Google BigQuery Connection API

Name: BigQuery Connection API
Brand: BigQuery Connection API
Availability: InStock

✓ Official Vendor SpecAnalyticsData Pipelinesoauth28 EndpointsREST

Install Jentic One Beta

Connect the BigQuery Connection API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the BigQuery Connection API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with BigQuery Connection API.

Create connection resources for Cloud SQL, Spanner, AWS, and Azure data sources

List and patch existing connections under a project and location

Delete connections that are no longer referenced by federated queries

GET STARTED

Start building with BigQuery Connection API

Explore with Jentic

View OpenAPI Document

For Agents

Manage BigQuery connection resources that link external data sources (Cloud SQL, Spanner, AWS, Azure) into federated queries. Agents can create, list, and IAM-bind connections.

Use for: I need to create a BigQuery connection to a Cloud SQL Postgres database, List all BigQuery connections in a project and location, Get the details of a specific BigQuery connection by name, Update the credentials on an existing BigQuery connection

Not supported: Does not run SQL queries, transfer data, or manage column-level masking - use for managing federated connection resources only.

The BigQuery Connection API manages named connection resources that BigQuery uses to query external data sources such as Cloud SQL, Spanner, AWS, and Azure without copying the data. You can create connections, attach IAM policies, and reference them from federated queries and external tables in BigQuery. This is the control-plane API for federation; the connections it creates are then used by the main BigQuery query engine. Each connection isolates credentials for the underlying source so analysts can query across systems without holding direct database secrets.

Use Cases

Patterns agents use BigQuery Connection API for, with concrete tasks.

★ Federated Query Setup

Provision named connections so BigQuery can run federated SELECTs against Cloud SQL, Spanner, or external clouds without bulk-copying the data. Connections are created at /v1/{parent}/connections and referenced by EXTERNAL_QUERY in SQL. This lets analysts join warehouse tables with operational stores in a single query.

Create a Cloud SQL Postgres connection named prod-orders in project myproj and location US, using the supplied instance and credential.

Cross-Cloud Data Access

Create AWS or Azure connections so BigQuery Omni can query S3 or Blob Storage tables from a Google Cloud project. Connections store the role mapping and present a stable resource name that BigQuery references in external table definitions. Users get one warehouse to query multi-cloud data instead of moving everything into BigQuery storage.

Create an AWS connection with the provided IAM role ARN in project myproj location aws-us-east-1 and return the generated AWS identity.

Connection Governance

Apply IAM bindings to each connection so only specific service accounts can use it, keeping analyst groups isolated from production source credentials. setIamPolicy/getIamPolicy at /v1/{resource}:getIamPolicy and :setIamPolicy enforce least privilege. Combined with audit logs, this gives data platform teams a clear control point for federation.

Grant roles/bigqueryconnection.connectionUser to service account etl@myproj.iam.gserviceaccount.com on connection projects/myproj/locations/US/connections/prod-orders.

Agent-Driven Federation Provisioning

Let an AI agent provision the connections required for a new federated query workload - read the user's request, pick the correct source type, create the connection, and bind the right IAM policy. Jentic exposes the create, get, and setIamPolicy operations so the agent can do the whole flow in one task. Credentials for Google OAuth stay in your Jentic One instance.

Given the request 'connect our analytics warehouse to the orders Cloud SQL replica', create the connection and grant the analytics service account connectionUser role.

Key Endpoints

8 endpoints — the bigquery connection api manages named connection resources that bigquery uses to query external data sources such as cloud sql, spanner, aws, and azure without copying the data.

METHOD

PATH

DESCRIPTION

POST

/v1/{+parent}/connections

Create a connection in a project and location

GET

/v1/{+parent}/connections

List connections under a project and location

GET

/v1/{+name}

Get a single connection by resource name

PATCH

/v1/{+name}

Update an existing connection

DELETE

/v1/{+name}

Delete a connection

POST

/v1/{+resource}:setIamPolicy

Set the IAM policy on a connection

POST

/v1/{+resource}:getIamPolicy

Read the IAM policy on a connection

POST

/v1/{+parent}/connections

Create a connection in a project and location

GET

/v1/{+parent}/connections

List connections under a project and location

GET

/v1/{+name}

Get a single connection by resource name

PATCH

/v1/{+name}

Update an existing connection

DELETE

/v1/{+name}

Delete a connection

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your BigQuery OAuth credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create a BigQuery connection to Cloud SQL', and Jentic returns the matching operation with its input schema, including the cloudSql, aws, and azure variant blocks, so the agent calls the right endpoint without reading the discovery document.

Time to first call

FAQs

Specific to using BigQuery Connection API through Jentic.

What authentication does the BigQuery Connection API use?

The BigQuery Connection API uses Google OAuth 2.0 with the https://www.googleapis.com/auth/bigquery and https://www.googleapis.com/auth/cloud-platform scopes. Through Jentic, the OAuth refresh token sits in the encrypted vault and the agent receives only a short-lived access token.

Can I create a Cloud SQL connection with this API?

Yes. POST /v1/{parent}/connections with cloudSql.instanceId, cloudSql.database, cloudSql.type, and a credential block returns a connection resource that BigQuery can then reference in EXTERNAL_QUERY federated SQL.

What are the rate limits for the BigQuery Connection API?

Quotas are project-level: typically 100 connections per project per location and a small write QPS for create/patch/delete on the same connection. Read calls (GET, list) are bursty up to several hundred QPS per project. Check Google Cloud's quotas page for the current numbers in your project.

How do I bind a service account to a connection through Jentic?

Search Jentic for 'set IAM policy on a BigQuery connection', load the schema for POST /v1/{resource}:setIamPolicy, and execute with a policy that grants roles/bigqueryconnection.connectionUser to the target service account. Jentic injects the OAuth token automatically.

Does this API run queries against the connected source?

No. This API only manages the connection resource; queries that use the connection are executed by the main BigQuery API via EXTERNAL_QUERY or external tables. Use the BigQuery API for query execution.

Can I limit what my agent is allowed to do with the BigQuery Connection API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and this API puts the connection resource name right in the URL path (/v1/{parent}/connections and /v1/{name}), so a rule can pin the agent to a single project or connection. You can allow it to create, list, and read connections there while excluding higher-impact calls like deleting a connection or setting its IAM policy with setIamPolicy, unless you explicitly add them. Your Google OAuth credential is stored on your own instance and injected at execution time, so the agent never sees it directly.

Google BigQuery Connection API

Connect the BigQuery Connection API to your agent

Capabilities

Start building with BigQuery Connection API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs