From ac81cd038be8309c69116df8a06bd5e5387e1ced Mon Sep 17 00:00:00 2001
From: Dhaval Bhensdadiya <dhaval.bhensdadiya@crestdata.ai>
Date: Tue, 27 Jan 2026 15:46:05 +0530
Subject: [PATCH 1/4] feat(secretmanager): Add samples for listing secrets and
 versions with filters

---
 ...t_regional_secret_versions_with_filter.php | 57 +++++++++++++++++++
 .../src/list_regional_secrets_with_filter.php | 56 ++++++++++++++++++
 .../src/list_secret_versions_with_filter.php  | 55 ++++++++++++++++++
 .../src/list_secrets_with_filter.php          | 54 ++++++++++++++++++
 .../test/regionalsecretmanagerTest.php        | 32 +++++++++++
 secretmanager/test/secretmanagerTest.php      | 30 ++++++++++
 6 files changed, 284 insertions(+)
 create mode 100644 secretmanager/src/list_regional_secret_versions_with_filter.php
 create mode 100644 secretmanager/src/list_regional_secrets_with_filter.php
 create mode 100644 secretmanager/src/list_secret_versions_with_filter.php
 create mode 100644 secretmanager/src/list_secrets_with_filter.php

diff --git a/secretmanager/src/list_regional_secret_versions_with_filter.php b/secretmanager/src/list_regional_secret_versions_with_filter.php
new file mode 100644
index 0000000000..23c391b37f
--- /dev/null
+++ b/secretmanager/src/list_regional_secret_versions_with_filter.php
@@ -0,0 +1,57 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_list_regional_secret_versions_with_filter]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\ListSecretVersionsRequest;
+
+/**
+ * List secret versions in a location using a filter.
+ *
+ * @param string $projectId Your Google Cloud project id (e.g. 'my-project')
+ * @param string $locationId Your secret location (e.g. 'us-central1')
+ * @param string $secretId  Secret id (e.g. 'my-secret')
+ * @param string $filter    Filter string (see Secret Manager filtering docs)
+ */
+function list_regional_secret_versions_with_filter(string $projectId, string $locationId, string $secretId, string $filter): void
+{
+    $options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
+    $client = new SecretManagerServiceClient($options);
+
+    $parent = $client->projectLocationSecretName($projectId, $locationId, $secretId);
+
+    $request = ListSecretVersionsRequest::build($parent)->setFilter($filter);
+
+    foreach ($client->listSecretVersions($request) as $version) {
+        printf('Found secret version %s' . PHP_EOL, $version->getName());
+    }
+}
+// [END secretmanager_list_regional_secret_versions_with_filter]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/list_regional_secrets_with_filter.php b/secretmanager/src/list_regional_secrets_with_filter.php
new file mode 100644
index 0000000000..978816e902
--- /dev/null
+++ b/secretmanager/src/list_regional_secrets_with_filter.php
@@ -0,0 +1,56 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_list_regional_secrets_with_filter]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\ListSecretsRequest;
+
+/**
+ * List secrets in a location using a filter.
+ *
+ * @param string $projectId Your Google Cloud project id (e.g. 'my-project')
+ * @param string $locationId Your secret location (e.g. 'us-central1')
+ * @param string $filter    Filter string (see Secret Manager filtering docs)
+ */
+function list_regional_secrets_with_filter(string $projectId, string $locationId, string $filter): void
+{
+    $options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
+    $client = new SecretManagerServiceClient($options);
+
+    $parent = $client->locationName($projectId, $locationId);
+
+    $request = ListSecretsRequest::build($parent)->setFilter($filter);
+
+    foreach ($client->listSecrets($request) as $secret) {
+        printf('Found secret %s' . PHP_EOL, $secret->getName());
+    }
+}
+// [END secretmanager_list_regional_secrets_with_filter]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/list_secret_versions_with_filter.php b/secretmanager/src/list_secret_versions_with_filter.php
new file mode 100644
index 0000000000..17dac9544b
--- /dev/null
+++ b/secretmanager/src/list_secret_versions_with_filter.php
@@ -0,0 +1,55 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_list_secret_versions_with_filter]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\ListSecretVersionsRequest;
+
+/**
+ * List secret versions for a secret using a filter.
+ *
+ * @param string $projectId Your Google Cloud project id (e.g. 'my-project')
+ * @param string $secretId  Your secret id (e.g. 'my-secret')
+ * @param string $filter    Filter string (see Secret Manager filtering docs)
+ */
+function list_secret_versions_with_filter(string $projectId, string $secretId, string $filter): void
+{
+    $client = new SecretManagerServiceClient();
+
+    $parent = $client->secretName($projectId, $secretId);
+
+    $request = ListSecretVersionsRequest::build($parent)->setFilter($filter);
+
+    foreach ($client->listSecretVersions($request) as $version) {
+        printf('Found secret version %s' . PHP_EOL, $version->getName());
+    }
+}
+// [END secretmanager_list_secret_versions_with_filter]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/list_secrets_with_filter.php b/secretmanager/src/list_secrets_with_filter.php
new file mode 100644
index 0000000000..6468c58001
--- /dev/null
+++ b/secretmanager/src/list_secrets_with_filter.php
@@ -0,0 +1,54 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_list_secrets_with_filter]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\ListSecretsRequest;
+
+/**
+ * List secrets in a project using a filter.
+ *
+ * @param string $projectId Your Google Cloud project id (e.g. 'my-project')
+ * @param string $filter    Filter string (see Secret Manager filtering docs)
+ */
+function list_secrets_with_filter(string $projectId, string $filter): void
+{
+    $client = new SecretManagerServiceClient();
+
+    $parent = $client->projectName($projectId);
+
+    $request = ListSecretsRequest::build($parent)->setFilter($filter);
+
+    foreach ($client->listSecrets($request) as $secret) {
+        printf('Found secret %s' . PHP_EOL, $secret->getName());
+    }
+}
+// [END secretmanager_list_secrets_with_filter]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/test/regionalsecretmanagerTest.php b/secretmanager/test/regionalsecretmanagerTest.php
index 18c9c97ac5..c85008eff1 100644
--- a/secretmanager/test/regionalsecretmanagerTest.php
+++ b/secretmanager/test/regionalsecretmanagerTest.php
@@ -405,6 +405,23 @@ public function testIamRevokeAccess()
         $this->assertStringContainsString('Updated IAM policy', $output);
     }
 
