // @@protoc_insertion_point(builder_scope:google.cloud.kms.v1.MacSignResponse)
+  }
+
+  // @@protoc_insertion_point(class_scope:google.cloud.kms.v1.MacSignResponse)
+  private static final com.google.cloud.kms.v1.MacSignResponse DEFAULT_INSTANCE;
+
+  static {
+    DEFAULT_INSTANCE = new com.google.cloud.kms.v1.MacSignResponse();
+  }
+
+  public static com.google.cloud.kms.v1.MacSignResponse getDefaultInstance() {
+    return DEFAULT_INSTANCE;
+  }
+
+  private static final com.google.protobuf.Parser<MacSignResponse> PARSER =
+      new com.google.protobuf.AbstractParser<MacSignResponse>() {
+        @java.lang.Override
+        public MacSignResponse parsePartialFrom(
+            com.google.protobuf.CodedInputStream input,
+            com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+            throws com.google.protobuf.InvalidProtocolBufferException {
+          return new MacSignResponse(input, extensionRegistry);
+        }
+      };
+
+  public static com.google.protobuf.Parser<MacSignResponse> parser() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.protobuf.Parser<MacSignResponse> getParserForType() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.cloud.kms.v1.MacSignResponse getDefaultInstanceForType() {
+    return DEFAULT_INSTANCE;
+  }
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignResponseOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignResponseOrBuilder.java
new file mode 100644
index 00000000..5e9ae9f5
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignResponseOrBuilder.java
@@ -0,0 +1,175 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+public interface MacSignResponseOrBuilder
+    extends
+    // @@protoc_insertion_point(interface_extends:google.cloud.kms.v1.MacSignResponse)
+    com.google.protobuf.MessageOrBuilder {
+
+  /**
+   *
+   *
+   * <pre>
+   * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
+   * this field to verify that the intended resource was used for signing.
+   * </pre>
+   *
+   * <code>string name = 1;</code>
+   *
+   * @return The name.
+   */
+  java.lang.String getName();
+  /**
+   *
+   *
+   * <pre>
+   * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
+   * this field to verify that the intended resource was used for signing.
+   * </pre>
+   *
+   * <code>string name = 1;</code>
+   *
+   * @return The bytes for name.
+   */
+  com.google.protobuf.ByteString getNameBytes();
+
+  /**
+   *
+   *
+   * <pre>
+   * The created signature.
+   * </pre>
+   *
+   * <code>bytes mac = 2;</code>
+   *
+   * @return The mac.
+   */
+  com.google.protobuf.ByteString getMac();
+
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+   * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+   *
+   * @return Whether the macCrc32c field is set.
+   */
+  boolean hasMacCrc32C();
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+   * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+   *
+   * @return The macCrc32c.
+   */
+  com.google.protobuf.Int64Value getMacCrc32C();
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A CRC32C checksum of the returned
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+   * [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+   * CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+   * results to this field. Discard the response in case of non-matching
+   * checksum values, and perform a limited number of retries. A persistent
+   * mismatch may indicate an issue in your computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 3;</code>
+   */
+  com.google.protobuf.Int64ValueOrBuilder getMacCrc32COrBuilder();
+
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A flag indicating whether
+   * [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was received by
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+   * [data][google.cloud.kms.v1.MacSignRequest.data]. A false value of this field
+   * indicates either that [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was left
+   * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+   * set [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] but this field is still false,
+   * discard the response and perform a limited number of retries.
+   * </pre>
+   *
+   * <code>bool verified_data_crc32c = 4;</code>
+   *
+   * @return The verifiedDataCrc32c.
+   */
+  boolean getVerifiedDataCrc32C();
+
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  int getProtectionLevelValue();
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+   *
+   * @return The protectionLevel.
+   */
+  com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel();
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyRequest.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyRequest.java
new file mode 100644
index 00000000..52ac29ad
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyRequest.java
@@ -0,0 +1,1697 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+/**
+ *
+ *
+ * <pre>
+ * Request message for [KeyManagementService.MacVerify][google.cloud.kms.v1.KeyManagementService.MacVerify].
+ * </pre>
+ *
+ * Protobuf type {@code google.cloud.kms.v1.MacVerifyRequest}
+ */
+public final class MacVerifyRequest extends com.google.protobuf.GeneratedMessageV3
+    implements
+    // @@protoc_insertion_point(message_implements:google.cloud.kms.v1.MacVerifyRequest)
+    MacVerifyRequestOrBuilder {
+  private static final long serialVersionUID = 0L;
+  // Use MacVerifyRequest.newBuilder() to construct.
+  private MacVerifyRequest(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+    super(builder);
+  }
+
+  private MacVerifyRequest() {
+    name_ = "";
+    data_ = com.google.protobuf.ByteString.EMPTY;
+    mac_ = com.google.protobuf.ByteString.EMPTY;
+  }
+
+  @java.lang.Override
+  @SuppressWarnings({"unused"})
+  protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
+    return new MacVerifyRequest();
+  }
+
+  @java.lang.Override
+  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
+    return this.unknownFields;
+  }
+
+  private MacVerifyRequest(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    this();
+    if (extensionRegistry == null) {
+      throw new java.lang.NullPointerException();
+    }
+    com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+        com.google.protobuf.UnknownFieldSet.newBuilder();
+    try {
+      boolean done = false;
+      while (!done) {
+        int tag = input.readTag();
+        switch (tag) {
+          case 0:
+            done = true;
+            break;
+          case 10:
+            {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              name_ = s;
+              break;
+            }
+          case 18:
+            {
+              data_ = input.readBytes();
+              break;
+            }
+          case 26:
+            {
+              com.google.protobuf.Int64Value.Builder subBuilder = null;
+              if (dataCrc32C_ != null) {
+                subBuilder = dataCrc32C_.toBuilder();
+              }
+              dataCrc32C_ =
+                  input.readMessage(com.google.protobuf.Int64Value.parser(), extensionRegistry);
+              if (subBuilder != null) {
+                subBuilder.mergeFrom(dataCrc32C_);
+                dataCrc32C_ = subBuilder.buildPartial();
+              }
+
+              break;
+            }
+          case 34:
+            {
+              mac_ = input.readBytes();
+              break;
+            }
+          case 42:
+            {
+              com.google.protobuf.Int64Value.Builder subBuilder = null;
+              if (macCrc32C_ != null) {
+                subBuilder = macCrc32C_.toBuilder();
+              }
+              macCrc32C_ =
+                  input.readMessage(com.google.protobuf.Int64Value.parser(), extensionRegistry);
+              if (subBuilder != null) {
+                subBuilder.mergeFrom(macCrc32C_);
+                macCrc32C_ = subBuilder.buildPartial();
+              }
+
+              break;
+            }
+          default:
+            {
+              if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
+                done = true;
+              }
+              break;
+            }
+        }
+      }
+    } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+      throw e.setUnfinishedMessage(this);
+    } catch (java.io.IOException e) {
+      throw new com.google.protobuf.InvalidProtocolBufferException(e).setUnfinishedMessage(this);
+    } finally {
+      this.unknownFields = unknownFields.build();
+      makeExtensionsImmutable();
+    }
+  }
+
+  public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_MacVerifyRequest_descriptor;
+  }
+
+  @java.lang.Override
+  protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internalGetFieldAccessorTable() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_MacVerifyRequest_fieldAccessorTable
+        .ensureFieldAccessorsInitialized(
+            com.google.cloud.kms.v1.MacVerifyRequest.class,
+            com.google.cloud.kms.v1.MacVerifyRequest.Builder.class);
+  }
+
+  public static final int NAME_FIELD_NUMBER = 1;
+  private volatile java.lang.Object name_;
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The name.
+   */
+  @java.lang.Override
+  public java.lang.String getName() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      return (java.lang.String) ref;
+    } else {
+      com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+      java.lang.String s = bs.toStringUtf8();
+      name_ = s;
+      return s;
+    }
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The bytes for name.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getNameBytes() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      com.google.protobuf.ByteString b =
+          com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+      name_ = b;
+      return b;
+    } else {
+      return (com.google.protobuf.ByteString) ref;
+    }
+  }
+
+  public static final int DATA_FIELD_NUMBER = 2;
+  private com.google.protobuf.ByteString data_;
+  /**
+   *
+   *
+   * <pre>
+   * Required. The data used previously as a [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] to generate the MAC
+   * tag.
+   * </pre>
+   *
+   * <code>bytes data = 2 [(.google.api.field_behavior) = REQUIRED];</code>
+   *
+   * @return The data.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getData() {
+    return data_;
+  }
+
+  public static final int DATA_CRC32C_FIELD_NUMBER = 3;
+  private com.google.protobuf.Int64Value dataCrc32C_;
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+   * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return Whether the dataCrc32c field is set.
+   */
+  @java.lang.Override
+  public boolean hasDataCrc32C() {
+    return dataCrc32C_ != null;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+   * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return The dataCrc32c.
+   */
+  @java.lang.Override
+  public com.google.protobuf.Int64Value getDataCrc32C() {
+    return dataCrc32C_ == null ? com.google.protobuf.Int64Value.getDefaultInstance() : dataCrc32C_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+   * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   */
+  @java.lang.Override
+  public com.google.protobuf.Int64ValueOrBuilder getDataCrc32COrBuilder() {
+    return getDataCrc32C();
+  }
+
+  public static final int MAC_FIELD_NUMBER = 4;
+  private com.google.protobuf.ByteString mac_;
+  /**
+   *
+   *
+   * <pre>
+   * Required. The signature to verify.
+   * </pre>
+   *
+   * <code>bytes mac = 4 [(.google.api.field_behavior) = REQUIRED];</code>
+   *
+   * @return The mac.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getMac() {
+    return mac_;
+  }
+
+  public static final int MAC_CRC32C_FIELD_NUMBER = 5;
+  private com.google.protobuf.Int64Value macCrc32C_;
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.tag][]) is equal to
+   * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return Whether the macCrc32c field is set.
+   */
+  @java.lang.Override
+  public boolean hasMacCrc32C() {
+    return macCrc32C_ != null;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.tag][]) is equal to
+   * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return The macCrc32c.
+   */
+  @java.lang.Override
+  public com.google.protobuf.Int64Value getMacCrc32C() {
+    return macCrc32C_ == null ? com.google.protobuf.Int64Value.getDefaultInstance() : macCrc32C_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.tag][]) is equal to
+   * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   */
+  @java.lang.Override
+  public com.google.protobuf.Int64ValueOrBuilder getMacCrc32COrBuilder() {
+    return getMacCrc32C();
+  }
+
+  private byte memoizedIsInitialized = -1;
+
+  @java.lang.Override
+  public final boolean isInitialized() {
+    byte isInitialized = memoizedIsInitialized;
+    if (isInitialized == 1) return true;
+    if (isInitialized == 0) return false;
+
+    memoizedIsInitialized = 1;
+    return true;
+  }
+
+  @java.lang.Override
+  public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io.IOException {
+    if (!getNameBytes().isEmpty()) {
+      com.google.protobuf.GeneratedMessageV3.writeString(output, 1, name_);
+    }
+    if (!data_.isEmpty()) {
+      output.writeBytes(2, data_);
+    }
+    if (dataCrc32C_ != null) {
+      output.writeMessage(3, getDataCrc32C());
+    }
+    if (!mac_.isEmpty()) {
+      output.writeBytes(4, mac_);
+    }
+    if (macCrc32C_ != null) {
+      output.writeMessage(5, getMacCrc32C());
+    }
+    unknownFields.writeTo(output);
+  }
+
+  @java.lang.Override
+  public int getSerializedSize() {
+    int size = memoizedSize;
+    if (size != -1) return size;
+
+    size = 0;
+    if (!getNameBytes().isEmpty()) {
+      size += com.google.protobuf.GeneratedMessageV3.computeStringSize(1, name_);
+    }
+    if (!data_.isEmpty()) {
+      size += com.google.protobuf.CodedOutputStream.computeBytesSize(2, data_);
+    }
+    if (dataCrc32C_ != null) {
+      size += com.google.protobuf.CodedOutputStream.computeMessageSize(3, getDataCrc32C());
+    }
+    if (!mac_.isEmpty()) {
+      size += com.google.protobuf.CodedOutputStream.computeBytesSize(4, mac_);
+    }
+    if (macCrc32C_ != null) {
+      size += com.google.protobuf.CodedOutputStream.computeMessageSize(5, getMacCrc32C());
+    }
+    size += unknownFields.getSerializedSize();
+    memoizedSize = size;
+    return size;
+  }
+
+  @java.lang.Override
+  public boolean equals(final java.lang.Object obj) {
+    if (obj == this) {
+      return true;
+    }
+    if (!(obj instanceof com.google.cloud.kms.v1.MacVerifyRequest)) {
+      return super.equals(obj);
+    }
+    com.google.cloud.kms.v1.MacVerifyRequest other = (com.google.cloud.kms.v1.MacVerifyRequest) obj;
+
+    if (!getName().equals(other.getName())) return false;
+    if (!getData().equals(other.getData())) return false;
+    if (hasDataCrc32C() != other.hasDataCrc32C()) return false;
+    if (hasDataCrc32C()) {
+      if (!getDataCrc32C().equals(other.getDataCrc32C())) return false;
+    }
+    if (!getMac().equals(other.getMac())) return false;
+    if (hasMacCrc32C() != other.hasMacCrc32C()) return false;
+    if (hasMacCrc32C()) {
+      if (!getMacCrc32C().equals(other.getMacCrc32C())) return false;
+    }
+    if (!unknownFields.equals(other.unknownFields)) return false;
+    return true;
+  }
+
+  @java.lang.Override
+  public int hashCode() {
+    if (memoizedHashCode != 0) {
+      return memoizedHashCode;
+    }
+    int hash = 41;
+    hash = (19 * hash) + getDescriptor().hashCode();
+    hash = (37 * hash) + NAME_FIELD_NUMBER;
+    hash = (53 * hash) + getName().hashCode();
+    hash = (37 * hash) + DATA_FIELD_NUMBER;
+    hash = (53 * hash) + getData().hashCode();
+    if (hasDataCrc32C()) {
+      hash = (37 * hash) + DATA_CRC32C_FIELD_NUMBER;
+      hash = (53 * hash) + getDataCrc32C().hashCode();
+    }
+    hash = (37 * hash) + MAC_FIELD_NUMBER;
+    hash = (53 * hash) + getMac().hashCode();
+    if (hasMacCrc32C()) {
+      hash = (37 * hash) + MAC_CRC32C_FIELD_NUMBER;
+      hash = (53 * hash) + getMacCrc32C().hashCode();
+    }
+    hash = (29 * hash) + unknownFields.hashCode();
+    memoizedHashCode = hash;
+    return hash;
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseFrom(java.nio.ByteBuffer data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseFrom(
+      java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseFrom(
+      com.google.protobuf.ByteString data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseFrom(
+      com.google.protobuf.ByteString data,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseFrom(byte[] data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseFrom(
+      byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseFrom(java.io.InputStream input)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseDelimitedFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseDelimitedFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseFrom(
+      com.google.protobuf.CodedInputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest parseFrom(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  @java.lang.Override
+  public Builder newBuilderForType() {
+    return newBuilder();
+  }
+
+  public static Builder newBuilder() {
+    return DEFAULT_INSTANCE.toBuilder();
+  }
+
+  public static Builder newBuilder(com.google.cloud.kms.v1.MacVerifyRequest prototype) {
+    return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
+  }
+
+  @java.lang.Override
+  public Builder toBuilder() {
+    return this == DEFAULT_INSTANCE ? new Builder() : new Builder().mergeFrom(this);
+  }
+
+  @java.lang.Override
+  protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+    Builder builder = new Builder(parent);
+    return builder;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Request message for [KeyManagementService.MacVerify][google.cloud.kms.v1.KeyManagementService.MacVerify].
+   * </pre>
+   *
+   * Protobuf type {@code google.cloud.kms.v1.MacVerifyRequest}
+   */
+  public static final class Builder extends com.google.protobuf.GeneratedMessageV3.Builder<Builder>
+      implements
+      // @@protoc_insertion_point(builder_implements:google.cloud.kms.v1.MacVerifyRequest)
+      com.google.cloud.kms.v1.MacVerifyRequestOrBuilder {
+    public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacVerifyRequest_descriptor;
+    }
+
+    @java.lang.Override
+    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacVerifyRequest_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              com.google.cloud.kms.v1.MacVerifyRequest.class,
+              com.google.cloud.kms.v1.MacVerifyRequest.Builder.class);
+    }
+
+    // Construct using com.google.cloud.kms.v1.MacVerifyRequest.newBuilder()
+    private Builder() {
+      maybeForceBuilderInitialization();
+    }
+
+    private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+      super(parent);
+      maybeForceBuilderInitialization();
+    }
+
+    private void maybeForceBuilderInitialization() {
+      if (com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders) {}
+    }
+
+    @java.lang.Override
+    public Builder clear() {
+      super.clear();
+      name_ = "";
+
+      data_ = com.google.protobuf.ByteString.EMPTY;
+
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32C_ = null;
+      } else {
+        dataCrc32C_ = null;
+        dataCrc32CBuilder_ = null;
+      }
+      mac_ = com.google.protobuf.ByteString.EMPTY;
+
+      if (macCrc32CBuilder_ == null) {
+        macCrc32C_ = null;
+      } else {
+        macCrc32C_ = null;
+        macCrc32CBuilder_ = null;
+      }
+      return this;
+    }
+
+    @java.lang.Override
+    public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacVerifyRequest_descriptor;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacVerifyRequest getDefaultInstanceForType() {
+      return com.google.cloud.kms.v1.MacVerifyRequest.getDefaultInstance();
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacVerifyRequest build() {
+      com.google.cloud.kms.v1.MacVerifyRequest result = buildPartial();
+      if (!result.isInitialized()) {
+        throw newUninitializedMessageException(result);
+      }
+      return result;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacVerifyRequest buildPartial() {
+      com.google.cloud.kms.v1.MacVerifyRequest result =
+          new com.google.cloud.kms.v1.MacVerifyRequest(this);
+      result.name_ = name_;
+      result.data_ = data_;
+      if (dataCrc32CBuilder_ == null) {
+        result.dataCrc32C_ = dataCrc32C_;
+      } else {
+        result.dataCrc32C_ = dataCrc32CBuilder_.build();
+      }
+      result.mac_ = mac_;
+      if (macCrc32CBuilder_ == null) {
+        result.macCrc32C_ = macCrc32C_;
+      } else {
+        result.macCrc32C_ = macCrc32CBuilder_.build();
+      }
+      onBuilt();
+      return result;
+    }
+
+    @java.lang.Override
+    public Builder clone() {
+      return super.clone();
+    }
+
+    @java.lang.Override
+    public Builder setField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.setField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
+      return super.clearField(field);
+    }
+
+    @java.lang.Override
+    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
+      return super.clearOneof(oneof);
+    }
+
+    @java.lang.Override
+    public Builder setRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
+      return super.setRepeatedField(field, index, value);
+    }
+
+    @java.lang.Override
+    public Builder addRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.addRepeatedField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(com.google.protobuf.Message other) {
+      if (other instanceof com.google.cloud.kms.v1.MacVerifyRequest) {
+        return mergeFrom((com.google.cloud.kms.v1.MacVerifyRequest) other);
+      } else {
+        super.mergeFrom(other);
+        return this;
+      }
+    }
+
+    public Builder mergeFrom(com.google.cloud.kms.v1.MacVerifyRequest other) {
+      if (other == com.google.cloud.kms.v1.MacVerifyRequest.getDefaultInstance()) return this;
+      if (!other.getName().isEmpty()) {
+        name_ = other.name_;
+        onChanged();
+      }
+      if (other.getData() != com.google.protobuf.ByteString.EMPTY) {
+        setData(other.getData());
+      }
+      if (other.hasDataCrc32C()) {
+        mergeDataCrc32C(other.getDataCrc32C());
+      }
+      if (other.getMac() != com.google.protobuf.ByteString.EMPTY) {
+        setMac(other.getMac());
+      }
+      if (other.hasMacCrc32C()) {
+        mergeMacCrc32C(other.getMacCrc32C());
+      }
+      this.mergeUnknownFields(other.unknownFields);
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final boolean isInitialized() {
+      return true;
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      com.google.cloud.kms.v1.MacVerifyRequest parsedMessage = null;
+      try {
+        parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        parsedMessage = (com.google.cloud.kms.v1.MacVerifyRequest) e.getUnfinishedMessage();
+        throw e.unwrapIOException();
+      } finally {
+        if (parsedMessage != null) {
+          mergeFrom(parsedMessage);
+        }
+      }
+      return this;
+    }
+
+    private java.lang.Object name_ = "";
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return The name.
+     */
+    public java.lang.String getName() {
+      java.lang.Object ref = name_;
+      if (!(ref instanceof java.lang.String)) {
+        com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        name_ = s;
+        return s;
+      } else {
+        return (java.lang.String) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return The bytes for name.
+     */
+    public com.google.protobuf.ByteString getNameBytes() {
+      java.lang.Object ref = name_;
+      if (ref instanceof String) {
+        com.google.protobuf.ByteString b =
+            com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+        name_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @param value The name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setName(java.lang.String value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearName() {
+
+      name_ = getDefaultInstance().getName();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+     * </pre>
+     *
+     * <code>
+     * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+     * </code>
+     *
+     * @param value The bytes for name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setNameBytes(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+      checkByteStringIsUtf8(value);
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+
+    private com.google.protobuf.ByteString data_ = com.google.protobuf.ByteString.EMPTY;
+    /**
+     *
+     *
+     * <pre>
+     * Required. The data used previously as a [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] to generate the MAC
+     * tag.
+     * </pre>
+     *
+     * <code>bytes data = 2 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @return The data.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString getData() {
+      return data_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The data used previously as a [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] to generate the MAC
+     * tag.
+     * </pre>
+     *
+     * <code>bytes data = 2 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @param value The data to set.
+     * @return This builder for chaining.
+     */
+    public Builder setData(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      data_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The data used previously as a [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] to generate the MAC
+     * tag.
+     * </pre>
+     *
+     * <code>bytes data = 2 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearData() {
+
+      data_ = getDefaultInstance().getData();
+      onChanged();
+      return this;
+    }
+
+    private com.google.protobuf.Int64Value dataCrc32C_;
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Int64Value,
+            com.google.protobuf.Int64Value.Builder,
+            com.google.protobuf.Int64ValueOrBuilder>
+        dataCrc32CBuilder_;
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     *
+     * @return Whether the dataCrc32c field is set.
+     */
+    public boolean hasDataCrc32C() {
+      return dataCrc32CBuilder_ != null || dataCrc32C_ != null;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     *
+     * @return The dataCrc32c.
+     */
+    public com.google.protobuf.Int64Value getDataCrc32C() {
+      if (dataCrc32CBuilder_ == null) {
+        return dataCrc32C_ == null
+            ? com.google.protobuf.Int64Value.getDefaultInstance()
+            : dataCrc32C_;
+      } else {
+        return dataCrc32CBuilder_.getMessage();
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder setDataCrc32C(com.google.protobuf.Int64Value value) {
+      if (dataCrc32CBuilder_ == null) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+        dataCrc32C_ = value;
+        onChanged();
+      } else {
+        dataCrc32CBuilder_.setMessage(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder setDataCrc32C(com.google.protobuf.Int64Value.Builder builderForValue) {
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32C_ = builderForValue.build();
+        onChanged();
+      } else {
+        dataCrc32CBuilder_.setMessage(builderForValue.build());
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder mergeDataCrc32C(com.google.protobuf.Int64Value value) {
+      if (dataCrc32CBuilder_ == null) {
+        if (dataCrc32C_ != null) {
+          dataCrc32C_ =
+              com.google.protobuf.Int64Value.newBuilder(dataCrc32C_)
+                  .mergeFrom(value)
+                  .buildPartial();
+        } else {
+          dataCrc32C_ = value;
+        }
+        onChanged();
+      } else {
+        dataCrc32CBuilder_.mergeFrom(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder clearDataCrc32C() {
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32C_ = null;
+        onChanged();
+      } else {
+        dataCrc32C_ = null;
+        dataCrc32CBuilder_ = null;
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public com.google.protobuf.Int64Value.Builder getDataCrc32CBuilder() {
+
+      onChanged();
+      return getDataCrc32CFieldBuilder().getBuilder();
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public com.google.protobuf.Int64ValueOrBuilder getDataCrc32COrBuilder() {
+      if (dataCrc32CBuilder_ != null) {
+        return dataCrc32CBuilder_.getMessageOrBuilder();
+      } else {
+        return dataCrc32C_ == null
+            ? com.google.protobuf.Int64Value.getDefaultInstance()
+            : dataCrc32C_;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Int64Value,
+            com.google.protobuf.Int64Value.Builder,
+            com.google.protobuf.Int64ValueOrBuilder>
+        getDataCrc32CFieldBuilder() {
+      if (dataCrc32CBuilder_ == null) {
+        dataCrc32CBuilder_ =
+            new com.google.protobuf.SingleFieldBuilderV3<
+                com.google.protobuf.Int64Value,
+                com.google.protobuf.Int64Value.Builder,
+                com.google.protobuf.Int64ValueOrBuilder>(
+                getDataCrc32C(), getParentForChildren(), isClean());
+        dataCrc32C_ = null;
+      }
+      return dataCrc32CBuilder_;
+    }
+
+    private com.google.protobuf.ByteString mac_ = com.google.protobuf.ByteString.EMPTY;
+    /**
+     *
+     *
+     * <pre>
+     * Required. The signature to verify.
+     * </pre>
+     *
+     * <code>bytes mac = 4 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @return The mac.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString getMac() {
+      return mac_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The signature to verify.
+     * </pre>
+     *
+     * <code>bytes mac = 4 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @param value The mac to set.
+     * @return This builder for chaining.
+     */
+    public Builder setMac(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      mac_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Required. The signature to verify.
+     * </pre>
+     *
+     * <code>bytes mac = 4 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearMac() {
+
+      mac_ = getDefaultInstance().getMac();
+      onChanged();
+      return this;
+    }
+
+    private com.google.protobuf.Int64Value macCrc32C_;
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Int64Value,
+            com.google.protobuf.Int64Value.Builder,
+            com.google.protobuf.Int64ValueOrBuilder>
+        macCrc32CBuilder_;
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.tag][]) is equal to
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     *
+     * @return Whether the macCrc32c field is set.
+     */
+    public boolean hasMacCrc32C() {
+      return macCrc32CBuilder_ != null || macCrc32C_ != null;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.tag][]) is equal to
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     *
+     * @return The macCrc32c.
+     */
+    public com.google.protobuf.Int64Value getMacCrc32C() {
+      if (macCrc32CBuilder_ == null) {
+        return macCrc32C_ == null
+            ? com.google.protobuf.Int64Value.getDefaultInstance()
+            : macCrc32C_;
+      } else {
+        return macCrc32CBuilder_.getMessage();
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.tag][]) is equal to
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder setMacCrc32C(com.google.protobuf.Int64Value value) {
+      if (macCrc32CBuilder_ == null) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+        macCrc32C_ = value;
+        onChanged();
+      } else {
+        macCrc32CBuilder_.setMessage(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.tag][]) is equal to
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder setMacCrc32C(com.google.protobuf.Int64Value.Builder builderForValue) {
+      if (macCrc32CBuilder_ == null) {
+        macCrc32C_ = builderForValue.build();
+        onChanged();
+      } else {
+        macCrc32CBuilder_.setMessage(builderForValue.build());
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.tag][]) is equal to
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder mergeMacCrc32C(com.google.protobuf.Int64Value value) {
+      if (macCrc32CBuilder_ == null) {
+        if (macCrc32C_ != null) {
+          macCrc32C_ =
+              com.google.protobuf.Int64Value.newBuilder(macCrc32C_).mergeFrom(value).buildPartial();
+        } else {
+          macCrc32C_ = value;
+        }
+        onChanged();
+      } else {
+        macCrc32CBuilder_.mergeFrom(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.tag][]) is equal to
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public Builder clearMacCrc32C() {
+      if (macCrc32CBuilder_ == null) {
+        macCrc32C_ = null;
+        onChanged();
+      } else {
+        macCrc32C_ = null;
+        macCrc32CBuilder_ = null;
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.tag][]) is equal to
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public com.google.protobuf.Int64Value.Builder getMacCrc32CBuilder() {
+
+      onChanged();
+      return getMacCrc32CFieldBuilder().getBuilder();
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.tag][]) is equal to
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    public com.google.protobuf.Int64ValueOrBuilder getMacCrc32COrBuilder() {
+      if (macCrc32CBuilder_ != null) {
+        return macCrc32CBuilder_.getMessageOrBuilder();
+      } else {
+        return macCrc32C_ == null
+            ? com.google.protobuf.Int64Value.getDefaultInstance()
+            : macCrc32C_;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+     * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+     * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+     * fails. If you receive a checksum error, your client should verify that
+     * CRC32C([MacVerifyRequest.tag][]) is equal to
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+     * number of retries. A persistent mismatch may indicate an issue in your
+     * computation of the CRC32C checksum.
+     * Note: This field is defined as int64 for reasons of compatibility across
+     * different languages. However, it is a non-negative integer, which will
+     * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+     * that support this type.
+     * </pre>
+     *
+     * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+     * </code>
+     */
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.protobuf.Int64Value,
+            com.google.protobuf.Int64Value.Builder,
+            com.google.protobuf.Int64ValueOrBuilder>
+        getMacCrc32CFieldBuilder() {
+      if (macCrc32CBuilder_ == null) {
+        macCrc32CBuilder_ =
+            new com.google.protobuf.SingleFieldBuilderV3<
+                com.google.protobuf.Int64Value,
+                com.google.protobuf.Int64Value.Builder,
+                com.google.protobuf.Int64ValueOrBuilder>(
+                getMacCrc32C(), getParentForChildren(), isClean());
+        macCrc32C_ = null;
+      }
+      return macCrc32CBuilder_;
+    }
+
+    @java.lang.Override
+    public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.setUnknownFields(unknownFields);
+    }
+
+    @java.lang.Override
+    public final Builder mergeUnknownFields(
+        final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.mergeUnknownFields(unknownFields);
+    }
+
+    // @@protoc_insertion_point(builder_scope:google.cloud.kms.v1.MacVerifyRequest)
+  }
+
+  // @@protoc_insertion_point(class_scope:google.cloud.kms.v1.MacVerifyRequest)
+  private static final com.google.cloud.kms.v1.MacVerifyRequest DEFAULT_INSTANCE;
+
+  static {
+    DEFAULT_INSTANCE = new com.google.cloud.kms.v1.MacVerifyRequest();
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyRequest getDefaultInstance() {
+    return DEFAULT_INSTANCE;
+  }
+
+  private static final com.google.protobuf.Parser<MacVerifyRequest> PARSER =
+      new com.google.protobuf.AbstractParser<MacVerifyRequest>() {
+        @java.lang.Override
+        public MacVerifyRequest parsePartialFrom(
+            com.google.protobuf.CodedInputStream input,
+            com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+            throws com.google.protobuf.InvalidProtocolBufferException {
+          return new MacVerifyRequest(input, extensionRegistry);
+        }
+      };
+
+  public static com.google.protobuf.Parser<MacVerifyRequest> parser() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.protobuf.Parser<MacVerifyRequest> getParserForType() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.cloud.kms.v1.MacVerifyRequest getDefaultInstanceForType() {
+    return DEFAULT_INSTANCE;
+  }
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyRequestOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyRequestOrBuilder.java
new file mode 100644
index 00000000..b685e9ee
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyRequestOrBuilder.java
@@ -0,0 +1,229 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+public interface MacVerifyRequestOrBuilder
+    extends
+    // @@protoc_insertion_point(interface_extends:google.cloud.kms.v1.MacVerifyRequest)
+    com.google.protobuf.MessageOrBuilder {
+
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The name.
+   */
+  java.lang.String getName();
+  /**
+   *
+   *
+   * <pre>
+   * Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+   * </pre>
+   *
+   * <code>
+   * string name = 1 [(.google.api.field_behavior) = REQUIRED, (.google.api.resource_reference) = { ... }
+   * </code>
+   *
+   * @return The bytes for name.
+   */
+  com.google.protobuf.ByteString getNameBytes();
+
+  /**
+   *
+   *
+   * <pre>
+   * Required. The data used previously as a [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] to generate the MAC
+   * tag.
+   * </pre>
+   *
+   * <code>bytes data = 2 [(.google.api.field_behavior) = REQUIRED];</code>
+   *
+   * @return The data.
+   */
+  com.google.protobuf.ByteString getData();
+
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+   * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return Whether the dataCrc32c field is set.
+   */
+  boolean hasDataCrc32C();
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+   * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return The dataCrc32c.
+   */
+  com.google.protobuf.Int64Value getDataCrc32C();
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+   * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value data_crc32c = 3 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   */
+  com.google.protobuf.Int64ValueOrBuilder getDataCrc32COrBuilder();
+
+  /**
+   *
+   *
+   * <pre>
+   * Required. The signature to verify.
+   * </pre>
+   *
+   * <code>bytes mac = 4 [(.google.api.field_behavior) = REQUIRED];</code>
+   *
+   * @return The mac.
+   */
+  com.google.protobuf.ByteString getMac();
+
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.tag][]) is equal to
+   * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return Whether the macCrc32c field is set.
+   */
+  boolean hasMacCrc32C();
