Google BigQuery setup guide

Agents read your numbers and run reports.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Google BigQuery, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Google BigQuery can be connected 2 ways. Where there’s a key or token to paste, that’s usually the quickest.

Google service account

Service account.

1. In Google Cloud console (https://console.cloud.google.com), pick the project that should run and pay for queries. The BigQuery API is on by default in new projects; if not, enable it under APIs & Services > Library.
2. Open IAM & Admin > Service Accounts and create a service account. In IAM, grant it BigQuery Job User on the project (to run queries) and BigQuery Data Viewer on the project or on each dataset agents may read.
3. Only if agents should add rows: grant BigQuery Data Editor on the one dataset that receives them. Data Editor can also change and delete tables in that dataset, so keep it separate from your source data.
4. On the service account's Keys tab choose Add key > Create new key > JSON. Organizations created on or after May 3, 2024 block key creation by default; an organization admin has to allow it for this project, or use the OAuth option instead.
5. Paste the JSON file's contents and the project ID, add the dataset location if your data is outside the US and EU multi-regions, and choose how much one query may scan.

Field	What to enter
Service account key (JSON file contents)	A secret: Everdeck saves it encrypted and never shows it again. Where to find it.
Project ID that runs and pays for queries	Text. For example my-project-123.
Dataset location if not the US or EU multi-region (for example asia-southeast1) (optional)	Text. For example asia-southeast1.
Most data one query may scan (on-demand pricing) (optional)	Choice: 1 GiB (about $0.006), 10 GiB (about $0.06), 100 GiB (about $0.61), 1 TiB (about $6.25). Starts as 10737418240.

The scopes Everdeck asks for:

• https://www.googleapis.com/auth/bigquery

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at Google BigQuery until you delete or rotate it there.

Your Google OAuth app

Your OAuth app.

This way signs in with an OAuth app you create for Google BigQuery, as its steps describe: Everdeck never uses an app of its own. Register this redirect URI with your app:

https://everdeck.io/api/oauth/callback

Then save the app’s client ID and secret in Everdeck, on the connect page or under OAuth apps, and sign in.

1. In Google Cloud console (https://console.cloud.google.com), pick a project and make sure the BigQuery API is enabled (APIs & Services > Library).
2. Open Google Auth platform > Branding and fill in the app name and support email. Under Audience, choose Internal if you use Google Workspace. An External app left in Testing gets refresh tokens that expire after 7 days.
3. Under Data Access, add the scope listed below.
4. Under Clients, choose Create Client > Web application and add the authorized redirect URI https://everdeck.io/api/oauth/callback.
5. Copy the Client ID and Client secret into the form, enter the project ID, location and scan limit, then sign in with a Google account that has BigQuery Job User on the project and read access to the datasets. Agents get exactly that account's access.

Field	What to enter
Project ID that runs and pays for queries	Text. For example my-project-123.
Dataset location if not the US or EU multi-region (for example asia-southeast1) (optional)	Text. For example asia-southeast1.
Most data one query may scan (on-demand pricing) (optional)	Choice: 1 GiB (about $0.006), 10 GiB (about $0.06), 100 GiB (about $0.61), 1 TiB (about $6.25). Starts as 10737418240.

The scopes Everdeck asks for:

• https://www.googleapis.com/auth/bigquery

When you disconnect, Everdeck asks Google BigQuery to revoke the sign-in, then deletes the tokens it saved.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• List projectsTier 0 · ReadReads outside contentbigquery_list_projects

  Google Cloud projects these credentials can use with BigQuery, with their IDs and names.

• List datasetsTier 0 · ReadReads outside contentbigquery_list_datasets

  Datasets in a project with their location and labels. project_id defaults to the connected project; use another, such as bigquery-public-data, to browse shared data.

• List tablesTier 0 · ReadReads outside contentbigquery_list_tables

  Tables, views and materialized views in a dataset, with type, partitioning and creation time.

• Describe a tableTier 0 · ReadReads outside contentbigquery_get_table

  A table's or view's columns (name, type, mode, description, nested fields), row count, size in bytes, partitioning and clustering, and whether queries must filter on the partition column. Read this before writing SQL.

• Preview rowsTier 0 · ReadReads outside contentbigquery_preview_rows

  Read rows straight from a table without running a query: free and quota-light, but unfiltered and in storage order. Values come back as rows[].f[].v in column order (or in the order of columns when given); get_table gives the names. Does not work on views.

• Estimate a query's costTier 0 · ReadReads outside contentbigquery_estimate_query

  Validate a GoogleSQL query and report how many bytes it would scan, without running it or paying for it. On-demand pricing is $6.25 per TiB after the first free TiB each month.

• Run a SQL queryTier 0 · ReadReads outside contentbigquery_run_query

  Run a read-only GoogleSQL query (SELECT, or WITH ... SELECT) and get column names and up to max_rows rows as objects. Name tables as `project.dataset.table`, select only the columns you need and filter on the partition column: billing counts every byte of each column read, and LIMIT does not reduce it. Queries that would scan more than the connection's limit are refused without charge; other statements (INSERT, UPDATE, DELETE, CREATE...) are refused.

• Get more query resultsTier 0 · ReadReads outside contentbigquery_get_query_results

  Fetch further pages, or the finished results, of a query that run_query returned with a job_id (large results or a query still running). Values come back as rows[].f[].v in the order of schema.fields.

• Append rows to a tableTier 2 · ReversibleReads outside contentbigquery_insert_rows

  Stream new rows into an existing table, for example to log results or decisions. Each row is {"json": {column: value}} and may carry an insertId so retries within a minute are not duplicated. Rows that fail are listed in insertErrors even when the call succeeds.

What can start work

These events from Google BigQuery can become tasks for your agents through Intake. How Intake works.

New rows arrived in a table the company chooses (for example new orders or signups), detected by an increasing timestamp or ID column.

Connect Google BigQuery first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Google BigQuery later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit or Reconnect.

To stop agents using Google BigQuery, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.