0
# Globus Connect Server Management
1

2
Configuration and management of Globus Connect Server endpoints, collections, storage gateways, and access policies for institutional data sharing. The GCS service provides comprehensive tools for setting up and managing data access infrastructure with fine-grained control over permissions, storage backends, and user credentials.
3

4
## Capabilities
5

6
### GCS Client
7

8
Core client for Globus Connect Server management operations with comprehensive endpoint, collection, and storage gateway administration.
9

10
```python { .api }
11
class GCSClient(BaseClient):
12
    """
13
    Client for GCS Manager API operations.
14
    
15
    Manages Globus Connect Server instances including endpoints, collections,
16
    storage gateways, roles, and user credentials with comprehensive
17
    configuration and policy support.
18
    """
19
    
20
    def __init__(
21
        self,
22
        gcs_address: str,
23
        *,
24
        app: GlobusApp | None = None,
25
        app_scopes: list[Scope] | None = None,
26
        environment: str | None = None,
27
        authorizer: GlobusAuthorizer | None = None,
28
        app_name: str | None = None,
29
        transport_params: dict[str, Any] | None = None
30
    ) -> None: ...
31
    
32
    @staticmethod
33
    def get_gcs_endpoint_scopes(
34
        endpoint_id: str | UUID
35
    ) -> GCSEndpointScopeBuilder:
36
        """
37
        Get scope builder for GCS endpoint-specific operations.
38
        
39
        Creates a scope builder for generating scopes required for
40
        endpoint management operations on a specific GCS endpoint.
41
        
42
        Parameters:
43
        - endpoint_id: UUID of the GCS endpoint
44
        
45
        Returns:
46
        GCSEndpointScopeBuilder for constructing endpoint-specific scopes
47
        """
48
    
49
    @staticmethod
50
    def get_gcs_collection_scopes(
51
        collection_id: str | UUID
52
    ) -> GCSCollectionScopeBuilder:
53
        """
54
        Get scope builder for GCS collection-specific operations.
55
        
56
        Creates a scope builder for generating scopes required for
57
        collection management and data access operations.
58
        
59
        Parameters:
60
        - collection_id: UUID of the GCS collection
61
        
62
        Returns:
63
        GCSCollectionScopeBuilder for constructing collection-specific scopes
64
        """
65
```
66

67
### Endpoint Management
68

69
Manage Globus Connect Server endpoint configuration and metadata for institutional data sharing infrastructure.
70

71
```python { .api }
72
def get_gcs_info(
73
    self, 
74
    query_params: dict[str, Any] | None = None
75
) -> UnpackingGCSResponse:
76
    """
77
    Get general information about the GCS instance.
78
    
79
    Returns basic configuration information, capabilities, and
80
    metadata about the Globus Connect Server installation.
81
    
82
    Parameters:
83
    - query_params: Additional query parameters
84
    
85
    Returns:
86
    UnpackingGCSResponse with GCS instance information
87
    """
88

89
def get_endpoint(
90
    self, 
91
    query_params: dict[str, Any] | None = None
92
) -> UnpackingGCSResponse:
93
    """
94
    Get endpoint configuration and metadata.
95
    
96
    Returns complete endpoint information including display name,
97
    description, organization, contact info, and other metadata.
98
    
99
    Parameters:
100
    - query_params: Additional query parameters
101
    
102
    Returns:
103
    UnpackingGCSResponse with endpoint configuration
104
    """
105

106
def update_endpoint(
107
    self,
108
    endpoint_data: dict[str, Any] | EndpointDocument,
109
    *,
110
    query_params: dict[str, Any] | None = None
111
) -> UnpackingGCSResponse:
112
    """
113
    Update endpoint configuration.
114
    
115
    Modifies endpoint metadata including display name, description,
116
    organization information, contact details, and other settings.
117
    
118
    Parameters:
119
    - endpoint_data: Endpoint configuration updates
120
    - query_params: Additional parameters
121
    
122
    Returns:
123
    UnpackingGCSResponse confirming update
124
    """
125
```
126

127
### Collection Management
128

129
Create and manage collections for organized data access with support for mapped collections, guest collections, and comprehensive policy configuration.
130

131
```python { .api }
132
def get_collection_list(
133
    self,
134
    *,
135
    mapped_collection_id: str | UUID | None = None,
136
    include: str | Iterable[str] | None = None,
137
    query_params: dict[str, Any] | None = None
138
) -> IterableGCSResponse:
139
    """
140
    List collections with filtering and expansion options.
141
    
142
    Parameters:
143
    - mapped_collection_id: Filter by parent mapped collection
144
    - include: Additional data to include (user_credential_id, etc.)
145
    - query_params: Additional query parameters
146
    
147
    Returns:
148
    IterableGCSResponse with paginated collection listings
149
    """
150

151
def get_collection(
152
    self,
153
    collection_id: str | UUID,
154
    *,
155
    include: str | Iterable[str] | None = None,
156
    query_params: dict[str, Any] | None = None
157
) -> UnpackingGCSResponse:
158
    """
159
    Get detailed collection configuration.
160
    
161
    Parameters:
162
    - collection_id: UUID of the collection
163
    - include: Additional data to include in response
164
    - query_params: Additional parameters
165
    
166
    Returns:
167
    UnpackingGCSResponse with complete collection configuration
168
    """
169

170
def create_collection(
171
    self,
172
    collection_data: dict[str, Any] | CollectionDocument
173
) -> UnpackingGCSResponse:
174
    """
175
    Create a new collection.
176
    
177
    Creates either a mapped collection (direct storage access) or
178
    guest collection (restricted access) with specified policies
179
    and access controls.
180
    
181
    Parameters:
182
    - collection_data: Complete collection configuration
183
    
184
    Returns:
185
    UnpackingGCSResponse with created collection details
186
    """
187

188
def update_collection(
189
    self,
190
    collection_id: str | UUID,
191
    collection_data: dict[str, Any] | CollectionDocument,
192
    *,
193
    query_params: dict[str, Any] | None = None
194
) -> UnpackingGCSResponse:
195
    """
196
    Update collection configuration.
197
    
198
    Modifies collection settings including display name, description,
199
    policies, and access controls.
200
    
201
    Parameters:
202
    - collection_id: UUID of collection to update
203
    - collection_data: Updated configuration
204
    - query_params: Additional parameters
205
    
206
    Returns:
207
    UnpackingGCSResponse confirming update
208
    """
209

210
def delete_collection(
211
    self,
212
    collection_id: str | UUID,
213
    *,
214
    query_params: dict[str, Any] | None = None
215
) -> UnpackingGCSResponse:
216
    """
217
    Delete a collection.
218
    
219
    Permanently removes a collection. Data remains on storage
220
    but is no longer accessible through Globus services.
221
    
222
    Parameters:
223
    - collection_id: UUID of collection to delete
224
    - query_params: Additional parameters
225
    
226
    Returns:
227
    UnpackingGCSResponse confirming deletion
228
    """
229
```
230

231
### Storage Gateway Management
232

233
Manage storage gateways that provide the connection between collections and underlying storage systems with support for multiple storage backends.
234