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.tag][]) is equal to
+   * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   *
+   * @return The macCrc32c.
+   */
+  com.google.protobuf.Int64Value getMacCrc32C();
+  /**
+   *
+   *
+   * <pre>
+   * Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+   * specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+   * received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+   * fails. If you receive a checksum error, your client should verify that
+   * CRC32C([MacVerifyRequest.tag][]) is equal to
+   * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+   * number of retries. A persistent mismatch may indicate an issue in your
+   * computation of the CRC32C checksum.
+   * Note: This field is defined as int64 for reasons of compatibility across
+   * different languages. However, it is a non-negative integer, which will
+   * never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+   * that support this type.
+   * </pre>
+   *
+   * <code>.google.protobuf.Int64Value mac_crc32c = 5 [(.google.api.field_behavior) = OPTIONAL];
+   * </code>
+   */
+  com.google.protobuf.Int64ValueOrBuilder getMacCrc32COrBuilder();
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyResponse.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyResponse.java
new file mode 100644
index 00000000..45e579ed
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyResponse.java
@@ -0,0 +1,1232 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+/**
+ *
+ *
+ * <pre>
+ * Response message for [KeyManagementService.MacVerify][google.cloud.kms.v1.KeyManagementService.MacVerify].
+ * </pre>
+ *
+ * Protobuf type {@code google.cloud.kms.v1.MacVerifyResponse}
+ */
+public final class MacVerifyResponse extends com.google.protobuf.GeneratedMessageV3
+    implements
+    // @@protoc_insertion_point(message_implements:google.cloud.kms.v1.MacVerifyResponse)
+    MacVerifyResponseOrBuilder {
+  private static final long serialVersionUID = 0L;
+  // Use MacVerifyResponse.newBuilder() to construct.
+  private MacVerifyResponse(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+    super(builder);
+  }
+
+  private MacVerifyResponse() {
+    name_ = "";
+    protectionLevel_ = 0;
+  }
+
+  @java.lang.Override
+  @SuppressWarnings({"unused"})
+  protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
+    return new MacVerifyResponse();
+  }
+
+  @java.lang.Override
+  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
+    return this.unknownFields;
+  }
+
+  private MacVerifyResponse(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    this();
+    if (extensionRegistry == null) {
+      throw new java.lang.NullPointerException();
+    }
+    com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+        com.google.protobuf.UnknownFieldSet.newBuilder();
+    try {
+      boolean done = false;
+      while (!done) {
+        int tag = input.readTag();
+        switch (tag) {
+          case 0:
+            done = true;
+            break;
+          case 10:
+            {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              name_ = s;
+              break;
+            }
+          case 16:
+            {
+              success_ = input.readBool();
+              break;
+            }
+          case 24:
+            {
+              verifiedDataCrc32C_ = input.readBool();
+              break;
+            }
+          case 32:
+            {
+              verifiedMacCrc32C_ = input.readBool();
+              break;
+            }
+          case 40:
+            {
+              verifiedSuccessIntegrity_ = input.readBool();
+              break;
+            }
+          case 48:
+            {
+              int rawValue = input.readEnum();
+
+              protectionLevel_ = rawValue;
+              break;
+            }
+          default:
+            {
+              if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
+                done = true;
+              }
+              break;
+            }
+        }
+      }
+    } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+      throw e.setUnfinishedMessage(this);
+    } catch (java.io.IOException e) {
+      throw new com.google.protobuf.InvalidProtocolBufferException(e).setUnfinishedMessage(this);
+    } finally {
+      this.unknownFields = unknownFields.build();
+      makeExtensionsImmutable();
+    }
+  }
+
+  public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_MacVerifyResponse_descriptor;
+  }
+
+  @java.lang.Override
+  protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internalGetFieldAccessorTable() {
+    return com.google.cloud.kms.v1.KmsProto
+        .internal_static_google_cloud_kms_v1_MacVerifyResponse_fieldAccessorTable
+        .ensureFieldAccessorsInitialized(
+            com.google.cloud.kms.v1.MacVerifyResponse.class,
+            com.google.cloud.kms.v1.MacVerifyResponse.Builder.class);
+  }
+
+  public static final int NAME_FIELD_NUMBER = 1;
+  private volatile java.lang.Object name_;
+  /**
+   *
+   *
+   * <pre>
+   * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+   * Check this field to verify that the intended resource was used for
+   * verification.
+   * </pre>
+   *
+   * <code>string name = 1;</code>
+   *
+   * @return The name.
+   */
+  @java.lang.Override
+  public java.lang.String getName() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      return (java.lang.String) ref;
+    } else {
+      com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+      java.lang.String s = bs.toStringUtf8();
+      name_ = s;
+      return s;
+    }
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+   * Check this field to verify that the intended resource was used for
+   * verification.
+   * </pre>
+   *
+   * <code>string name = 1;</code>
+   *
+   * @return The bytes for name.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString getNameBytes() {
+    java.lang.Object ref = name_;
+    if (ref instanceof java.lang.String) {
+      com.google.protobuf.ByteString b =
+          com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+      name_ = b;
+      return b;
+    } else {
+      return (com.google.protobuf.ByteString) ref;
+    }
+  }
+
+  public static final int SUCCESS_FIELD_NUMBER = 2;
+  private boolean success_;
+  /**
+   *
+   *
+   * <pre>
+   * This field indicates whether or not the verification operation for
+   * [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] over [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] was successful.
+   * </pre>
+   *
+   * <code>bool success = 2;</code>
+   *
+   * @return The success.
+   */
+  @java.lang.Override
+  public boolean getSuccess() {
+    return success_;
+  }
+
+  public static final int VERIFIED_DATA_CRC32C_FIELD_NUMBER = 3;
+  private boolean verifiedDataCrc32C_;
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A flag indicating whether
+   * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was received by
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+   * [data][google.cloud.kms.v1.MacVerifyRequest.data]. A false value of this field
+   * indicates either that [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was left
+   * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+   * set [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] but this field is still false,
+   * discard the response and perform a limited number of retries.
+   * </pre>
+   *
+   * <code>bool verified_data_crc32c = 3;</code>
+   *
+   * @return The verifiedDataCrc32c.
+   */
+  @java.lang.Override
+  public boolean getVerifiedDataCrc32C() {
+    return verifiedDataCrc32C_;
+  }
+
+  public static final int VERIFIED_MAC_CRC32C_FIELD_NUMBER = 4;
+  private boolean verifiedMacCrc32C_;
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A flag indicating whether
+   * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was received by
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+   * [data][google.cloud.kms.v1.MacVerifyRequest.mac]. A false value of this field
+   * indicates either that [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was left
+   * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+   * set [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] but this field is still false,
+   * discard the response and perform a limited number of retries.
+   * </pre>
+   *
+   * <code>bool verified_mac_crc32c = 4;</code>
+   *
+   * @return The verifiedMacCrc32c.
+   */
+  @java.lang.Override
+  public boolean getVerifiedMacCrc32C() {
+    return verifiedMacCrc32C_;
+  }
+
+  public static final int VERIFIED_SUCCESS_INTEGRITY_FIELD_NUMBER = 5;
+  private boolean verifiedSuccessIntegrity_;
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. This value is used for the integrity
+   * verification of [MacVerifyResponse.success]. If the value of this field
+   * contradicts the value of [MacVerifyResponse.success], discard the response
+   * and perform a limited number of retries.
+   * </pre>
+   *
+   * <code>bool verified_success_integrity = 5;</code>
+   *
+   * @return The verifiedSuccessIntegrity.
+   */
+  @java.lang.Override
+  public boolean getVerifiedSuccessIntegrity() {
+    return verifiedSuccessIntegrity_;
+  }
+
+  public static final int PROTECTION_LEVEL_FIELD_NUMBER = 6;
+  private int protectionLevel_;
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  @java.lang.Override
+  public int getProtectionLevelValue() {
+    return protectionLevel_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+   *
+   * @return The protectionLevel.
+   */
+  @java.lang.Override
+  public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+    @SuppressWarnings("deprecation")
+    com.google.cloud.kms.v1.ProtectionLevel result =
+        com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+    return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+  }
+
+  private byte memoizedIsInitialized = -1;
+
+  @java.lang.Override
+  public final boolean isInitialized() {
+    byte isInitialized = memoizedIsInitialized;
+    if (isInitialized == 1) return true;
+    if (isInitialized == 0) return false;
+
+    memoizedIsInitialized = 1;
+    return true;
+  }
+
+  @java.lang.Override
+  public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io.IOException {
+    if (!getNameBytes().isEmpty()) {
+      com.google.protobuf.GeneratedMessageV3.writeString(output, 1, name_);
+    }
+    if (success_ != false) {
+      output.writeBool(2, success_);
+    }
+    if (verifiedDataCrc32C_ != false) {
+      output.writeBool(3, verifiedDataCrc32C_);
+    }
+    if (verifiedMacCrc32C_ != false) {
+      output.writeBool(4, verifiedMacCrc32C_);
+    }
+    if (verifiedSuccessIntegrity_ != false) {
+      output.writeBool(5, verifiedSuccessIntegrity_);
+    }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      output.writeEnum(6, protectionLevel_);
+    }
+    unknownFields.writeTo(output);
+  }
+
+  @java.lang.Override
+  public int getSerializedSize() {
+    int size = memoizedSize;
+    if (size != -1) return size;
+
+    size = 0;
+    if (!getNameBytes().isEmpty()) {
+      size += com.google.protobuf.GeneratedMessageV3.computeStringSize(1, name_);
+    }
+    if (success_ != false) {
+      size += com.google.protobuf.CodedOutputStream.computeBoolSize(2, success_);
+    }
+    if (verifiedDataCrc32C_ != false) {
+      size += com.google.protobuf.CodedOutputStream.computeBoolSize(3, verifiedDataCrc32C_);
+    }
+    if (verifiedMacCrc32C_ != false) {
+      size += com.google.protobuf.CodedOutputStream.computeBoolSize(4, verifiedMacCrc32C_);
+    }
+    if (verifiedSuccessIntegrity_ != false) {
+      size += com.google.protobuf.CodedOutputStream.computeBoolSize(5, verifiedSuccessIntegrity_);
+    }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      size += com.google.protobuf.CodedOutputStream.computeEnumSize(6, protectionLevel_);
+    }
+    size += unknownFields.getSerializedSize();
+    memoizedSize = size;
+    return size;
+  }
+
+  @java.lang.Override
+  public boolean equals(final java.lang.Object obj) {
+    if (obj == this) {
+      return true;
+    }
+    if (!(obj instanceof com.google.cloud.kms.v1.MacVerifyResponse)) {
+      return super.equals(obj);
+    }
+    com.google.cloud.kms.v1.MacVerifyResponse other =
+        (com.google.cloud.kms.v1.MacVerifyResponse) obj;
+
+    if (!getName().equals(other.getName())) return false;
+    if (getSuccess() != other.getSuccess()) return false;
+    if (getVerifiedDataCrc32C() != other.getVerifiedDataCrc32C()) return false;
+    if (getVerifiedMacCrc32C() != other.getVerifiedMacCrc32C()) return false;
+    if (getVerifiedSuccessIntegrity() != other.getVerifiedSuccessIntegrity()) return false;
+    if (protectionLevel_ != other.protectionLevel_) return false;
+    if (!unknownFields.equals(other.unknownFields)) return false;
+    return true;
+  }
+
+  @java.lang.Override
+  public int hashCode() {
+    if (memoizedHashCode != 0) {
+      return memoizedHashCode;
+    }
+    int hash = 41;
+    hash = (19 * hash) + getDescriptor().hashCode();
+    hash = (37 * hash) + NAME_FIELD_NUMBER;
+    hash = (53 * hash) + getName().hashCode();
+    hash = (37 * hash) + SUCCESS_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getSuccess());
+    hash = (37 * hash) + VERIFIED_DATA_CRC32C_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getVerifiedDataCrc32C());
+    hash = (37 * hash) + VERIFIED_MAC_CRC32C_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getVerifiedMacCrc32C());
+    hash = (37 * hash) + VERIFIED_SUCCESS_INTEGRITY_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getVerifiedSuccessIntegrity());
+    hash = (37 * hash) + PROTECTION_LEVEL_FIELD_NUMBER;
+    hash = (53 * hash) + protectionLevel_;
+    hash = (29 * hash) + unknownFields.hashCode();
+    memoizedHashCode = hash;
+    return hash;
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseFrom(java.nio.ByteBuffer data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseFrom(
+      java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseFrom(
+      com.google.protobuf.ByteString data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseFrom(
+      com.google.protobuf.ByteString data,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseFrom(byte[] data)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseFrom(
+      byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws com.google.protobuf.InvalidProtocolBufferException {
+    return PARSER.parseFrom(data, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseFrom(java.io.InputStream input)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseDelimitedFrom(
+      java.io.InputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseDelimitedFrom(
+      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseDelimitedWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseFrom(
+      com.google.protobuf.CodedInputStream input) throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(PARSER, input);
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse parseFrom(
+      com.google.protobuf.CodedInputStream input,
+      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+      throws java.io.IOException {
+    return com.google.protobuf.GeneratedMessageV3.parseWithIOException(
+        PARSER, input, extensionRegistry);
+  }
+
+  @java.lang.Override
+  public Builder newBuilderForType() {
+    return newBuilder();
+  }
+
+  public static Builder newBuilder() {
+    return DEFAULT_INSTANCE.toBuilder();
+  }
+
+  public static Builder newBuilder(com.google.cloud.kms.v1.MacVerifyResponse prototype) {
+    return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
+  }
+
+  @java.lang.Override
+  public Builder toBuilder() {
+    return this == DEFAULT_INSTANCE ? new Builder() : new Builder().mergeFrom(this);
+  }
+
+  @java.lang.Override
+  protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+    Builder builder = new Builder(parent);
+    return builder;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Response message for [KeyManagementService.MacVerify][google.cloud.kms.v1.KeyManagementService.MacVerify].
+   * </pre>
+   *
+   * Protobuf type {@code google.cloud.kms.v1.MacVerifyResponse}
+   */
+  public static final class Builder extends com.google.protobuf.GeneratedMessageV3.Builder<Builder>
+      implements
+      // @@protoc_insertion_point(builder_implements:google.cloud.kms.v1.MacVerifyResponse)
+      com.google.cloud.kms.v1.MacVerifyResponseOrBuilder {
+    public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacVerifyResponse_descriptor;
+    }
+
+    @java.lang.Override
+    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacVerifyResponse_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              com.google.cloud.kms.v1.MacVerifyResponse.class,
+              com.google.cloud.kms.v1.MacVerifyResponse.Builder.class);
+    }
+
+    // Construct using com.google.cloud.kms.v1.MacVerifyResponse.newBuilder()
+    private Builder() {
+      maybeForceBuilderInitialization();
+    }
+
+    private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+      super(parent);
+      maybeForceBuilderInitialization();
+    }
+
+    private void maybeForceBuilderInitialization() {
+      if (com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders) {}
+    }
+
+    @java.lang.Override
+    public Builder clear() {
+      super.clear();
+      name_ = "";
+
+      success_ = false;
+
+      verifiedDataCrc32C_ = false;
+
+      verifiedMacCrc32C_ = false;
+
+      verifiedSuccessIntegrity_ = false;
+
+      protectionLevel_ = 0;
+
+      return this;
+    }
+
+    @java.lang.Override
+    public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
+      return com.google.cloud.kms.v1.KmsProto
+          .internal_static_google_cloud_kms_v1_MacVerifyResponse_descriptor;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacVerifyResponse getDefaultInstanceForType() {
+      return com.google.cloud.kms.v1.MacVerifyResponse.getDefaultInstance();
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacVerifyResponse build() {
+      com.google.cloud.kms.v1.MacVerifyResponse result = buildPartial();
+      if (!result.isInitialized()) {
+        throw newUninitializedMessageException(result);
+      }
+      return result;
+    }
+
+    @java.lang.Override
+    public com.google.cloud.kms.v1.MacVerifyResponse buildPartial() {
+      com.google.cloud.kms.v1.MacVerifyResponse result =
+          new com.google.cloud.kms.v1.MacVerifyResponse(this);
+      result.name_ = name_;
+      result.success_ = success_;
+      result.verifiedDataCrc32C_ = verifiedDataCrc32C_;
+      result.verifiedMacCrc32C_ = verifiedMacCrc32C_;
+      result.verifiedSuccessIntegrity_ = verifiedSuccessIntegrity_;
+      result.protectionLevel_ = protectionLevel_;
+      onBuilt();
+      return result;
+    }
+
+    @java.lang.Override
+    public Builder clone() {
+      return super.clone();
+    }
+
+    @java.lang.Override
+    public Builder setField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.setField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
+      return super.clearField(field);
+    }
+
+    @java.lang.Override
+    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
+      return super.clearOneof(oneof);
+    }
+
+    @java.lang.Override
+    public Builder setRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
+      return super.setRepeatedField(field, index, value);
+    }
+
+    @java.lang.Override
+    public Builder addRepeatedField(
+        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
+      return super.addRepeatedField(field, value);
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(com.google.protobuf.Message other) {
