--- title: "PATCH /v1/projects/{projectsId}/locations/{locationsId}/connections/{connectionsId}" method: PATCH path: "/v1/projects/{projectsId}/locations/{locationsId}/connections/{connectionsId}" tags: ["projects"] --- # PATCH /v1/projects/{projectsId}/locations/{locationsId}/connections/{connectionsId} `PATCH /v1/projects/{projectsId}/locations/{locationsId}/connections/{connectionsId}` ## Request - Base URL: `https://bigqueryconnection.googleapis.com` - URL: `https://bigqueryconnection.googleapis.com/v1/projects/{projectsId}/locations/{locationsId}/connections/{connectionsId}` - Auth: one of: - OAuth 2 and OAuth 2 - Implicit: `https://accounts.google.com/o/oauth2/auth` - Scopes: `https://www.googleapis.com/auth/bigquery` - Authorization code: `https://accounts.google.com/o/oauth2/auth` - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/bigquery` - OAuth 2 and OAuth 2 - Implicit: `https://accounts.google.com/o/oauth2/auth` - Scopes: `https://www.googleapis.com/auth/cloud-platform` - Authorization code: `https://accounts.google.com/o/oauth2/auth` - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform` Updates the specified connection. For security reasons, also resets credential if connection properties are in the update field mask. ## Path parameters - `projectsId` string, required - `locationsId` string, required - `connectionsId` string, required ## Query parameters - `updateMask` string, google-fieldmask ## Request body - Connection: Configuration parameters to establish connection with an external data source, except the credential attributes. - `aws` AwsProperties: Connection properties specific to Amazon Web Services (AWS). - `accessRole` AwsAccessRole: Authentication method for Amazon Web Services (AWS) that uses Google owned Google service account to assume into customer's AWS IAM Role. - `iamRoleId` string: The user’s AWS IAM Role that trusts the Google-owned AWS IAM user Connection. - `identity` string: A unique Google-owned and Google-generated identity for the Connection. This identity will be used to access the user's AWS IAM Role. - `serviceAccountId` string: Output only. The email address of the Google-owned service account that represents the connection's identity. Grant IAM roles to this service account, for example, to let the connection resolve the Service Directory service in `AwsProperties.service_directory_service`. - `crossCloudCacheOptions` CrossCloudCacheOptions: Options for caching cross-cloud data and metadata files. - `enabled` boolean: Optional. Whether cross-cloud caching is enabled. This only affects queries through BigQuery. If this value is `true`, read data and metadata are stored in a cache, which can increase performance and decrease network egress costs for cross-cloud queries. If this value is `false`, cross-cloud caching is disabled. - `serviceDirectoryService` string: Optional. The Service Directory resource name for routing traffic to AWS over a private network connection through Cross-Cloud Interconnect, in the format `projects/{project_id}/locations/{location}/namespaces/{namespace_id}/services/{service_id}`. If both this field and `s3_service_directory_service` are set, this field takes precedence. - `azure` AzureProperties: Container for connection properties specific to Azure. - `application` string: Output only. The name of the Azure Active Directory Application. - `clientId` string: Output only. The client id of the Azure Active Directory Application. - `crossCloudCacheOptions` CrossCloudCacheOptions: Options for caching cross-cloud data and metadata files. - `enabled` boolean: Optional. Whether cross-cloud caching is enabled. This only affects queries through BigQuery. If this value is `true`, read data and metadata are stored in a cache, which can increase performance and decrease network egress costs for cross-cloud queries. If this value is `false`, cross-cloud caching is disabled. - `customerTenantId` string: The id of customer's directory that host the data. - `federatedApplicationClientId` string: The client ID of the user's Azure Active Directory Application used for a federated connection. - `identity` string: Output only. A unique Google-owned and Google-generated identity for the Connection. This identity will be used to access the user's Azure Active Directory Application. - `objectId` string: Output only. The object id of the Azure Active Directory Application. - `redirectUri` string: The URL user will be redirected to after granting consent during connection setup. - `serviceAccountId` string: Output only. The email address of the Google-owned service account that represents the connection's identity. Grant IAM roles to this service account, for example, to