diff --git a/google/cloud/networkconnectivity/v1/BUILD.bazel b/google/cloud/networkconnectivity/v1/BUILD.bazel
index 6ac01592d4..61fb9ab4b8 100644
--- a/google/cloud/networkconnectivity/v1/BUILD.bazel
+++ b/google/cloud/networkconnectivity/v1/BUILD.bazel
@@ -25,6 +25,7 @@ proto_library(
     name = "networkconnectivity_proto",
     srcs = [
         "common.proto",
+        "cross_network_automation.proto",
         "hub.proto",
         "policy_based_routing.proto",
     ],
@@ -35,6 +36,8 @@ proto_library(
         "//google/api:field_info_proto",
         "//google/api:resource_proto",
         "//google/longrunning:operations_proto",
+        "//google/rpc:error_details_proto",
+        "//google/rpc:status_proto",
         "@com_google_protobuf//:empty_proto",
         "@com_google_protobuf//:field_mask_proto",
         "@com_google_protobuf//:timestamp_proto",
@@ -99,6 +102,7 @@ java_gapic_library(
 java_gapic_test(
     name = "networkconnectivity_java_gapic_test_suite",
     test_classes = [
+        "com.google.cloud.networkconnectivity.v1.CrossNetworkAutomationServiceClientTest",
         "com.google.cloud.networkconnectivity.v1.HubServiceClientTest",
         "com.google.cloud.networkconnectivity.v1.PolicyBasedRoutingServiceClientTest",
     ],
@@ -137,6 +141,8 @@ go_proto_library(
     deps = [
         "//google/api:annotations_go_proto",
         "//google/longrunning:longrunning_go_proto",
+        "//google/rpc:errdetails_go_proto",
+        "//google/rpc:status_go_proto",
     ],
 )
 
@@ -352,7 +358,6 @@ load(
 
 csharp_proto_library(
     name = "networkconnectivity_csharp_proto",
-    extra_opts = [],
     deps = [":networkconnectivity_proto"],
 )
 
diff --git a/google/cloud/networkconnectivity/v1/common.proto b/google/cloud/networkconnectivity/v1/common.proto
index bd956bf4b2..bf5b3f0a69 100644
--- a/google/cloud/networkconnectivity/v1/common.proto
+++ b/google/cloud/networkconnectivity/v1/common.proto
@@ -35,6 +35,14 @@ option (google.api.resource_definition) = {
   type: "compute.googleapis.com/Network"
   pattern: "projects/{project}/global/networks/{resource_id}"
 };
+option (google.api.resource_definition) = {
+  type: "compute.googleapis.com/Subnetwork"
+  pattern: "projects/{project}/regions/{region}/subnetworks/{subnetwork}"
+};
+option (google.api.resource_definition) = {
+  type: "compute.googleapis.com/ServiceAttachment"
+  pattern: "projects/{project}/regions/{region}/serviceAttachments/{service_attachment}"
+};
 
 // Represents the metadata of the long-running operation.
 message OperationMetadata {
@@ -57,9 +65,10 @@ message OperationMetadata {
 