+      if (other instanceof com.google.cloud.kms.v1.MacVerifyResponse) {
+        return mergeFrom((com.google.cloud.kms.v1.MacVerifyResponse) other);
+      } else {
+        super.mergeFrom(other);
+        return this;
+      }
+    }
+
+    public Builder mergeFrom(com.google.cloud.kms.v1.MacVerifyResponse other) {
+      if (other == com.google.cloud.kms.v1.MacVerifyResponse.getDefaultInstance()) return this;
+      if (!other.getName().isEmpty()) {
+        name_ = other.name_;
+        onChanged();
+      }
+      if (other.getSuccess() != false) {
+        setSuccess(other.getSuccess());
+      }
+      if (other.getVerifiedDataCrc32C() != false) {
+        setVerifiedDataCrc32C(other.getVerifiedDataCrc32C());
+      }
+      if (other.getVerifiedMacCrc32C() != false) {
+        setVerifiedMacCrc32C(other.getVerifiedMacCrc32C());
+      }
+      if (other.getVerifiedSuccessIntegrity() != false) {
+        setVerifiedSuccessIntegrity(other.getVerifiedSuccessIntegrity());
+      }
+      if (other.protectionLevel_ != 0) {
+        setProtectionLevelValue(other.getProtectionLevelValue());
+      }
+      this.mergeUnknownFields(other.unknownFields);
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final boolean isInitialized() {
+      return true;
+    }
+
+    @java.lang.Override
+    public Builder mergeFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      com.google.cloud.kms.v1.MacVerifyResponse parsedMessage = null;
+      try {
+        parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        parsedMessage = (com.google.cloud.kms.v1.MacVerifyResponse) e.getUnfinishedMessage();
+        throw e.unwrapIOException();
+      } finally {
+        if (parsedMessage != null) {
+          mergeFrom(parsedMessage);
+        }
+      }
+      return this;
+    }
+
+    private java.lang.Object name_ = "";
+    /**
+     *
+     *
+     * <pre>
+     * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+     * Check this field to verify that the intended resource was used for
+     * verification.
+     * </pre>
+     *
+     * <code>string name = 1;</code>
+     *
+     * @return The name.
+     */
+    public java.lang.String getName() {
+      java.lang.Object ref = name_;
+      if (!(ref instanceof java.lang.String)) {
+        com.google.protobuf.ByteString bs = (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        name_ = s;
+        return s;
+      } else {
+        return (java.lang.String) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+     * Check this field to verify that the intended resource was used for
+     * verification.
+     * </pre>
+     *
+     * <code>string name = 1;</code>
+     *
+     * @return The bytes for name.
+     */
+    public com.google.protobuf.ByteString getNameBytes() {
+      java.lang.Object ref = name_;
+      if (ref instanceof String) {
+        com.google.protobuf.ByteString b =
+            com.google.protobuf.ByteString.copyFromUtf8((java.lang.String) ref);
+        name_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+     * Check this field to verify that the intended resource was used for
+     * verification.
+     * </pre>
+     *
+     * <code>string name = 1;</code>
+     *
+     * @param value The name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setName(java.lang.String value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+     * Check this field to verify that the intended resource was used for
+     * verification.
+     * </pre>
+     *
+     * <code>string name = 1;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearName() {
+
+      name_ = getDefaultInstance().getName();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+     * Check this field to verify that the intended resource was used for
+     * verification.
+     * </pre>
+     *
+     * <code>string name = 1;</code>
+     *
+     * @param value The bytes for name to set.
+     * @return This builder for chaining.
+     */
+    public Builder setNameBytes(com.google.protobuf.ByteString value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+      checkByteStringIsUtf8(value);
+
+      name_ = value;
+      onChanged();
+      return this;
+    }
+
+    private boolean success_;
+    /**
+     *
+     *
+     * <pre>
+     * This field indicates whether or not the verification operation for
+     * [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] over [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] was successful.
+     * </pre>
+     *
+     * <code>bool success = 2;</code>
+     *
+     * @return The success.
+     */
+    @java.lang.Override
+    public boolean getSuccess() {
+      return success_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * This field indicates whether or not the verification operation for
+     * [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] over [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] was successful.
+     * </pre>
+     *
+     * <code>bool success = 2;</code>
+     *
+     * @param value The success to set.
+     * @return This builder for chaining.
+     */
+    public Builder setSuccess(boolean value) {
+
+      success_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * This field indicates whether or not the verification operation for
+     * [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] over [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] was successful.
+     * </pre>
+     *
+     * <code>bool success = 2;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearSuccess() {
+
+      success_ = false;
+      onChanged();
+      return this;
+    }
+
+    private boolean verifiedDataCrc32C_;
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A flag indicating whether
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was received by
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+     * [data][google.cloud.kms.v1.MacVerifyRequest.data]. A false value of this field
+     * indicates either that [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was left
+     * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+     * set [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] but this field is still false,
+     * discard the response and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_data_crc32c = 3;</code>
+     *
+     * @return The verifiedDataCrc32c.
+     */
+    @java.lang.Override
+    public boolean getVerifiedDataCrc32C() {
+      return verifiedDataCrc32C_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A flag indicating whether
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was received by
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+     * [data][google.cloud.kms.v1.MacVerifyRequest.data]. A false value of this field
+     * indicates either that [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was left
+     * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+     * set [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] but this field is still false,
+     * discard the response and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_data_crc32c = 3;</code>
+     *
+     * @param value The verifiedDataCrc32c to set.
+     * @return This builder for chaining.
+     */
+    public Builder setVerifiedDataCrc32C(boolean value) {
+
+      verifiedDataCrc32C_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A flag indicating whether
+     * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was received by
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+     * [data][google.cloud.kms.v1.MacVerifyRequest.data]. A false value of this field
+     * indicates either that [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was left
+     * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+     * set [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] but this field is still false,
+     * discard the response and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_data_crc32c = 3;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearVerifiedDataCrc32C() {
+
+      verifiedDataCrc32C_ = false;
+      onChanged();
+      return this;
+    }
+
+    private boolean verifiedMacCrc32C_;
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A flag indicating whether
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was received by
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+     * [data][google.cloud.kms.v1.MacVerifyRequest.mac]. A false value of this field
+     * indicates either that [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was left
+     * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+     * set [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] but this field is still false,
+     * discard the response and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_mac_crc32c = 4;</code>
+     *
+     * @return The verifiedMacCrc32c.
+     */
+    @java.lang.Override
+    public boolean getVerifiedMacCrc32C() {
+      return verifiedMacCrc32C_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A flag indicating whether
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was received by
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+     * [data][google.cloud.kms.v1.MacVerifyRequest.mac]. A false value of this field
+     * indicates either that [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was left
+     * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+     * set [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] but this field is still false,
+     * discard the response and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_mac_crc32c = 4;</code>
+     *
+     * @param value The verifiedMacCrc32c to set.
+     * @return This builder for chaining.
+     */
+    public Builder setVerifiedMacCrc32C(boolean value) {
+
+      verifiedMacCrc32C_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. A flag indicating whether
+     * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was received by
+     * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+     * [data][google.cloud.kms.v1.MacVerifyRequest.mac]. A false value of this field
+     * indicates either that [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was left
+     * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+     * set [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] but this field is still false,
+     * discard the response and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_mac_crc32c = 4;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearVerifiedMacCrc32C() {
+
+      verifiedMacCrc32C_ = false;
+      onChanged();
+      return this;
+    }
+
+    private boolean verifiedSuccessIntegrity_;
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. This value is used for the integrity
+     * verification of [MacVerifyResponse.success]. If the value of this field
+     * contradicts the value of [MacVerifyResponse.success], discard the response
+     * and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_success_integrity = 5;</code>
+     *
+     * @return The verifiedSuccessIntegrity.
+     */
+    @java.lang.Override
+    public boolean getVerifiedSuccessIntegrity() {
+      return verifiedSuccessIntegrity_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. This value is used for the integrity
+     * verification of [MacVerifyResponse.success]. If the value of this field
+     * contradicts the value of [MacVerifyResponse.success], discard the response
+     * and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_success_integrity = 5;</code>
+     *
+     * @param value The verifiedSuccessIntegrity to set.
+     * @return This builder for chaining.
+     */
+    public Builder setVerifiedSuccessIntegrity(boolean value) {
+
+      verifiedSuccessIntegrity_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Integrity verification field. This value is used for the integrity
+     * verification of [MacVerifyResponse.success]. If the value of this field
+     * contradicts the value of [MacVerifyResponse.success], discard the response
+     * and perform a limited number of retries.
+     * </pre>
+     *
+     * <code>bool verified_success_integrity = 5;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearVerifiedSuccessIntegrity() {
+
+      verifiedSuccessIntegrity_ = false;
+      onChanged();
+      return this;
+    }
+
+    private int protectionLevel_ = 0;
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+     *
+     * @return The enum numeric value on the wire for protectionLevel.
+     */
+    @java.lang.Override
+    public int getProtectionLevelValue() {
+      return protectionLevel_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+     *
+     * @param value The enum numeric value on the wire for protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevelValue(int value) {
+
+      protectionLevel_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+     *
+     * @return The protectionLevel.
+     */
+    @java.lang.Override
+    public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+      @SuppressWarnings("deprecation")
+      com.google.cloud.kms.v1.ProtectionLevel result =
+          com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+      return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+     *
+     * @param value The protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevel(com.google.cloud.kms.v1.ProtectionLevel value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      protectionLevel_ = value.getNumber();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearProtectionLevel() {
+
+      protectionLevel_ = 0;
+      onChanged();
+      return this;
+    }
+
+    @java.lang.Override
+    public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.setUnknownFields(unknownFields);
+    }
+
+    @java.lang.Override
+    public final Builder mergeUnknownFields(
+        final com.google.protobuf.UnknownFieldSet unknownFields) {
+      return super.mergeUnknownFields(unknownFields);
+    }
+
+    // @@protoc_insertion_point(builder_scope:google.cloud.kms.v1.MacVerifyResponse)
+  }
+
+  // @@protoc_insertion_point(class_scope:google.cloud.kms.v1.MacVerifyResponse)
+  private static final com.google.cloud.kms.v1.MacVerifyResponse DEFAULT_INSTANCE;
+
+  static {
+    DEFAULT_INSTANCE = new com.google.cloud.kms.v1.MacVerifyResponse();
+  }
+
+  public static com.google.cloud.kms.v1.MacVerifyResponse getDefaultInstance() {
+    return DEFAULT_INSTANCE;
+  }
+
+  private static final com.google.protobuf.Parser<MacVerifyResponse> PARSER =
+      new com.google.protobuf.AbstractParser<MacVerifyResponse>() {
+        @java.lang.Override
+        public MacVerifyResponse parsePartialFrom(
+            com.google.protobuf.CodedInputStream input,
+            com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+            throws com.google.protobuf.InvalidProtocolBufferException {
+          return new MacVerifyResponse(input, extensionRegistry);
+        }
+      };
+
+  public static com.google.protobuf.Parser<MacVerifyResponse> parser() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.protobuf.Parser<MacVerifyResponse> getParserForType() {
+    return PARSER;
+  }
+
+  @java.lang.Override
+  public com.google.cloud.kms.v1.MacVerifyResponse getDefaultInstanceForType() {
+    return DEFAULT_INSTANCE;
+  }
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyResponseOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyResponseOrBuilder.java
new file mode 100644
index 00000000..d8530cc8
--- /dev/null
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyResponseOrBuilder.java
@@ -0,0 +1,149 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Generated by the protocol buffer compiler.  DO NOT EDIT!
+// source: google/cloud/kms/v1/service.proto
+
+package com.google.cloud.kms.v1;
+
+public interface MacVerifyResponseOrBuilder
+    extends
+    // @@protoc_insertion_point(interface_extends:google.cloud.kms.v1.MacVerifyResponse)
+    com.google.protobuf.MessageOrBuilder {
+
+  /**
+   *
+   *
+   * <pre>
+   * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+   * Check this field to verify that the intended resource was used for
+   * verification.
+   * </pre>
+   *
+   * <code>string name = 1;</code>
+   *
+   * @return The name.
+   */
+  java.lang.String getName();
+  /**
+   *
+   *
+   * <pre>
+   * The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+   * Check this field to verify that the intended resource was used for
+   * verification.
+   * </pre>
+   *
+   * <code>string name = 1;</code>
+   *
+   * @return The bytes for name.
+   */
+  com.google.protobuf.ByteString getNameBytes();
+
+  /**
+   *
+   *
+   * <pre>
+   * This field indicates whether or not the verification operation for
+   * [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] over [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] was successful.
+   * </pre>
+   *
+   * <code>bool success = 2;</code>
+   *
+   * @return The success.
+   */
+  boolean getSuccess();
+
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A flag indicating whether
+   * [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was received by
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+   * [data][google.cloud.kms.v1.MacVerifyRequest.data]. A false value of this field
+   * indicates either that [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was left
+   * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+   * set [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] but this field is still false,
+   * discard the response and perform a limited number of retries.
+   * </pre>
+   *
+   * <code>bool verified_data_crc32c = 3;</code>
+   *
+   * @return The verifiedDataCrc32c.
+   */
+  boolean getVerifiedDataCrc32C();
+
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. A flag indicating whether
+   * [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was received by
+   * [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+   * [data][google.cloud.kms.v1.MacVerifyRequest.mac]. A false value of this field
+   * indicates either that [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was left
+   * unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+   * set [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] but this field is still false,
+   * discard the response and perform a limited number of retries.
+   * </pre>
+   *
+   * <code>bool verified_mac_crc32c = 4;</code>
+   *
+   * @return The verifiedMacCrc32c.
+   */
+  boolean getVerifiedMacCrc32C();
+
+  /**
+   *
+   *
+   * <pre>
+   * Integrity verification field. This value is used for the integrity
+   * verification of [MacVerifyResponse.success]. If the value of this field
+   * contradicts the value of [MacVerifyResponse.success], discard the response
+   * and perform a limited number of retries.
+   * </pre>
+   *
+   * <code>bool verified_success_integrity = 5;</code>
+   *
+   * @return The verifiedSuccessIntegrity.
+   */
+  boolean getVerifiedSuccessIntegrity();
+
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  int getProtectionLevelValue();
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 6;</code>
+   *
+   * @return The protectionLevel.
+   */
+  com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel();
+}
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/PublicKey.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/PublicKey.java
index 051a4283..c4e73c85 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/PublicKey.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/PublicKey.java
@@ -42,6 +42,7 @@ private PublicKey() {
     pem_ = "";
     algorithm_ = 0;
     name_ = "";
+    protectionLevel_ = 0;
   }
 