+    public function testListSecretVersionsWithFilter()
+    {
+        $name = self::$client->parseName(self::$testSecretWithVersions->getName());
+
+        // Filter for enabled versions.
+        $filter = 'state = ENABLED';
+
+        $output = $this->runFunctionSnippet('list_regional_secret_versions_with_filter', [
+            $name['project'],
+            $name['location'],
+            $name['secret'],
+            $filter,
+        ]);
+
+        $this->assertStringContainsString('Found secret version', $output);
+    }
+
     public function testListSecretVersions()
     {
         $name = self::$client->parseName(self::$testSecretWithVersions->getName());
@@ -418,6 +435,21 @@ public function testListSecretVersions()
         $this->assertStringContainsString('secret version', $output);
     }
 
+    public function testListSecretsWithFilter()
+    {
+        $name = self::$client->parseName(self::$testSecret->getName());
+
+        $filter = 'name:' . $name['secret'];
+
+        $output = $this->runFunctionSnippet('list_regional_secrets_with_filter', [
+            $name['project'],
+            $name['location'],
+            $filter,
+        ]);
+
+        $this->assertStringContainsString('Found secret', $output);
+    }
+
     public function testListSecrets()
     {
         $name = self::$client->parseName(self::$testSecret->getName());
diff --git a/secretmanager/test/secretmanagerTest.php b/secretmanager/test/secretmanagerTest.php
index 11b9dd3bd6..c7826a91e6 100644
--- a/secretmanager/test/secretmanagerTest.php
+++ b/secretmanager/test/secretmanagerTest.php
@@ -414,6 +414,22 @@ public function testIamRevokeAccess()
         $this->assertStringContainsString('Updated IAM policy', $output);
     }
 
+    public function testListSecretVersionsWithFilter()
+    {
+        $name = self::$client->parseName(self::$testSecretWithVersions->getName());
+
+        // Filter for enabled versions.
+        $filter = 'state = ENABLED';
+
+        $output = $this->runFunctionSnippet('list_secret_versions_with_filter', [
+            $name['project'],
+            $name['secret'],
+            $filter,
+        ]);
+
+        $this->assertStringContainsString('Found secret version', $output);
+    }
+
     public function testListSecretVersions()
     {
         $name = self::$client->parseName(self::$testSecretWithVersions->getName());
@@ -426,6 +442,20 @@ public function testListSecretVersions()
         $this->assertStringContainsString('secret version', $output);
     }
 
+    public function testListSecretsWithFilter()
+    {
+        $name = self::$client->parseName(self::$testSecret->getName());
+
+        $filter = 'name:' . $name['secret'];
+
+        $output = $this->runFunctionSnippet('list_secrets_with_filter', [
+            $name['project'],
+            $filter,
+        ]);
+
+        $this->assertStringContainsString('Found secret', $output);
+    }
+
     public function testListSecrets()
     {
         $name = self::$client->parseName(self::$testSecret->getName());

From d6f157282eeaa11bb9fe6c8b4ac63f0edfe338b1 Mon Sep 17 00:00:00 2001
From: Dhaval Bhensdadiya <dhaval.bhensdadiya@crestdata.ai>
Date: Thu, 29 Jan 2026 12:18:01 +0530
Subject: [PATCH 2/4] Adding new line at end as per gemini in filter tests

---
 secretmanager/src/list_regional_secret_versions_with_filter.php | 2 +-
 secretmanager/src/list_regional_secrets_with_filter.php         | 2 +-
 secretmanager/src/list_secret_versions_with_filter.php          | 2 +-
 secretmanager/src/list_secrets_with_filter.php                  | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/secretmanager/src/list_regional_secret_versions_with_filter.php b/secretmanager/src/list_regional_secret_versions_with_filter.php
index 23c391b37f..c86bb03a71 100644
--- a/secretmanager/src/list_regional_secret_versions_with_filter.php
+++ b/secretmanager/src/list_regional_secret_versions_with_filter.php
@@ -54,4 +54,4 @@ function list_regional_secret_versions_with_filter(string $projectId, string $lo
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/list_regional_secrets_with_filter.php b/secretmanager/src/list_regional_secrets_with_filter.php
index 978816e902..9f83f7fcb9 100644
--- a/secretmanager/src/list_regional_secrets_with_filter.php
+++ b/secretmanager/src/list_regional_secrets_with_filter.php
@@ -53,4 +53,4 @@ function list_regional_secrets_with_filter(string $projectId, string $locationId
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/list_secret_versions_with_filter.php b/secretmanager/src/list_secret_versions_with_filter.php
index 17dac9544b..d6fb6c2866 100644
--- a/secretmanager/src/list_secret_versions_with_filter.php
+++ b/secretmanager/src/list_secret_versions_with_filter.php
@@ -52,4 +52,4 @@ function list_secret_versions_with_filter(string $projectId, string $secretId, s
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/list_secrets_with_filter.php b/secretmanager/src/list_secrets_with_filter.php
index 6468c58001..2d07bed0d2 100644
--- a/secretmanager/src/list_secrets_with_filter.php
+++ b/secretmanager/src/list_secrets_with_filter.php
@@ -51,4 +51,4 @@ function list_secrets_with_filter(string $projectId, string $filter): void
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

From 598200ec1eae63d8b0c1cd4fa6d011daea1e349c Mon Sep 17 00:00:00 2001
From: Dhaval Bhensdadiya <dhaval.bhensdadiya@crestdata.ai>
Date: Tue, 27 Jan 2026 16:21:25 +0530
Subject: [PATCH 3/4] feat(secretmanager): Add samples for ETag-based secret
 and secret version operations

---
 .../src/delete_regional_secret_using_etag.php | 67 ++++++++++++++
 .../src/delete_secret_using_etag.php          | 65 ++++++++++++++
 ...roy_regional_secret_version_using_etag.php | 63 +++++++++++++
 .../src/destroy_secret_version_using_etag.php | 61 +++++++++++++
 ...ble_regional_secret_version_using_etag.php | 63 +++++++++++++
 .../src/disable_secret_version_using_etag.php | 61 +++++++++++++
 ...ble_regional_secret_version_using_etag.php | 63 +++++++++++++
 .../src/enable_secret_version_using_etag.php  | 61 +++++++++++++
 .../src/update_regional_secret_using_etag.php | 80 +++++++++++++++++
 .../src/update_secret_using_etag.php          | 81 +++++++++++++++++
 .../test/regionalsecretmanagerTest.php        | 89 +++++++++++++++++--
 secretmanager/test/secretmanagerTest.php      | 75 ++++++++++++++++
 12 files changed, 824 insertions(+), 5 deletions(-)
 create mode 100644 secretmanager/src/delete_regional_secret_using_etag.php
 create mode 100644 secretmanager/src/delete_secret_using_etag.php
 create mode 100644 secretmanager/src/destroy_regional_secret_version_using_etag.php
 create mode 100644 secretmanager/src/destroy_secret_version_using_etag.php
 create mode 100644 secretmanager/src/disable_regional_secret_version_using_etag.php
 create mode 100644 secretmanager/src/disable_secret_version_using_etag.php
 create mode 100644 secretmanager/src/enable_regional_secret_version_using_etag.php
 create mode 100644 secretmanager/src/enable_secret_version_using_etag.php
 create mode 100644 secretmanager/src/update_regional_secret_using_etag.php
 create mode 100644 secretmanager/src/update_secret_using_etag.php

