---
title: "PUT /projects/{projectsId}/datasets/{datasetsId}/tables/{tablesId}/rowAccessPolicies/{rowAccessPoliciesId}"
method: PUT
path: "/projects/{projectsId}/datasets/{datasetsId}/tables/{tablesId}/rowAccessPolicies/{rowAccessPoliciesId}"
tags: ["rowAccessPolicies"]
---

# PUT /projects/{projectsId}/datasets/{datasetsId}/tables/{tablesId}/rowAccessPolicies/{rowAccessPoliciesId}

`PUT /projects/{projectsId}/datasets/{datasetsId}/tables/{tablesId}/rowAccessPolicies/{rowAccessPoliciesId}`

## Request

- Base URL: `https://bigquery.googleapis.com/bigquery/v2`
- URL: `https://bigquery.googleapis.com/bigquery/v2/projects/{projectsId}/datasets/{datasetsId}/tables/{tablesId}/rowAccessPolicies/{rowAccessPoliciesId}`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/bigquery`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/bigquery`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`

Updates a row access policy. # IAM Permissions Requires the following IAM permission(s) on the table: - `bigquery.rowAccessPolicies.update` - `bigquery.rowAccessPolicies.setIamPolicy` - `bigquery.tables.getData`

## Path parameters

- `projectsId` string, required
- `datasetsId` string, required
- `tablesId` string, required
- `rowAccessPoliciesId` string, required

## Request body

- RowAccessPolicy: Represents access on a subset of rows on the specified table, defined by its filter predicate. Access to the subset of rows is controlled by its IAM policy.
  - `creationTime` string, google-datetime: Output only. The time when this row access policy was created, in milliseconds since the epoch.
  - `etag` string: Output only. A hash of this resource.
  - `filterPredicate` string: Required. A SQL boolean expression that represents the rows defined by this row access policy, similar to the boolean expression in a WHERE clause of a SELECT query on a table. References to other tables, routines, and temporary functions are not supported. Examples: region="EU" date_field = CAST('2019-9-27' as DATE) nullable_field is not NULL numeric_field BETWEEN 1.0 AND 5.0
  - `grantees` string[]: Optional. Input only. The optional list of iam_member users or groups that specifies the initial members that the row-level access policy should be created with. grantees types: - "user:alice@example.com": An email address that represents a specific Google account. - "serviceAccount:my-other-app@appspot.gserviceaccount.com": An email address that represents a service account. - "group:admins@example.com": An email address that represents a Google group. - "domain:example.com":The Google Workspace domain (primary) that represents all the users of that domain. - "allAuthenticatedUsers": A special identifier that represents all service accounts and all users on the internet who have authenticated with a Google Account. This identifier includes accounts that aren't connected to a Google Workspace or Cloud Identity domain, such as personal Gmail accounts. Users who aren't authenticated, such as anonymous visitors, aren't included. - "allUsers":A special identifier that represents anyone who is on the internet, including authenticated and unauthenticated users. Because BigQuery requires authentication before a user can access the service, allUsers includes only authenticated users.
  - `lastModifiedTime` string, google-datetime: Output only. The time when this row access policy was last modified, in milliseconds since the epoch.
  - `rowAccessPolicyReference` RowAccessPolicyReference: Id path of a row access policy.
    - `datasetId` string: Required. The ID of the dataset containing this row access policy.
    - `policyId` string: Required. The ID of the row access policy. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.
    - `projectId` string: Required. The ID of the project containing this row access policy.
    - `tableId` string: Required. The ID of the table containing this row access policy.

## Response `200`

Successful response

- RowAccessPolicy: Represents access on a subset of rows on the specified table, defined by its filter predicate. Access to the subset of rows is controlled by its IAM policy.
  - `creationTime` string, google-datetime: Output only. The time when this row access policy was created, in milliseconds since the epoch.
  - `etag` string: Output only. A hash of this resource.
  - `filterPredicate` string: Required. A SQL boolean expression that represents the rows defined by this row access policy, similar to the boolean expression in a WHERE clause of a SELECT query on a table. References to other tables, routines, and temporary functions are not supported. Examples: region="EU" date_field = CAST('2019-9-27' as DATE) nullable_field is not NULL numeric_field BETWEEN 1.0 AND 5.0
  - `grantees` string[]: Optional. Input only. The optional list of iam_member users or groups that specifies the initial members that the row-level access policy should be created with. grantees types: - "user:alice@example.com": An email address that represents a specific Google account. - "serviceAccount:my-other-app@appspot.gserviceaccount.com": An email address that represents a service account. - "group:admins@example.com": An email address that represents a Google group. - "domain:example.com":The Google Workspace domain (primary) that represents all the users of that domain. - "allAuthenticatedUsers": A special identifier that represents all service accounts and all users on the internet who have authenticated with a Google Account. This identifier includes accounts that aren't connected to a Google Workspace or Cloud Identity domain, such as personal Gmail accounts. Users who aren't authenticated, such as anonymous visitors, aren't included. - "allUsers":A special identifier that represents anyone who is on the internet, including authenticated and unauthenticated users. Because BigQuery requires authentication before a user can access the service, allUsers includes only authenticated users.
  - `lastModifiedTime` string, google-datetime: Output only. The time when this row access policy was last modified, in milliseconds since the epoch.
  - `rowAccessPolicyReference` RowAccessPolicyReference: Id path of a row access policy.
    - `datasetId` string: Required. The ID of the dataset containing this row access policy.
    - `policyId` string: Required. The ID of the row access policy. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.
    - `projectId` string: Required. The ID of the project containing this row access policy.
    - `tableId` string: Required. The ID of the table containing this row access policy.

## Changes

- **2026-11-05** `33188b5cf151`: 4 info
  - the security scope `https://www.googleapis.com/auth/bigquery` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/bigquery` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was removed from the endpoint's security scheme `Oauth2c`
- **2026-10-29** `1c22958240fa`: 4 info
  - the security scope `https://www.googleapis.com/auth/bigquery` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/bigquery` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/bigquery/changes/projects/:projectsId/datasets/:datasetsId/tables/:tablesId/rowAccessPolicies/:rowAccessPoliciesId/put.md)

---

[API](https://skmtc.dev/google/apis/bigquery.md) - [All operations](https://skmtc.dev/google/apis/bigquery/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/bigquery/revisions/33188b5cf151?raw)