   @java.lang.Override
@@ -109,6 +110,13 @@ private PublicKey(
               name_ = s;
               break;
             }
+          case 40:
+            {
+              int rawValue = input.readEnum();
+
+              protectionLevel_ = rawValue;
+              break;
+            }
           default:
             {
               if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
@@ -372,6 +380,42 @@ public com.google.protobuf.ByteString getNameBytes() {
     }
   }
 
+  public static final int PROTECTION_LEVEL_FIELD_NUMBER = 5;
+  private int protectionLevel_;
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  @java.lang.Override
+  public int getProtectionLevelValue() {
+    return protectionLevel_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+   *
+   * @return The protectionLevel.
+   */
+  @java.lang.Override
+  public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+    @SuppressWarnings("deprecation")
+    com.google.cloud.kms.v1.ProtectionLevel result =
+        com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+    return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -401,6 +445,10 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
     if (!getNameBytes().isEmpty()) {
       com.google.protobuf.GeneratedMessageV3.writeString(output, 4, name_);
     }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      output.writeEnum(5, protectionLevel_);
+    }
     unknownFields.writeTo(output);
   }
 
@@ -425,6 +473,10 @@ public int getSerializedSize() {
     if (!getNameBytes().isEmpty()) {
       size += com.google.protobuf.GeneratedMessageV3.computeStringSize(4, name_);
     }
+    if (protectionLevel_
+        != com.google.cloud.kms.v1.ProtectionLevel.PROTECTION_LEVEL_UNSPECIFIED.getNumber()) {
+      size += com.google.protobuf.CodedOutputStream.computeEnumSize(5, protectionLevel_);
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -447,6 +499,7 @@ public boolean equals(final java.lang.Object obj) {
       if (!getPemCrc32C().equals(other.getPemCrc32C())) return false;
     }
     if (!getName().equals(other.getName())) return false;
+    if (protectionLevel_ != other.protectionLevel_) return false;
     if (!unknownFields.equals(other.unknownFields)) return false;
     return true;
   }
@@ -468,6 +521,8 @@ public int hashCode() {
     }
     hash = (37 * hash) + NAME_FIELD_NUMBER;
     hash = (53 * hash) + getName().hashCode();
+    hash = (37 * hash) + PROTECTION_LEVEL_FIELD_NUMBER;
+    hash = (53 * hash) + protectionLevel_;
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -625,6 +680,8 @@ public Builder clear() {
       }
       name_ = "";
 
