BigQuery
This article outlines the integration with the BigQuery connector, enabling streamlined metadata management through features such as crawling, profiling, querying, data preview, and lineage building (both automatic and manual).
The connector establishes connectivity to BigQuery through JDBC and SDK. Authentication is configured using File Authentication or UI Authentication, with access established through a BigQuery service account and the required project, application, and authentication details.
Overview
Connector Details
Connector Category
Data Warehouse
OvalEdge Release Supported
Release6.3.4.x and later
Connectivity
[How the connection is established with BigQuery]
JDBC and SDK
Connector Features
Crawling
✅
Delta Crawling
❌
Profiling
✅
Sample Profiling
✅
Query Sheet
✅
Data Preview
✅
Auto Lineage
✅
Manual Lineage
✅
Secure Authentication via Credential Manager
✅
Data Quality
✅
DAM (Data Access Management)
❌
Bridge
✅
Metadata Mapping
The following objects are crawled from BigQuery and mapped to the corresponding UI assets.
Project
Project
Database name
Database
Database
Dataset / Schema
Dataset Id / Schema Name
Schema name
Schemas
Schema
Table
Table Name
Table name
Tables
Table
Table
Table Type
Table Type
Tables
Table
Columns
column_name
Column name
Table Columns
Table Column
Columns
data_type
Column Type
Table Columns
Table Column
Views
Table_Name
View name
Views
Table
Views
View_Definition
Query
Views
Table
Routines (Procedures and Functions)
Routine_Name
Routine name
Procedures/ Functions
Code
Routines (Procedures and Functions)
Routine_Definition
Query
Procedures/ Functions
Code
Routines (Procedures and Functions)
Routine_Type
Job Type
Procedures/ Functions
Code
Routines (Procedures and Functions)
Created
Created date
Procedures/ Functions
Code
Set up a Connection
Prerequisites
The following are the prerequisites to establish a connection:
Service Account User Permissions
It is recommended to use a dedicated service account to establish the connection to the data source, configured with the following minimum set of permissions.
Schemas
INFORMATION_SCHEMA.SCHEMATA
roles/bigquery.dataViewer roles/bigquery.metadataViewer roles/bigquery.jobUser
bigquery.datasets.get
Tables
INFORMATION_SCHEMA.TABLES
roles/bigquery.dataViewer roles/bigquery.metadataViewer roles/bigquery.jobUser
bigquery.tables.get bigquery.tables.list bigquery.jobs.create
Columns
INFORMATION_SCHEMA.COLUMNS
roles/bigquery.dataViewer roles/bigquery.metadataViewer roles/bigquery.jobUser
bigquery.tables.get bigquery.tables.list bigquery.jobs.create
Views
INFORMATION_SCHEMA.VIEWS
roles/bigquery.dataViewer roles/bigquery.metadataViewer roles/bigquery.jobUser
bigquery.tables.get bigquery.tables.list bigquery.jobs.create
Routines (Procedures / Functions)
INFORMATION_SCHEMA.ROUTINES
roles/bigquery.dataViewer roles/bigquery.metadataViewer roles/bigquery.jobUser
bigquery.routines.get bigquery.routines.list bigquery.jobs.create
Connection Configuration Steps
Users are required to have the Connector Creator role in order to configure a new connection.
Log into OvalEdge, go to Administration > Connectors, click + (New Connector), search for BigQuery, and complete the required parameters.
Connector Type
By default, "BigQuery" is displayed as the selected connector type.
Credential Manager*
Select the desired credentials manager from the drop-down list. Relevant parameters will be displayed based on the selection.
Supported Credential Managers:
OE Credential Manager
AWS Secrets Manager
HashiCorp Vault
Azure Key Vault
For more details, click here.
Server*
By default, the BigQuery server URL (https://bigquery.googleapis.com) is pre-populated. If required, update the field with the BigQuery server endpoint or IP address (e.g., xxxx-xxxx.xxxx4ijtzasl.xx-south-1.rds.xxxxx.com or 1xx.xxx.1.x0).
License Add Ons
Select the checkbox for the Auto Lineage Add-On to build data lineage automatically.
Select the checkbox for the Data Quality Add-On to identify data quality issues using data quality rules and anomaly detection.
For more details, click here.