235
```python { .api }
236
def get_storage_gateway_list(
237
    self,
238
    *,
239
    include: str | Iterable[str] | None = None,
240
    query_params: dict[str, Any] | None = None
241
) -> IterableGCSResponse:
242
    """
243
    List storage gateways with optional data expansion.
244
    
245
    Parameters:
246
    - include: Additional data to include (policies, etc.)
247
    - query_params: Additional parameters
248
    
249
    Returns:
250
    IterableGCSResponse with paginated storage gateway listings
251
    """
252

253
def create_storage_gateway(
254
    self,
255
    data: dict[str, Any] | StorageGatewayDocument,
256
    *,
257
    query_params: dict[str, Any] | None = None
258
) -> UnpackingGCSResponse:
259
    """
260
    Create a new storage gateway.
261
    
262
    Creates a storage gateway connecting to underlying storage
263
    infrastructure (POSIX filesystems, S3, etc.) with specified
264
    connector type and policies.
265
    
266
    Parameters:
267
    - data: Storage gateway configuration including connector and policies
268
    - query_params: Additional parameters
269
    
270
    Returns:
271
    UnpackingGCSResponse with created gateway details
272
    """
273

274
def get_storage_gateway(
275
    self,
276
    storage_gateway_id: str | UUID,
277
    *,
278
    include: str | Iterable[str] | None = None,
279
    query_params: dict[str, Any] | None = None
280
) -> UnpackingGCSResponse:
281
    """
282
    Get storage gateway configuration.
283
    
284
    Parameters:
285
    - storage_gateway_id: UUID of the storage gateway
286
    - include: Additional data to include
287
    - query_params: Additional parameters
288
    
289
    Returns:
290
    UnpackingGCSResponse with gateway configuration
291
    """
292

293
def update_storage_gateway(
294
    self,
295
    storage_gateway_id: str | UUID,
296
    data: dict[str, Any] | StorageGatewayDocument,
297
    *,
298
    query_params: dict[str, Any] | None = None
299
) -> UnpackingGCSResponse:
300
    """
301
    Update storage gateway configuration.
302
    
303
    Modifies gateway settings including connector parameters,
304
    policies, and authentication requirements.
305
    
306
    Parameters:
307
    - storage_gateway_id: UUID of gateway to update
308
    - data: Updated configuration
309
    - query_params: Additional parameters
310
    
311
    Returns:
312
    UnpackingGCSResponse confirming update
313
    """
314

315
def delete_storage_gateway(
316
    self,
317
    storage_gateway_id: str | UUID,
318
    *,
319
    query_params: dict[str, Any] | None = None
320
) -> UnpackingGCSResponse:
321
    """
322
    Delete a storage gateway.
323
    
324
    Removes gateway configuration. Collections using this gateway
325
    will become inaccessible until configured with a new gateway.
326
    
327
    Parameters:
328
    - storage_gateway_id: UUID of gateway to delete
329
    - query_params: Additional parameters
330
    
331
    Returns:
332
    UnpackingGCSResponse confirming deletion
333
    """
334
```
335

336
### Role and Access Management
337

338
Manage user roles and permissions for collections and endpoints with fine-grained access control.
339

340
```python { .api }
341
def get_role_list(
342
    self,
343
    collection_id: str | UUID | None = None,
344
    include: str | None = None,
345
    query_params: dict[str, Any] | None = None
346
) -> IterableGCSResponse:
347
    """
348
    List roles with optional filtering by collection.
349
    
350
    Parameters:
351
    - collection_id: Filter roles for specific collection
352
    - include: Additional data to include
353
    - query_params: Additional parameters
354
    
355
    Returns:
356
    IterableGCSResponse with role listings
357
    """
358

359
def create_role(
360
    self,
361
    data: dict[str, Any] | GCSRoleDocument,
362
    query_params: dict[str, Any] | None = None
363
) -> UnpackingGCSResponse:
364
    """
365
    Create a user role assignment.
366
    
367
    Assigns specific permissions to a user or group for a collection,
368
    defining what operations they can perform (read, write, admin).
369
    
370
    Parameters:
371
    - data: Role assignment specification
372
    - query_params: Additional parameters
373
    
374
    Returns:
375
    UnpackingGCSResponse with created role details
376
    """
377

378
def get_role(
379
    self,
380
    role_id: str | UUID,
381
    query_params: dict[str, Any] | None = None
382
) -> UnpackingGCSResponse:
383
    """
384
    Get role assignment details.
385
    
386
    Parameters:
387
    - role_id: UUID of the role assignment
388
    - query_params: Additional parameters
389
    
390
    Returns:
391
    UnpackingGCSResponse with role configuration
392
    """
393

394
def delete_role(
395
    self,
396
    role_id: str | UUID,
397
    query_params: dict[str, Any] | None = None
398
) -> UnpackingGCSResponse:
399
    """
400
    Remove a role assignment.
401
    
402
    Revokes user or group permissions for a collection.
403
    
404
    Parameters:
405
    - role_id: UUID of role assignment to delete
406
    - query_params: Additional parameters
407
    
408
    Returns:
409
    UnpackingGCSResponse confirming deletion
410
    """
411
```
412