+      protectionLevel_ = 0;
+
       return this;
     }
 
@@ -659,6 +716,7 @@ public com.google.cloud.kms.v1.PublicKey buildPartial() {
         result.pemCrc32C_ = pemCrc32CBuilder_.build();
       }
       result.name_ = name_;
+      result.protectionLevel_ = protectionLevel_;
       onBuilt();
       return result;
     }
@@ -722,6 +780,9 @@ public Builder mergeFrom(com.google.cloud.kms.v1.PublicKey other) {
         name_ = other.name_;
         onChanged();
       }
+      if (other.protectionLevel_ != 0) {
+        setProtectionLevelValue(other.getProtectionLevelValue());
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -1374,6 +1435,97 @@ public Builder setNameBytes(com.google.protobuf.ByteString value) {
       return this;
     }
 
+    private int protectionLevel_ = 0;
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+     *
+     * @return The enum numeric value on the wire for protectionLevel.
+     */
+    @java.lang.Override
+    public int getProtectionLevelValue() {
+      return protectionLevel_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+     *
+     * @param value The enum numeric value on the wire for protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevelValue(int value) {
+
+      protectionLevel_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+     *
+     * @return The protectionLevel.
+     */
+    @java.lang.Override
+    public com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel() {
+      @SuppressWarnings("deprecation")
+      com.google.cloud.kms.v1.ProtectionLevel result =
+          com.google.cloud.kms.v1.ProtectionLevel.valueOf(protectionLevel_);
+      return result == null ? com.google.cloud.kms.v1.ProtectionLevel.UNRECOGNIZED : result;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+     *
+     * @param value The protectionLevel to set.
+     * @return This builder for chaining.
+     */
+    public Builder setProtectionLevel(com.google.cloud.kms.v1.ProtectionLevel value) {
+      if (value == null) {
+        throw new NullPointerException();
+      }
+
+      protectionLevel_ = value.getNumber();
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
+     * </pre>
+     *
+     * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearProtectionLevel() {
+
+      protectionLevel_ = 0;
+      onChanged();
+      return this;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/PublicKeyOrBuilder.java b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/PublicKeyOrBuilder.java
index dfda0ab8..fd754aae 100644
--- a/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/PublicKeyOrBuilder.java
+++ b/proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/PublicKeyOrBuilder.java
@@ -179,4 +179,29 @@ public interface PublicKeyOrBuilder
    * @return The bytes for name.
    */
   com.google.protobuf.ByteString getNameBytes();
+
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+   *
+   * @return The enum numeric value on the wire for protectionLevel.
+   */
+  int getProtectionLevelValue();
+  /**
+   *
+   *
+   * <pre>
+   * The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
+   * </pre>
+   *
+   * <code>.google.cloud.kms.v1.ProtectionLevel protection_level = 5;</code>
+   *
+   * @return The protectionLevel.
+   */
+  com.google.cloud.kms.v1.ProtectionLevel getProtectionLevel();
 }
diff --git a/proto-google-cloud-kms-v1/src/main/proto/google/cloud/kms/v1/resources.proto b/proto-google-cloud-kms-v1/src/main/proto/google/cloud/kms/v1/resources.proto
index 825c3297..b03e22b9 100644
--- a/proto-google-cloud-kms-v1/src/main/proto/google/cloud/kms/v1/resources.proto
+++ b/proto-google-cloud-kms-v1/src/main/proto/google/cloud/kms/v1/resources.proto
@@ -79,6 +79,10 @@ message CryptoKey {
     // [AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt] and
     // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
     ASYMMETRIC_DECRYPT = 6;
+
+    // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used with
+    // [MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
+    MAC = 9;
   }
 
   // Output only. The resource name for this [CryptoKey][google.cloud.kms.v1.CryptoKey] in the format
@@ -141,6 +145,16 @@ message CryptoKey {
   // Labels with user-defined metadata. For more information, see
   // [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
   map<string, string> labels = 10;
+
+  // Immutable. Whether this key may contain imported versions only.
+  bool import_only = 13 [(google.api.field_behavior) = IMMUTABLE];
+
+  // Immutable. The period of time that versions of this key spend in the
+  // [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+  // state before transitioning to
+  // [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. If not
+  // specified at creation time, the default duration is 24 hours.
+  google.protobuf.Duration destroy_scheduled_duration = 14 [(google.api.field_behavior) = IMMUTABLE];
 }
 
 // A [CryptoKeyVersionTemplate][google.cloud.kms.v1.CryptoKeyVersionTemplate] specifies the properties to use when creating
@@ -235,6 +249,12 @@ message CryptoKeyVersion {
   // The fields in the name after "EC_SIGN_" correspond to the following
   // parameters: elliptic curve, digest algorithm.
   //
+  // Algorithms beginning with "HMAC_" are usable with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+  // [MAC][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.MAC].
+  //
+  // The suffix following "HMAC_" corresponds to the hash algorithm being used
+  // (eg. SHA256).
+  //
   // For more information, see [Key purposes and algorithms]
   // (https://cloud.google.com/kms/docs/algorithms).
   enum CryptoKeyVersionAlgorithm {
@@ -290,6 +310,9 @@ message CryptoKeyVersion {
     // HSM protection level.
     EC_SIGN_SECP256K1_SHA256 = 31;
 