Connector Name*
Enter a unique name for the BigQuery connection
(Example: "BigQuery_Prod").
Connector Environment
Select the environment (Example: PROD, STG) configured for the connector. For more details, click here.
Billing Project ID
Enter the Billing Project ID used for BigQuery query and data access billing.
Connector description
Enter a brief description of the connector.
Validation Type*
The following two types of validation are supported for BigQuery:
File Authentication
UI Authentication
Project Id*
Enter the Project ID associated with the BigQuery environment.
Application*
Enter the Application ID associated with the BigQuery environment and authorized for required operations.
File Path*
Enter the File Path of the BigQuery JSON file.
Regions (comma-separated)
Enter one or more BigQuery regions (e.g., US, EU, us-central1) - separate multiple regions with commas.
Account Type*
Enter the service account type used for BigQuery UI authentication.
Client id*
Enter the client ID associated with the BigQuery service account.
Client Email*
Enter the client email associated with the BigQuery service account.
Private Key*
Enter the private key for the BigQuery service account.
Private Key Id*
Enter the private key ID associated with the BigQuery service account.
Token Uri*
Enter the token Uri used for authentication with BigQuery.
Project Id*
Enter the Project ID associated with the BigQuery environment.
Application*
Enter the Application ID associated with the BigQuery environment and authorized for required operations.
Regions (comma-separated)
Enter one or more BigQuery regions (e.g., US, EU, us-central1) - separate multiple regions with commas.
Default Governance Roles
Default Governance Roles*
Select the appropriate users or teams for each governance role from the drop-down list. All users and teams configured in OvalEdge Security are displayed for selection.
Admin Roles
Admin Roles*
Select one or more users from the dropdown list for Integration Admin and Security & Governance Admin. All users configured in OvalEdge Security are available for selection.
No of Archive Objects
No Of Archive Objects*
This shows the number of recent metadata changes to a dataset at the source. By default, it is off. To enable it, toggle the Archive button and specify the number of objects to archive.
Example: Setting it to 4 retrieves the last four changes, displayed in the 'Version' column of the 'Metadata Changes' module.
Bridge
Select Bridge*
If applicable, select the bridge from the drop-down list.
The drop-down list displays all active bridges configured in OvalEdge. These bridges enable communication between data sources and OvalEdge without altering firewall rules.
After entering all connection details, the following actions can be performed:
Click Validate to verify the connection.
Click Save to store the connection for future use.
Click Save & Configure to apply additional settings before saving.
The saved connection will appear on the Connectors home page.
Manage Connector Operations
Crawl/Profile
To perform crawl and profile operations, users must be assigned the Integration Admin role.
The Crawl/Profile button allows users to select one or more schemas for crawling and profiling.
Navigate to the Connectors page and click Crawl/Profile.
Select the schemas to crawl.
The Crawl option is selected by default. Click the Crawl & Profile radio button to run both operations.
Click Run to collect metadata from the connected source and load it into the OvalEdge Data Catalog.
After a successful crawl, the information appears in the Data Catalog > Databases tab.
The Schedule checkbox allows automated crawling and profiling at defined intervals, from a minute to a year.
Click the Schedule checkbox to enable the Select Period drop-down.
Select a time period for the operation from the drop-down menu.
Click Schedule to initiate metadata collection from the connected source.
The system will automatically execute the selected operation (Crawl or Crawl & Profile) at the scheduled time.
Other Operations
The Connectors page in OvalEdge provides a centralized view of all configured connectors, including their health status.
Managing connectors includes:
Connectors Health: Displays the current status of each connector using a green icon for active connections and a red icon for inactive connections, helping to monitor the connectivity with data sources.
Viewing: Click the Eye icon next to the connector name to view connector details.
Nine Dots Menu Options:
To view, edit, validate, build lineage, configure, or delete connectors, click on the Nine Dots menu.
Edit Connector: Update and revalidate the data source.
Validate Connector: Check the connection's integrity.
Settings: Modify connector settings.
Crawler: Configure data extraction.
Profiler: Customize data profiling rules and methods.
Query Policies: Define query execution rules based on roles.
Access Instructions: Add notes on how data can be accessed.
Business Glossary Settings: Manage term associations at the connector level.
Anomaly Detection Settings: Configure anomaly detection preferences at the connector level.
Connection Pooling: Configure database connection pool parameters to optimize database connectivity and resource utilization. For more details, click here.
Others: Configure notification recipients for metadata changes.
Build Lineage: Automatically build data lineage using source code parsing.
Delete Connector: Remove a connector with confirmation.
For more details on connector settings, click here.
Data Types with Limited Support
The following data types are supported for crawling but have limited support across other connector features:
GEOGRAPHY – Profiling and querying are not supported.
JSON – Profiling and querying are not supported.
STRUCT – Profiling and querying are not supported.
ENUM – Crawling and profiling are not supported; Data View is supported.
Troubleshooting
If incorrect parameters are entered, error messages may appear. Ensure all inputs are accurate to resolve these issues. If issues persist, contact the assigned support team.
1
Error while validating connection: Error while validating BIGQUERY Connection : IOException block 1: Use JsonReader.setLenient(true) to accept malformed JSON at line 1 column 2 path
The system is unable to authenticate because the JSON key file path is incorrect, the file is missing, or the file is not in a valid JSON format.
Resolution:
Verify the file path in the connection settings and ensure the file is a valid JSON service account key.
Confirm the JSON file is a valid, unprotected service account key file and not encrypted or password-secured.
If connecting through a bridge, confirm that the JSON file exists on the bridge client machine and is accessible.
2
Invalid details in Application or Project Id
Connection to BigQuery failed due to an incorrect Project ID or Application ID, or the dataset associated with the Application ID does not exist or is inaccessible.
Resolution:
Ensure the Project ID matches the correct Google Cloud project.
Confirm the Application ID corresponds to an existing dataset in the project and that the dataset is accessible.
3
com.google.api.client.auth.oauth2.TokenResponseException: 401 Unauthorized
Authentication failed because the service account key is invalid, expired, or deleted, or because the associated service account is disabled.
Resolution:
Regenerate a new service account key from the GCP Console.
Confirm the private key entered matches the value in the service account JSON, entered only up to the point before the line break markers.
Verify the service account is active and has the required BigQuery permissions.
Replace the old key in the connection configuration.
4
com.google.api.client.googleapis.json.GoogleJsonResponseException: 403
The service account does not have sufficient IAM roles to query data or run BigQuery jobs.
Resolution:
Grant the required roles to the service account in Google Cloud IAM.
Minimum recommended roles:
roles/bigquery.user
roles/bigquery.dataViewer
roles/bigquery.jobUser
5
Error while validating connection: 403 permission exception
The service account being used has not been granted access to the specific project ID being connected to.
Resolution:
Confirm the service account has been granted access to the intended project ID.
Verify the required BigQuery permissions, data viewer, metadata viewer, and job user, have been assigned to the service account for that project.
Reconfirm access with the relevant GCP administrator if the mismatch continues.
6
Error while validating connection: invalid details in application or project ID
This historically occurred when the project ID and the application or data set ID entered did not correspond to each other, meaning the data set did not exist within the specified project.
Resolution:
Confirm that the project ID and application or data set ID entered belong to the same project.
Retry validation once the correct project and data set pairing is confirmed.
1
A project configured with service account access does not appear in the connector after crawling
Access permission changes made to a service account can take some time to reflect, or the project may not currently be listed in the connector's configured project IDs.
Resolution:
Confirm the project ID is included in the connector's configured list, or left blank to include all accessible projects.
Allow some time for recently updated service account permissions to take effect before retrying.
Recrawl the connector once access has been confirmed as active.
2
Profile completed with a data type not supported warning on certain columns
Certain data types do not have a structured format that allows minimum and maximum values to be calculated, so these columns are skipped with a warning rather than an error during profiling.
Resolution:
Confirm the flagged column uses one of the currently unsupported data types for profiling.
Treat this as an expected warning rather than a failure, since these columns are intentionally skipped.
Refer to the Data Types with Limited Support section for the list of unsupported data types.
3
Null count, distinct count, or other profile statistics not appearing for a table
These statistics require the data viewer and job user permissions, since they are generated by running a query against the actual data rather than just reading structural metadata.
Resolution:
Confirm the service account has been granted both data viewer and job user permissions.
Confirm the metadata viewer permission is also present, since this supports the underlying cataloguing needed for profiling.
Recrawl and reprofile the table once all required permissions are confirmed.