413
### User Credential Management
414

415
Manage user credentials for accessing storage systems that require authentication beyond Globus identity.
416

417
```python { .api }
418
def get_user_credential_list(
419
    self,
420
    storage_gateway: str | UUID | None = None,
421
    query_params: dict[str, Any] | None = None
422
) -> IterableGCSResponse:
423
    """
424
    List user credentials with optional filtering.
425
    
426
    Parameters:
427
    - storage_gateway: Filter by associated storage gateway
428
    - query_params: Additional parameters
429
    
430
    Returns:
431
    IterableGCSResponse with credential listings
432
    """
433

434
def create_user_credential(
435
    self,
436
    data: dict[str, Any] | UserCredentialDocument,
437
    query_params: dict[str, Any] | None = None
438
) -> UnpackingGCSResponse:
439
    """
440
    Create user credential for storage access.
441
    
442
    Stores user credentials (username/password, keys, etc.) required
443
    for accessing underlying storage systems that need additional
444
    authentication beyond Globus identity.
445
    
446
    Parameters:
447
    - data: Credential specification including type and values
448
    - query_params: Additional parameters
449
    
450
    Returns:
451
    UnpackingGCSResponse with credential metadata (not sensitive data)
452
    """
453

454
def get_user_credential(
455
    self,
456
    user_credential_id: str | UUID,
457
    query_params: dict[str, Any] | None = None
458
) -> UnpackingGCSResponse:
459
    """
460
    Get user credential metadata.
461
    
462
    Returns credential information without exposing sensitive data.
463
    
464
    Parameters:
465
    - user_credential_id: UUID of the credential
466
    - query_params: Additional parameters
467
    
468
    Returns:
469
    UnpackingGCSResponse with credential metadata
470
    """
471

472
def update_user_credential(
473
    self,
474
    user_credential_id: str | UUID,
475
    data: dict[str, Any] | UserCredentialDocument,
476
    query_params: dict[str, Any] | None = None
477
) -> UnpackingGCSResponse:
478
    """
479
    Update user credentials.
480
    
481
    Modifies stored credentials for storage system access.
482
    
483
    Parameters:
484
    - user_credential_id: UUID of credential to update
485
    - data: Updated credential information
486
    - query_params: Additional parameters
487
    
488
    Returns:
489
    UnpackingGCSResponse confirming update
490
    """
491

492
def delete_user_credential(
493
    self,
494
    user_credential_id: str | UUID,
495
    query_params: dict[str, Any] | None = None
496
) -> UnpackingGCSResponse:
497
    """
498
    Delete user credentials.
499
    
500
    Removes stored credentials, potentially making associated
501
    storage inaccessible until new credentials are provided.
502
    
503
    Parameters:
504
    - user_credential_id: UUID of credential to delete
505
    - query_params: Additional parameters
506
    
507
    Returns:
508
    UnpackingGCSResponse confirming deletion
509
    """
510
```
511

512
### Configuration Documents and Data Classes
513

514
Comprehensive data structures for configuring endpoints, collections, storage gateways, and policies with type-safe construction.
515

