$ immuta sdd -h
Manage Sensitive Data Discovery

Usage:
  immuta sdd [command]

Available Commands:
  classifier  Manage Sensitive Data Discovery Classifiers
  run         Run Sensitive Data Discovery with provided options
  template    Manage Sensitive Data Discovery Templates

Flags:
  -h, --help   Help for sdd

Global Flags:
      --config string    Config file (default $HOME/.immutacfg.yaml)
  -p, --profile string   Specifies the profile for what instance/api the cli will use (default "default")

Use "immuta sdd [command] --help" for more information about a command.

$ immuta sdd -h
Run Sensitive Data Discovery with provided options

Usage:
  immuta sdd run [datasourceName(s)] [flags]

Examples:
# run SDD as a dry run on the specified data sources
$ immuta sdd run "Datasource One" "Datasource Two" --dryRun --template "someFramework"
# run SDD on ALL data sources in immuta
$ immuta sdd run


Flags:
  -d, --dryRun                  No updates will actually be made
  -f, --force                   Do not prompt for confirmation when attempting to run sdd on all data sources
  -h, --help                    Help for run
  -o, --output json | yaml      Output format
      --outputTemplate string   Format the response using a Go template
  -t, --template string   Run SDD with this template, can only be used with the dryRun flag
  -w, --wait int                The number of seconds to wait for the SDD job(s) to finish. Default is until the SDD job(s) finish (default -1)

Global Flags:
      --config string    Config file (default $HOME/.immutacfg.yaml)
  -p, --profile string   Specifies the profile for what instance/api the cli will use (default "default")

$ immuta sdd run "Credit Accounts"
Running SDD
Credit Accounts  06b71830-aebc-11ec-970b-51ffefcbfd0c  completed

$ immuta sdd run
Running SDD
Started 8 SDD jobs

Manage Purposes

Usage:
  immuta purpose [command]

Available Commands:
  delete      Delete a purpose by name
  list        List all purposes
  save        Create/update a purpose in Immuta

Flags:
  -h, --help   help for purpose

Global Flags:
      --config string    config file (default $HOME/.immutacfg.yaml)
  -p, --profile string   specifies the profile for what instance/api the cli will use (default "default")

Use "immuta purpose [command] --help" for more information about a command.

name: Demo Purpose
acknowledgement: You promise not to share this data outside the project.
description: This project is only to be used for departmental data.

$ immuta purpose list
Re-identification Prohibited
Re-identification Prohibited.CCPA
Re-identification Prohibited.Safe Harbor Method
Use Case Outside De-identification

$ immuta purpose save test-purpose.yml
{"dryRun":false,"creating":true,"updating":false,"purposeId":8}

$ immuta purpose list
Demo Purpose
Re-identification Prohibited
Re-identification Prohibited.CCPA
Re-identification Prohibited.Safe Harbor Method
Use Case Outside De-identification

$ immuta purpose list
Demo Purpose
Re-identification Prohibited
Re-identification Prohibited.CCPA
Re-identification Prohibited.Safe Harbor Method
Use Case Outside De-identification

$ immuta purpose delete "Demo Purpose"
{"dryRun":false,"deleting":["Demo Purpose"]}

$ immuta purpose list
Re-identification Prohibited
Re-identification Prohibited.CCPA
Re-identification Prohibited.Safe Harbor Method
Use Case Outside De-identification

name: Purpose Hierarchy
acknowledgement: The root acknowledgement
subpurposes:
  - name: Purpose Hierarchy.Child 1
    acknowledgement: Override the root acknowledgement
  - name: Purpose Hierarchy.Child 2
  - name: Purpose Hierarchy.Child 1.Grandchild 1
  - name: Purpose Hierarchy.Child 1.Grandchild 2
  - name: Purpose Hierarchy.Child 2.Grandchild 1
  - name: Purpose Hierarchy.Child 2.Grandchild 2

$ immuta configure
? What is the url of the immuta instance you use?: https://your.instance.url.com/
? What is the api key of your immuta user account?:  ***************************Updated the config at /Users/user/.immutacfg.yaml

default:

  api_key: <apiKey>

  host: https://your.immuta.url.com

$ immuta policy list
New Column Added

$ immuta policy save ./test-policy.yml
{"dryRun":false,"creating":true,"updating":false,"policyId":4}

$ immuta policy list
New Column Added
data conditional masking

$ immuta policy list
New Column Added
data conditional masking

$ immuta policy rename "data conditional masking" "Data Masking"
{"oldPolicyKey":"data conditional masking","newPolicyKey":"Data Masking"}

$ immuta policy list
Data Masking
New Column Added

$ immuta policy clone ./your-file-path/policy-folder
Cloning all global policies...
Cloning: Test to Desktop/clone-policies/policy/Test.yaml

$ immuta policy list
Data Masking
New Column Added

$ immuta policy delete "Data Masking" --dryRun
{"dryRun":true,"deleting":"Data Masking"}

$ immuta policy delete "Data Masking"
{"dryRun":false,"deleting":"Data Masking"}

$ immuta policy list
New Column Added

curl \
    --request GET \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer dea464c07bd07300095caa8" \
    https://your-immuta-url.com/organizations?searchText=immuta

{
  "values": [
    {
      "name": "Immuta"
    }
  ]
}

$ immuta audit exportConfig get f7f9e289-f37b-4942-a18d-66d6de6e7cb2
$
{
  "id": "f7f9e289-f37b-4942-a18d-66d6de6e7cb2",
  "interval": "EVERY_12_HOURS",
  "enabled": true,
  "endpointConfiguration": {
    "__typename": "S3EndpointConfiguration",
    "bucket": "your-s3-bucket",
    "path": "hr-data",
    "region": "us-east-1",
    "accessKeyId": "accessKey"
  },
  "createdAt": "2022-10-23T23:03:11.466Z",
  "createdBy": {
    "name": "John Doe",
    "identityProvider": "okta",
    "id": "[email protected]",
    "type": "USER"
  },
  "updatedAt": "2022-10-23T23:03:11.466Z",
  "updatedBy": {
    "name": "John Doe",
    "identityProvider": "okta",
    "id": "[email protected]",
    "type": "USER"
  }
}

Manage Data Sources

Usage:
  immuta datasource [command]

Available Commands:
  delete      Delete all datasources for the given connection key
  list        List Data Source keys and sources
  rename      Rename the connection key
  save        Create/Update all specified data sources in Immuta given connection info to the remote data base

Flags:
  -h, --help   help for datasource

Global Flags:
      --config string    config file (default $HOME/.immutacfg.yaml)
  -p, --profile string   specifies the profile for what instance/api the cli will use (default "default")

Use "immuta datasource [command] --help" for more information about a command.

$ immuta datasource save test.yml --dryRun
{"dryRun":true,"creating":["Public Credit Accounts","Public Credit Transactions","Public Fake Medical Claims 2017","Public Uciml Census Income Enriched"],"updating":[],"deleting":[],"noChange":[],"detectionRunning":false,"tagsUpdated":false,"connectionString":null}

$ immuta datasource save test.yml --wait 5
{"dryRun":false,"creating":["Public Credit Accounts","Public Credit Transactions","Public Fake Medical Claims 2017","Public Uciml Census Income Enriched"],"updating":[],"deleting":[],"noChange":[],"detectionRunning":false,"tagsUpdated":false,"connectionString":"[email protected]:3306/public"}

$ immuta datasource list keys
snowflake.demo-databases.your.url.com:3306/public/public

$ immuta datasource rename snowflake.demo-databases.your.url.com:3306/public/public demonstration
{"oldConnectionKey":"snowflake.demo-databases.your.url.com:3306/public/public","newConnectionKey":"demonstration"}

$ immuta datasource list keys
demonstration

$ immuta datasource list keys

demonstration

$ immuta datasource delete demonstration
{"dryRun":false,"deleting":["Public Credit Transactions","Public Credit Accounts","Public Uciml Census Income Enriched","Public Fake Medical Claims 2017"]}

$ immuta datasource list sources demonstration
Error: status code: 404 message: The connection key "demonstration" was not found

Manage Projects

Usage:
  immuta project [command]

Available Commands:
  delete      Delete a project by project key
  list        List all policy keys
  rename      Rename the project key
  save        Create/Update a Project in Immuta

Flags:
  -h, --help   help for project

Global Flags:
      --config string    config file (default $HOME/.immutacfg.yaml)
  -p, --profile string   specifies the profile for what instance/api the cli will use (default "default")

Use "immuta project [command] --help" for more information about a command.