4
Query in the query sheet exceeds the configured time limit
The query being run is taking longer than the currently configured query timeout setting.
Resolution:
Increase the query timeout value in the connector settings if longer-running queries are expected.
Review the query for potential performance issues if it is taking unusually long to complete.
Retry the query once the timeout has been adjusted appropriately.
FAQs
1
What is BigQuery, and how does its structure map to the application's catalog?
BigQuery is a fully managed, cloud-based data warehouse service within the Google Cloud Platform. Google manages the underlying database infrastructure and physical maintenance.
In the application's catalog:
Google Cloud project → Database
Data set (application ID) → Schema
Tables, columns, views, and procedures → Objects under the schema
The standard naming format is project ID followed by data set ID.
2
Why is BigQuery categorized as an RDBMS type connector even though it is a data warehouse product?
Although BigQuery is a cloud data warehouse, it stores data in a structured format with tables, columns, views, and procedures, similar to a traditional relational database.
Therefore, it is catalogued and represented as an RDBMS type connector.
3
What connectivity methods does this connector use behind the scenes?
The connector uses two connectivity methods:
JDBC
SDK
There is no separate option to select the method during setup. The connector automatically uses the appropriate method as required.
No additional driver file is required because the necessary components are already bundled with the connector.
1
What authentication types are available for this connector?
Two authentication types are available:
File authentication: Uses a service account JSON key file placed in a path accessible to the application or in the bridge client folder when a bridge is used.
UI authentication: Allows the same service account credentials, including the private key, to be entered directly in the connection fields.
UI authentication can be used when placing the JSON key file directly on the server is not preferred for security reasons.
Both authentication types use the same underlying service account credentials.
2
What permissions are required on the service account?
The following permissions are generally required:
BigQuery data viewer: Required for profiling and viewing data in the data tab.
BigQuery metadata viewer: Required for crawling and cataloguing.
BigQuery job user: Required for operations that submit a query job within BigQuery, such as retrieving table or column details.
3
Are the project ID and application or data set ID fields mandatory?
No. As of the current version, these fields are not mandatory.
Multiple project IDs can be entered, separated by commas, to retrieve data sets from specific projects.
The fields can also be left blank to retrieve all projects and data sets accessible to the configured service account.
4
How does the private key need to be entered when using UI authentication?
For UI authentication, enter only the required portion of the private key up to the point before the line break markers in the original key.
The complete key text, including those markers, should not be entered.
This applies only to UI authentication. File authentication does not require manual private key entry.
5
What is the purpose of the regions field in the connector settings?
The regions field specifies the geographic regions where the BigQuery projects or data sets are located.
Enter multiple regions separated by commas to ensure that data sets outside the default regions are also picked up during crawling.
6
What is the billing project ID field used for?
The billing project ID specifies the project under which a query job runs for billing purposes during crawling or profiling.
If configured, the query job runs under the specified billing project ID.
If not configured, it uses the standard project associated with the connection.
1
What object types are catalogued for BigQuery?
The connector catalogues:
Tables
Columns
Views
Functions
Triggers
Procedures
Indexes and synonyms are not applicable to BigQuery because these concepts do not exist in its architecture in the same way as in traditional relational databases.
2
Does profiling use full profiling or sample profiling by default?
Full profiling is used by default.
Sample profiling can be configured through the profile settings when a lighter-weight profiling approach is preferred, particularly for larger tables.
3
How many records are shown by default in the query sheet?
The query sheet displays 1,000 records by default when a table is selected.
Additional records can be accessed through pagination when using advanced mode.
4
Does the query policy setting that shows an authorization popup apply to BigQuery?
This setting is generally more relevant to connectors that use simple username and password authentication.
BigQuery uses File authentication or UI authentication with service account credentials instead.
However, query type and role-based restrictions can still be configured to control the operations a user can perform in the query sheet.
5
Are external tables supported by this connector?
External tables are catalogued but are not supported for profiling.
Their structural information is available in the catalog, but profiling statistics are not generated.
6
Is tag-based crawling supported for BigQuery?
No. Tag-based crawling is not currently supported for BigQuery.
It may be considered as a future enhancement.
Copyright © 2026, OvalEdge LLC, Peachtree Corners, GA, USA.
Last updated
Was this helpful?