516
```python { .api }
517
class EndpointDocument(PayloadWrapper):
518
    """
519
    Document for configuring Globus Connect Server endpoints.
520
    
521
    Defines endpoint metadata including display name, description,
522
    organization information, contact details, and other settings.
523
    """
524
    
525
    def __init__(
526
        self,
527
        *,
528
        display_name: str | MissingType = MISSING,
529
        description: str | MissingType = MISSING,
530
        organization: str | MissingType = MISSING,
531
        department: str | MissingType = MISSING,
532
        contact_email: str | MissingType = MISSING,
533
        contact_info: str | MissingType = MISSING,
534
        info_link: str | MissingType = MISSING,
535
        public: bool | MissingType = MISSING,
536
        default_directory: str | MissingType = MISSING,
537
        **kwargs
538
    ) -> None: ...
539

540
class CollectionDocument(PayloadWrapper):
541
    """
542
    Base class for collection configuration documents.
543
    
544
    Provides common functionality for both mapped and guest collections
545
    with policy configuration and access control.
546
    """
547
    
548
    def __init__(
549
        self,
550
        *,
551
        display_name: str | MissingType = MISSING,
552
        description: str | MissingType = MISSING,
553
        collection_type: str | MissingType = MISSING,
554
        public: bool | MissingType = MISSING,
555
        **kwargs
556
    ) -> None: ...
557

558
class MappedCollectionDocument(CollectionDocument):
559
    """
560
    Configuration for mapped collections with direct storage access.
561
    
562
    Mapped collections provide direct access to storage through
563
    a storage gateway with configurable policies and permissions.
564
    """
565
    
566
    def __init__(
567
        self,
568
        *,
569
        storage_gateway_id: str | UUID | MissingType = MISSING,
570
        collection_base_path: str | MissingType = MISSING,
571
        policies: CollectionPolicies | dict | MissingType = MISSING,
572
        **kwargs
573
    ) -> None: ...
574

575
class GuestCollectionDocument(CollectionDocument):
576
    """
577
    Configuration for guest collections with restricted access.
578
    
579
    Guest collections provide limited access to a subdirectory
580
    of a mapped collection with additional access controls.
581
    """
582
    
583
    def __init__(
584
        self,
585
        *,
586
        mapped_collection_id: str | UUID | MissingType = MISSING,
587
        root_path: str | MissingType = MISSING,
588
        **kwargs
589
    ) -> None: ...
590

591
class StorageGatewayDocument(PayloadWrapper):
592
    """
593
    Configuration for storage gateways connecting to storage backends.
594
    
595
    Defines the connection between Globus services and underlying
596
    storage systems with connector-specific configuration and policies.
597
    """
598
    
599
    def __init__(
600
        self,
601
        *,
602
        display_name: str | MissingType = MISSING,
603
        connector: str | MissingType = MISSING,
604
        policies: StorageGatewayPolicies | dict | MissingType = MISSING,
605
        **kwargs
606
    ) -> None: ...
607

608
class GCSRoleDocument(PayloadWrapper):
609
    """
610
    Document for role assignments and permissions management.
611
    
612
    Defines user or group permissions for collections including
613
    access levels and specific operation permissions.
614
    """
615
    
616
    def __init__(
617
        self,
618
        *,
619
        collection: str | UUID | MissingType = MISSING,
620
        principal: str | MissingType = MISSING,
621
        principal_type: str | MissingType = MISSING,
622
        role: str | MissingType = MISSING,
623
        **kwargs
624
    ) -> None: ...
625

626
class UserCredentialDocument(PayloadWrapper):
627
    """
628
    Document for user credential management.
629
    
630
    Stores user credentials required for accessing storage systems
631
    that need additional authentication beyond Globus identity.
632
    """
633
    
634
    def __init__(
635
        self,
636
        *,
637
        storage_gateway: str | UUID | MissingType = MISSING,
638
        identity_id: str | MissingType = MISSING,
639
        username: str | MissingType = MISSING,
640
        **kwargs
641
    ) -> None: ...
642
```
643