diff --git a/secretmanager/src/delete_regional_secret_using_etag.php b/secretmanager/src/delete_regional_secret_using_etag.php
new file mode 100644
index 0000000000..5cfc4353cf
--- /dev/null
+++ b/secretmanager/src/delete_regional_secret_using_etag.php
@@ -0,0 +1,67 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_delete_regional_secret_using_etag]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\GetSecretRequest;
+use Google\Cloud\SecretManager\V1\DeleteSecretRequest;
+
+/**
+ * Delete a regional secret using a stored etag (optimistic concurrency).
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $locationId Secret location (e.g. 'us-central1')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ */
+function delete_regional_secret_using_etag(string $projectId, string $locationId, string $secretId): void
+{
+    $options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
+    $client = new SecretManagerServiceClient($options);
+
+    $name = $client->projectLocationSecretName($projectId, $locationId, $secretId);
+
+    // Get the current secret to read the etag.
+    $getRequest = GetSecretRequest::build($name);
+    $current = $client->getSecret($getRequest);
+
+    $etag = $current->getEtag();
+
+    // Build the delete request with the etag.
+    $deleteRequest = (new DeleteSecretRequest())
+        ->setName($name)
+        ->setEtag($etag);
+
+    // Delete the secret.
+    $client->deleteSecret($deleteRequest);
+
+    printf('Deleted secret %s' . PHP_EOL, $secretId);
+}
+// [END secretmanager_delete_regional_secret_using_etag]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/delete_secret_using_etag.php b/secretmanager/src/delete_secret_using_etag.php
new file mode 100644
index 0000000000..d720d7f550
--- /dev/null
+++ b/secretmanager/src/delete_secret_using_etag.php
@@ -0,0 +1,65 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_delete_secret_using_etag]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\GetSecretRequest;
+use Google\Cloud\SecretManager\V1\DeleteSecretRequest;
+
+/**
+ * Delete a secret using a stored etag (optimistic concurrency).
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ */
+function delete_secret_using_etag(string $projectId, string $secretId): void
+{
+    $client = new SecretManagerServiceClient();
+
+    $name = $client->secretName($projectId, $secretId);
+
+    // Get the current secret to read the etag.
+    $getRequest = GetSecretRequest::build($name);
+    $current = $client->getSecret($getRequest);
+
+    $etag = $current->getEtag();
+
+    // Build the delete request with the etag.
+    $deleteRequest = (new DeleteSecretRequest())
+        ->setName($name)
+        ->setEtag($etag);
+
+    // Delete the secret.
+    $client->deleteSecret($deleteRequest);
+
+    printf('Deleted secret %s' . PHP_EOL, $secretId);
+}
+// [END secretmanager_delete_secret_using_etag]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/destroy_regional_secret_version_using_etag.php b/secretmanager/src/destroy_regional_secret_version_using_etag.php
new file mode 100644
index 0000000000..1274b1395f
--- /dev/null
+++ b/secretmanager/src/destroy_regional_secret_version_using_etag.php
@@ -0,0 +1,63 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_destroy_regional_secret_version_using_etag]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\GetSecretVersionRequest;
+use Google\Cloud\SecretManager\V1\DestroySecretVersionRequest;
+
+/**
+ * Destroy a regional secret version using a stored etag.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $locationId Secret location (e.g. 'us-central1')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ * @param string $versionId Your version ID (e.g. 'latest' or '5')
+ */
+function destroy_regional_secret_version_using_etag(string $projectId, string $locationId, string $secretId, string $versionId): void
+{
+    $options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
+    $client = new SecretManagerServiceClient($options);
+
+    $name = $client->projectLocationSecretSecretVersionName($projectId, $locationId, $secretId, $versionId);
+
+    // Read current etag for the version.
+    $getRequest = GetSecretVersionRequest::build($name);
+    $current = $client->getSecretVersion($getRequest);
+    $etag = $current->getEtag();
+
+    $request = DestroySecretVersionRequest::build($name)->setEtag($etag);
+
+    $response = $client->destroySecretVersion($request);
+
+    printf('Destroyed secret version: %s' . PHP_EOL, $response->getName());
+}
+// [END secretmanager_destroy_regional_secret_version_using_etag]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/destroy_secret_version_using_etag.php b/secretmanager/src/destroy_secret_version_using_etag.php
new file mode 100644
index 0000000000..e17eaf691a
--- /dev/null
+++ b/secretmanager/src/destroy_secret_version_using_etag.php
@@ -0,0 +1,61 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_destroy_secret_version_using_etag]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\GetSecretVersionRequest;
+use Google\Cloud\SecretManager\V1\DestroySecretVersionRequest;
+
+/**
+ * Destroy a secret version using a stored etag.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ * @param string $versionId Your version ID (e.g. 'latest' or '5')
+ */
+function destroy_secret_version_using_etag(string $projectId, string $secretId, string $versionId): void
+{
+    $client = new SecretManagerServiceClient();
+
+    $name = $client->secretVersionName($projectId, $secretId, $versionId);
+
+    // Read current etag for the version.
+    $getRequest = GetSecretVersionRequest::build($name);
+    $current = $client->getSecretVersion($getRequest);
+    $etag = $current->getEtag();
+
+    $request = DestroySecretVersionRequest::build($name)->setEtag($etag);
+
+    $response = $client->destroySecretVersion($request);
+
+    printf('Destroyed secret version: %s' . PHP_EOL, $response->getName());
+}
+// [END secretmanager_destroy_secret_version_using_etag]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/disable_regional_secret_version_using_etag.php b/secretmanager/src/disable_regional_secret_version_using_etag.php
new file mode 100644
index 0000000000..5f8d6e6856
--- /dev/null
+++ b/secretmanager/src/disable_regional_secret_version_using_etag.php
@@ -0,0 +1,63 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_disable_regional_secret_version_using_etag]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\GetSecretVersionRequest;
+use Google\Cloud\SecretManager\V1\DisableSecretVersionRequest;
+
+/**
+ * Disable a regional secret version using a stored etag.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $locationId Secret location (e.g. 'us-central1')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ * @param string $versionId Your version ID (e.g. 'latest' or '5')
+ */
+function disable_regional_secret_version_using_etag(string $projectId, string $locationId, string $secretId, string $versionId): void
+{
+    $options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
+    $client = new SecretManagerServiceClient($options);
+
+    $name = $client->projectLocationSecretSecretVersionName($projectId, $locationId, $secretId, $versionId);
+
+    // Read current etag for the version.
+    $getRequest = GetSecretVersionRequest::build($name);
+    $current = $client->getSecretVersion($getRequest);
+    $etag = $current->getEtag();
+
+    $request = DisableSecretVersionRequest::build($name)->setEtag($etag);
+
+    $response = $client->disableSecretVersion($request);
+
+    printf('Disabled secret version: %s' . PHP_EOL, $response->getName());
+}
+// [END secretmanager_disable_regional_secret_version_using_etag]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/disable_secret_version_using_etag.php b/secretmanager/src/disable_secret_version_using_etag.php
new file mode 100644
index 0000000000..7dab2f4a48
--- /dev/null
+++ b/secretmanager/src/disable_secret_version_using_etag.php
@@ -0,0 +1,61 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_disable_secret_version_using_etag]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\GetSecretVersionRequest;
+use Google\Cloud\SecretManager\V1\DisableSecretVersionRequest;
+
+/**
+ * Disable a secret version using a stored etag.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ * @param string $versionId Your version ID (e.g. 'latest' or '5')
+ */
+function disable_secret_version_using_etag(string $projectId, string $secretId, string $versionId): void
+{
+    $client = new SecretManagerServiceClient();
+
+    $name = $client->secretVersionName($projectId, $secretId, $versionId);
+
+    // Read current etag for the version.
+    $getRequest = GetSecretVersionRequest::build($name);
+    $current = $client->getSecretVersion($getRequest);
+    $etag = $current->getEtag();
+
+    $request = DisableSecretVersionRequest::build($name)->setEtag($etag);
+
+    $response = $client->disableSecretVersion($request);
+
+    printf('Disabled secret version: %s' . PHP_EOL, $response->getName());
+}
+// [END secretmanager_disable_secret_version_using_etag]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/enable_regional_secret_version_using_etag.php b/secretmanager/src/enable_regional_secret_version_using_etag.php
new file mode 100644
index 0000000000..824f9d2482
--- /dev/null
+++ b/secretmanager/src/enable_regional_secret_version_using_etag.php
@@ -0,0 +1,63 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_enable_regional_secret_version_using_etag]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\GetSecretVersionRequest;
+use Google\Cloud\SecretManager\V1\EnableSecretVersionRequest;
+
+/**
+ * Enable a regional secret version using a stored etag.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $locationId Secret location (e.g. 'us-central1')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ * @param string $versionId Your version ID (e.g. 'latest' or '5')
+ */
+function enable_regional_secret_version_using_etag(string $projectId, string $locationId, string $secretId, string $versionId): void