let the connection resolve the Service Directory service in `AzureProperties.service_directory_service`. - `serviceDirectoryService` string: Optional. The service directory resource name for routing traffic over a private network connection through Cross-Cloud Interconnect, in the format `projects/{project_id}/locations/{location}/namespaces/{namespace_id}/services/{service_id}`. - `cloudResource` CloudResourceProperties: Container for connection properties for delegation of access to GCP resources. - `serviceAccountId` string: Output only. The account ID of the service created for the purpose of this connection. The service account does not have any permissions associated with it when it is created. After creation, customers delegate permissions to the service account. When the connection is used in the context of an operation in BigQuery, the service account will be used to connect to the desired resources in GCP. The account ID is in the form of: @gcp-sa-bigquery-cloudresource.iam.gserviceaccount.com - `cloudSpanner` CloudSpannerProperties: Connection properties specific to Cloud Spanner. - `database` string: Cloud Spanner database in the form `project/instance/database' - `databaseRole` string: Optional. Cloud Spanner database role for fine-grained access control. The Cloud Spanner admin should have provisioned the database role with appropriate permissions, such as `SELECT` and `INSERT`. Other users should only use roles provided by their Cloud Spanner admins. For more details, see [About fine-grained access control] (https://cloud.google.com/spanner/docs/fgac-about). REQUIRES: The database role name must start with a letter, and can only contain letters, numbers, and underscores. - `maxParallelism` integer: Allows setting max parallelism per query when executing on Spanner independent compute resources. If unspecified, default values of parallelism are chosen that are dependent on the Cloud Spanner instance configuration. REQUIRES: `use_parallelism` must be set. REQUIRES: `use_data_boost` must be set. - `useDataBoost` boolean: If set, the request will be executed via Spanner independent compute resources. REQUIRES: `use_parallelism` must be set. - `useParallelism` boolean: If parallelism should be used when reading from Cloud Spanner - `useServerlessAnalytics` boolean: Deprecated: prefer use_data_boost instead. If the serverless analytics service should be used to read data from Cloud Spanner. Note: `use_parallelism` must be set when using serverless analytics. - `cloudSql` CloudSqlProperties: Connection properties specific to the Cloud SQL. - `credential` CloudSqlCredential: Credential info for the Cloud SQL. - `password` string: The password for the credential. - `username` string: The username for the credential. - `database` string: Database name. - `instanceId` string: Cloud SQL instance ID in the form `project:location:instance`. - `serviceAccountId` string: Output only. The account ID of the service used for the purpose of this connection. When the connection is used in the context of an operation in BigQuery, this service account will serve as the identity being used for connecting to the CloudSQL instance specified in this connection. - `type` 'DATABASE_TYPE_UNSPECIFIED' | 'POSTGRES' | 'MYSQL': Type of the Cloud SQL database. - `configuration` ConnectorConfiguration: Represents concrete parameter values for Connector Configuration. - `asset` ConnectorConfigurationAsset: Data Asset - a resource within instance of the system, reachable under specified endpoint. For example a database name in a SQL DB. - `database` string: Name of the database. - `googleCloudResource` string: Full Google Cloud resource name - https://cloud.google.com/apis/design/resource_names#full_resource_name. Example: `//library.googleapis.com/shelves/shelf1/books/book2` - `authentication` ConnectorConfigurationAuthentication: Client authentication. - `parameters` object: Optional. A map of name-value pairs for connector-specific parameters. These extra configuration parameters aren't standardized in the configuration sections. To update a single parameter value, call ConnectionService.UpdateConnection with `update_mask` set to `configuration.parameters.parameter_id`. If ``parameter_id`` doesn't fit the `[a-zA-Z0-9_]+` pattern, ``parameter_id`` should be escaped with backticks—for example, ``configuration.parameters.