We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

ProvideBigQueryAccess APIs request and response mapping

Supported in:

Google secops SIEM

This guide details the request and response mapping specifications and property parity analysis for migrating from the Legacy Backstory API (UpdateBigQueryAccess) to the modern Chronicle API (ProvideBigQueryAccess).

Protocol and mapping overview

Feature	Legacy API (`UpdateBigQueryAccess`)	Modern Chronicle API (`ProvideBigQueryAccess`)
HTTP method	`POST`	`POST`
Permissions	Legacy partner permissions	`chronicle.bigQueryAccess.provide`

Request payload field-by-field parity

The legacy call set BigQuery access permissions (read/write) for a customerID. The modern Chronicle API targets a specific instance path and standardizes dataset query permissions.

Legacy field (`UpdateBigQueryAccessRequest`)	Modern field (`ProvideBigQueryAccessRequest`)	Field type	Parity and migration notes
`customer_id`	`parent` (in HTTP path)	`string`	Google Cloud scoped hierarchy: In the legacy API, the target customer was identified globally by `customer_id`. In the modern API, the request targets a specific instance resource path: `projects/{project}/locations/{location}/instances/{instance}`.
`email`	`email`	`string`	Parity mapped: Identifies the user email obtaining access.
`write_access`	—	`bool`	Retired: The modern Chronicle API standardizes user dataset queries as read-only, removing client-managed writes.

Response payload field-by-field parity

The response maps properties for user identifiers and roles.

Legacy field (`BigQueryAccess` response)	Modern field (`BigQueryAccess` response)	Target type	Parity and migration notes
—	`name`	`string`	New field: Standard resource name identifier of the BigQuery access resource. Format: `projects/{project}/locations/{location}/instances/{instance}/bigQueryAccess`.
`email`	`email`	`string`	Parity mapped: User email address.
`roles`	`roles`	`repeated BigQueryAccessRole`	Parity mapped: List of roles assigned. Members of `BigQueryAccessRole` contain a single `name` field that maps to legacy roles.
`roles[].name` (Legacy `Role.name`)	`roles[].name` (Modern `BigQueryAccessRole.name`)	`string`	Parity mapped: Role string identifier.

Key differences

Write access deprecated:
- Legacy clients could explicitly request write access using write_access = true.
- The modern Chronicle API standardizes BigQuery access for user analysis as read-only table querying, removing the client-wide write_access parameter.