   // Output only. Identifies whether the user has requested cancellation
   // of the operation. Operations that have been cancelled successfully
-  // have [Operation.error][] value with a
-  // [google.rpc.Status.code][google.rpc.Status.code] of 1, corresponding to
-  // `Code.CANCELLED`.
+  // have
+  // [google.longrunning.Operation.error][google.longrunning.Operation.error]
+  // value with a [google.rpc.Status.code][google.rpc.Status.code] of 1,
+  // corresponding to `Code.CANCELLED`.
   bool requested_cancellation = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. API version used to start the operation.
diff --git a/google/cloud/networkconnectivity/v1/cross_network_automation.proto b/google/cloud/networkconnectivity/v1/cross_network_automation.proto
new file mode 100644
index 0000000000..69589576aa
--- /dev/null
+++ b/google/cloud/networkconnectivity/v1/cross_network_automation.proto
@@ -0,0 +1,1341 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.networkconnectivity.v1;
+
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/cloud/networkconnectivity/v1/common.proto";
+import "google/longrunning/operations.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
+import "google/protobuf/timestamp.proto";
+import "google/rpc/error_details.proto";
+import "google/rpc/status.proto";
+
+option csharp_namespace = "Google.Cloud.NetworkConnectivity.V1";
+option go_package = "cloud.google.com/go/networkconnectivity/apiv1/networkconnectivitypb;networkconnectivitypb";
+option java_multiple_files = true;
+option java_outer_classname = "CrossNetworkAutomationProto";
+option java_package = "com.google.cloud.networkconnectivity.v1";
+option php_namespace = "Google\\Cloud\\NetworkConnectivity\\V1";
+option ruby_package = "Google::Cloud::NetworkConnectivity::V1";
+option (google.api.resource_definition) = {
+  type: "compute.googleapis.com/Project"
+  pattern: "projects/{project}"
+};
+
+// The service for CrossNetworkAutomation resources.
+service CrossNetworkAutomationService {
+  option (google.api.default_host) = "networkconnectivity.googleapis.com";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/cloud-platform";
+
+  // Lists ServiceConnectionMaps in a given project and location.
+  rpc ListServiceConnectionMaps(ListServiceConnectionMapsRequest)
+      returns (ListServiceConnectionMapsResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=projects/*/locations/*}/serviceConnectionMaps"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Gets details of a single ServiceConnectionMap.
+  rpc GetServiceConnectionMap(GetServiceConnectionMapRequest)
+      returns (ServiceConnectionMap) {
+    option (google.api.http) = {
+      get: "/v1/{name=projects/*/locations/*/serviceConnectionMaps/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Creates a new ServiceConnectionMap in a given project and location.
+  rpc CreateServiceConnectionMap(CreateServiceConnectionMapRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=projects/*/locations/*}/serviceConnectionMaps"
+      body: "service_connection_map"
+    };
+    option (google.api.method_signature) =
+        "parent,service_connection_map,service_connection_map_id";
+    option (google.longrunning.operation_info) = {
+      response_type: "ServiceConnectionMap"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
+  // Updates the parameters of a single ServiceConnectionMap.
+  rpc UpdateServiceConnectionMap(UpdateServiceConnectionMapRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{service_connection_map.name=projects/*/locations/*/serviceConnectionMaps/*}"
+      body: "service_connection_map"
+    };
+    option (google.api.method_signature) = "service_connection_map,update_mask";
+    option (google.longrunning.operation_info) = {
+      response_type: "ServiceConnectionMap"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
+  // Deletes a single ServiceConnectionMap.
+  rpc DeleteServiceConnectionMap(DeleteServiceConnectionMapRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=projects/*/locations/*/serviceConnectionMaps/*}"
+    };
+    option (google.api.method_signature) = "name";
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
+  // Lists ServiceConnectionPolicies in a given project and location.
+  rpc ListServiceConnectionPolicies(ListServiceConnectionPoliciesRequest)
+      returns (ListServiceConnectionPoliciesResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=projects/*/locations/*}/serviceConnectionPolicies"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Gets details of a single ServiceConnectionPolicy.
+  rpc GetServiceConnectionPolicy(GetServiceConnectionPolicyRequest)
+      returns (ServiceConnectionPolicy) {
+    option (google.api.http) = {
+      get: "/v1/{name=projects/*/locations/*/serviceConnectionPolicies/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Creates a new ServiceConnectionPolicy in a given project and location.
+  rpc CreateServiceConnectionPolicy(CreateServiceConnectionPolicyRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=projects/*/locations/*}/serviceConnectionPolicies"
+      body: "service_connection_policy"
+    };
+    option (google.api.method_signature) =
+        "parent,service_connection_policy,service_connection_policy_id";
+    option (google.longrunning.operation_info) = {
+      response_type: "ServiceConnectionPolicy"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
+  // Updates the parameters of a single ServiceConnectionPolicy.
+  rpc UpdateServiceConnectionPolicy(UpdateServiceConnectionPolicyRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{service_connection_policy.name=projects/*/locations/*/serviceConnectionPolicies/*}"
+      body: "service_connection_policy"
+    };
+    option (google.api.method_signature) =
+        "service_connection_policy,update_mask";
+    option (google.longrunning.operation_info) = {
+      response_type: "ServiceConnectionPolicy"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
+  // Deletes a single ServiceConnectionPolicy.
+  rpc DeleteServiceConnectionPolicy(DeleteServiceConnectionPolicyRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=projects/*/locations/*/serviceConnectionPolicies/*}"
+    };
+    option (google.api.method_signature) = "name";
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
+  // Lists ServiceClasses in a given project and location.
+  rpc ListServiceClasses(ListServiceClassesRequest)
+      returns (ListServiceClassesResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=projects/*/locations/*}/serviceClasses"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Gets details of a single ServiceClass.
+  rpc GetServiceClass(GetServiceClassRequest) returns (ServiceClass) {
+    option (google.api.http) = {
+      get: "/v1/{name=projects/*/locations/*/serviceClasses/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Updates the parameters of a single ServiceClass.
+  rpc UpdateServiceClass(UpdateServiceClassRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{service_class.name=projects/*/locations/*/serviceClasses/*}"
+      body: "service_class"
+    };
+    option (google.api.method_signature) = "service_class,update_mask";
+    option (google.longrunning.operation_info) = {
+      response_type: "ServiceClass"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
+  // Deletes a single ServiceClass.
+  rpc DeleteServiceClass(DeleteServiceClassRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=projects/*/locations/*/serviceClasses/*}"
+    };
+    option (google.api.method_signature) = "name";
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
+  // Gets details of a single ServiceConnectionToken.
+  rpc GetServiceConnectionToken(GetServiceConnectionTokenRequest)
+      returns (ServiceConnectionToken) {
+    option (google.api.http) = {
+      get: "/v1/{name=projects/*/locations/*/serviceConnectionTokens/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Lists ServiceConnectionTokens in a given project and location.
+  rpc ListServiceConnectionTokens(ListServiceConnectionTokensRequest)
+      returns (ListServiceConnectionTokensResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=projects/*/locations/*}/serviceConnectionTokens"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Creates a new ServiceConnectionToken in a given project and location.
+  rpc CreateServiceConnectionToken(CreateServiceConnectionTokenRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=projects/*/locations/*}/serviceConnectionTokens"
+      body: "service_connection_token"
+    };
+    option (google.api.method_signature) =
+        "parent,service_connection_token,service_connection_token_id";
+    option (google.longrunning.operation_info) = {
+      response_type: "ServiceConnectionToken"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
+  // Deletes a single ServiceConnectionToken.
+  rpc DeleteServiceConnectionToken(DeleteServiceConnectionTokenRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=projects/*/locations/*/serviceConnectionTokens/*}"
+    };
+    option (google.api.method_signature) = "name";
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "OperationMetadata"
+    };
+  }
+}
+
+// The infrastructure used for connections between consumers/producers.
+enum Infrastructure {
+  // An invalid infrastructure as the default case.
+  INFRASTRUCTURE_UNSPECIFIED = 0;
+
+  // Private Service Connect is used for connections.
+  PSC = 1;
+}
+
+// The error type indicates whether a connection error is consumer facing,
+// producer facing or system internal.
+enum ConnectionErrorType {
+  // An invalid error type as the default case.
+  CONNECTION_ERROR_TYPE_UNSPECIFIED = 0;
+
+  // The error is due to Service Automation system internal.
+  ERROR_INTERNAL = 1;
+
+  // The error is due to the setup on consumer side.
+  ERROR_CONSUMER_SIDE = 2;
+
+  // The error is due to the setup on producer side.
+  ERROR_PRODUCER_SIDE = 3;
+}
+
+// The requested IP version for the PSC connection.
+enum IPVersion {
+  // Default value. We will use IPv4 or IPv6 depending on the IP version of
+  // first available subnetwork.
+  IP_VERSION_UNSPECIFIED = 0;
+
+  // Will use IPv4 only.
+  IPV4 = 1;
+
+  // Will use IPv6 only.
+  IPV6 = 2;
+}
+
+// The ServiceConnectionMap resource.
+message ServiceConnectionMap {
+  option (google.api.resource) = {
+    type: "networkconnectivity.googleapis.com/ServiceConnectionMap"
+    pattern: "projects/{project}/locations/{location}/serviceConnectionMaps/{service_connection_map}"
+  };
+
+  // The PSC configurations on producer side.
+  message ProducerPscConfig {
+    // The resource path of a service attachment.
+    // Example:
+    // projects/{projectNumOrId}/regions/{region}/serviceAttachments/{resourceId}.
+    string service_attachment_uri = 1 [(google.api.resource_reference) = {
+      type: "compute.googleapis.com/ServiceAttachment"
+    }];
+  }
+
+  // Allow the producer to specify which consumers can connect to it.
+  message ConsumerPscConfig {
+    // PSC Consumer Config State.
+    enum State {
+      // Default state, when Connection Map is created initially.
+      STATE_UNSPECIFIED = 0;
+
+      // Set when policy and map configuration is valid,
+      // and their matching can lead to allowing creation of PSC Connections
+      // subject to other constraints like connections limit.
+      VALID = 1;
+
+      // No Service Connection Policy found for this network and Service
+      // Class
+      CONNECTION_POLICY_MISSING = 2;
+
+      // Service Connection Policy limit reached for this network and Service
+      // Class
+      POLICY_LIMIT_REACHED = 3;
+
+      // The consumer instance project is not in
+      // AllowedGoogleProducersResourceHierarchyLevels of the matching
+      // ServiceConnectionPolicy.
+      CONSUMER_INSTANCE_PROJECT_NOT_ALLOWLISTED = 4;
+    }
+
+    // The consumer project where PSC connections are allowed to be created in.
+    string project = 1;
+
+    // The resource path of the consumer network where PSC connections are
+    // allowed to be created in. Note, this network does not need be in the
+    // ConsumerPscConfig.project in the case of SharedVPC.
+    // Example:
+    // projects/{projectNumOrId}/global/networks/{networkId}.
+    string network = 2 [(google.api.resource_reference) = {
+      type: "compute.googleapis.com/Network"
+    }];
+
+    // This is used in PSC consumer ForwardingRule to control whether the PSC
+    // endpoint can be accessed from another region.
+    bool disable_global_access = 3;
+
+    // Output only. Overall state of PSC Connections management for this
+    // consumer psc config.
+    State state = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+    // Immutable. Deprecated. Use producer_instance_metadata instead.
+    // An immutable identifier for the producer instance.
+    string producer_instance_id = 5
+        [deprecated = true, (google.api.field_behavior) = IMMUTABLE];
+
+    // Output only. A map to store mapping between customer vip and target
+    // service attachment. Only service attachment with producer specified ip
+    // addresses are stored here.
+    map<string, string> service_attachment_ip_address_map = 6
+        [(google.api.field_behavior) = OUTPUT_ONLY];
+
+    // Required. The project ID or project number of the consumer project. This
+    // project is the one that the consumer uses to interact with the producer
+    // instance. From the perspective of a consumer who's created a producer
+    // instance, this is the project of the producer instance. Format:
+    // 'projects/<project_id_or_number>' Eg. 'projects/consumer-project' or
+    // 'projects/1234'
+    string consumer_instance_project = 7 [
+      (google.api.field_behavior) = REQUIRED,
+      (google.api.resource_reference) = {
+        type: "compute.googleapis.com/Project"
+      }
+    ];
+
+    // Immutable. An immutable map for the producer instance metadata.
+    map<string, string> producer_instance_metadata = 8
+        [(google.api.field_behavior) = IMMUTABLE];
+
+    // The requested IP version for the PSC connection.
+    optional IPVersion ip_version = 9;
+  }
+
+  // PSC connection details on consumer side.
+  message ConsumerPscConnection {
+    // The state of the PSC connection.
+    // We reserve the right to add more states without notice in the future.
+    // Users should not use exhaustive switch statements on this enum.
+    // See https://google.aip.dev/216.
+    enum State {
+      // An invalid state as the default case.
+      STATE_UNSPECIFIED = 0;
+
+      // The connection has been created successfully. However, for the
+      // up-to-date connection status, please use the service attachment's
+      // "ConnectedEndpoint.status" as the source of truth.
+      ACTIVE = 1;
+
+      // The connection is not functional since some resources on the connection
+      // fail to be created.
+      FAILED = 2;
+
+      // The connection is being created.
+      CREATING = 3;
+
+      // The connection is being deleted.
+      DELETING = 4;
+
+      // The connection is being repaired to complete creation.
+      CREATE_REPAIRING = 5;
+
+      // The connection is being repaired to complete deletion.
+      DELETE_REPAIRING = 6;
+    }
+
+    // The URI of a service attachment which is the target of the PSC
+    // connection.
+    string service_attachment_uri = 1;
+
+    // The state of the PSC connection.
+    State state = 2;
+
+    // The consumer project whose PSC forwarding rule is connected to the
+    // service attachments in this service connection map.
+    string project = 3;
+
+    // The consumer network whose PSC forwarding rule is connected to the
+    // service attachments in this service connection map.
+    // Note that the network could be on a different project (shared VPC).
+    string network = 4;
+
+    // The PSC connection id of the PSC forwarding rule connected
+    // to the service attachments in this service connection map.
+    string psc_connection_id = 5;
+
+    // The IP literal allocated on the consumer network for the PSC forwarding
+    // rule that is created to connect to the producer service attachment in
+    // this service connection map.
+    string ip = 6;
+
+    // The error type indicates whether the error is consumer facing, producer
+    // facing or system internal.
+    ConnectionErrorType error_type = 7 [deprecated = true];
+
+    // The most recent error during operating this connection.
+    google.rpc.Status error = 8 [deprecated = true];
+
+    // The last Compute Engine operation to setup PSC connection.
+    string gce_operation = 9;
+
+    // The URI of the consumer forwarding rule created.
+    // Example:
+    // projects/{projectNumOrId}/regions/us-east1/networks/{resourceId}.
+    string forwarding_rule = 10;
+
+    // Output only. The error info for the latest error during operating this
+    // connection.
+    google.rpc.ErrorInfo error_info = 11
+        [(google.api.field_behavior) = OUTPUT_ONLY];
+
+    // Output only. The URI of the selected subnetwork selected to allocate IP
+    // address for this connection.
+    string selected_subnetwork = 12 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+    // Immutable. Deprecated. Use producer_instance_metadata instead.
+    // An immutable identifier for the producer instance.
+    string producer_instance_id = 13
+        [deprecated = true, (google.api.field_behavior) = IMMUTABLE];
+
+    // Immutable. An immutable map for the producer instance metadata.
+    map<string, string> producer_instance_metadata = 14
+        [(google.api.field_behavior) = IMMUTABLE];
+
+    // The requested IP version for the PSC connection.
+    optional IPVersion ip_version = 15;
+  }
+
+  // Immutable. The name of a ServiceConnectionMap.
+  // Format:
+  // projects/{project}/locations/{location}/serviceConnectionMaps/{service_connection_map}
+  // See: https://google.aip.dev/122#fields-representing-resource-names
+  string name = 1 [(google.api.field_behavior) = IMMUTABLE];
+
+  // Output only. Time when the ServiceConnectionMap was created.
+  google.protobuf.Timestamp create_time = 2
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Time when the ServiceConnectionMap was updated.
+  google.protobuf.Timestamp update_time = 3
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // User-defined labels.
+  map<string, string> labels = 4;
+
+  // A description of this resource.
+  string description = 5;
+
+  // The service class identifier this ServiceConnectionMap is for.
+  // The user of ServiceConnectionMap create API needs to have
+  // networkconnecitivty.serviceclasses.use iam permission for the service
+  // class.
+  string service_class = 7;
+
+  // Output only. The service class uri this ServiceConnectionMap is for.
+  string service_class_uri = 12 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The infrastructure used for connections between
+  // consumers/producers.
+  Infrastructure infrastructure = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The PSC configurations on producer side.
+  repeated ProducerPscConfig producer_psc_configs = 9;
+
+  // The PSC configurations on consumer side.
+  repeated ConsumerPscConfig consumer_psc_configs = 10;
+
+  // Output only. PSC connection details on consumer side.
+  repeated ConsumerPscConnection consumer_psc_connections = 11
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // The token provided by the consumer. This token authenticates that the
+  // consumer can create a connection within the specified project and network.
+  string token = 13;
+
+  // Optional. The etag is computed by the server, and may be sent on update and
+  // delete requests to ensure the client has an up-to-date value before
+  // proceeding.
+  optional string etag = 14 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request for ListServiceConnectionMaps.
+message ListServiceConnectionMapsRequest {
+  // Required. The parent resource's name. ex. projects/123/locations/us-east1
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "locations.googleapis.com/Location"
+    }
+  ];
+
+  // The maximum number of results per page that should be returned.
+  int32 page_size = 2;
+
+  // The page token.
+  string page_token = 3;
+
+  // A filter expression that filters the results listed in the response.
+  string filter = 4;
+
+  // Sort the results by a certain order.
+  string order_by = 5;
+}
+
+// Response for ListServiceConnectionMaps.
+message ListServiceConnectionMapsResponse {
+  // ServiceConnectionMaps to be returned.
+  repeated ServiceConnectionMap service_connection_maps = 1;
+
+  // The next pagination token in the List response. It should be used as
+  // page_token for the following request. An empty value means no more result.
+  string next_page_token = 2;
+
+  // Locations that could not be reached.
+  repeated string unreachable = 3;
+}
+
+// Request for GetServiceConnectionMap.
+message GetServiceConnectionMapRequest {
+  // Required. Name of the ServiceConnectionMap to get.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/ServiceConnectionMap"
+    }
+  ];
+}
+
+// Request for CreateServiceConnectionMap.
+message CreateServiceConnectionMapRequest {
+  // Required. The parent resource's name of the ServiceConnectionMap. ex.
+  // projects/123/locations/us-east1
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "networkconnectivity.googleapis.com/ServiceConnectionMap"
+    }
+  ];
+
+  // Optional. Resource ID
+  // (i.e. 'foo' in '[...]/projects/p/locations/l/serviceConnectionMaps/foo')
+  // See https://google.aip.dev/122#resource-id-segments
+  // Unique per location.
+  // If one is not provided, one will be generated.
+  string service_connection_map_id = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Required. Initial values for a new ServiceConnectionMaps
+  ServiceConnectionMap service_connection_map = 3
+      [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. An optional request ID to identify requests. Specify a unique
+  // request ID so that if you must retry your request, the server will know to
+  // ignore the request if it has already been completed. The server will
+  // guarantee that for at least 60 minutes since the first request.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check if original operation with the same request ID
+  // was received, and if so, will ignore the second request. This prevents
+  // clients from accidentally creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request for UpdateServiceConnectionMap.
+message UpdateServiceConnectionMapRequest {
+  // Optional. Field mask is used to specify the fields to be overwritten in the
+  // ServiceConnectionMap resource by the update.
+  // The fields specified in the update_mask are relative to the resource, not
+  // the full request. A field will be overwritten if it is in the mask. If the
+  // user does not provide a mask then all fields will be overwritten.
+  google.protobuf.FieldMask update_mask = 1
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Required. New values to be patched into the resource.
+  ServiceConnectionMap service_connection_map = 2
+      [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. An optional request ID to identify requests. Specify a unique
+  // request ID so that if you must retry your request, the server will know to
+  // ignore the request if it has already been completed. The server will
+  // guarantee that for at least 60 minutes since the first request.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check if original operation with the same request ID
+  // was received, and if so, will ignore the second request. This prevents
+  // clients from accidentally creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request for DeleteServiceConnectionMap.
+message DeleteServiceConnectionMapRequest {
+  // Required. The name of the ServiceConnectionMap to delete.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/ServiceConnectionMap"
+    }
+  ];
+
+  // Optional. An optional request ID to identify requests. Specify a unique
+  // request ID so that if you must retry your request, the server will know to
+  // ignore the request if it has already been completed. The server will
+  // guarantee that for at least 60 minutes after the first request.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check if original operation with the same request ID
+  // was received, and if so, will ignore the second request. This prevents