`parameter id` ``. - `serviceAccount` string: Output only. Google-managed service account associated with this connection, e.g., `service-{project_number}@gcp-sa-bigqueryconnection.iam.gserviceaccount.com`. BigQuery jobs using this connection will act as `service_account` identity while connecting to the datasource. - `usernamePassword` ConnectorConfigurationUsernamePassword: Username and Password authentication. - `password` ConnectorConfigurationSecret: Secret value parameter. - `plaintext` string: Input only. Secret as plaintext. - `secretType` 'SECRET_TYPE_UNSPECIFIED' | 'PLAINTEXT': Output only. Indicates type of secret. Can be used to check type of stored secret value even if it's `INPUT_ONLY`. - `username` string: Required. Username. - `connectorId` string: Required. Immutable. The ID of the Connector these parameters are configured for. - `endpoint` ConnectorConfigurationEndpoint: Remote endpoint specification. - `hostPort` string: Host and port in a format of `hostname:port` as defined in https://www.ietf.org/rfc/rfc3986.html#section-3.2.2 and https://www.ietf.org/rfc/rfc3986.html#section-3.2.3. - `network` ConnectorConfigurationNetwork: Network related configuration. - `privateServiceConnect` ConnectorConfigurationPrivateServiceConnect: Private Service Connect configuration. - `networkAttachment` string: Required. Network Attachment name in the format of `projects/{project}/regions/{region}/networkAttachments/{networkattachment}`. - `parameters` object: Optional. A map of name-value pairs for connector-specific parameters. These extra configuration parameters aren't standardized in the configuration sections. To update a single parameter value, call ConnectionService.UpdateConnection with `update_mask` set to `configuration.parameters.parameter_id`. If ``parameter_id`` doesn't fit the `[a-zA-Z0-9_]+` pattern, ``parameter_id`` should be escaped with backticks—for example, ``configuration.parameters.`parameter id` ``. - `tls` ConnectorConfigurationTls: TLS configuration options. - `mode` 'MODE_UNSPECIFIED' | 'DISABLE' | 'ENCRYPT_VERIFY_NONE' | 'ENCRYPT_VERIFY_CA' | 'ENCRYPT_VERIFY_CA_AND_HOST': Optional. The mode of TLS configuration. - `privatePki` ConnectorConfigurationTlsPrivatePki: Private PKI. - `trustedCertificatesPem` string: Optional. a PEM-encoded list of certificates to trust - `webPki` ConnectorConfigurationTlsWebPki: Web PKI. - `creationTime` string, int64: Output only. The creation timestamp of the connection. - `description` string: User provided description. - `friendlyName` string: User provided display name for the connection. - `hasCredential` boolean: Output only. True, if credential is configured for this connection. - `kmsKeyName` string: Optional. The Cloud KMS key that is used for credentials encryption. If omitted, internal Google owned encryption keys are used. Example: `projects/[kms_project_id]/locations/[region]/keyRings/[key_region]/cryptoKeys/[key]` - `lastModifiedTime` string, int64: Output only. The last update timestamp of the connection. - `name` string: Output only. The resource name of the connection in the form of: `projects/{project_id}/locations/{location_id}/connections/{connection_id}` - `salesforceDataCloud` SalesforceDataCloudProperties: Connection properties specific to Salesforce DataCloud. This is intended for use only by Salesforce partner projects. - `crossCloudCacheOptions` CrossCloudCacheOptions: Options for caching cross-cloud data and metadata files. - `enabled` boolean: Optional. Whether cross-cloud caching is enabled. This only affects queries through BigQuery. If this value is `true`, read data and metadata are stored in a cache, which can increase performance and decrease network egress costs for cross-cloud queries. If this value is `false`, cross-cloud caching is disabled. - `identity` string: Output only. A unique Google-owned and Google-generated service account identity for the connection. - `instanceUri` string: The URL to the user's Salesforce DataCloud instance. - `tenantId` string: The ID of the user's Salesforce tenant. - `spark` SparkProperties: Container for connection properties to execute stored procedures for Apache Spark. - `metastoreServiceConfig` MetastoreServiceConfig: Configuration of the Dataproc Metastore Service. - `metastoreService` string: Optional. Resource name of an existing Dataproc Metastore service. Example: * `projects/[project_id]/locations/[region]/services/[service_id]` - `serviceAccountId` string: Output only. The account ID of the service created for the purpose of this connection. The service account does not have any permissions associated with it when it is created. After creation, customers delegate permissions to the service account. When the connection is used in the context of a stored procedure for Apache Spark in BigQuery, the service account is used to connect to the desired resources in Google Cloud. The account ID is in the form of: bqcx--@gcp-sa-bigquery-consp.iam.gserviceaccount.com - `sparkHistoryServerConfig` SparkHistoryServerConfig: Configuration of the Spark History Server. - `dataprocCluster` string: Optional. Resource name of an existing Dataproc Cluster to act as a Spark History Server for the connection. Example: * `projects/[project_id]/regions/[region]/clusters/[cluster_name]` ## Response `200` Successful response - Connection: Configuration parameters to establish connection with an external data source, except the credential attributes. - `aws` AwsProperties: Connection properties specific to Amazon Web Services (AWS). - `accessRole` AwsAccessRole: Authentication method for Amazon Web Services (AWS) that uses Google owned Google service account to assume into customer's AWS IAM Role. - `iamRoleId` string: The user’s AWS IAM Role that trusts the Google-owned AWS IAM user Connection. - `identity` string: A unique Google-owned and Google-generated identity for the Connection. This identity will be used to access the user's AWS IAM Role. - `serviceAccountId` string: Output only. The email address of the Google-owned service account that represents the connection's identity. Grant IAM roles to this service account, for example, to let the connection resolve the Service Directory service in `AwsProperties.service_directory_service`. - `crossCloudCacheOptions` CrossCloudCacheOptions: Options for caching cross-cloud data and metadata files. - `enabled` boolean: Optional. Whether cross-cloud caching is enabled. This only affects queries through BigQuery. If this value is `true`, read data and metadata are stored in a cache, which can increase performance and decrease network egress costs for cross-cloud queries. If this value is `false`, cross-cloud caching is disabled. - `serviceDirectoryService` string: Optional. The Service Directory resource name for routing traffic to AWS over a private network connection through Cross-Cloud Interconnect, in the format `projects/{project_id}/locations/{location}/namespaces/{namespace_id}/services/{service_id}`. If both this field and `s3_service_directory_service` are set, this field takes precedence. - `azure` AzureProperties: Container for connection properties specific to Azure. - `application` string: Output only. The name of the Azure Active Directory Application. - `clientId` string: Output only. The client id of the Azure Active Directory Application. - `crossCloudCacheOptions` CrossCloudCacheOptions: Options for caching cross-cloud data and metadata files. - `enabled` boolean: Optional. Whether cross-cloud caching is enabled. This only affects queries through BigQuery. If this value is `true`, read data and metadata are stored in a cache, which can increase performance and decrease network egress costs for cross-cloud queries. If this value is `false`, cross-cloud caching is disabled. - `customerTenantId` string: The id of customer's directory that host the data. - `federatedApplicationClientId` string: The client ID of the user's Azure Active Directory Application used for a federated connection. - `identity` string: Output only. A unique Google-owned and Google-generated identity for the Connection. This identity will be used to access the user's Azure Active Directory Application. - `objectId` string: Output only. The object id of the Azure Active Directory Application. - `redirectUri` string: The URL user will be redirected to after granting consent during connection setup. - `serviceAccountId` string: Output only. The email address of the Google-owned service account that represents the connection's identity. Grant IAM roles to this service account, for example, to let the connection resolve the Service Directory service in `AzureProperties.service_directory_service`. - `serviceDirectoryService` string: Optional. The service directory resource name for routing traffic over a private network connection through Cross-Cloud Interconnect, in the format `projects/{project_id}/locations/{location}/namespaces/{namespace_id}/services/{service_id}`. - `cloudResource` CloudResourceProperties: Container for connection properties for delegation of access to GCP resources. - `serviceAccountId` string: Output only. The account ID of the service created for the purpose of this connection. The service account does not have any permissions associated with it when it is created. After creation, customers delegate permissions to the service account. When the connection is used in the context of an operation in BigQuery, the service account will be used to connect to the desired resources in GCP. The account ID is in the form of: @gcp-sa-bigquery-cloudresource.iam.gserviceaccount.com - `cloudSpanner` CloudSpannerProperties: Connection properties specific to Cloud Spanner. - `database` string: Cloud Spanner database in the form `project/instance/database' - `databaseRole` string: Optional. Cloud Spanner database role for fine-grained access control. The Cloud Spanner admin should have provisioned the database role with appropriate permissions, such as `SELECT` and `INSERT`. Other users should only use roles provided by their Cloud Spanner admins. For more details, see [About fine-grained access control] (https://cloud.google.com/spanner/docs/fgac-about). REQUIRES: The database role name must start with a letter, and can only contain letters, numbers, and underscores. - `maxParallelism` integer: Allows setting max parallelism per query when executing on Spanner independent compute resources. If unspecified, default values of parallelism are chosen that are dependent on the Cloud Spanner instance configuration. REQUIRES: `use_parallelism` must be set. REQUIRES: `use_data_boost` must be set. - `useDataBoost` boolean: If set, the request will be executed via Spanner independent compute resources. REQUIRES: `use_parallelism` must be set. - `useParallelism` boolean: If parallelism should be used when reading from Cloud Spanner - `useServerlessAnalytics` boolean: Deprecated: prefer use_data_boost instead. If the serverless analytics service should be used to read data from Cloud Spanner. Note: `use_parallelism` must be set when using serverless analytics. - `cloudSql` CloudSqlProperties: Connection properties specific to the Cloud SQL. - `credential` CloudSqlCredential: Credential info for the Cloud SQL. - `password` string: The password for the credential. - `username` string: The username for the credential. - `database` string: Database name. - `instanceId` string: Cloud SQL instance ID in the form `project:location:instance`. - `serviceAccountId` string: Output only. The account ID of the service used for the purpose of this connection. When the connection is used in the context of an operation in BigQuery, this service account will serve as the identity being used for connecting to the CloudSQL instance specified in this connection. - `type` 'DATABASE_TYPE_UNSPECIFIED' | 'POSTGRES' | 'MYSQL': Type of the Cloud SQL database. - `configuration` ConnectorConfiguration: Represents concrete parameter values for Connector Configuration. - `asset` ConnectorConfigurationAsset: Data Asset - a resource within instance of the system, reachable under specified endpoint. For example a database name in a SQL DB. - `database` string: Name of the database. - `googleCloudResource` string: Full Google Cloud resource name - https://cloud.google.com/apis/design/resource_names#full_resource_name. Example: `//library.googleapis.com/shelves/shelf1/books/book2` - `authentication` ConnectorConfigurationAuthentication: Client authentication. - `parameters` object: Optional. A map of name-value pairs for connector-specific parameters. These extra configuration parameters aren't standardized in the configuration sections. To update a single parameter value, call ConnectionService.UpdateConnection with `update_mask` set to `configuration.parameters.parameter_id`. If ``parameter_id`` doesn't fit the `[a-zA-Z0-9_]+` pattern, ``parameter_id`` should be escaped with backticks—for example, ``configuration.parameters.`parameter id` ``. - `serviceAccount` string: Output only. Google-managed service account associated with this connection, e.g., `service-{project_number}@gcp-sa-bigqueryconnection.iam.gserviceaccount.com`. BigQuery jobs using this connection will act as `service_account` identity while connecting to the datasource. - `usernamePassword` ConnectorConfigurationUsernamePassword: Username and Password authentication. - `password` ConnectorConfigurationSecret: Secret value parameter. - `plaintext` string: Input only. Secret as plaintext. - `secretType` 'SECRET_TYPE_UNSPECIFIED' | 'PLAINTEXT': Output only. Indicates type of secret. Can be used to check type of stored secret value even if it's `INPUT_ONLY`. - `username` string: Required. Username. - `connectorId` string: Required. Immutable. The ID of the Connector these parameters are configured for. - `endpoint` ConnectorConfigurationEndpoint: Remote endpoint specification. - `hostPort` string: Host and port in a format of `hostname:port` as defined in https://www.ietf.org/rfc/rfc3986.html#section-3.2.2 and https://www.ietf.org/rfc/rfc3986.html#section-3.2.3. - `network` ConnectorConfigurationNetwork: Network related configuration. - `privateServiceConnect` ConnectorConfigurationPrivateServiceConnect: Private Service Connect configuration. - `networkAttachment` string: Required. Network Attachment name in the format of `projects/{project}/regions/{region}/networkAttachments/{networkattachment}`. - `parameters` object: Optional. A map of name-value pairs for connector-specific parameters. These extra configuration parameters aren't standardized in the configuration sections. To update a single parameter value, call ConnectionService.UpdateConnection with `update_mask` set to `configuration.parameters.parameter_id`. If ``parameter_id`` doesn't fit the `[a-zA-Z0-9_]+` pattern, ``parameter_id`` should be escaped with backticks—for example, ``configuration.parameters.