rowAccessPolicies

POST /projects/{projectsId}/datasets/{datasetsId}/tables/{tablesId}/rowAccessPolicies

Changed on Nov 5, 2026

Creates a row access policy. # IAM Permissions Requires the following IAM permission(s) on the table: - bigquery.rowAccessPolicies.create - bigquery.rowAccessPolicies.setIamPolicy - bigquery.tables.getData

Request

Base URL
https://bigquery.googleapis.com/bigquery/v2
Auth
- OAuth 2 and OAuth 2
  Implicit: https://accounts.google.com/o/oauth2/auth
  Scopes: https://www.googleapis.com/auth/bigquery
  Authorization code: https://accounts.google.com/o/oauth2/auth
  Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/bigquery
- or OAuth 2 and OAuth 2
  Implicit: https://accounts.google.com/o/oauth2/auth
  Scopes: https://www.googleapis.com/auth/cloud-platform
  Authorization code: https://accounts.google.com/o/oauth2/auth
  Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/cloud-platform

Path parameters

projectsIdstring required

datasetsIdstring required

tablesIdstring required

Request body

creationTimestring google-datetime

Output only. The time when this row access policy was created, in milliseconds since the epoch.

etagstring

Output only. A hash of this resource.

filterPredicatestring

Required. A SQL boolean expression that represents the rows defined by this row access policy, similar to the boolean expression in a WHERE clause of a SELECT query on a table. References to other tables, routines, and temporary functions are not supported. Examples: region="EU" date_field = CAST('2019-9-27' as DATE) nullable_field is not NULL numeric_field BETWEEN 1.0 AND 5.0

granteesstring[]

Optional. Input only. The optional list of iam_member users or groups that specifies the initial members that the row-level access policy should be created with. grantees types: - "user:alice@example.com": An email address that represents a specific Google account. - "serviceAccount:my-other-app@appspot.gserviceaccount.com": An email address that represents a service account. - "group:admins@example.com": An email address that represents a Google group. - "domain:example.com":The Google Workspace domain (primary) that represents all the users of that domain. - "allAuthenticatedUsers": A special identifier that represents all service accounts and all users on the internet who have authenticated with a Google Account. This identifier includes accounts that aren't connected to a Google Workspace or Cloud Identity domain, such as personal Gmail accounts. Users who aren't authenticated, such as anonymous visitors, aren't included. - "allUsers":A special identifier that represents anyone who is on the internet, including authenticated and unauthenticated users. Because BigQuery requires authentication before a user can access the service, allUsers includes only authenticated users.

lastModifiedTimestring google-datetime

Output only. The time when this row access policy was last modified, in milliseconds since the epoch.

Response

Successful response