+    // HMAC-SHA256 signing with a 256 bit key.
+    HMAC_SHA256 = 32;
+
     // Algorithm representing symmetric encryption by an external key manager.
     EXTERNAL_SYMMETRIC_ENCRYPTION = 18;
   }
@@ -312,7 +335,6 @@ message CryptoKeyVersion {
     DISABLED = 2;
 
     // This version is destroyed, and the key material is no longer stored.
-    // A version may not leave this state once entered.
     DESTROYED = 3;
 
     // This version is scheduled for destruction, and will be destroyed soon.
@@ -444,6 +466,9 @@ message PublicKey {
   //
   // NOTE: This field is in Beta.
   string name = 4;
+
+  // The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
+  ProtectionLevel protection_level = 5;
 }
 
 // An [ImportJob][google.cloud.kms.v1.ImportJob] can be used to create [CryptoKeys][google.cloud.kms.v1.CryptoKey] and
diff --git a/proto-google-cloud-kms-v1/src/main/proto/google/cloud/kms/v1/service.proto b/proto-google-cloud-kms-v1/src/main/proto/google/cloud/kms/v1/service.proto
index e96b612a..ba3baf28 100644
--- a/proto-google-cloud-kms-v1/src/main/proto/google/cloud/kms/v1/service.proto
+++ b/proto-google-cloud-kms-v1/src/main/proto/google/cloud/kms/v1/service.proto
@@ -208,6 +208,53 @@ service KeyManagementService {
     option (google.api.method_signature) = "crypto_key_version,update_mask";
   }
 
+  // Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
+  //
+  // Returns an error if called on a key whose purpose is not
+  // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
+  rpc UpdateCryptoKeyPrimaryVersion(UpdateCryptoKeyPrimaryVersionRequest) returns (CryptoKey) {
+    option (google.api.http) = {
+      post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:updatePrimaryVersion"
+      body: "*"
+    };
+    option (google.api.method_signature) = "name,crypto_key_version_id";
+  }
+
+  // Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
+  //
+  // Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
+  // [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+  // and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
+  // hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+  // will be changed to
+  // [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
+  // material will be irrevocably destroyed.
+  //
+  // Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
+  // [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
+  rpc DestroyCryptoKeyVersion(DestroyCryptoKeyVersionRequest) returns (CryptoKeyVersion) {
+    option (google.api.http) = {
+      post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:destroy"
+      body: "*"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
+  // [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
+  // state.
+  //
+  // Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
+  // will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
+  // and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
+  rpc RestoreCryptoKeyVersion(RestoreCryptoKeyVersionRequest) returns (CryptoKeyVersion) {
+    option (google.api.http) = {
+      post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:restore"
+      body: "*"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
   // Encrypts data, so that it can only be recovered by a call to [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt].
   // The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be
   // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
@@ -251,51 +298,36 @@ service KeyManagementService {
     option (google.api.method_signature) = "name,ciphertext";
   }
 
-  // Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
-  //
-  // Returns an error if called on a key whose purpose is not
-  // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
-  rpc UpdateCryptoKeyPrimaryVersion(UpdateCryptoKeyPrimaryVersionRequest) returns (CryptoKey) {
+  // Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+  // MAC, producing a tag that can be verified by another source with the
+  // same key.
+  rpc MacSign(MacSignRequest) returns (MacSignResponse) {
     option (google.api.http) = {
-      post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:updatePrimaryVersion"
+      post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:macSign"
       body: "*"
     };
-    option (google.api.method_signature) = "name,crypto_key_version_id";
+    option (google.api.method_signature) = "name,data";
   }
 
-  // Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
-  //
-  // Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
-  // [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-  // and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24
-  // hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-  // will be changed to
-  // [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
-  // material will be irrevocably destroyed.
-  //
-  // Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
-  // [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
-  rpc DestroyCryptoKeyVersion(DestroyCryptoKeyVersionRequest) returns (CryptoKeyVersion) {
+  // Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
+  // MAC, and returns a response that indicates whether or not the verification
+  // was successful.
+  rpc MacVerify(MacVerifyRequest) returns (MacVerifyResponse) {
     option (google.api.http) = {
-      post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:destroy"
+      post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:macVerify"
       body: "*"
     };
-    option (google.api.method_signature) = "name";
+    option (google.api.method_signature) = "name,data,mac";
   }
 
-  // Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
-  // [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
-  // state.
-  //
-  // Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
-  // will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
-  // and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
-  rpc RestoreCryptoKeyVersion(RestoreCryptoKeyVersionRequest) returns (CryptoKeyVersion) {
+  // Generate random bytes using the Cloud KMS randomness source in the provided
+  // location.
+  rpc GenerateRandomBytes(GenerateRandomBytesRequest) returns (GenerateRandomBytesResponse) {
     option (google.api.http) = {
-      post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:restore"
+      post: "/v1/{location=projects/*/locations/*}:generateRandomBytes"
       body: "*"
     };
-    option (google.api.method_signature) = "name";
+    option (google.api.method_signature) = "location,length_bytes,protection_level";
   }
 }
 
@@ -699,6 +731,42 @@ message UpdateCryptoKeyVersionRequest {
   google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
 }
 
+// Request message for [KeyManagementService.UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion].
+message UpdateCryptoKeyPrimaryVersionRequest {
+  // Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to update.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudkms.googleapis.com/CryptoKey"
+    }
+  ];
+
+  // Required. The id of the child [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as primary.
+  string crypto_key_version_id = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+// Request message for [KeyManagementService.DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion].
+message DestroyCryptoKeyVersionRequest {
+  // Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to destroy.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudkms.googleapis.com/CryptoKeyVersion"
+    }
+  ];
+}
+
+// Request message for [KeyManagementService.RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion].
+message RestoreCryptoKeyVersionRequest {
+  // Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to restore.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudkms.googleapis.com/CryptoKeyVersion"
+    }
+  ];
+}
+
 // Request message for [KeyManagementService.Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
 message EncryptRequest {
   // Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] or [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
@@ -747,8 +815,6 @@ message EncryptRequest {
   // different languages. However, it is a non-negative integer, which will
   // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
   // that support this type.
-  //
-  // NOTE: This field is in Beta.
   google.protobuf.Int64Value plaintext_crc32c = 7 [(google.api.field_behavior) = OPTIONAL];
 
   // Optional. An optional CRC32C checksum of the
@@ -765,8 +831,6 @@ message EncryptRequest {
   // different languages. However, it is a non-negative integer, which will
   // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
   // that support this type.
-  //
-  // NOTE: This field is in Beta.
   google.protobuf.Int64Value additional_authenticated_data_crc32c = 8 [(google.api.field_behavior) = OPTIONAL];
 }
 
@@ -802,8 +866,6 @@ message DecryptRequest {
   // different languages. However, it is a non-negative integer, which will
   // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
   // that support this type.
-  //
-  // NOTE: This field is in Beta.
   google.protobuf.Int64Value ciphertext_crc32c = 5 [(google.api.field_behavior) = OPTIONAL];
 
   // Optional. An optional CRC32C checksum of the
@@ -820,8 +882,6 @@ message DecryptRequest {
   // different languages. However, it is a non-negative integer, which will
   // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
   // that support this type.
-  //
-  // NOTE: This field is in Beta.
   google.protobuf.Int64Value additional_authenticated_data_crc32c = 6 [(google.api.field_behavior) = OPTIONAL];
 }
 
@@ -853,8 +913,6 @@ message AsymmetricSignRequest {
   // different languages. However, it is a non-negative integer, which will
   // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
   // that support this type.
-  //
-  // NOTE: This field is in Beta.
   google.protobuf.Int64Value digest_crc32c = 4 [(google.api.field_behavior) = OPTIONAL];
 }
 
@@ -886,32 +944,100 @@ message AsymmetricDecryptRequest {
   // different languages. However, it is a non-negative integer, which will
   // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
   // that support this type.
-  //
-  // NOTE: This field is in Beta.
   google.protobuf.Int64Value ciphertext_crc32c = 4 [(google.api.field_behavior) = OPTIONAL];
 }
 
-// Response message for [KeyManagementService.Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt].
-message DecryptResponse {
-  // The decrypted data originally supplied in [EncryptRequest.plaintext][google.cloud.kms.v1.EncryptRequest.plaintext].
-  bytes plaintext = 1;
+// Request message for [KeyManagementService.MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
+message MacSignRequest {
+  // Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudkms.googleapis.com/CryptoKeyVersion"
+    }
+  ];
 
-  // Integrity verification field. A CRC32C checksum of the returned
-  // [DecryptResponse.plaintext][google.cloud.kms.v1.DecryptResponse.plaintext]. An integrity check of
-  // [DecryptResponse.plaintext][google.cloud.kms.v1.DecryptResponse.plaintext] can be performed by computing the CRC32C
-  // checksum of [DecryptResponse.plaintext][google.cloud.kms.v1.DecryptResponse.plaintext] and comparing your results to
-  // this field. Discard the response in case of non-matching checksum values,
-  // and perform a limited number of retries. A persistent mismatch may indicate
-  // an issue in your computation of the CRC32C checksum. Note: receiving this
-  // response message indicates that [KeyManagementService][google.cloud.kms.v1.KeyManagementService] is able to
-  // successfully decrypt the [ciphertext][google.cloud.kms.v1.DecryptRequest.ciphertext].
+  // Required. The data to sign. The MAC tag is computed over this data field based on
+  // the specific algorithm.
+  bytes data = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. An optional CRC32C checksum of the [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]. If
+  // specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+  // received [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] using this checksum.
+  // [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+  // fails. If you receive a checksum error, your client should verify that
+  // CRC32C([MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data]) is equal to
+  // [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c], and if so, perform a limited
+  // number of retries. A persistent mismatch may indicate an issue in your
+  // computation of the CRC32C checksum.
   // Note: This field is defined as int64 for reasons of compatibility across
   // different languages. However, it is a non-negative integer, which will
   // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
   // that support this type.
-  //
-  // NOTE: This field is in Beta.
-  google.protobuf.Int64Value plaintext_crc32c = 2;
+  google.protobuf.Int64Value data_crc32c = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request message for [KeyManagementService.MacVerify][google.cloud.kms.v1.KeyManagementService.MacVerify].
+message MacVerifyRequest {
+  // Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudkms.googleapis.com/CryptoKeyVersion"
+    }
+  ];
+
+  // Required. The data used previously as a [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] to generate the MAC
+  // tag.
+  bytes data = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. An optional CRC32C checksum of the [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]. If
+  // specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+  // received [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] using this checksum.
+  // [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+  // fails. If you receive a checksum error, your client should verify that
+  // CRC32C([MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data]) is equal to
+  // [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c], and if so, perform a limited
+  // number of retries. A persistent mismatch may indicate an issue in your
+  // computation of the CRC32C checksum.
+  // Note: This field is defined as int64 for reasons of compatibility across
+  // different languages. However, it is a non-negative integer, which will
+  // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+  // that support this type.
+  google.protobuf.Int64Value data_crc32c = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // Required. The signature to verify.
+  bytes mac = 4 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. An optional CRC32C checksum of the [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac]. If
+  // specified, [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will verify the integrity of the
+  // received [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] using this checksum.
+  // [KeyManagementService][google.cloud.kms.v1.KeyManagementService] will report an error if the checksum verification
+  // fails. If you receive a checksum error, your client should verify that
+  // CRC32C([MacVerifyRequest.tag][]) is equal to
+  // [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c], and if so, perform a limited
+  // number of retries. A persistent mismatch may indicate an issue in your
+  // computation of the CRC32C checksum.
+  // Note: This field is defined as int64 for reasons of compatibility across
+  // different languages. However, it is a non-negative integer, which will
+  // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+  // that support this type.
+  google.protobuf.Int64Value mac_crc32c = 5 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request message for [KeyManagementService.GenerateRandomBytes][google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes].
+message GenerateRandomBytesRequest {
+  // The project-specific location in which to generate random bytes.
+  // For example, "projects/my-project/locations/us-central1".
+  string location = 1;
+
+  // The length in bytes of the amount of randomness to retrieve.  Minimum 8
+  // bytes, maximum 1024 bytes.
+  int32 length_bytes = 2;
+
+  // The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Defaults to
+  // [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
+  ProtectionLevel protection_level = 3;
 }
 