+  // clients from accidentally creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The etag is computed by the server, and may be sent on update and
+  // delete requests to ensure the client has an up-to-date value before
+  // proceeding.
+  optional string etag = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// The ServiceConnectionPolicy resource.
+message ServiceConnectionPolicy {
+  option (google.api.resource) = {
+    type: "networkconnectivity.googleapis.com/ServiceConnectionPolicy"
+    pattern: "projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy}"
+  };
+
+  // Configuration used for Private Service Connect connections. Used when
+  // Infrastructure is PSC.
+  message PscConfig {
+    // ProducerInstanceLocation is used to specify which authorization mechanism
+    // to use to determine which projects the Producer instance can be within.
+    enum ProducerInstanceLocation {
+      // Producer instance location is not specified. When this option is
+      // chosen, then the PSC connections created by this
+      // ServiceConnectionPolicy must be within the same project as the Producer
+      // instance. This is the default ProducerInstanceLocation value.
+      // To allow for PSC connections from this network to other networks, use
+      // the CUSTOM_RESOURCE_HIERARCHY_LEVELS option.
+      PRODUCER_INSTANCE_LOCATION_UNSPECIFIED = 0;
+
+      // Producer instance must be within one of the values provided in
+      // allowed_google_producers_resource_hierarchy_level.
+      CUSTOM_RESOURCE_HIERARCHY_LEVELS = 1;
+    }
+
+    // The resource paths of subnetworks to use for IP address management.
+    // Example:
+    // projects/{projectNumOrId}/regions/{region}/subnetworks/{resourceId}.
+    repeated string subnetworks = 1 [(google.api.resource_reference) = {
+      type: "compute.googleapis.com/Subnetwork"
+    }];
+
+    // Optional. Max number of PSC connections for this policy.
+    optional int64 limit = 2 [(google.api.field_behavior) = OPTIONAL];
+
+    // Required. ProducerInstanceLocation is used to specify which authorization
+    // mechanism to use to determine which projects the Producer instance can be
+    // within.
+    ProducerInstanceLocation producer_instance_location = 3
+        [(google.api.field_behavior) = REQUIRED];
+
+    // Optional. List of Projects, Folders, or Organizations from where the
+    // Producer instance can be within. For example, a network administrator can
+    // provide both 'organizations/foo' and 'projects/bar' as
+    // allowed_google_producers_resource_hierarchy_levels. This allowlists this
+    // network to connect with any Producer instance within the 'foo'
+    // organization or the 'bar' project. By default,
+    // allowed_google_producers_resource_hierarchy_level is empty. The format
+    // for each allowed_google_producers_resource_hierarchy_level is <resource
+    // type>/<id> where <resource type> is one of 'projects', 'folders', or
+    // 'organizations' and <id> is either the ID or the number of the resource
+    // type. Format for each allowed_google_producers_resource_hierarchy_level
+    // value: 'projects/<project_id_or_number>' or 'folders/<folder_id>' or
+    // 'organizations/<organization_id>'
+    // Eg. [projects/my-project-id, projects/567, folders/891,
+    // organizations/123]
+    repeated string allowed_google_producers_resource_hierarchy_level = 4
+        [(google.api.field_behavior) = OPTIONAL];
+  }
+
+  // Information about a specific Private Service Connect connection.
+  message PscConnection {
+    // State of the PSC Connection
+    State state = 1;
+
+    // The resource reference of the PSC Forwarding Rule within the consumer
+    // VPC.
+    string consumer_forwarding_rule = 2;
+
+    // The resource reference of the consumer address.
+    string consumer_address = 3;
+
+    // The error type indicates whether the error is consumer facing, producer
+    // facing or system internal.
+    ConnectionErrorType error_type = 4 [deprecated = true];
+
+    // The most recent error during operating this connection.
+    // Deprecated, please use error_info instead.
+    google.rpc.Status error = 5 [deprecated = true];
+
+    // The last Compute Engine operation to setup PSC connection.
+    string gce_operation = 6;
+
+    // The project where the PSC connection is created.
+    string consumer_target_project = 7;
+
+    // The PSC connection id of the PSC forwarding rule.
+    string psc_connection_id = 8;
+
+    // Output only. The error info for the latest error during operating this
+    // connection.
+    google.rpc.ErrorInfo error_info = 9
+        [(google.api.field_behavior) = OUTPUT_ONLY];
+
+    // Output only. The URI of the subnetwork selected to allocate IP address
+    // for this connection.
+    string selected_subnetwork = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+    // Immutable. Deprecated. Use producer_instance_metadata instead.
+    // An immutable identifier for the producer instance.
+    string producer_instance_id = 11
+        [deprecated = true, (google.api.field_behavior) = IMMUTABLE];
+
+    // Immutable. An immutable map for the producer instance metadata.
+    map<string, string> producer_instance_metadata = 12
+        [(google.api.field_behavior) = IMMUTABLE];
+
+    // Output only. [Output only] The service class associated with this PSC
+    // Connection. The value is derived from the SCPolicy and matches the
+    // service class name provided by the customer.
+    string service_class = 13 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+    // The requested IP version for the PSC connection.
+    optional IPVersion ip_version = 14;
+  }
+
+  // The state of the PSC connection.
+  // We reserve the right to add more states without notice in the future.
+  // Users should not use exhaustive switch statements on this enum.
+  // See https://google.aip.dev/216.
+  enum State {
+    // An invalid state as the default case.
+    STATE_UNSPECIFIED = 0;
+
+    // The connection has been created successfully. However, for the
+    // up-to-date connection status, please use the created forwarding rule's
+    // "PscConnectionStatus" as the source of truth.
+    ACTIVE = 1;
+
+    // The connection is not functional since some resources on the connection
+    // fail to be created.
+    FAILED = 2;
+
+    // The connection is being created.
+    CREATING = 3;
+
+    // The connection is being deleted.
+    DELETING = 4;
+
+    // The connection is being repaired to complete creation.
+    CREATE_REPAIRING = 5;
+
+    // The connection is being repaired to complete deletion.
+    DELETE_REPAIRING = 6;
+  }
+
+  // Immutable. The name of a ServiceConnectionPolicy.
+  // Format:
+  // projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy}
+  // See: https://google.aip.dev/122#fields-representing-resource-names
+  string name = 1 [(google.api.field_behavior) = IMMUTABLE];
+
+  // Output only. Time when the ServiceConnectionPolicy was created.
+  google.protobuf.Timestamp create_time = 2
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Time when the ServiceConnectionPolicy was updated.
+  google.protobuf.Timestamp update_time = 3
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // User-defined labels.
+  map<string, string> labels = 4;
+
+  // A description of this resource.
+  string description = 5;
+
+  // The resource path of the consumer network.
+  // Example:
+  // - projects/{projectNumOrId}/global/networks/{resourceId}.
+  string network = 6 [
+    (google.api.resource_reference) = { type: "compute.googleapis.com/Network" }
+  ];
+
+  // The service class identifier for which this ServiceConnectionPolicy is for.
+  // The service class identifier is a unique, symbolic representation of a
+  // ServiceClass. It is provided by the Service Producer. Google services have
+  // a prefix of gcp or google-cloud. For example, gcp-memorystore-redis or
+  // google-cloud-sql. 3rd party services do not. For example,
+  // test-service-a3dfcx.
+  string service_class = 7;
+
+  // Output only. The type of underlying resources used to create the
+  // connection.
+  Infrastructure infrastructure = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Configuration used for Private Service Connect connections. Used when
+  // Infrastructure is PSC.
+  PscConfig psc_config = 9;
+
+  // Output only. [Output only] Information about each Private Service Connect
+  // connection.
+  repeated PscConnection psc_connections = 10
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Optional. The etag is computed by the server, and may be sent on update and
+  // delete requests to ensure the client has an up-to-date value before
+  // proceeding.
+  optional string etag = 11 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request for ListServiceConnectionPolicies.
+message ListServiceConnectionPoliciesRequest {
+  // Required. The parent resource's name. ex. projects/123/locations/us-east1
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "locations.googleapis.com/Location"
+    }
+  ];
+
+  // The maximum number of results per page that should be returned.
+  int32 page_size = 2;
+
+  // The page token.
+  string page_token = 3;
+
+  // A filter expression that filters the results listed in the response.
+  string filter = 4;
+
+  // Sort the results by a certain order.
+  string order_by = 5;
+}
+
+// Response for ListServiceConnectionPolicies.
+message ListServiceConnectionPoliciesResponse {
+  // ServiceConnectionPolicies to be returned.
+  repeated ServiceConnectionPolicy service_connection_policies = 1;
+
+  // The next pagination token in the List response. It should be used as
+  // page_token for the following request. An empty value means no more result.
+  string next_page_token = 2;
+
+  // Locations that could not be reached.
+  repeated string unreachable = 3;
+}
+
+// Request for GetServiceConnectionPolicy.
+message GetServiceConnectionPolicyRequest {
+  // Required. Name of the ServiceConnectionPolicy to get.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/ServiceConnectionPolicy"
+    }
+  ];
+}
+
+// Request for CreateServiceConnectionPolicy.
+message CreateServiceConnectionPolicyRequest {
+  // Required. The parent resource's name of the ServiceConnectionPolicy. ex.
+  // projects/123/locations/us-east1
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "networkconnectivity.googleapis.com/ServiceConnectionPolicy"
+    }
+  ];
+
+  // Optional. Resource ID
+  // (i.e. 'foo' in
+  // '[...]/projects/p/locations/l/serviceConnectionPolicies/foo') See
+  // https://google.aip.dev/122#resource-id-segments Unique per location.
+  string service_connection_policy_id = 2
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Required. Initial values for a new ServiceConnectionPolicies
+  ServiceConnectionPolicy service_connection_policy = 3
+      [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. An optional request ID to identify requests. Specify a unique
+  // request ID so that if you must retry your request, the server will know to
+  // ignore the request if it has already been completed. The server will
+  // guarantee that for at least 60 minutes since the first request.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check if original operation with the same request ID
+  // was received, and if so, will ignore the second request. This prevents
+  // clients from accidentally creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request for UpdateServiceConnectionPolicy.
+message UpdateServiceConnectionPolicyRequest {
+  // Optional. Field mask is used to specify the fields to be overwritten in the
+  // ServiceConnectionPolicy resource by the update.
+  // The fields specified in the update_mask are relative to the resource, not
+  // the full request. A field will be overwritten if it is in the mask. If the
+  // user does not provide a mask then all fields will be overwritten.
+  google.protobuf.FieldMask update_mask = 1
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Required. New values to be patched into the resource.
+  ServiceConnectionPolicy service_connection_policy = 2
+      [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. An optional request ID to identify requests. Specify a unique
+  // request ID so that if you must retry your request, the server will know to
+  // ignore the request if it has already been completed. The server will
+  // guarantee that for at least 60 minutes since the first request.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check if original operation with the same request ID
+  // was received, and if so, will ignore the second request. This prevents
+  // clients from accidentally creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request for DeleteServiceConnectionPolicy.
+message DeleteServiceConnectionPolicyRequest {
+  // Required. The name of the ServiceConnectionPolicy to delete.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/ServiceConnectionPolicy"
+    }
+  ];
+
+  // Optional. An optional request ID to identify requests. Specify a unique
+  // request ID so that if you must retry your request, the server will know to
+  // ignore the request if it has already been completed. The server will
+  // guarantee that for at least 60 minutes after the first request.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check if original operation with the same request ID
+  // was received, and if so, will ignore the second request. This prevents
+  // clients from accidentally creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The etag is computed by the server, and may be sent on update and
+  // delete requests to ensure the client has an up-to-date value before
+  // proceeding.
+  optional string etag = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// The ServiceClass resource.
+message ServiceClass {
+  option (google.api.resource) = {
+    type: "networkconnectivity.googleapis.com/ServiceClass"
+    pattern: "projects/{project}/locations/{location}/serviceClasses/{service_class}"
+  };
+
+  // Immutable. The name of a ServiceClass resource.
+  // Format:
+  // projects/{project}/locations/{location}/serviceClasses/{service_class}
+  // See: https://google.aip.dev/122#fields-representing-resource-names
+  string name = 1 [(google.api.field_behavior) = IMMUTABLE];
+
+  // Output only. The generated service class name. Use this name to refer to
+  // the Service class in Service Connection Maps and Service Connection
+  // Policies.
+  string service_class = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Time when the ServiceClass was created.
+  google.protobuf.Timestamp create_time = 2
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Time when the ServiceClass was updated.
+  google.protobuf.Timestamp update_time = 3
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // User-defined labels.
+  map<string, string> labels = 4;
+
+  // A description of this resource.
+  string description = 5;
+
+  // Optional. The etag is computed by the server, and may be sent on update and
+  // delete requests to ensure the client has an up-to-date value before
+  // proceeding.
+  optional string etag = 8 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request for ListServiceClasses.
+message ListServiceClassesRequest {
+  // Required. The parent resource's name. ex. projects/123/locations/us-east1
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "locations.googleapis.com/Location"
+    }
+  ];
+
+  // The maximum number of results per page that should be returned.
+  int32 page_size = 2;
+
+  // The page token.
+  string page_token = 3;
+
+  // A filter expression that filters the results listed in the response.
+  string filter = 4;
+
+  // Sort the results by a certain order.
+  string order_by = 5;
+}
+
+// Response for ListServiceClasses.
+message ListServiceClassesResponse {
+  // ServiceClasses to be returned.
+  repeated ServiceClass service_classes = 1;
+
+  // The next pagination token in the List response. It should be used as
+  // page_token for the following request. An empty value means no more result.
+  string next_page_token = 2;
+
+  // Locations that could not be reached.
+  repeated string unreachable = 3;
+}
+
+// Request for GetServiceClass.
+message GetServiceClassRequest {
+  // Required. Name of the ServiceClass to get.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/ServiceClass"
+    }
+  ];
+}
+
+// Request for UpdateServiceClass.
+message UpdateServiceClassRequest {
+  // Optional. Field mask is used to specify the fields to be overwritten in the
+  // ServiceClass resource by the update.
+  // The fields specified in the update_mask are relative to the resource, not
+  // the full request. A field will be overwritten if it is in the mask. If the
+  // user does not provide a mask then all fields will be overwritten.
+  google.protobuf.FieldMask update_mask = 1
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Required. New values to be patched into the resource.
+  ServiceClass service_class = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. An optional request ID to identify requests. Specify a unique
+  // request ID so that if you must retry your request, the server will know to
+  // ignore the request if it has already been completed. The server will
+  // guarantee that for at least 60 minutes since the first request.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check if original operation with the same request ID
+  // was received, and if so, will ignore the second request. This prevents
+  // clients from accidentally creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request for DeleteServiceClass.
+message DeleteServiceClassRequest {
+  // Required. The name of the ServiceClass to delete.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/ServiceClass"
+    }
+  ];
+
+  // Optional. An optional request ID to identify requests. Specify a unique
+  // request ID so that if you must retry your request, the server will know to
+  // ignore the request if it has already been completed. The server will
+  // guarantee that for at least 60 minutes after the first request.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check if original operation with the same request ID
+  // was received, and if so, will ignore the second request. This prevents
+  // clients from accidentally creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The etag is computed by the server, and may be sent on update and
+  // delete requests to ensure the client has an up-to-date value before
+  // proceeding.
+  optional string etag = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// The ServiceConnectionToken resource.
+message ServiceConnectionToken {
+  option (google.api.resource) = {
+    type: "networkconnectivity.googleapis.com/ServiceConnectionToken"
+    pattern: "projects/{project}/locations/{location}/serviceConnectionTokens/{service_connection_token}"
+  };
+
+  // Immutable. The name of a ServiceConnectionToken.
+  // Format:
+  // projects/{project}/locations/{location}/ServiceConnectionTokens/{service_connection_token}
+  // See: https://google.aip.dev/122#fields-representing-resource-names
+  string name = 1 [(google.api.field_behavior) = IMMUTABLE];
+
+  // Output only. Time when the ServiceConnectionToken was created.
+  google.protobuf.Timestamp create_time = 2
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Time when the ServiceConnectionToken was updated.
+  google.protobuf.Timestamp update_time = 3
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // User-defined labels.
+  map<string, string> labels = 4;
+
+  // A description of this resource.
+  string description = 5;
+
+  // The resource path of the network associated with this token.
+  // Example:
+  // projects/{projectNumOrId}/global/networks/{resourceId}.
+  string network = 6 [
+    (google.api.resource_reference) = { type: "compute.googleapis.com/Network" }
+  ];
+
+  // Output only. The token generated by Automation.
+  string token = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The time to which this token is valid.
+  google.protobuf.Timestamp expire_time = 8
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Optional. The etag is computed by the server, and may be sent on update and
+  // delete requests to ensure the client has an up-to-date value before
+  // proceeding.
+  optional string etag = 9 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request for ListServiceConnectionTokens.
+message ListServiceConnectionTokensRequest {
+  // Required. The parent resource's name. ex. projects/123/locations/us-east1
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "locations.googleapis.com/Location"
+    }
+  ];
+
+  // The maximum number of results per page that should be returned.
+  int32 page_size = 2;
+
+  // The page token.
+  string page_token = 3;
+
+  // A filter expression that filters the results listed in the response.
+  string filter = 4;
+
+  // Sort the results by a certain order.
+  string order_by = 5;
+}
+
+// Response for ListServiceConnectionTokens.
+message ListServiceConnectionTokensResponse {
+  // ServiceConnectionTokens to be returned.
+  repeated ServiceConnectionToken service_connection_tokens = 1;
+
+  // The next pagination token in the List response. It should be used as
+  // page_token for the following request. An empty value means no more result.
+  string next_page_token = 2;
+
+  // Locations that could not be reached.
+  repeated string unreachable = 3;
+}
+
+// Request for GetServiceConnectionToken.
+message GetServiceConnectionTokenRequest {
+  // Required. Name of the ServiceConnectionToken to get.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/ServiceConnectionToken"
+    }
+  ];
+}
+
+// Request for CreateServiceConnectionToken.
+message CreateServiceConnectionTokenRequest {
+  // Required. The parent resource's name of the ServiceConnectionToken. ex.
+  // projects/123/locations/us-east1
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "networkconnectivity.googleapis.com/ServiceConnectionToken"
+    }
+  ];
+
+  // Optional. Resource ID
+  // (i.e. 'foo' in '[...]/projects/p/locations/l/ServiceConnectionTokens/foo')
+  // See https://google.aip.dev/122#resource-id-segments
+  // Unique per location.
+  // If one is not provided, one will be generated.
+  string service_connection_token_id = 2
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Required. Initial values for a new ServiceConnectionTokens
+  ServiceConnectionToken service_connection_token = 3
+      [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. An optional request ID to identify requests. Specify a unique
+  // request ID so that if you must retry your request, the server will know to
+  // ignore the request if it has already been completed. The server will
+  // guarantee that for at least 60 minutes since the first request.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check if original operation with the same request ID
+  // was received, and if so, will ignore the second request. This prevents
+  // clients from accidentally creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Request for DeleteServiceConnectionToken.
+message DeleteServiceConnectionTokenRequest {
+  // Required. The name of the ServiceConnectionToken to delete.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/ServiceConnectionToken"
+    }
+  ];
+
+  // Optional. An optional request ID to identify requests. Specify a unique
+  // request ID so that if you must retry your request, the server will know to
+  // ignore the request if it has already been completed. The server will
+  // guarantee that for at least 60 minutes after the first request.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check if original operation with the same request ID
+  // was received, and if so, will ignore the second request. This prevents
+  // clients from accidentally creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The etag is computed by the server, and may be sent on update and
+  // delete requests to ensure the client has an up-to-date value before
+  // proceeding.
+  optional string etag = 3 [(google.api.field_behavior) = OPTIONAL];
+}
diff --git a/google/cloud/networkconnectivity/v1/hub.proto b/google/cloud/networkconnectivity/v1/hub.proto
index a909b4ffe3..c12320483e 100644
--- a/google/cloud/networkconnectivity/v1/hub.proto
+++ b/google/cloud/networkconnectivity/v1/hub.proto
@@ -200,6 +200,34 @@ service HubService {
     };
   }
 
