Connect Single Origin to BigQuery

Single Origin reads metadata only from your BigQuery environment: dataset, table, view, model and routine schemas, plus job and reservation information. It never reads your table data.

You connect Single Origin by granting our service account read-only access to your project's metadata. The setup takes a few minutes, and nothing leaves your environment.

What you're granting

You assign three predefined IAM roles to the Single Origin service account:

Role	Role ID	What it allows
BigQuery Metadata Viewer	`roles/bigquery.metadataViewer`	Read schemas and metadata for datasets, tables, views, models and routines. Does not grant access to the data inside your tables.
BigQuery Resource Viewer	`roles/bigquery.resourceViewer`	Read job, reservation and configuration metadata across the project.
BigQuery User	`roles/bigquery.user`	Lets Single Origin run its queries on the system tables.

None of these roles includes bigquery.tables.getData or any other data-read permission. Single Origin can see the structure of your warehouse but never the contents of your rows.

Before you start

You'll need:

A user account that can manage IAM on the project (the Owner or IAM Admin role).
The Single Origin service account email, from your onboarding email. It looks like single-origin-reader@<SINGLE_ORIGIN_PROJECT>.iam.gserviceaccount.com. Copy it exactly; IAM principals are case-sensitive.
Your BigQuery project ID (shown as <YOUR_PROJECT_ID> below).

Choose a method

Open the IAM page and select the project you want Single Origin to read.
Click Grant access.
In New principals, paste the Single Origin service account email.
Under Assign roles, search for BigQuery Metadata Viewer and select it.
Click Add another role and add BigQuery Resource Viewer.
Click Add another role and add BigQuery User.
Click Save.

The Single Origin service account now appears in your IAM list with all three roles.

Run the three commands, replacing the placeholders with your values:

gcloud projects add-iam-policy-binding <YOUR_PROJECT_ID> \
  --member="serviceAccount:single-origin-reader@<SINGLE_ORIGIN_PROJECT>.iam.gserviceaccount.com" \
  --role="roles/bigquery.metadataViewer"

gcloud projects add-iam-policy-binding <YOUR_PROJECT_ID> \
  --member="serviceAccount:single-origin-reader@<SINGLE_ORIGIN_PROJECT>.iam.gserviceaccount.com" \
  --role="roles/bigquery.resourceViewer"

gcloud projects add-iam-policy-binding <YOUR_PROJECT_ID> \
  --member="serviceAccount:single-origin-reader@<SINGLE_ORIGIN_PROJECT>.iam.gserviceaccount.com" \
  --role="roles/bigquery.user"

locals {
  single_origin_member = "serviceAccount:single-origin-reader@<SINGLE_ORIGIN_PROJECT>.iam.gserviceaccount.com"
}

resource "google_project_iam_member" "single_origin_metadata_viewer" {
  project = "<YOUR_PROJECT_ID>"
  role    = "roles/bigquery.metadataViewer"
  member  = local.single_origin_member
}

resource "google_project_iam_member" "single_origin_resource_viewer" {
  project = "<YOUR_PROJECT_ID>"
  role    = "roles/bigquery.resourceViewer"
  member  = local.single_origin_member
}

resource "google_project_iam_member" "single_origin_user" {
  project = "<YOUR_PROJECT_ID>"
  role    = "roles/bigquery.user"
  member  = local.single_origin_member
}

Finish up

Once the roles are assigned, tell your Single Origin contact (or confirm in the onboarding flow) and send your project ID. Single Origin verifies the connection and starts reading metadata. No further action is needed on your side.

Revoking access

You can remove Single Origin's access at any time. Delete the three role bindings for the service account on the IAM page, or run:

gcloud projects remove-iam-policy-binding <YOUR_PROJECT_ID> \
  --member="serviceAccount:single-origin-reader@<SINGLE_ORIGIN_PROJECT>.iam.gserviceaccount.com" \
  --role="roles/bigquery.metadataViewer"

gcloud projects remove-iam-policy-binding <YOUR_PROJECT_ID> \
  --member="serviceAccount:single-origin-reader@<SINGLE_ORIGIN_PROJECT>.iam.gserviceaccount.com" \
  --role="roles/bigquery.resourceViewer"

gcloud projects remove-iam-policy-binding <YOUR_PROJECT_ID> \
  --member="serviceAccount:single-origin-reader@<SINGLE_ORIGIN_PROJECT>.iam.gserviceaccount.com" \
  --role="roles/bigquery.user"