 // Response message for [KeyManagementService.Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
@@ -934,8 +1060,6 @@ message EncryptResponse {
   // different languages. However, it is a non-negative integer, which will
   // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
   // that support this type.
-  //
-  // NOTE: This field is in Beta.
   google.protobuf.Int64Value ciphertext_crc32c = 4;
 
   // Integrity verification field. A flag indicating whether
@@ -946,8 +1070,6 @@ message EncryptResponse {
   // that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
   // [EncryptRequest.plaintext_crc32c][google.cloud.kms.v1.EncryptRequest.plaintext_crc32c] but this field is still false, discard
   // the response and perform a limited number of retries.
-  //
-  // NOTE: This field is in Beta.
   bool verified_plaintext_crc32c = 5;
 
   // Integrity verification field. A flag indicating whether
@@ -959,9 +1081,37 @@ message EncryptResponse {
   // that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've set
   // [EncryptRequest.additional_authenticated_data_crc32c][google.cloud.kms.v1.EncryptRequest.additional_authenticated_data_crc32c] but this field is
   // still false, discard the response and perform a limited number of retries.
-  //
-  // NOTE: This field is in Beta.
   bool verified_additional_authenticated_data_crc32c = 6;
+
+  // The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption.
+  ProtectionLevel protection_level = 7;
+}
+
+// Response message for [KeyManagementService.Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt].
+message DecryptResponse {
+  // The decrypted data originally supplied in [EncryptRequest.plaintext][google.cloud.kms.v1.EncryptRequest.plaintext].
+  bytes plaintext = 1;
+
+  // Integrity verification field. A CRC32C checksum of the returned
+  // [DecryptResponse.plaintext][google.cloud.kms.v1.DecryptResponse.plaintext]. An integrity check of
+  // [DecryptResponse.plaintext][google.cloud.kms.v1.DecryptResponse.plaintext] can be performed by computing the CRC32C
+  // checksum of [DecryptResponse.plaintext][google.cloud.kms.v1.DecryptResponse.plaintext] and comparing your results to
+  // this field. Discard the response in case of non-matching checksum values,
+  // and perform a limited number of retries. A persistent mismatch may indicate
+  // an issue in your computation of the CRC32C checksum. Note: receiving this
+  // response message indicates that [KeyManagementService][google.cloud.kms.v1.KeyManagementService] is able to
+  // successfully decrypt the [ciphertext][google.cloud.kms.v1.DecryptRequest.ciphertext].
+  // Note: This field is defined as int64 for reasons of compatibility across
+  // different languages. However, it is a non-negative integer, which will
+  // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+  // that support this type.
+  google.protobuf.Int64Value plaintext_crc32c = 2;
+
+  // Whether the Decryption was performed using the primary key version.
+  bool used_primary = 3;
+
+  // The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+  ProtectionLevel protection_level = 4;
 }
 
 // Response message for [KeyManagementService.AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign].
@@ -980,8 +1130,6 @@ message AsymmetricSignResponse {
   // different languages. However, it is a non-negative integer, which will
   // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
   // that support this type.
-  //
-  // NOTE: This field is in Beta.
   google.protobuf.Int64Value signature_crc32c = 2;
 
   // Integrity verification field. A flag indicating whether
@@ -992,15 +1140,14 @@ message AsymmetricSignResponse {
   // unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
   // set [AsymmetricSignRequest.digest_crc32c][google.cloud.kms.v1.AsymmetricSignRequest.digest_crc32c] but this field is still false,
   // discard the response and perform a limited number of retries.
-  //
-  // NOTE: This field is in Beta.
   bool verified_digest_crc32c = 3;
 
   // The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
   // this field to verify that the intended resource was used for signing.
-  //
-  // NOTE: This field is in Beta.
   string name = 4;
+
+  // The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+  ProtectionLevel protection_level = 6;
 }
 
 // Response message for [KeyManagementService.AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt].
@@ -1019,8 +1166,6 @@ message AsymmetricDecryptResponse {
   // different languages. However, it is a non-negative integer, which will
   // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
   // that support this type.
-  //
-  // NOTE: This field is in Beta.
   google.protobuf.Int64Value plaintext_crc32c = 2;
 
   // Integrity verification field. A flag indicating whether
@@ -1031,45 +1176,106 @@ message AsymmetricDecryptResponse {
   // was left unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If
   // you've set [AsymmetricDecryptRequest.ciphertext_crc32c][google.cloud.kms.v1.AsymmetricDecryptRequest.ciphertext_crc32c] but this field is
   // still false, discard the response and perform a limited number of retries.
-  //
-  // NOTE: This field is in Beta.
   bool verified_ciphertext_crc32c = 3;
+
+  // The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in decryption.
+  ProtectionLevel protection_level = 4;
 }
 
-// Request message for [KeyManagementService.UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion].
-message UpdateCryptoKeyPrimaryVersionRequest {
-  // Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to update.
-  string name = 1 [
-    (google.api.field_behavior) = REQUIRED,
-    (google.api.resource_reference) = {
-      type: "cloudkms.googleapis.com/CryptoKey"
-    }
-  ];
+// Response message for [KeyManagementService.MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
+message MacSignResponse {
+  // The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing. Check
+  // this field to verify that the intended resource was used for signing.
+  string name = 1;
 
-  // Required. The id of the child [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as primary.
-  string crypto_key_version_id = 2 [(google.api.field_behavior) = REQUIRED];
+  // The created signature.
+  bytes mac = 2;
+
+  // Integrity verification field. A CRC32C checksum of the returned
+  // [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac]. An integrity check of
+  // [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] can be performed by computing the
+  // CRC32C checksum of [MacSignResponse.mac][google.cloud.kms.v1.MacSignResponse.mac] and comparing your
+  // results to this field. Discard the response in case of non-matching
+  // checksum values, and perform a limited number of retries. A persistent
+  // mismatch may indicate an issue in your computation of the CRC32C checksum.
+  // Note: This field is defined as int64 for reasons of compatibility across
+  // different languages. However, it is a non-negative integer, which will
+  // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+  // that support this type.
+  google.protobuf.Int64Value mac_crc32c = 3;
+
+  // Integrity verification field. A flag indicating whether
+  // [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was received by
+  // [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+  // [data][google.cloud.kms.v1.MacSignRequest.data]. A false value of this field
+  // indicates either that [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] was left
+  // unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+  // set [MacSignRequest.data_crc32c][google.cloud.kms.v1.MacSignRequest.data_crc32c] but this field is still false,
+  // discard the response and perform a limited number of retries.
+  bool verified_data_crc32c = 4;
+
+  // The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for signing.
+  ProtectionLevel protection_level = 5;
 }
 
-// Request message for [KeyManagementService.DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion].
-message DestroyCryptoKeyVersionRequest {
-  // Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to destroy.
-  string name = 1 [
-    (google.api.field_behavior) = REQUIRED,
-    (google.api.resource_reference) = {
-      type: "cloudkms.googleapis.com/CryptoKeyVersion"
-    }
-  ];
+// Response message for [KeyManagementService.MacVerify][google.cloud.kms.v1.KeyManagementService.MacVerify].
+message MacVerifyResponse {
+  // The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+  // Check this field to verify that the intended resource was used for
+  // verification.
+  string name = 1;
+
+  // This field indicates whether or not the verification operation for
+  // [MacVerifyRequest.mac][google.cloud.kms.v1.MacVerifyRequest.mac] over [MacVerifyRequest.data][google.cloud.kms.v1.MacVerifyRequest.data] was successful.
+  bool success = 2;
+
+  // Integrity verification field. A flag indicating whether
+  // [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was received by
+  // [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+  // [data][google.cloud.kms.v1.MacVerifyRequest.data]. A false value of this field
+  // indicates either that [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] was left
+  // unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+  // set [MacVerifyRequest.data_crc32c][google.cloud.kms.v1.MacVerifyRequest.data_crc32c] but this field is still false,
+  // discard the response and perform a limited number of retries.
+  bool verified_data_crc32c = 3;
+
+  // Integrity verification field. A flag indicating whether
+  // [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was received by
+  // [KeyManagementService][google.cloud.kms.v1.KeyManagementService] and used for the integrity verification of the
+  // [data][google.cloud.kms.v1.MacVerifyRequest.mac]. A false value of this field
+  // indicates either that [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] was left
+  // unset or that it was not delivered to [KeyManagementService][google.cloud.kms.v1.KeyManagementService]. If you've
+  // set [MacVerifyRequest.mac_crc32c][google.cloud.kms.v1.MacVerifyRequest.mac_crc32c] but this field is still false,
+  // discard the response and perform a limited number of retries.
+  bool verified_mac_crc32c = 4;
+
+  // Integrity verification field. This value is used for the integrity
+  // verification of [MacVerifyResponse.success]. If the value of this field
+  // contradicts the value of [MacVerifyResponse.success], discard the response
+  // and perform a limited number of retries.
+  bool verified_success_integrity = 5;
+
+  // The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used for verification.
+  ProtectionLevel protection_level = 6;
 }
 
-// Request message for [KeyManagementService.RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion].
-message RestoreCryptoKeyVersionRequest {
-  // Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to restore.
-  string name = 1 [
-    (google.api.field_behavior) = REQUIRED,
-    (google.api.resource_reference) = {
-      type: "cloudkms.googleapis.com/CryptoKeyVersion"
-    }
-  ];
+// Response message for [KeyManagementService.GenerateRandomBytes][google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes].
+message GenerateRandomBytesResponse {
+  // The generated data.
+  bytes data = 1;
+
+  // Integrity verification field. A CRC32C checksum of the returned
+  // [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data]. An integrity check of
+  // [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] can be performed by computing the
+  // CRC32C checksum of [GenerateRandomBytesResponse.data][google.cloud.kms.v1.GenerateRandomBytesResponse.data] and comparing your
+  // results to this field. Discard the response in case of non-matching
+  // checksum values, and perform a limited number of retries. A persistent
+  // mismatch may indicate an issue in your computation of the CRC32C checksum.
+  // Note: This field is defined as int64 for reasons of compatibility across
+  // different languages. However, it is a non-negative integer, which will
+  // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+  // that support this type.
+  google.protobuf.Int64Value data_crc32c = 3;
 }
 
 // A [Digest][google.cloud.kms.v1.Digest] holds a cryptographic message digest.
diff --git a/synth.metadata b/synth.metadata
index 0b0f756e..f7f184f0 100644
--- a/synth.metadata
+++ b/synth.metadata
@@ -4,15 +4,15 @@
       "git": {
         "name": ".",
         "remote": "https://github.com/googleapis/java-kms.git",
-        "sha": "66710e15a83172e3758f36722411a209f360fd18"
+        "sha": "49661d3d2601a7a628ad56a1ae136a23a60994a9"
       }
     },
     {
       "git": {
         "name": "googleapis",
         "remote": "https://github.com/googleapis/googleapis.git",
-        "sha": "d9eaf41de44d953458b18712a3f240bb4c564e48",
-        "internalRef": "388535346"
+        "sha": "2efb6951f151116fb7b5766fb4e377db465d49e9",
+        "internalRef": "389008671"
       }
     },
     {
@@ -157,6 +157,10 @@
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/EncryptResponseOrBuilder.java",
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/ExternalProtectionLevelOptions.java",
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/ExternalProtectionLevelOptionsOrBuilder.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesRequest.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesRequestOrBuilder.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesResponse.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GenerateRandomBytesResponseOrBuilder.java",
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GetCryptoKeyRequest.java",
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GetCryptoKeyRequestOrBuilder.java",
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/GetCryptoKeyVersionRequest.java",
@@ -198,6 +202,14 @@
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/LocationMetadata.java",
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/LocationMetadataOrBuilder.java",
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/LocationName.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignRequest.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignRequestOrBuilder.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignResponse.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacSignResponseOrBuilder.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyRequest.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyRequestOrBuilder.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyResponse.java",
+    "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/MacVerifyResponseOrBuilder.java",
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/ProtectionLevel.java",
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/PublicKey.java",
     "proto-google-cloud-kms-v1/src/main/java/com/google/cloud/kms/v1/PublicKeyOrBuilder.java",