+  // Accepts a proposal to update a Network Connectivity Center spoke in a hub.
+  rpc AcceptSpokeUpdate(AcceptSpokeUpdateRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{name=projects/*/locations/global/hubs/*}:acceptSpokeUpdate"
+      body: "*"
+    };
+    option (google.api.method_signature) = "name,spoke_uri,spoke_etag";
+    option (google.longrunning.operation_info) = {
+      response_type: "AcceptSpokeUpdateResponse"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
+  // Rejects a proposal to update a Network Connectivity Center spoke in a hub.
+  rpc RejectSpokeUpdate(RejectSpokeUpdateRequest)
+      returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{name=projects/*/locations/global/hubs/*}:rejectSpokeUpdate"
+      body: "*"
+    };
+    option (google.api.method_signature) = "name,spoke_uri,spoke_etag";
+    option (google.longrunning.operation_info) = {
+      response_type: "RejectSpokeUpdateResponse"
+      metadata_type: "OperationMetadata"
+    };
+  }
+
   // Deletes a Network Connectivity Center spoke.
   rpc DeleteSpoke(DeleteSpokeRequest) returns (google.longrunning.Operation) {
     option (google.api.http) = {
@@ -336,6 +364,11 @@ enum State {
   // The hub associated with this spoke resource has been deleted.
   // This state applies to spoke resources only.
   OBSOLETE = 10;
+
+  // The resource is in an undefined state due to resource creation or deletion
+  // failure. You can try to delete the resource later or contact support for
+  // help.
+  FAILED = 11;
 }
 
