GET /projects/{projectId}/datasets/{datasetId}/tables
🟢 low
— no
Run a SQL query (jobs.query). SQL is arbitrary — typically SELECT analytics, but BigQuery SQL can also mutate (DML/DDL), so this is approval-gated. (docs)
POST /projects/{projectId}/queries
🔴 high
✅ yes
Fetch the results of a previously started query job by jobId. (docs)
GET /projects/{projectId}/queries/{jobId}
🟢 low
— no
What the agent can do
None.
Connecting it
You provide: Google OAuth (BigQuery) + GCP Project ID
Where to get it: Google Cloud Console → enable the BigQuery API → OAuth consent screen → Credentials → Create OAuth client ID. The connecting Google identity needs BigQuery Data Viewer (read datasets/tables) + BigQuery Job User (run queries) on the project. Supply the GCP Project ID that queries should bill/scope to.
Account needed: A Google Cloud project with the BigQuery API enabled AND billing enabled — query bytes are billed against this project, so a project without an active billing account cannot run jobs.query.
App registration: Create an OAuth client ID (Web application); configure the consent screen with the BigQuery scope, authorized domains, and redirect URIs.
Verification required: The BigQuery scope is SENSITIVE: production use requires Google OAuth app verification (brand verification + consent-screen review). No annual CASA assessment is required for BigQuery.
Testing: BigQuery sandbox (no billing) allows querying but caps storage/retention and blocks some operations; unverified 'Testing' OAuth apps are limited to 100 test users with 7-day refresh-token expiry.
Limits
jobs.query: up to 1,000 concurrent interactive queries per project; API request quota of ~100 req/s per user (HTTP 429/403 rateLimitExceeded on exceed). Datasets/tables list calls page via pageToken (default ~50 rows).