Use data products

This document is intended for Knowledge Catalog (formerly Dataplex Universal Catalog) data product consumers who want to discover and use data products for their use cases.

For more information about the architecture and key concepts of data products, see About data products .

Before you begin

1. Enable the Dataplex, BigQuery APIs.

   Roles required to enable APIs

   To enable APIs, you need the Service Usage Admin IAM role ( roles/serviceusage.serviceUsageAdmin ), which contains the serviceusage.services.enable permission. Learn how to grant roles .

   Enable the APIs

Required roles

To get the permissions that you need to search for, access, and use data products, ask your administrator to grant you the following IAM roles on the data product or the project:

• Search for data products: Dataplex Catalog Viewer ( roles/dataplex.catalogViewer )
• Search for data assets and request access: Dataplex Data Products Consumer ( roles/dataplex.dataProductsConsumer )
• Read-only access to view data product definitions and metadata: Dataplex Data Products Viewer ( roles/dataplex.dataProductsViewer )

For more information about granting roles, see Manage access to projects, folders, and organizations .

You might also be able to get the required permissions through custom roles or other predefined roles .

As a data product consumer, to view the metadata of an asset, you must have the viewer permission to access the corresponding asset in the source system. For example, to search for metadata for a dataset or a table in a data product, you need the BigQuery Metadata Viewer role ( roles/bigquery.metadataViewer ). For more information, see Required roles for accessing search results .

Search for data products

 curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d \
  '{
  "query": " ADDITIONAL_KEYWORDS 
(type=(DATA_PRODUCT))",
  "pageSize": 10
  }' \
"https://dataplex.googleapis.com/v1/projects/ PROJECT_ID 
/locations/global:searchEntries" 

Request access to data products

As a data product consumer, if you don't have IAM permissions to access a data product, you can request access using the integrated access approval workflows.

Submit an access request

 curl  
-X  
POST  
 \ 
-H  
 "Authorization: Bearer 
 $( 
gcloud  
auth  
print-access-token ) 
 " 
  
 \ 
-H  
 "Content-Type: application/json" 
  
 \ 
-d  
 '{ 
 "parent": "projects/ PROJECT_ID 
/locations/ LOCATION 
/dataProducts/ DATA_PRODUCT_ID 
", 
 "change_request": { 
 "justification": " JUSTIFICATION_TEXT 
", 
 "data_product_access_request": { 
 "parent": "projects/ PROJECT_ID 
/locations/ LOCATION 
/dataProducts/ DATA_PRODUCT_ID 
", 
 "access_group_id": " DATA_PRODUCT_ACCESS_GROUP_ID 
" 
 } 
 } 
 }' 
  
 \ 
 "https://dataplex.googleapis.com/v1/projects/ PROJECT_ID 
/locations/ LOCATION 
/dataProducts/ DATA_PRODUCT_ID 
:requestAccess" 
 

View the status of access requests

As a data product consumer, you can monitor the progress and lifecycle of your submitted access requests. Knowledge Catalog tracks and displays these requests using distinct status states depending on whether you are viewing a unified workflow list or a specific product's access summary.

View a unified list of your access requests

To view a comprehensive list of all your submitted access requests across all data products, follow these steps:

 curl  
-X  
GET  
 \ 
-H  
 "Authorization: Bearer 
 $( 
gcloud  
auth  
print-access-token ) 
 " 
  
 \ 
-H  
 "Content-Type: application/json" 
  
 \ 
 "https://dataplex.googleapis.com/v1/projects/ PROJECT_ID 
/locations/ LOCATION 
/changeRequests:listMine" 
 

View the access summary for a specific data product

In addition to the global workflow list, you can check your access posture for an individual data product. This lets you verify if you already possess inherited access to an asset group without needing to submit a new request.

To view the access summary for a data product, follow these steps:

 curl  
-X  
GET  
 \ 
-H  
 "Authorization: Bearer 
 $( 
gcloud  
auth  
print-access-token ) 
 " 
  
 \ 
-H  
 "Content-Type: application/json" 
  
 \ 
 "https://dataplex.googleapis.com/v1/projects/ PROJECT_ID 
/locations/ LOCATION 
/changeRequests/ CHANGE_REQUEST_ID 
" 
 

Delete an access request

1. In the Google Cloud console, go to the Knowledge Catalog Governance workflowspage.

   Go to Governance workflows

2. Click the My requeststab.

3. Locate the row containing your target data product request. If necessary, apply a filter to isolate the entry.

4. Click more_vert Actionsand then click Delete.

Consume data products

To use a data product, ensure that you are granted the necessary permissions. See Request access to data products .

After the data product owner grants you permission, you can access the data product and its assets. For example, if you're granted permissions to access a BigQuery table, you can query it directly in BigQuery to generate insights.

Access assets using user credentials

If your access request was approved for your user credentials, follow these steps to access the assets:

1. Search for the data product .
2. In the search results, click the data product that you want to use.
3. Click the Assetstab.

4. Click the asset for which you want to view details. This opens the entry details page.

   You can access details such as schema, insights, and lineage. If the asset is a BigQuery table or view, you can click Open in BigQueryto navigate to the BigQuery studio and query the results.

Access assets using a service account

If your access request was approved for a service account, you are granted the Service Account Token Creator ( roles/iam.serviceAccountTokenCreator ) IAM role on the data producer service account. This lets you create an impersonation chain to access the underlying assets.

To access assets using a service account, follow these steps:

1. Identify the configured service accounts for the data product by navigating to the Data Assetstab of the data product details page.

2. To impersonate the data producer service account, create an impersonation chain for your service account using the following Google Cloud CLI command:

    gcloud  
   config  
    set 
     
   auth/impersonate_service_account  
    CONSUMER_SERVICE_ACCOUNT 
   , PRODUCER_SERVICE_ACCOUNT 
    
   

   Replace the following:

   • CONSUMER_SERVICE_ACCOUNT : the full qualified email address of the service account belonging to the data product consumer

   • PRODUCER_SERVICE_ACCOUNT : the fully qualified email address of the service account mapped to the data product access group

   For more information, see Use service account impersonation .

Access data products using remote MCP server

For client applications and development tools that interact with your data products outside of the Google Cloud ecosystem, you can use a remote Model Context Protocol (MCP) server. This architectural pattern allows external developer clients to safely query and discover cataloged data assets while maintaining unified governance boundaries.

To learn how to deploy and connect to an external server, see Use the Knowledge Catalog remote MCP server .

What's next

• Learn more about data products .
• Learn how to create a data product .
• Learn more about managing data products .