+{
+    $options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
+    $client = new SecretManagerServiceClient($options);
+
+    $name = $client->projectLocationSecretSecretVersionName($projectId, $locationId, $secretId, $versionId);
+
+    // Read current etag for the version.
+    $getRequest = GetSecretVersionRequest::build($name);
+    $current = $client->getSecretVersion($getRequest);
+    $etag = $current->getEtag();
+
+    $request = EnableSecretVersionRequest::build($name)->setEtag($etag);
+
+    $response = $client->enableSecretVersion($request);
+
+    printf('Enabled secret version: %s' . PHP_EOL, $response->getName());
+}
+// [END secretmanager_enable_regional_secret_version_using_etag]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/enable_secret_version_using_etag.php b/secretmanager/src/enable_secret_version_using_etag.php
new file mode 100644
index 0000000000..3726377e4b
--- /dev/null
+++ b/secretmanager/src/enable_secret_version_using_etag.php
@@ -0,0 +1,61 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_enable_secret_version_using_etag]
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\GetSecretVersionRequest;
+use Google\Cloud\SecretManager\V1\EnableSecretVersionRequest;
+
+/**
+ * Enable a secret version using a stored etag.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ * @param string $versionId Your version ID (e.g. 'latest' or '5')
+ */
+function enable_secret_version_using_etag(string $projectId, string $secretId, string $versionId): void
+{
+    $client = new SecretManagerServiceClient();
+
+    $name = $client->secretVersionName($projectId, $secretId, $versionId);
+
+    // Read current etag for the version.
+    $getRequest = GetSecretVersionRequest::build($name);
+    $current = $client->getSecretVersion($getRequest);
+    $etag = $current->getEtag();
+
+    $request = EnableSecretVersionRequest::build($name)->setEtag($etag);
+
+    $response = $client->enableSecretVersion($request);
+
+    printf('Enabled secret version: %s' . PHP_EOL, $response->getName());
+}
+// [END secretmanager_enable_secret_version_using_etag]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/update_regional_secret_using_etag.php b/secretmanager/src/update_regional_secret_using_etag.php
new file mode 100644
index 0000000000..349a8e955e
--- /dev/null
+++ b/secretmanager/src/update_regional_secret_using_etag.php
@@ -0,0 +1,80 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_update_regional_secret_using_etag]
+use Google\Cloud\SecretManager\V1\Secret;
+use Google\Cloud\SecretManager\V1\GetSecretRequest;
+use Google\Cloud\SecretManager\V1\UpdateSecretRequest;
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Protobuf\FieldMask;
+
+/**
+ * Update a regional secret using an etag for optimistic concurrency.
+ *
+ * This sample fetches the current secret, reads its etag, then attempts to
+ * update the secret's labels while providing the etag. The update will
+ * succeed only if the etag matches the server's current etag.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $locationId Secret location (e.g. 'us-central1')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ * @param string $labelKey  Label key to set
+ * @param string $labelValue Label value to set
+ */
+function update_regional_secret_using_etag(string $projectId, string $locationId, string $secretId, string $labelKey, string $labelValue): void
+{
+    $options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
+    $client = new SecretManagerServiceClient($options);
+
+    $name = $client->projectLocationSecretName($projectId, $locationId, $secretId);
+
+    $getRequest = GetSecretRequest::build($name);
+    $current = $client->getSecret($getRequest);
+
+    $etag = $current->getEtag();
+
+    // Prepare the secret with the updated labels and the stored etag.
+    $secret = (new Secret())
+        ->setName($name)
+        ->setLabels([$labelKey => $labelValue])
+        ->setEtag($etag);
+
+    // Only update the labels field.
+    $updateMask = (new FieldMask())->setPaths(['labels']);
+
+    // Build and send the update request.
+    $request = UpdateSecretRequest::build($secret, $updateMask);
+
+    $response = $client->updateSecret($request);
+
+    printf('Updated secret using etag: %s' . PHP_EOL, $response->getName());
+}
+// [END secretmanager_update_regional_secret_using_etag]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/src/update_secret_using_etag.php b/secretmanager/src/update_secret_using_etag.php
new file mode 100644
index 0000000000..1908e4fd04
--- /dev/null
+++ b/secretmanager/src/update_secret_using_etag.php
@@ -0,0 +1,81 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_update_secret_using_etag]
+use Google\Cloud\SecretManager\V1\Secret;
+use Google\Cloud\SecretManager\V1\GetSecretRequest;
+use Google\Cloud\SecretManager\V1\UpdateSecretRequest;
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Protobuf\FieldMask;
+
+/**
+ * Update a secret using a stored etag (optimistic concurrency).
+ *
+ * This sample fetches the current secret, reads its etag, then attempts to
+ * update the secret's labels while providing the etag. The update will
+ * succeed only if the etag matches the server's current etag.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ * @param string $labelKey  Label key to set
+ * @param string $labelValue Label value to set
+ */
+function update_secret_using_etag(string $projectId, string $secretId, string $labelKey, string $labelValue): void
+{
+    // Create the Secret Manager client.
+    $client = new SecretManagerServiceClient();
+
+    // Build the resource name of the secret.
+    $name = $client->secretName($projectId, $secretId);
+
+    // Get the current secret to read the etag.
+    $getRequest = GetSecretRequest::build($name);
+    $current = $client->getSecret($getRequest);
+
+    $etag = $current->getEtag();
+
+    // Prepare the secret with the updated labels and the stored etag.
+    $secret = (new Secret())
+        ->setName($name)
+        ->setLabels([$labelKey => $labelValue])
+        ->setEtag($etag);
+
+    // Only update the labels field.
+    $updateMask = (new FieldMask())->setPaths(['labels']);
+
+    // Build and send the update request.
+    $request = UpdateSecretRequest::build($secret, $updateMask);
+
+    $response = $client->updateSecret($request);
+
+    printf('Updated secret using etag: %s' . PHP_EOL, $response->getName());
+}
+// [END secretmanager_update_secret_using_etag]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
diff --git a/secretmanager/test/regionalsecretmanagerTest.php b/secretmanager/test/regionalsecretmanagerTest.php
index c85008eff1..f9242fe8c3 100644
--- a/secretmanager/test/regionalsecretmanagerTest.php
+++ b/secretmanager/test/regionalsecretmanagerTest.php
@@ -56,6 +56,9 @@ class regionalsecretmanagerTest extends TestCase
     private static $testSecretVersionToDestroy;
     private static $testSecretVersionToDisable;
     private static $testSecretVersionToEnable;
+    private static $testSecretVersionToDestroyWithETag;
+    private static $testSecretVersionToDisableWithETag;
+    private static $testSecretVersionToEnableWithETag;
     private static $testSecretWithTagToCreateName;
     private static $testSecretBindTagToCreateName;
     private static $testSecretWithLabelsToCreateName;
@@ -86,17 +89,22 @@ public static function setUpBeforeClass(): void
         self::$testSecretToDelete = self::createSecret();
         self::$testSecretWithVersions = self::createSecret();
         self::$testSecretToCreateName = self::$client->projectLocationSecretName(self::$projectId, self::$locationId, self::randomSecretId());
-        self::$testSecretVersion = self::addSecretVersion(self::$testSecretWithVersions);
-        self::$testSecretVersionToDestroy = self::addSecretVersion(self::$testSecretWithVersions);
-        self::$testSecretVersionToDisable = self::addSecretVersion(self::$testSecretWithVersions);
-        self::$testSecretVersionToEnable = self::addSecretVersion(self::$testSecretWithVersions);
         self::$testSecretWithTagToCreateName = self::$client->projectLocationSecretName(self::$projectId, self::$locationId, self::randomSecretId());
         self::$testSecretBindTagToCreateName = self::$client->projectLocationSecretName(self::$projectId, self::$locationId, self::randomSecretId());
         self::$testSecretWithLabelsToCreateName = self::$client->projectLocationSecretName(self::$projectId, self::$locationId, self::randomSecretId());
         self::$testSecretWithAnnotationsToCreateName = self::$client->projectLocationSecretName(self::$projectId, self::$locationId, self::randomSecretId());
         self::$testSecretWithDelayedDestroyToCreateName = self::$client->projectLocationSecretName(self::$projectId, self::$locationId, self::randomSecretId());
+        
+        self::$testSecretVersion = self::addSecretVersion(self::$testSecretWithVersions);
+        self::$testSecretVersionToDestroy = self::addSecretVersion(self::$testSecretWithVersions);
+        self::$testSecretVersionToDisable = self::addSecretVersion(self::$testSecretWithVersions);
+        self::$testSecretVersionToEnable = self::addSecretVersion(self::$testSecretWithVersions);
         self::disableSecretVersion(self::$testSecretVersionToEnable);
-
+        self::$testSecretVersionToDestroyWithETag = self::addSecretVersion(self::$testSecretWithVersions);
+        self::$testSecretVersionToDisableWithETag = self::addSecretVersion(self::$testSecretWithVersions);
+        self::$testSecretVersionToEnableWithETag = self::addSecretVersion(self::$testSecretWithVersions);
+        self::disableSecretVersion(self::$testSecretVersionToEnableWithETag);
+        
         self::$testTagKey = self::createTagKey(self::randomSecretId());
         self::$testTagValue = self::createTagValue(self::randomSecretId());
     }
@@ -294,6 +302,20 @@ public function testCreateSecret()
         $this->assertStringContainsString('Created secret', $output);
     }
 