 // The SpokeType enum represents the type of spoke. The type
@@ -416,8 +449,8 @@ message Hub {
   // labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
   map<string, string> labels = 4;
 
-  // An optional description of the hub.
-  string description = 5;
+  // Optional. An optional description of the hub.
+  string description = 5 [(google.api.field_behavior) = OPTIONAL];
 
   // Output only. The Google-generated UUID for the hub. This value is unique
   // across all hub resources. If a hub is deleted and another with the same
@@ -460,10 +493,10 @@ message Hub {
   // the preset_topology is set to PRESET_TOPOLOGY_UNSPECIFIED.
   PresetTopology preset_topology = 14 [(google.api.field_behavior) = OPTIONAL];
 
-  // Optional. Whether Private Service Connect transitivity is enabled for the
-  // hub. If true, Private Service Connect endpoints in VPC spokes attached to
-  // the hub are made accessible to other VPC spokes attached to the hub.
-  // The default value is false.
+  // Optional. Whether Private Service Connect connection propagation is enabled
+  // for the hub. If true, Private Service Connect endpoints in VPC spokes
+  // attached to the hub are made accessible to other VPC spokes attached to the
+  // hub. The default value is false.
   optional bool export_psc = 15 [(google.api.field_behavior) = OPTIONAL];
 }
 
@@ -519,6 +552,16 @@ message Spoke {
       // Network Connectivity Center encountered errors while accepting
       // the spoke.
       FAILED = 4;
+
+      // The proposed spoke update is pending review.
+      UPDATE_PENDING_REVIEW = 5;
+
+      // The proposed spoke update has been rejected by the hub administrator.
+      UPDATE_REJECTED = 6;
+
+      // Network Connectivity Center encountered errors while accepting
+      // the spoke update.
+      UPDATE_FAILED = 7;
     }
 
     // The code associated with this reason.
@@ -549,8 +592,8 @@ message Spoke {
   // labels](https://cloud.google.com/resource-manager/docs/creating-managing-labels#requirements).
   map<string, string> labels = 4;
 
-  // An optional description of the spoke.
-  string description = 5;
+  // Optional. An optional description of the spoke.
+  string description = 5 [(google.api.field_behavior) = OPTIONAL];
 
   // Immutable. The name of the hub that this spoke is attached to.
   string hub = 6 [
@@ -568,14 +611,17 @@ message Spoke {
     }
   ];
 
-  // VPN tunnels that are associated with the spoke.
-  LinkedVpnTunnels linked_vpn_tunnels = 17;
+  // Optional. VPN tunnels that are associated with the spoke.
+  LinkedVpnTunnels linked_vpn_tunnels = 17
+      [(google.api.field_behavior) = OPTIONAL];
 
-  // VLAN attachments that are associated with the spoke.
-  LinkedInterconnectAttachments linked_interconnect_attachments = 18;
+  // Optional. VLAN attachments that are associated with the spoke.
+  LinkedInterconnectAttachments linked_interconnect_attachments = 18
+      [(google.api.field_behavior) = OPTIONAL];
 
-  // Router appliance instances that are associated with the spoke.
-  LinkedRouterApplianceInstances linked_router_appliance_instances = 19;
+  // Optional. Router appliance instances that are associated with the spoke.
+  LinkedRouterApplianceInstances linked_router_appliance_instances = 19
+      [(google.api.field_behavior) = OPTIONAL];
 
   // Optional. VPC network that is associated with the spoke.
   LinkedVpcNetwork linked_vpc_network = 20
@@ -593,12 +639,20 @@ message Spoke {
   // Output only. The current lifecycle state of this spoke.
   State state = 15 [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Output only. The reasons for current state of the spoke. Only present when
-  // the spoke is in the `INACTIVE` state.
+  // Output only. The reasons for current state of the spoke.
   repeated StateReason reasons = 21 [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. The type of resource associated with the spoke.
   SpokeType spoke_type = 22 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Optional. This checksum is computed by the server based on the value of
+  // other fields, and may be sent on update and delete requests to ensure the
+  // client has an up-to-date value before proceeding.
+  string etag = 27 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The list of fields waiting for hub administration's approval.
+  repeated string field_paths_pending_update = 28
+      [(google.api.field_behavior) = OPTIONAL];
 }
 
 message RouteTable {
@@ -774,10 +828,11 @@ message Group {
 // state, and it must be reviewed and accepted by a hub
 // administrator.
 message AutoAccept {
-  // A list of project ids or project numbers for which you want
+  // Optional. A list of project ids or project numbers for which you want
   // to enable auto-accept. The auto-accept setting is applied to
   // spokes being created or updated in these projects.
-  repeated string auto_accept_projects = 1;
+  repeated string auto_accept_projects = 1
+      [(google.api.field_behavior) = OPTIONAL];
 }
 
 // Request for
@@ -1376,6 +1431,107 @@ message RejectHubSpokeResponse {
   Spoke spoke = 1;
 }
 
+// The request for
+// [HubService.AcceptSpokeUpdate][google.cloud.networkconnectivity.v1.HubService.AcceptSpokeUpdate].
+message AcceptSpokeUpdateRequest {
+  // Required. The name of the hub to accept spoke update.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/Hub"
+    }
+  ];
+
+  // Required. The URI of the spoke to accept update.
+  string spoke_uri = 2 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/Spoke"
+    }
+  ];
+
+  // Required. The etag of the spoke to accept update.
+  string spoke_etag = 3 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. A request ID to identify requests. Specify a unique request ID so
+  // that if you must retry your request, the server knows to ignore the request
+  // if it has already been completed. The server guarantees that a request
+  // doesn't result in creation of duplicate commitments for at least 60
+  // minutes.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check to see whether the original operation
+  // was received. If it was, the server ignores the second request. This
+  // behavior prevents clients from mistakenly creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID, with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 4 [
+    (google.api.field_info).format = UUID4,
+    (google.api.field_behavior) = OPTIONAL
+  ];
+}
+
+// The response for
+// [HubService.AcceptSpokeUpdate][google.cloud.networkconnectivity.v1.HubService.AcceptSpokeUpdate].
+message AcceptSpokeUpdateResponse {
+  // The spoke that was operated on.
+  Spoke spoke = 1;
+}
+
+// The request for
+// [HubService.RejectSpokeUpdate][google.cloud.networkconnectivity.v1.HubService.RejectSpokeUpdate].
+message RejectSpokeUpdateRequest {
+  // Required. The name of the hub to reject spoke update.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/Hub"
+    }
+  ];
+
+  // Required. The URI of the spoke to reject update.
+  string spoke_uri = 2 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "networkconnectivity.googleapis.com/Spoke"
+    }
+  ];
+
+  // Required. The etag of the spoke to reject update.
+  string spoke_etag = 3 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. Additional information provided by the hub administrator.
+  string details = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. A request ID to identify requests. Specify a unique request ID so
+  // that if you must retry your request, the server knows to ignore the request
+  // if it has already been completed. The server guarantees that a request
+  // doesn't result in creation of duplicate commitments for at least 60
+  // minutes.
+  //
+  // For example, consider a situation where you make an initial request and
+  // the request times out. If you make the request again with the same request
+  // ID, the server can check to see whether the original operation
+  // was received. If it was, the server ignores the second request. This
+  // behavior prevents clients from mistakenly creating duplicate commitments.
+  //
+  // The request ID must be a valid UUID, with the exception that zero UUID is
+  // not supported (00000000-0000-0000-0000-000000000000).
+  string request_id = 5 [
+    (google.api.field_info).format = UUID4,
+    (google.api.field_behavior) = OPTIONAL
+  ];
+}
+
+// The response for
+// [HubService.RejectSpokeUpdate][google.cloud.networkconnectivity.v1.HubService.RejectSpokeUpdate].
+message RejectSpokeUpdateResponse {
+  // The spoke that was operated on.
+  Spoke spoke = 1;
+}
+
 // The request for
 // [HubService.GetRouteTable][google.cloud.networkconnectivity.v1.HubService.GetRouteTable].
 message GetRouteTableRequest {
@@ -1622,9 +1778,23 @@ message LinkedVpcNetwork {
   repeated string include_export_ranges = 3
       [(google.api.field_behavior) = OPTIONAL];
 
+  // Optional. The proposed include export IP ranges waiting for hub
+  // administration's approval.
+  repeated string proposed_include_export_ranges = 5
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Output only. The proposed exclude export IP ranges waiting for hub
+  // administration's approval.
+  repeated string proposed_exclude_export_ranges = 6
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
   // Output only. The list of Producer VPC spokes that this VPC spoke is a
   // service consumer VPC spoke for. These producer VPCs are connected through
-  // VPC peering to this spoke's backing VPC network.
+  // VPC peering to this spoke's backing VPC network. Because they are directly
+  // connected throuh VPC peering, NCC export filters do not apply between the
+  // service consumer VPC spoke and any of its producer VPC spokes. This VPC
+  // spoke cannot be deleted as long as any of these producer VPC spokes are
+  // connected to the NCC Hub.
   repeated string producer_vpc_spokes = 4 [
     (google.api.field_behavior) = OUTPUT_ONLY,
     (google.api.resource_reference) = {
@@ -1667,6 +1837,16 @@ message LinkedProducerVpcNetwork {
   // Optional. IP ranges allowed to be included from peering.
   repeated string include_export_ranges = 4
       [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The proposed include export IP ranges waiting for hub
+  // administration's approval.
+  repeated string proposed_include_export_ranges = 7
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Output only. The proposed exclude export IP ranges waiting for hub
+  // administration's approval.
+  repeated string proposed_exclude_export_ranges = 8
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 }
 
