Google BigQuery Data Policy API

Name: BigQuery Data Policy API
Brand: BigQuery Data Policy API
Availability: InStock

✓ Official Vendor SpecSecurityComplianceoauth29 EndpointsREST

For Agents

Manage column-level masking and access policies attached to BigQuery policy tags. Agents can create, rename, and IAM-bind data policies that protect sensitive columns at query time.

Use for: I need to create a data policy that masks customer email columns, List all BigQuery data policies under a project and location, Get the masking rule attached to a specific data policy, Update the masking expression on an existing data policy

Not supported: Does not run queries, manage encryption keys, or transfer data - use for column-level masking policy management only.

The BigQuery Data Policy API manages column-level masking policies that BigQuery enforces at query time. You attach a data policy to a policy tag in Data Catalog, and any column tagged with it is masked, hashed, or nulled out for callers who lack the unmask role. The API exposes create, list, patch, rename, and delete operations on data policies plus IAM policy management on each resource. Together with policy tags, this lets data platform teams enforce GDPR/HIPAA-style column controls without writing per-query views.

Install Jentic One Beta

Connect the BigQuery Data Policy API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the BigQuery Data Policy API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fbigquerydatapolicy" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fbigquerydatapolicy" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with BigQuery Data Policy API.

Create data policies that apply masking rules to columns tagged with a policy tag

List all data policies in a project and location for inventory and audit

Patch a data policy to change its data-masking expression

Rename a data policy resource without re-tagging columns

Delete data policies that are no longer enforced

GET STARTED

Start building with BigQuery Data Policy API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use BigQuery Data Policy API for, with concrete tasks.

★ PII Masking at Query Time

Apply masking policies to columns tagged with sensitivity labels so PII is hashed or nulled for callers without the unmask role. Data policies are managed at /v1/{parent}/dataPolicies and bound via setIamPolicy. This avoids creating per-team views and keeps a single source of truth for the underlying table.

Create a data policy named mask_email_sha256 that applies SHA256 to columns tagged with the pii.email policy tag in project myproj location US.

Tiered Access Across Analyst Groups

Grant the dataPolicies.maskedReader role to broad analyst groups and roles/datacatalog.categoryFineGrainedReader to a small unmask group. Use setIamPolicy on the data policy resource to control which principals see the raw values. The whole tiering can be expressed as a few API calls, avoiding hand-managed BigQuery views.

Bind roles/bigquerydatapolicy.maskedReader to group analysts@example.com on data policy projects/myproj/locations/US/dataPolicies/mask_email_sha256.

Compliance Audit and Inventory

Periodically list all data policies in each project and location and verify that critical policy tags have a policy attached. The list endpoint at /v1/{parent}/dataPolicies returns the policy expression and bound resources, which can be exported into a compliance system.

List all data policies in project myproj location US and return any that have an empty data masking expression.

Agent-Driven Policy Provisioning

An AI agent can take a request like 'mask credit card numbers everywhere they appear' and create the matching data policy via Jentic. The agent loads the create operation, generates the masking expression, and binds the right IAM role to a reviewer group. Sensitive credentials never leave your Jentic One instance.

From the request 'redact CCN columns for everyone except finance', create the data policy and grant unmask role to finance-readers@example.com.

Key Endpoints

9 endpoints — the bigquery data policy api manages column-level masking policies that bigquery enforces at query time.

METHOD

PATH

DESCRIPTION

POST

/v1/{+parent}/dataPolicies

Create a new data policy under a project and location

GET

/v1/{+parent}/dataPolicies

List data policies under a project and location

GET

/v1/{+name}

Get a single data policy

PATCH

/v1/{+name}

Update a data policy's masking expression

POST

/v1/{+name}:rename

Rename a data policy resource

DELETE

/v1/{+name}

Delete a data policy

POST

/v1/{+resource}:setIamPolicy

Set the IAM policy on a data policy

POST

/v1/{+parent}/dataPolicies

Create a new data policy under a project and location

GET

/v1/{+parent}/dataPolicies

List data policies under a project and location

GET

/v1/{+name}

Get a single data policy

PATCH

/v1/{+name}

Update a data policy's masking expression

POST

/v1/{+name}:rename

Rename a data policy resource

DELETE

/v1/{+name}

Delete a data policy

POST

/v1/{+resource}:setIamPolicy

Set the IAM policy on a data policy

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the BigQuery Data Policy API by hand means setting up Google OAuth2, scoping a service account for policy management, and minting short-lived access tokens for each masking policy call yourself. Through Jentic you install once, import the BigQuery Data Policy API from the API Directory, store the OAuth credential once, and your agent calls it.

Permission scoping

This API puts the data policy resource name in the URL path (/v1/{parent}/dataPolicies, /v1/{name}), so a rule can pin your agent to one project or policy: it can create, list, and read data policies there and nothing else. You choose the operations it may call, so actions like deleting a policy or setting its IAM policy are not included unless you add them.

Credential isolation

Your BigQuery OAuth credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'mask a BigQuery column', and Jentic returns the create dataPolicy operation with its dataMaskingPolicy schema so the agent calls the right endpoint without reading the discovery document.

FAQs

Specific to using BigQuery Data Policy API through Jentic.

What authentication does the BigQuery Data Policy API use?

The BigQuery Data Policy API uses Google OAuth 2.0 with the cloud-platform and bigquery scopes. Jentic stores the OAuth refresh token encrypted and provides the agent only a scoped access token at execution time.

Can I attach a masking expression to a Data Catalog policy tag?

Yes. Create the data policy via POST /v1/{parent}/dataPolicies with a policyTag field referencing the Data Catalog tag and a dataMaskingPolicy expression (for example SHA256, DEFAULT_MASKING_VALUE, or a custom UDF). BigQuery enforces it on every query.

What are the rate limits for the BigQuery Data Policy API?

Project-level quotas apply: typically a small write QPS for create/patch/rename/delete on the same data policy and a few hundred QPS for reads. Specific per-project values are visible in the Google Cloud quotas console.

How do I rename a data policy through Jentic?

Search Jentic for 'rename a BigQuery data policy', load the schema for POST /v1/{name}:rename, and execute with the new newDataPolicyId. Jentic forwards the OAuth token; the policyTag binding stays intact.

Does this API mask data in tables that have no policy tag?

No. Data policies only take effect on columns whose schema includes a policyTag that this policy is attached to. Untagged columns are returned in cleartext regardless of how many data policies exist.

Can I limit what my agent is allowed to do with the BigQuery Data Policy API?

Yes. Because your Jentic One instance is self-hosted, your own rules decide which operations and credentials the agent may use. Since this API puts the data policy resource name in the URL path (/v1/{parent}/dataPolicies and /v1/{name}), you can pin the agent to a single project or policy and let it only create, list, and read data policies there. Destructive or access-granting calls like deleting a policy or running setIamPolicy stay off limits unless you explicitly add them.

Google BigQuery Data Policy API

Connect the BigQuery Data Policy API to your agent

Capabilities

Start building with BigQuery Data Policy API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs