---
title: "POST /projects/{+projectId}/datasets/{+datasetId}/tables/{+tableId}/rowAccessPolicies"
method: POST
path: "/projects/{+projectId}/datasets/{+datasetId}/tables/{+tableId}/rowAccessPolicies"
tags: ["rowAccessPolicies"]
---

# POST /projects/{+projectId}/datasets/{+datasetId}/tables/{+tableId}/rowAccessPolicies

`POST /projects/{+projectId}/datasets/{+datasetId}/tables/{+tableId}/rowAccessPolicies`

Creates a row access policy. # IAM Permissions Requires the following IAM permission(s) on the table: - `bigquery.rowAccessPolicies.create` - `bigquery.rowAccessPolicies.setIamPolicy` - `bigquery.tables.getData`

## Path parameters

- `projectId` string, required
- `datasetId` string, required
- `tableId` string, required

## Request body

- RowAccessPolicy — Represents access on a subset of rows on the specified table, defined by its filter predicate. Access to the subset of rows is controlled by its IAM policy.
  - `filterPredicate` string — Required. A SQL boolean expression that represents the rows defined by this row access policy, similar to the boolean expression in a WHERE clause of a SELECT query on a table. References to other tables, routines, and temporary functions are not supported. Examples: region="EU" date_field = CAST('2019-9-27' as DATE) nullable_field is not NULL numeric_field BETWEEN 1.0 AND 5.0
  - `grantees` string[] — Optional. Input only. The optional list of iam_member users or groups that specifies the initial members that the row-level access policy should be created with. grantees types: - "user:alice@example.com": An email address that represents a specific Google account. - "serviceAccount:my-other-app@appspot.gserviceaccount.com": An email address that represents a service account. - "group:admins@example.com": An email address that represents a Google group. - "domain:example.com":The Google Workspace domain (primary) that represents all the users of that domain. - "allAuthenticatedUsers": A special identifier that represents all service accounts and all users on the internet who have authenticated with a Google Account. This identifier includes accounts that aren't connected to a Google Workspace or Cloud Identity domain, such as personal Gmail accounts. Users who aren't authenticated, such as anonymous visitors, aren't included. - "allUsers":A special identifier that represents anyone who is on the internet, including authenticated and unauthenticated users. Because BigQuery requires authentication before a user can access the service, allUsers includes only authenticated users.
  - `etag` string — Output only. A hash of this resource.
  - `lastModifiedTime` string, google-datetime — Output only. The time when this row access policy was last modified, in milliseconds since the epoch.
  - `rowAccessPolicyReference` RowAccessPolicyReference — Id path of a row access policy.
    - `datasetId` string — Required. The ID of the dataset containing this row access policy.
    - `policyId` string — Required. The ID of the row access policy. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.
    - `projectId` string — Required. The ID of the project containing this row access policy.
    - `tableId` string — Required. The ID of the table containing this row access policy.
  - `creationTime` string, google-datetime — Output only. The time when this row access policy was created, in milliseconds since the epoch.

## Response `200`

Successful response

---

[API](https://skmtc.dev/google/apis/bigquery.md) · [All operations](https://skmtc.dev/google/apis/bigquery/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/bigquery/revisions/98f33ea9c8c9/schema)