 // A router appliance instance is a Compute Engine virtual machine (VM) instance
diff --git a/google/cloud/networkconnectivity/v1/networkconnectivity_v1.yaml b/google/cloud/networkconnectivity/v1/networkconnectivity_v1.yaml
index 75ae024268..26bc710cc0 100644
--- a/google/cloud/networkconnectivity/v1/networkconnectivity_v1.yaml
+++ b/google/cloud/networkconnectivity/v1/networkconnectivity_v1.yaml
@@ -5,6 +5,7 @@ title: Network Connectivity API
 
 apis:
 - name: google.cloud.location.Locations
+- name: google.cloud.networkconnectivity.v1.CrossNetworkAutomationService
 - name: google.cloud.networkconnectivity.v1.HubService
 - name: google.cloud.networkconnectivity.v1.PolicyBasedRoutingService
 - name: google.iam.v1.IAMPolicy
@@ -61,6 +62,9 @@ http:
     - get: '/v1/{resource=projects/*/locations/global/hubs/*/groups/*}:getIamPolicy'
     - get: '/v1/{resource=projects/*/locations/*/spokes/*}:getIamPolicy'
     - get: '/v1/{resource=projects/*/locations/global/policyBasedRoutes/*}:getIamPolicy'
+    - get: '/v1/{resource=projects/*/locations/*/serviceConnectionMaps/*}:getIamPolicy'
+    - get: '/v1/{resource=projects/*/locations/*/serviceConnectionPolicies/*}:getIamPolicy'
+    - get: '/v1/{resource=projects/*/locations/*/serviceClasses/*}:getIamPolicy'
   - selector: google.iam.v1.IAMPolicy.SetIamPolicy
     post: '/v1/{resource=projects/*/locations/global/hubs/*}:setIamPolicy'
     body: '*'
@@ -71,6 +75,12 @@ http:
       body: '*'
     - post: '/v1/{resource=projects/*/locations/global/policyBasedRoutes/*}:setIamPolicy'
       body: '*'
+    - post: '/v1/{resource=projects/*/locations/*/serviceConnectionMaps/*}:setIamPolicy'
+      body: '*'
+    - post: '/v1/{resource=projects/*/locations/*/serviceConnectionPolicies/*}:setIamPolicy'
+      body: '*'
+    - post: '/v1/{resource=projects/*/locations/*/serviceClasses/*}:setIamPolicy'
+      body: '*'
   - selector: google.iam.v1.IAMPolicy.TestIamPermissions
     post: '/v1/{resource=projects/*/locations/global/hubs/*}:testIamPermissions'
     body: '*'
@@ -81,6 +91,12 @@ http:
       body: '*'
     - post: '/v1/{resource=projects/*/locations/global/policyBasedRoutes/*}:testIamPermissions'
       body: '*'
+    - post: '/v1/{resource=projects/*/locations/*/serviceConnectionMaps/*}:testIamPermissions'
+      body: '*'
+    - post: '/v1/{resource=projects/*/locations/*/serviceConnectionPolicies/*}:testIamPermissions'
+      body: '*'
+    - post: '/v1/{resource=projects/*/locations/*/serviceClasses/*}:testIamPermissions'
+      body: '*'
   - selector: google.longrunning.Operations.CancelOperation
     post: '/v1/{name=projects/*/locations/*/operations/*}:cancel'
     body: '*'
@@ -101,6 +117,10 @@ authentication:
     oauth:
       canonical_scopes: |-
         https://www.googleapis.com/auth/cloud-platform
+  - selector: 'google.cloud.networkconnectivity.v1.CrossNetworkAutomationService.*'
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
   - selector: 'google.cloud.networkconnectivity.v1.HubService.*'
     oauth:
       canonical_scopes: |-
diff --git a/google/cloud/networkconnectivity/v1/policy_based_routing.proto b/google/cloud/networkconnectivity/v1/policy_based_routing.proto
index 09622d8806..46979d4519 100644
--- a/google/cloud/networkconnectivity/v1/policy_based_routing.proto
+++ b/google/cloud/networkconnectivity/v1/policy_based_routing.proto
@@ -40,7 +40,7 @@ service PolicyBasedRoutingService {
   option (google.api.oauth_scopes) =
       "https://www.googleapis.com/auth/cloud-platform";
 
-  // Lists PolicyBasedRoutes in a given project and location.
+  // Lists policy-based routes in a given project and location.
   rpc ListPolicyBasedRoutes(ListPolicyBasedRoutesRequest)
       returns (ListPolicyBasedRoutesResponse) {
     option (google.api.http) = {
@@ -49,7 +49,7 @@ service PolicyBasedRoutingService {
     option (google.api.method_signature) = "parent";
   }
 
-  // Gets details of a single PolicyBasedRoute.
+  // Gets details of a single policy-based route.
   rpc GetPolicyBasedRoute(GetPolicyBasedRouteRequest)
       returns (PolicyBasedRoute) {
     option (google.api.http) = {
@@ -58,7 +58,7 @@ service PolicyBasedRoutingService {
     option (google.api.method_signature) = "name";
   }
 
-  // Creates a new PolicyBasedRoute in a given project and location.
+  // Creates a new policy-based route in a given project and location.
   rpc CreatePolicyBasedRoute(CreatePolicyBasedRouteRequest)
       returns (google.longrunning.Operation) {
     option (google.api.http) = {
@@ -73,7 +73,7 @@ service PolicyBasedRoutingService {
     };
   }
 
-  // Deletes a single PolicyBasedRoute.
+  // Deletes a single policy-based route.
   rpc DeletePolicyBasedRoute(DeletePolicyBasedRouteRequest)
       returns (google.longrunning.Operation) {
     option (google.api.http) = {
@@ -87,28 +87,26 @@ service PolicyBasedRoutingService {
   }
 }
 
-// Policy Based Routes (PBR) are more powerful routes that allows GCP customers
-// to route their L4 network traffic based on not just destination IP, but also
-// source IP, protocol and more. A PBR always take precedence when it conflicts
-// with other types of routes.
-// Next id: 22
+// Policy-based routes route L4 network traffic based on not just destination IP
+// address, but also source IP address, protocol, and more. If a policy-based
+// route conflicts with other types of routes, the policy-based route always
+// takes precedence.
 message PolicyBasedRoute {
   option (google.api.resource) = {
     type: "networkconnectivity.googleapis.com/PolicyBasedRoute"
     pattern: "projects/{project}/locations/global/PolicyBasedRoutes/{policy_based_route}"
   };
 
-  // VM instances to which this policy based route applies to.
+  // VM instances that this policy-based route applies to.
   message VirtualMachine {
-    // Optional. A list of VM instance tags to which this policy based route
-    // applies to. VM instances that have ANY of tags specified here will
-    // install this PBR.
+    // Optional. A list of VM instance tags that this policy-based route applies
+    // to. VM instances that have ANY of tags specified here installs this PBR.
     repeated string tags = 1 [(google.api.field_behavior) = OPTIONAL];
   }
 
-  // InterconnectAttachment to which this route applies to.
+  // InterconnectAttachment that this route applies to.
   message InterconnectAttachment {
-    // Optional. Cloud region to install this policy based route on interconnect
+    // Optional. Cloud region to install this policy-based route on interconnect
     // attachment. Use `all` to install it on all interconnect attachments.
     string region = 1 [(google.api.field_behavior) = OPTIONAL];
   }
@@ -124,39 +122,39 @@ message PolicyBasedRoute {
       IPV4 = 1;
     }
 
-    // Optional. The IP protocol that this policy based route applies to. Valid
+    // Optional. The IP protocol that this policy-based route applies to. Valid
     // values are 'TCP', 'UDP', and 'ALL'. Default is 'ALL'.
     string ip_protocol = 1 [(google.api.field_behavior) = OPTIONAL];
 
-    // Optional. The source IP range of outgoing packets that this policy based
+    // Optional. The source IP range of outgoing packets that this policy-based
     // route applies to. Default is "0.0.0.0/0" if protocol version is IPv4.
     string src_range = 2 [(google.api.field_behavior) = OPTIONAL];
 
-    // Optional. The destination IP range of outgoing packets that this policy
-    // based route applies to. Default is "0.0.0.0/0" if protocol version is
-    // IPv4.
+    // Optional. The destination IP range of outgoing packets that this
+    // policy-based route applies to. Default is "0.0.0.0/0" if protocol version
+    // is IPv4.
     string dest_range = 3 [(google.api.field_behavior) = OPTIONAL];
 
-    // Required. Internet protocol versions this policy based route applies to.
-    // For this version, only IPV4 is supported.
+    // Required. Internet protocol versions this policy-based route applies to.
+    // For this version, only IPV4 is supported. IPV6 is supported in preview.
     ProtocolVersion protocol_version = 6
         [(google.api.field_behavior) = REQUIRED];
   }
 
   // Informational warning message.
   message Warnings {
-    // Warning code for Policy Based Routing. Expect to add values in the
+    // Warning code for policy-based routing. Expect to add values in the
     // future.
     enum Code {
       // Default value.
       WARNING_UNSPECIFIED = 0;
 
-      // The policy based route is not active and functioning. Common causes are
-      // the dependent network was deleted or the resource project was turned
-      // off.
+      // The policy-based route is not active and functioning. Common causes are
+      // that the dependent network was deleted or the resource project was
+      // turned off.
       RESOURCE_NOT_ACTIVE = 1;
 
-      // The policy based route is being modified (e.g. created/deleted) at this
+      // The policy-based route is being modified (e.g. created/deleted) at this
       // time.
       RESOURCE_BEING_MODIFIED = 2;
     }
@@ -182,29 +180,30 @@ message PolicyBasedRoute {
     OTHER_ROUTES_UNSPECIFIED = 0;
 
     // Use the routes from the default routing tables (system-generated routes,
-    // custom routes, peering route) to determine the next hop. This will
-    // effectively exclude matching packets being applied on other PBRs with a
-    // lower priority.
+    // custom routes, peering route) to determine the next hop. This effectively
+    // excludes matching packets being applied on other PBRs with a lower
+    // priority.
     DEFAULT_ROUTING = 1;
   }
 
-  // Target specifies network endpoints to which this policy based route applies
-  // to. If none of the target is specified, the PBR will be installed on all
-  // network endpoints (e.g. VMs, VPNs, and Interconnects) in the VPC.
+  // Target specifies network endpoints that this policy-based route applies to.
+  // If no target is specified, the PBR will be installed on all network
+  // endpoints (e.g. VMs, VPNs, and Interconnects) in the VPC.
   oneof target {
-    // Optional. VM instances to which this policy based route applies to.
+    // Optional. VM instances that this policy-based route applies to.
     VirtualMachine virtual_machine = 18
         [(google.api.field_behavior) = OPTIONAL];
 