644
### Storage Policies and Connectors
645

646
Comprehensive policy classes for different storage backend types with connector-specific configuration options.
647

648
```python { .api }
649
class CollectionPolicies(PayloadWrapper):
650
    """Base class for collection-level policies and access controls."""
651

652
class POSIXCollectionPolicies(CollectionPolicies):
653
    """Policies for POSIX filesystem-based collections."""
654

655
class POSIXStagingCollectionPolicies(CollectionPolicies):
656
    """Policies for POSIX collections with staging support."""
657

658
class GoogleCloudStorageCollectionPolicies(CollectionPolicies):
659
    """Policies for Google Cloud Storage collections."""
660

661
class StorageGatewayPolicies(PayloadWrapper):
662
    """Base class for storage gateway policies and configuration."""
663

664
class POSIXStoragePolicies(StorageGatewayPolicies):
665
    """Policies for POSIX filesystem storage gateways."""
666

667
class S3StoragePolicies(StorageGatewayPolicies):
668
    """Policies for Amazon S3 storage gateways."""
669

670
class GoogleCloudStoragePolicies(StorageGatewayPolicies):
671
    """Policies for Google Cloud Storage gateways."""
672

673
class AzureBlobStoragePolicies(StorageGatewayPolicies):
674
    """Policies for Azure Blob Storage gateways."""
675

676
class BoxStoragePolicies(StorageGatewayPolicies):
677
    """Policies for Box storage gateways."""
678

679
class GoogleDriveStoragePolicies(StorageGatewayPolicies):
680
    """Policies for Google Drive storage gateways."""
681

682
class OneDriveStoragePolicies(StorageGatewayPolicies):
683
    """Policies for Microsoft OneDrive storage gateways."""
684

685
class ConnectorTable:
686
    """
687
    Registry and lookup table for storage connector information.
688
    
689
    Provides information about available storage connectors,
690
    their capabilities, and configuration requirements.
691
    """
692
    
693
    def __getitem__(self, connector_id: str) -> GlobusConnectServerConnector: ...
694
    
695
    def __contains__(self, connector_id: str) -> bool: ...
696

697
class GlobusConnectServerConnector:
698
    """
699
    Information about a specific storage connector.
700
    
701
    Contains metadata about connector capabilities, requirements,
702
    and configuration options for different storage backends.
703
    """
704
```
705

706
### Response Objects
707

708
Specialized response classes for GCS operations with automatic unpacking and iteration support.
709

710
```python { .api }
711
class IterableGCSResponse(IterableResponse):
712
    """Response class for GCS operations returning paginated data."""
713
    
714
    def __iter__(self) -> Iterator[dict[str, Any]]:
715
        """Iterate over GCS response data items."""
716

717
class UnpackingGCSResponse(GlobusHTTPResponse):
718
    """
719
    Response class that automatically unpacks GCS data.
720
    
721
    Provides direct access to the main data content from GCS
722
    responses while maintaining access to full response metadata.
723
    """
724
```
725

726
### Error Handling
727

728
GCS-specific error handling for configuration and management operations.
729

730
```python { .api }
731
class GCSAPIError(GlobusAPIError):
732
    """
733
    Error class for GCS Manager API errors.
734
    
735
    Provides enhanced error handling for GCS-specific error
736
    conditions including configuration validation and access issues.
737
    """
738
```
739

740
## Common Usage Patterns
741

742
### Basic Collection Setup
743

744
```python
745
from globus_sdk import GCSClient, MappedCollectionDocument, POSIXStoragePolicies
746

747
# Initialize GCS client for your endpoint
748
gcs_client = GCSClient("gcs.example.org", authorizer=authorizer)
749

750
# Get endpoint information
751
endpoint_info = gcs_client.get_endpoint()
752
print(f"Endpoint: {endpoint_info['display_name']}")
753

754
# Create a storage gateway
755
storage_gateway_doc = StorageGatewayDocument(
756
    display_name="Main POSIX Storage",
757
    connector="posix",
758
    policies=POSIXStoragePolicies(
759
        groups_allow="0,users",
760
        groups_deny="",
761
        file_permissions="0644",
762
        directory_permissions="0755"
763
    )
764
)
765

766
gateway_response = gcs_client.create_storage_gateway(storage_gateway_doc)
767
gateway_id = gateway_response["id"]
768

769
# Create a mapped collection
770
collection_doc = MappedCollectionDocument(
771
    display_name="Research Data Collection",
772
    description="Shared research data access",
773
    storage_gateway_id=gateway_id,
774
    collection_base_path="/data/research",
775
    public=True
776
)
777

778
collection_response = gcs_client.create_collection(collection_doc)
779
collection_id = collection_response["id"]
780

781
print(f"Created collection: {collection_id}")
782
```
783