+    public function testDeleteSecretUsingEtag()
+    {
+        $secret = self::createSecret();
+        $name = self::$client->parseName($secret->getName());
+
+        $output = $this->runFunctionSnippet('delete_regional_secret_using_etag', [
+            $name['project'],
+            $name['location'],
+            $name['secret'],
+        ]);
+
+        $this->assertStringContainsString('Deleted secret', $output);
+    }
+
     public function testDeleteSecret()
     {
         $name = self::$client->parseName(self::$testSecretToDelete->getName());
@@ -307,6 +329,20 @@ public function testDeleteSecret()
         $this->assertStringContainsString('Deleted secret', $output);
     }
 
+    public function testDestroySecretVersionUsingEtag()
+    {
+        $name = self::$client->parseName(self::$testSecretVersionToDestroyWithETag->getName());
+
+        $output = $this->runFunctionSnippet('destroy_regional_secret_version_using_etag', [
+            $name['project'],
+            $name['location'],
+            $name['secret'],
+            $name['secret_version'],
+        ]);
+
+        $this->assertStringContainsString('Destroyed secret version', $output);
+    }
+
     public function testDestroySecretVersion()
     {
         $name = self::$client->parseName(self::$testSecretVersionToDestroy->getName());
@@ -321,6 +357,20 @@ public function testDestroySecretVersion()
         $this->assertStringContainsString('Destroyed secret version', $output);
     }
 
+    public function testDisableSecretVersionUsingEtag()
+    {
+        $name = self::$client->parseName(self::$testSecretVersionToDisableWithETag->getName());
+
+        $output = $this->runFunctionSnippet('disable_regional_secret_version_using_etag', [
+            $name['project'],
+            $name['location'],
+            $name['secret'],
+            $name['secret_version'],
+        ]);
+
+        $this->assertStringContainsString('Disabled secret version', $output);
+    }
+
     public function testDisableSecretVersion()
     {
         $name = self::$client->parseName(self::$testSecretVersionToDisable->getName());
@@ -335,6 +385,20 @@ public function testDisableSecretVersion()
         $this->assertStringContainsString('Disabled secret version', $output);
     }
 