$ immuta project list
Public

$ immuta project save test-project.yml
{"dryRun":false,"creating":true,"updating":false,"numberOfDataSourcesAdded":0,"numberOfDataSourcesRemoved":0,"creatingWorkspace":false,"deletingWorkspace":false,"projectId":3}

$ immuta project list
Public
demo project

$ immuta project list
Public
demo project

$ immuta project rename "demo project" "Data Analytics Team"
{"oldProjectKey":"demo project","newProjectKey":"Data Analytics Team"}

$ immuta project list
Data Analytics Team
Public

$ immuta project list
Data Analytics Team
Public

$ immuta project delete "Data Analytics Team"
{"dryRun":false,"deleting":"Data Analytics Team"}

$ immuta project list
Data Analytics Team
Public

$ immuta project delete "Data Analytics Team" --hardDelete
{"dryRun":false,"deleting":"Data Analytics Team"}

$ immuta project list
Public

curl \
    --request GET \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer dea464c07bd07300095caa8" \
    https://your-immuta-url.com/fingerprint/status

{
  "healthy": true
}

curl \
    --request POST \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer dea464c07bd07300095caa8" \
    --data @example_payload.json
    https://your-immuta-url.com/jobs/statuses

{
  "jobIds": [
    "cefb58a0-cd71-11ec-8e29-81c20d280994"
  ],
  "wait": 0,
  "pollInterval": 1
}

{
  "cefb58a0-cd71-11ec-8e29-81c20d280994": {
    "id": "cefb58a0-cd71-11ec-8e29-81c20d280994",
    "state": "completed",
    "output": null
  }
}

curl \
    --request GET \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer dea464c07bd07300095caa8" \
    https://your-immuta-url.com/connectionStrings

{
  "values": [
    {
      "name": "[email protected]:???/TEST",
      "count": 5
    }
  ]
}

immuta clone <outputDirPath>

immuta api <endPoint> [--method httpMethod] [--input <filePath>] [--body body] [--data key=value] [--raw-data key=value] [--header key:value] [--query key=value] [--path-param key=value] [--outputTemplate string]

# list tags
$ immuta api tag

# list tags use query string to filter results
$ immuta api tag -q searchText=Discovered -q limit=10

# template the response using a Go template. This will print all tags new line separated.
$ immuta api tag -q limit=10 --template \
    '{{range .}}{{.name}}{{"\n"}}{{end}}'

# Run column detection on specified table
$ immuta api dataSource/detectRemoteChanges -X PUT -d table=tableName -d schema=schemaName

# the above command is the same as
$ immuta api dataSource/detectRemoteChanges -X PUT --body '{"table": "tableName", "schema", "schemaName"}'

# set a user's current project - replace templated values in path
$ immuta api project/current/{projectId} -P projectId=1 -X POST

# the above command is the same as
$ immuta api project/current/1 -X POST

name: Anyone Project
projectKey: Anyone project
documentation: "# Anyone Can See This"
description: "Anyone can join this project"
allowMaskedJoins: false
subscriptionPolicy:
    type: anyone
    automaticSubscription: true
    description: "Auto-subscribe everyone"
tags:
  - Discovered.Person Name
purposes:
  - Use Purposes
  - Purpose Hierarchy.Child 2.Grandchild 2

name: Approval Project
projectKey: Approval project
description: "Need approval to join this project"
allowMaskedJoins: true
subscriptionPolicy:
    type: approval
    approvals:
      - requiredPermission: GOVERNANCE
        specificApproverRequired: true
      - requiredPermission: ADMIN
        specificApproverRequired: false

name: Entitlement Project
projectKey: entitlement project
description: "Need specific entitlements to join this project"
subscriptionPolicy:
    type: entitlements
    automaticSubscription: false
    allowDiscovery: true
    entitlements:
      operator: any
      groups:
        - Engineers
        - Founders
      attributes:
        - name: Auth1
          value: super secret

name: Databricks Spark Project
projectKey: databricks spark project
datasources:
  - Crime Data
  - Databricks Credit Card Transactions
  - Databricks Hipaa Data
purposes:
  - Use Purposes
workspace:
  type: databricks
  config:
    database: native
    directory: native
    workspaceConfigurationName: S3

name: Snowflake Project
projectKey: snowflake project
datasources:
  - Snowflake Case
  - Snowflake Customer
  - Snowflake Web Sales
workspace:
  type: snowflake
  config:
    schema:
      SNOWFLAKE_NATIVE
    warehouses:
      - DEMO_WH
tags:
  - Discovered.Passport

curl \
    --request POST \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer dea464c07bd07300095caa8" \
    --data @example_payload.json
    https://your-immuta-url.com/searchFilter

