ProxyConfigRuleGcpSandboxesProxyGcpWorkloadIdentityConfig

WorkloadIdentityProvider federates an OIDC token LangSmith signs for this workspace through Workload Identity Federation instead of a service account key. Use the full resource name: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/. Cannot be changed after creation.

Scopes are the OAuth scopes requested for the access token.

Omit them to use https://www.googleapis.com/auth/cloud-platform.

ServiceAccountEmail is the service account to impersonate with the federated token. Omit it to use the federated principal directly.

SubjectScope picks the token subject the provider trusts: "workspace" (the default) or "tag:", which must be one of the sandbox's tag_value_ids. Only valid with workload_identity_provider.