+    public function testEnableSecretVersionUsingEtag()
+    {
+        $name = self::$client->parseName(self::$testSecretVersionToEnableWithETag->getName());
+
+        $output = $this->runFunctionSnippet('enable_regional_secret_version_using_etag', [
+            $name['project'],
+            $name['location'],
+            $name['secret'],
+            $name['secret_version'],
+        ]);
+
+        $this->assertStringContainsString('Enabled secret version', $output);
+    }
+
     public function testEnableSecretVersion()
     {
         $name = self::$client->parseName(self::$testSecretVersionToEnable->getName());
@@ -463,6 +527,21 @@ public function testListSecrets()
         $this->assertStringContainsString($name['secret'], $output);
     }
 
+    public function testUpdateSecretUsingEtag()
+    {
+        $name = self::$client->parseName(self::$testSecret->getName());
+
+        $output = $this->runFunctionSnippet('update_regional_secret_using_etag', [
+            $name['project'],
+            $name['location'],
+            $name['secret'],
+            'etaglabel',
+            'etagvalue',
+        ]);
+
+        $this->assertStringContainsString('Updated secret', $output);
+    }
+
     public function testUpdateSecret()
     {
         $name = self::$client->parseName(self::$testSecret->getName());
diff --git a/secretmanager/test/secretmanagerTest.php b/secretmanager/test/secretmanagerTest.php
index c7826a91e6..36330eedb9 100644
--- a/secretmanager/test/secretmanagerTest.php
+++ b/secretmanager/test/secretmanagerTest.php
@@ -59,6 +59,9 @@ class secretmanagerTest extends TestCase
     private static $testSecretVersionToDestroy;
     private static $testSecretVersionToDisable;
     private static $testSecretVersionToEnable;
+    private static $testSecretVersionToDestroyWithETag;
+    private static $testSecretVersionToDisableWithETag;
+    private static $testSecretVersionToEnableWithETag;
     private static $testSecretWithTagToCreateName;
     private static $testSecretBindTagToCreateName;
     private static $testSecretWithLabelsToCreateName;
@@ -100,6 +103,11 @@ public static function setUpBeforeClass(): void
         self::$testSecretVersionToEnable = self::addSecretVersion(self::$testSecretWithVersions);
         self::disableSecretVersion(self::$testSecretVersionToEnable);
 
+        self::$testSecretVersionToDestroyWithETag = self::addSecretVersion(self::$testSecretWithVersions);
+        self::$testSecretVersionToDisableWithETag = self::addSecretVersion(self::$testSecretWithVersions);
+        self::$testSecretVersionToEnableWithETag = self::addSecretVersion(self::$testSecretWithVersions);
+        self::disableSecretVersion(self::$testSecretVersionToEnableWithETag);
+
         self::$testTagKey = self::createTagKey(self::randomSecretId());
         self::$testTagValue = self::createTagValue(self::randomSecretId());
     }
@@ -310,6 +318,20 @@ public function testCreateSecretWithUserManagedReplication()
         $this->assertStringContainsString('Created secret', $output);
     }
 
+    public function testDeleteSecretUsingEtag()
+    {
+        // Create a fresh secret to delete with etag.
+        $secret = self::createSecret();
+        $name = self::$client->parseName($secret->getName());
+
+        $output = $this->runFunctionSnippet('delete_secret_using_etag', [
+            $name['project'],
+            $name['secret'],
+        ]);
+
+        $this->assertStringContainsString('Deleted secret', $output);
+    }
+
     public function testDeleteSecret()
     {
         $name = self::$client->parseName(self::$testSecretToDelete->getName());
@@ -322,6 +344,19 @@ public function testDeleteSecret()
         $this->assertStringContainsString('Deleted secret', $output);
     }
 
+    public function testDestroySecretVersionUsingEtag()
+    {
+        $name = self::$client->parseName(self::$testSecretVersionToDestroyWithETag->getName());
+
+        $output = $this->runFunctionSnippet('destroy_secret_version_using_etag', [
+            $name['project'],
+            $name['secret'],
+            $name['secret_version'],
+        ]);
+
+        $this->assertStringContainsString('Destroyed secret version', $output);
+    }
+
     public function testDestroySecretVersion()
     {
         $name = self::$client->parseName(self::$testSecretVersionToDestroy->getName());
@@ -335,6 +370,19 @@ public function testDestroySecretVersion()
         $this->assertStringContainsString('Destroyed secret version', $output);
     }
 
+    public function testDisableSecretVersionUsingEtag()
+    {
+        $name = self::$client->parseName(self::$testSecretVersionToDisableWithETag->getName());
+
+        $output = $this->runFunctionSnippet('disable_secret_version_using_etag', [
+            $name['project'],
+            $name['secret'],
+            $name['secret_version'],
+        ]);
+
+        $this->assertStringContainsString('Disabled secret version', $output);
+    }
+
     public function testDisableSecretVersion()
     {
         $name = self::$client->parseName(self::$testSecretVersionToDisable->getName());
@@ -348,6 +396,19 @@ public function testDisableSecretVersion()
         $this->assertStringContainsString('Disabled secret version', $output);
     }
 
+    public function testEnableSecretVersionUsingEtag()
+    {
+        $name = self::$client->parseName(self::$testSecretVersionToEnableWithETag->getName());
+
+        $output = $this->runFunctionSnippet('enable_secret_version_using_etag', [
+            $name['project'],
+            $name['secret'],
+            $name['secret_version'],
+        ]);
+
+        $this->assertStringContainsString('Enabled secret version', $output);
+    }
+
     public function testEnableSecretVersion()
     {
         $name = self::$client->parseName(self::$testSecretVersionToEnable->getName());
@@ -468,6 +529,20 @@ public function testListSecrets()
         $this->assertStringContainsString($name['secret'], $output);
     }
 