{
  "name": "Medical Claims",
  "filter": {
    "searchText": "",
    "column": ["income_greater_than_50k"],
    "type": "datasource",
    "tag": ["Discovered.Entity.Medicare Number"]
  }
}

{
  "name": "Medical Claims",
  "filter": {
    "searchText": "",
    "column": ["income_greater_than_50k"],
    "type": "datasource",
    "tag": ["Discovered.Entity.Medicare Number"]
  }
}

curl \
    --request GET \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer dea464c07bd07300095caa8" \
    https://your-immuta-url.com/searchFilter

{
  "values": [{
    "name": "States",
    "filter": {
      "type": "datasource",
      "column": ["state"],
      "searchText": ""
    }
  }]
}

curl \
    --request DELETE \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer dea464c07bd07300095caa8" \
    https://your-immuta-url.com/searchFilter/Medical%20Claims

{
  "name": "Medical Claims",
  "filter": {
    "tag": ["Discovered.Entity.Medicare Number"],
    "type": "datasource",
    "column": ["income_greater_than_50k"],
    "searchText": ""
  }
}

curl \
    --request GET \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer dea464c07bd07300095caa8" \
    https://demo.immuta.com/schemas?searchText=medical

{
  "values": [
    {
      "name": "medical_records",
      "count": 1
    }
  ]
}

connectionKey: my-databricks
connection:
    hostname: your.databricks.hostname.com
    port: 443
    ssl: true
    database: tpc
    username: token
    password: "${DATABRICKS_PASSWORD}"
    httpPath: sql/protocolv1/o/0/11101101
    handler: Databricks

connectionKey: my-databricks
nameTemplate:
  dataSourceFormat: Databricks <Tablename>
  tableFormat: <tablename>
  schemaFormat: databricks
connection:
  hostname: your.databricks.hostname.com
  port: 443
  ssl: true
  database: data
  username: token
  password: "${DATABRICKS_PASSWORD}"
  httpPath: sql/protocolv1/o/0/1110-11123
  handler: Databricks
sources:
  - table: credit_card_transactions
    schema: data
    tags:
      table:
        - PCI
        - SENSITIVE
      columns:
      - columnName: transaction_date
        tags:
          - PCI
          - DATE
  - table: crime_data
    schema: data
    naming:
        datasource: Crime Data
        table: crime_data
        schema: databricks

connectionKey: my-databricks
nameTemplate:
  dataSourceFormat: Databricks <Tablename>
  tableFormat: <tablename>
  schemaFormat: databricks
  schemaProjectNameFormat: <schema>
connection:
  hostname: your.databricks.hostname.com
  port: 443
  ssl: true
  database: data
  authenticationMethod: oAuthM2M
  useCertificate: false
  clientId: "${service_principal_clientId}"
  audience: https://your.databricks.hostname.com/oidc/v1/token 
  scope: all-apis
  clientSecret: "${clientSecret}"
  httpPath: sql/protocolv1/o/0/1110-11123
  handler: Databricks

connectionKey: ebock-databricks
nameTemplate:
  dataSourceFormat: Databricks <Tablename>
  tableFormat: <tablename>
  schemaFormat: databricks
connection:
  hostname: your.databricks.hostname.com
  port: 443
  ssl: true
  database: ebock
  username: token
  password: "${DATABRICKS_PASSWORD}"
  httpPath: sql/protocolv1/o/0/1110-185737-wove
  handler: Databricks
sources:
  - table: credit_card_transactions
    schema: ebock
  - table: crime_data_delta
    schema: ebock
    naming:
        datasource: Crime Data
        table: crime_data
        schema: databricks
  - table: hipaa_data
    schema: ebock