-    // Optional. The interconnect attachments to which this route applies to.
+    // Optional. The interconnect attachments that this policy-based route
+    // applies to.
     InterconnectAttachment interconnect_attachment = 9
         [(google.api.field_behavior) = OPTIONAL];
   }
 
   oneof next_hop {
-    // Optional. The IP of a global access enabled L4 ILB that should be the
-    // next hop to handle matching packets. For this version, only
-    // next_hop_ilb_ip is supported.
+    // Optional. The IP address of a global-access-enabled L4 ILB that is the
+    // next hop for matching packets. For this version, only nextHopIlbIp is
+    // supported.
     string next_hop_ilb_ip = 12 [(google.api.field_behavior) = OPTIONAL];
 
     // Optional. Other routes that will be referenced to determine the next hop
@@ -217,11 +216,11 @@ message PolicyBasedRoute {
   // `projects/{project_number}/locations/global/PolicyBasedRoutes/{policy_based_route_id}`
   string name = 1 [(google.api.field_behavior) = IMMUTABLE];
 
-  // Output only. Time when the PolicyBasedRoute was created.
+  // Output only. Time when the policy-based route was created.
   google.protobuf.Timestamp create_time = 2
       [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Output only. Time when the PolicyBasedRoute was updated.
+  // Output only. Time when the policy-based route was updated.
   google.protobuf.Timestamp update_time = 3
       [(google.api.field_behavior) = OUTPUT_ONLY];
 
@@ -232,8 +231,8 @@ message PolicyBasedRoute {
   // you create the resource.
   string description = 5 [(google.api.field_behavior) = OPTIONAL];
 
-  // Required. Fully-qualified URL of the network that this route applies to.
-  // e.g. projects/my-project/global/networks/my-network.
+  // Required. Fully-qualified URL of the network that this route applies to,
+  // for example: projects/my-project/global/networks/my-network.
   string network = 6 [
     (google.api.field_behavior) = REQUIRED,
     (google.api.resource_reference) = { type: "compute.googleapis.com/Network" }
@@ -242,9 +241,9 @@ message PolicyBasedRoute {
   // Required. The filter to match L4 traffic.
   Filter filter = 10 [(google.api.field_behavior) = REQUIRED];
 
-  // Optional. The priority of this policy based route. Priority is used to
-  // break ties in cases where there are more than one matching policy based
-  // routes found. In cases where multiple policy based routes are matched, the
+  // Optional. The priority of this policy-based route. Priority is used to
+  // break ties in cases where there are more than one matching policy-based
+  // routes found. In cases where multiple policy-based routes are matched, the
   // one with the lowest-numbered priority value wins. The default value is
   // 1000. The priority value must be from 1 to 65535, inclusive.
   int32 priority = 11 [(google.api.field_behavior) = OPTIONAL];
@@ -257,11 +256,13 @@ message PolicyBasedRoute {
   string self_link = 15 [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. Type of this resource. Always
-  // networkconnectivity#policyBasedRoute for Policy Based Route resources.
+  // networkconnectivity#policyBasedRoute for policy-based Route resources.
   string kind = 16 [(google.api.field_behavior) = OUTPUT_ONLY];
 }
 
-// Request for [PolicyBasedRouting.ListPolicyBasedRoutes][] method.
+// Request for
+// [PolicyBasedRoutingService.ListPolicyBasedRoutes][google.cloud.networkconnectivity.v1.PolicyBasedRoutingService.ListPolicyBasedRoutes]
+// method.
 message ListPolicyBasedRoutesRequest {
   // Required. The parent resource's name.
   string parent = 1 [
@@ -284,9 +285,11 @@ message ListPolicyBasedRoutesRequest {
   string order_by = 5;
 }
 
-// Response for [PolicyBasedRouting.ListPolicyBasedRoutes][] method.
+// Response for
+// [PolicyBasedRoutingService.ListPolicyBasedRoutes][google.cloud.networkconnectivity.v1.PolicyBasedRoutingService.ListPolicyBasedRoutes]
+// method.
 message ListPolicyBasedRoutesResponse {
-  // Policy based routes to be returned.
+  // Policy-based routes to be returned.
   repeated PolicyBasedRoute policy_based_routes = 1;
 
   // The next pagination token in the List response. It should be used as
@@ -297,7 +300,9 @@ message ListPolicyBasedRoutesResponse {
   repeated string unreachable = 3;
 }
 
-// Request for [PolicyBasedRouting.GetPolicyBasedRoute][] method.
+// Request for
+// [PolicyBasedRoutingService.GetPolicyBasedRoute][google.cloud.networkconnectivity.v1.PolicyBasedRoutingService.GetPolicyBasedRoute]
+// method.
 message GetPolicyBasedRouteRequest {
   // Required. Name of the PolicyBasedRoute resource to get.
   string name = 1 [
@@ -308,7 +313,9 @@ message GetPolicyBasedRouteRequest {
   ];
 }
 
-// Request for [PolicyBasedRouting.CreatePolicyBasedRoute][] method.
+// Request for
+// [PolicyBasedRoutingService.CreatePolicyBasedRoute][google.cloud.networkconnectivity.v1.PolicyBasedRoutingService.CreatePolicyBasedRoute]
+// method.
 message CreatePolicyBasedRouteRequest {
   // Required. The parent resource's name of the PolicyBasedRoute.
   string parent = 1 [
@@ -318,32 +325,41 @@ message CreatePolicyBasedRouteRequest {
     }
   ];
 
-  // Required. Unique id for the Policy Based Route to create.
+  // Required. Unique id for the policy-based route to create. Provided by the
+  // client when the resource is created. The name must comply with
+  // https://google.aip.dev/122#resource-id-segments. Specifically, the name
+  // must be 1-63 characters long and match the regular expression
+  // [a-z]([a-z0-9-]*[a-z0-9])?. The first character must be a lowercase letter,
+  // and all following characters (except for the last character) must be a
+  // dash, lowercase letter, or digit. The last character must be a lowercase
+  // letter or digit.
   string policy_based_route_id = 2 [(google.api.field_behavior) = REQUIRED];
 
-  // Required. Initial values for a new Policy Based Route.
+  // Required. Initial values for a new policy-based route.
   PolicyBasedRoute policy_based_route = 3
       [(google.api.field_behavior) = REQUIRED];
 
   // Optional. An optional request ID to identify requests. Specify a unique
-  // request ID so that if you must retry your request, the server will know to
-  // ignore the request if it has already been completed. The server will
-  // guarantee that for at least 60 minutes since the first request.
+  // request ID so that if you must retry your request, the server knows to
+  // ignore the request if it has already been completed. The server guarantees
+  // that for at least 60 minutes since the first request.
   //
   // For example, consider a situation where you make an initial request and
   // the request times out. If you make the request again with the same request
   // ID, the server can check if original operation with the same request ID
-  // was received, and if so, will ignore the second request. This prevents
-  // clients from accidentally creating duplicate commitments.
+  // was received, and if so, ignores the second request. This prevents clients
+  // from accidentally creating duplicate commitments.
   //
   // The request ID must be a valid UUID with the exception that zero UUID is
   // not supported (00000000-0000-0000-0000-000000000000).
   string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
 }
 
-// Request for [PolicyBasedRouting.DeletePolicyBasedRoute][] method.
+// Request for
+// [PolicyBasedRoutingService.DeletePolicyBasedRoute][google.cloud.networkconnectivity.v1.PolicyBasedRoutingService.DeletePolicyBasedRoute]
+// method.
 message DeletePolicyBasedRouteRequest {
-  // Required. Name of the PolicyBasedRoute resource to delete.
+  // Required. Name of the policy-based route resource to delete.
   string name = 1 [
     (google.api.field_behavior) = REQUIRED,
     (google.api.resource_reference) = {
@@ -352,15 +368,15 @@ message DeletePolicyBasedRouteRequest {
   ];
 
   // Optional. An optional request ID to identify requests. Specify a unique
-  // request ID so that if you must retry your request, the server will know to
-  // ignore the request if it has already been completed. The server will
-  // guarantee that for at least 60 minutes after the first request.
+  // request ID so that if you must retry your request, the server knows to
+  // ignore the request if it has already been completed. The server guarantees
+  // that for at least 60 minutes after the first request.
   //
   // For example, consider a situation where you make an initial request and
   // the request times out. If you make the request again with the same request
   // ID, the server can check if original operation with the same request ID
-  // was received, and if so, will ignore the second request. This prevents
-  // clients from accidentally creating duplicate commitments.
+  // was received, and if so, ignores the second request. This prevents clients
+  // from accidentally creating duplicate commitments.
   //
   // The request ID must be a valid UUID with the exception that zero UUID is
   // not supported (00000000-0000-0000-0000-000000000000).
diff --git a/google/cloud/networkconnectivity/v1alpha1/BUILD.bazel b/google/cloud/networkconnectivity/v1alpha1/BUILD.bazel
index ddb4306b48..60c7c9bb78 100644
--- a/google/cloud/networkconnectivity/v1alpha1/BUILD.bazel
+++ b/google/cloud/networkconnectivity/v1alpha1/BUILD.bazel
@@ -339,7 +339,6 @@ load(
 
 csharp_proto_library(
     name = "networkconnectivity_csharp_proto",
-    extra_opts = [],
     deps = [":networkconnectivity_proto"],
 )