+    public function testUpdateSecretUsingEtag()
+    {
+        $name = self::$client->parseName(self::$testSecret->getName());
+
+        $output = $this->runFunctionSnippet('update_secret_using_etag', [
+            $name['project'],
+            $name['secret'],
+            'etaglabel',
+            'etagvalue',
+        ]);
+
+        $this->assertStringContainsString('Updated secret', $output);
+    }
+
     public function testUpdateSecret()
     {
         $name = self::$client->parseName(self::$testSecret->getName());

From 503860f8fc5ccf0596da0896ff8902a54e90bd1b Mon Sep 17 00:00:00 2001
From: Dhaval Bhensdadiya <dhaval.bhensdadiya@crestdata.ai>
Date: Thu, 29 Jan 2026 12:22:32 +0530
Subject: [PATCH 4/4] Add newline at end as per gemini suggestion in etag
 samples

---
 secretmanager/src/delete_regional_secret_using_etag.php         | 2 +-
 secretmanager/src/delete_secret_using_etag.php                  | 2 +-
 .../src/destroy_regional_secret_version_using_etag.php          | 2 +-
 secretmanager/src/destroy_secret_version_using_etag.php         | 2 +-
 .../src/disable_regional_secret_version_using_etag.php          | 2 +-
 secretmanager/src/disable_secret_version_using_etag.php         | 2 +-
 secretmanager/src/enable_regional_secret_version_using_etag.php | 2 +-
 secretmanager/src/enable_secret_version_using_etag.php          | 2 +-
 secretmanager/src/update_regional_secret_using_etag.php         | 2 +-
 secretmanager/src/update_secret_using_etag.php                  | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/secretmanager/src/delete_regional_secret_using_etag.php b/secretmanager/src/delete_regional_secret_using_etag.php
index 5cfc4353cf..fb3a8c4b84 100644
--- a/secretmanager/src/delete_regional_secret_using_etag.php
+++ b/secretmanager/src/delete_regional_secret_using_etag.php
@@ -64,4 +64,4 @@ function delete_regional_secret_using_etag(string $projectId, string $locationId
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/delete_secret_using_etag.php b/secretmanager/src/delete_secret_using_etag.php
index d720d7f550..2f845625cf 100644
--- a/secretmanager/src/delete_secret_using_etag.php
+++ b/secretmanager/src/delete_secret_using_etag.php
@@ -62,4 +62,4 @@ function delete_secret_using_etag(string $projectId, string $secretId): void
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/destroy_regional_secret_version_using_etag.php b/secretmanager/src/destroy_regional_secret_version_using_etag.php
index 1274b1395f..457490e72e 100644
--- a/secretmanager/src/destroy_regional_secret_version_using_etag.php
+++ b/secretmanager/src/destroy_regional_secret_version_using_etag.php
@@ -60,4 +60,4 @@ function destroy_regional_secret_version_using_etag(string $projectId, string $l
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/destroy_secret_version_using_etag.php b/secretmanager/src/destroy_secret_version_using_etag.php
index e17eaf691a..a8b31d3230 100644
--- a/secretmanager/src/destroy_secret_version_using_etag.php
+++ b/secretmanager/src/destroy_secret_version_using_etag.php
@@ -58,4 +58,4 @@ function destroy_secret_version_using_etag(string $projectId, string $secretId,
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/disable_regional_secret_version_using_etag.php b/secretmanager/src/disable_regional_secret_version_using_etag.php
index 5f8d6e6856..ffb5a3c6e4 100644
--- a/secretmanager/src/disable_regional_secret_version_using_etag.php
+++ b/secretmanager/src/disable_regional_secret_version_using_etag.php
@@ -60,4 +60,4 @@ function disable_regional_secret_version_using_etag(string $projectId, string $l
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/disable_secret_version_using_etag.php b/secretmanager/src/disable_secret_version_using_etag.php
index 7dab2f4a48..44240b44f8 100644
--- a/secretmanager/src/disable_secret_version_using_etag.php
+++ b/secretmanager/src/disable_secret_version_using_etag.php
@@ -58,4 +58,4 @@ function disable_secret_version_using_etag(string $projectId, string $secretId,
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/enable_regional_secret_version_using_etag.php b/secretmanager/src/enable_regional_secret_version_using_etag.php
index 824f9d2482..df423f5413 100644
--- a/secretmanager/src/enable_regional_secret_version_using_etag.php
+++ b/secretmanager/src/enable_regional_secret_version_using_etag.php
@@ -60,4 +60,4 @@ function enable_regional_secret_version_using_etag(string $projectId, string $lo
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/enable_secret_version_using_etag.php b/secretmanager/src/enable_secret_version_using_etag.php
index 3726377e4b..82668c8832 100644
--- a/secretmanager/src/enable_secret_version_using_etag.php
+++ b/secretmanager/src/enable_secret_version_using_etag.php
@@ -58,4 +58,4 @@ function enable_secret_version_using_etag(string $projectId, string $secretId, s
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/update_regional_secret_using_etag.php b/secretmanager/src/update_regional_secret_using_etag.php
index 349a8e955e..5566c1c9dc 100644
--- a/secretmanager/src/update_regional_secret_using_etag.php
+++ b/secretmanager/src/update_regional_secret_using_etag.php
@@ -77,4 +77,4 @@ function update_regional_secret_using_etag(string $projectId, string $locationId
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
diff --git a/secretmanager/src/update_secret_using_etag.php b/secretmanager/src/update_secret_using_etag.php
index 1908e4fd04..7a1ca198fe 100644
--- a/secretmanager/src/update_secret_using_etag.php
+++ b/secretmanager/src/update_secret_using_etag.php
@@ -78,4 +78,4 @@ function update_secret_using_etag(string $projectId, string $secretId, string $l
 
 // The following 2 lines are only needed to execute the samples on the CLI
 require_once __DIR__ . '/../../testing/sample_helpers.php';
-\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);
\ No newline at end of file
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);