784
### Role and Permission Management
785

786
```python
787
from globus_sdk import GCSRoleDocument
788

789
# Grant read access to a user
790
read_role = GCSRoleDocument(
791
    collection=collection_id,
792
    principal="user@example.org",
793
    principal_type="identity",
794
    role="reader"
795
)
796

797
role_response = gcs_client.create_role(read_role)
798

799
# Grant write access to a group
800
write_role = GCSRoleDocument(
801
    collection=collection_id,
802
    principal="urn:globus:groups:id:12345678-1234-1234-1234-123456789012",
803
    principal_type="group",
804
    role="writer"
805
)
806

807
gcs_client.create_role(write_role)
808

809
# List all roles for the collection
810
roles = gcs_client.get_role_list(collection_id=collection_id)
811
for role in roles:
812
    print(f"Role {role['id']}: {role['principal']} -> {role['role']}")
813
```
814

815
### Guest Collection Creation
816

817
```python
818
from globus_sdk import GuestCollectionDocument
819

820
# Create a guest collection for limited access
821
guest_doc = GuestCollectionDocument(
822
    display_name="Project Alpha Data",
823
    description="Limited access to project alpha dataset",
824
    mapped_collection_id=collection_id,
825
    root_path="/project-alpha",
826
    public=False
827
)
828

829
guest_response = gcs_client.create_collection(guest_doc)
830
guest_collection_id = guest_response["id"]
831

832
# Grant access to specific users for the guest collection
833
guest_role = GCSRoleDocument(
834
    collection=guest_collection_id,
835
    principal="project-user@example.org", 
836
    principal_type="identity",
837
    role="writer"
838
)
839

840
gcs_client.create_role(guest_role)
841
```
842

843
### User Credential Management
844

845
```python
846
from globus_sdk import UserCredentialDocument
847

848
# Create user credentials for storage access
849
credential_doc = UserCredentialDocument(
850
    storage_gateway=gateway_id,
851
    identity_id="user-identity-uuid",
852
    username="storage_username"
853
    # Note: password/key would be provided through secure means
854
)
855

856
credential_response = gcs_client.create_user_credential(credential_doc)
857

858
# List credentials for monitoring
859
credentials = gcs_client.get_user_credential_list(storage_gateway=gateway_id)
860
for cred in credentials:
861
    print(f"Credential {cred['id']}: {cred['username']}")
862
```
863

864
### Advanced Storage Configuration
865

866
```python
867
from globus_sdk import S3StoragePolicies
868

869
# Create S3 storage gateway
870
s3_gateway_doc = StorageGatewayDocument(
871
    display_name="S3 Archive Storage",
872
    connector="s3",
873
    policies=S3StoragePolicies(
874
        s3_bucket="my-research-bucket",
875
        s3_region="us-west-2",
876
        s3_endpoint="https://s3.us-west-2.amazonaws.com"
877
    )
878
)
879

880
s3_gateway = gcs_client.create_storage_gateway(s3_gateway_doc)
881

882
# Create collection pointing to S3 storage
883
s3_collection_doc = MappedCollectionDocument(
884
    display_name="S3 Archive Collection",
885
    storage_gateway_id=s3_gateway["id"],
886
    collection_base_path="/",
887
    public=False
888
)
889

890
s3_collection = gcs_client.create_collection(s3_collection_doc)
891
```