`parameter id` ``. - `tls` ConnectorConfigurationTls: TLS configuration options. - `mode` 'MODE_UNSPECIFIED' | 'DISABLE' | 'ENCRYPT_VERIFY_NONE' | 'ENCRYPT_VERIFY_CA' | 'ENCRYPT_VERIFY_CA_AND_HOST': Optional. The mode of TLS configuration. - `privatePki` ConnectorConfigurationTlsPrivatePki: Private PKI. - `trustedCertificatesPem` string: Optional. a PEM-encoded list of certificates to trust - `webPki` ConnectorConfigurationTlsWebPki: Web PKI. - `creationTime` string, int64: Output only. The creation timestamp of the connection. - `description` string: User provided description. - `friendlyName` string: User provided display name for the connection. - `hasCredential` boolean: Output only. True, if credential is configured for this connection. - `kmsKeyName` string: Optional. The Cloud KMS key that is used for credentials encryption. If omitted, internal Google owned encryption keys are used. Example: `projects/[kms_project_id]/locations/[region]/keyRings/[key_region]/cryptoKeys/[key]` - `lastModifiedTime` string, int64: Output only. The last update timestamp of the connection. - `name` string: Output only. The resource name of the connection in the form of: `projects/{project_id}/locations/{location_id}/connections/{connection_id}` - `salesforceDataCloud` SalesforceDataCloudProperties: Connection properties specific to Salesforce DataCloud. This is intended for use only by Salesforce partner projects. - `crossCloudCacheOptions` CrossCloudCacheOptions: Options for caching cross-cloud data and metadata files. - `enabled` boolean: Optional. Whether cross-cloud caching is enabled. This only affects queries through BigQuery. If this value is `true`, read data and metadata are stored in a cache, which can increase performance and decrease network egress costs for cross-cloud queries. If this value is `false`, cross-cloud caching is disabled. - `identity` string: Output only. A unique Google-owned and Google-generated service account identity for the connection. - `instanceUri` string: The URL to the user's Salesforce DataCloud instance. - `tenantId` string: The ID of the user's Salesforce tenant. - `spark` SparkProperties: Container for connection properties to execute stored procedures for Apache Spark. - `metastoreServiceConfig` MetastoreServiceConfig: Configuration of the Dataproc Metastore Service. - `metastoreService` string: Optional. Resource name of an existing Dataproc Metastore service. Example: * `projects/[project_id]/locations/[region]/services/[service_id]` - `serviceAccountId` string: Output only. The account ID of the service created for the purpose of this connection. The service account does not have any permissions associated with it when it is created. After creation, customers delegate permissions to the service account. When the connection is used in the context of a stored procedure for Apache Spark in BigQuery, the service account is used to connect to the desired resources in Google Cloud. The account ID is in the form of: bqcx--@gcp-sa-bigquery-consp.iam.gserviceaccount.com - `sparkHistoryServerConfig` SparkHistoryServerConfig: Configuration of the Spark History Server. - `dataprocCluster` string: Optional. Resource name of an existing Dataproc Cluster to act as a Spark History Server for the connection. Example: * `projects/[project_id]/regions/[region]/clusters/[cluster_name]` ## Changes - **2026-11-05** `9e0c9a96b159`: 4 info - the security scope `https://www.googleapis.com/auth/bigquery` was added to the endpoint's security scheme `Oauth2` - the security scope `https://www.googleapis.com/auth/bigquery` was added to the endpoint's security scheme `Oauth2c` - the security scope `https://www.googleapis.com/auth/cloud-platform` was removed from the endpoint's security scheme `Oauth2` - the security scope `https://www.googleapis.com/auth/cloud-platform` was removed from the endpoint's security scheme `Oauth2c` [Operation history](https://skmtc.dev/google/apis/bigqueryconnection/changes/v1/projects/:projectsId/locations/:locationsId/connections/:connectionsId/patch.md) --- [API](https://skmtc.dev/google/apis/bigqueryconnection.md) - [All operations](https://skmtc.dev/google/apis/bigqueryconnection/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/bigqueryconnection/revisions/9e0c9a96b159?raw)