connectionKey: cdh-impala
nameTemplate:
  dataSourceFormat: Impala <Tablename>
  tableFormat: <tablename>
  schemaFormat: impala
connection:
  hostname: your.hadoop.hostname.example.com
  port: 21050
  ssl: true
  database: default
  handler: Apache Impala
  authenticationMethod: kerberos
  username: usera
  userFiles:
    - keyName: TrustedCerts
      content: <Base64 encoded contents of file go here>
      userFilename: tls-ca-bundle.pem
sources:
  - table: medical_records_parquet
    schema: default
  - table: nyc_taxi_fare_parquet
    schema: default
  - table: nyc_taxi_trip_parquet
    schema: default

connectionKey: redshift
connection:
  hostname: your-redshift-cluster.djie25k.us-east-1.redshift.amazonaws.com
  port: 5439
  ssl: true
  database: your_database_with_external_schema
  username: awsuser
  password: your_password
  handler: Redshift
  schema: external_schema
nameTemplate:
  dataSourceFormat: <Tablename>
  schemaFormat: <schema>
  tableFormat: <tablename>
  schemaProjectNameFormat: <Schema>
  nativeSchemaFormat: <schema>_immuta
  nativeViewFormat: <tablename>
sources:
  - all: true

connectionKey: tpc-snowflake
nameTemplate:
  dataSourceFormat: Snowflake <Tablename>
  tableFormat: <tablename>
  schemaFormat: snowflake
connection:
  hostname: example.hostname.snowflakecomputing.com
  port: 443
  ssl: true
  database: TPC
  username: USERA
  password: "${SNOWFLAKE_PASSWORD}"
  schema: PUBLIC
  warehouse: IT_WH
  handler: Snowflake
sources:
  - table: CASE
    schema: PUBLIC
  - table: CASE2
    schema: PUBLIC
  - table: CUSTOMER
    schema: PUBLIC
  - table: WEB_SALES
    schema: PUBLIC

$ immuta sdd template -h
Manage Sensitive Data Discovery Templates

Usage:
  immuta sdd template [command]

Available Commands:
  create      Create an SDD template
  delete      Delete the passed SDD template
  get         Get an SDD template
  global      Get the SDD global template
  search      Search all templates
  update      Update an SDD template

Flags:
  -h, --help   Help for template

Global Flags:
      --config string    Config file (default $HOME/.immutacfg.yaml)
  -p, --profile string   Specifies the profile for what instance/api the cli will use (default "default")

Use "immuta sdd template [command] --help" for more information about a command.

$ immuta sdd template create ./account-template.json -o json
{
  "name": "ACCOUNT_NUMBERS_FRAMEWORK",
  "displayName": "Account Numbers Framework",
  "description": "This framework contains the identifier that recognizes account numbers.",
  "createdBy": {
    "id": 1,
    "name": "Example User",
    "email": "[email protected]"
  },
  "id": 2,
  "createdAt": "2022-03-28T15:48:02.977Z",
  "updatedAt": "2022-03-28T15:48:02.977Z",
  "classifiers": [
    {
      "name": "ACCOUNT_NUMBER_IDENTIFIER",
      "overrides": {}
    }
  ]
}

$ immuta sdd template get ACCOUNT_NUMBERS_FRAMEWORK
Getting template ACCOUNT_NUMBERS_FRAMEWORK...
{
  "name": "ACCOUNT_NUMBERS_FRAMEWORK",
  "displayName": "Account Numbers Framework",
  "description": "This framework contains the identifier that recognizes account numbers.",
  "createdBy": {
    "id": 1,
    "name": "Example User",
    "email": "[email protected]"
  },
  "id": 2,
  "createdAt": "2022-03-28T15:48:02.977Z",
  "updatedAt": "2022-03-28T15:48:02.977Z",
  "classifiers": [
    {
      "name": "ACCOUNT_NUMBER_IDENTIFIER",
      "overrides": {}
    }
  ]
}

$ immuta sdd template global
Getting global template...
{
  "name": "ACCOUNT_NUMBERS_FRAMEWORK",
  "displayName": "Account Numbers Framework",
  "description": "This framework contains the identifier that recognizes account numbers.",
  "createdBy": {
    "id": 1,
    "name": "Example User",
    "email": "[email protected]"
  },
  "id": 3,
  "createdAt": "2022-03-28T17:10:48.507Z",
  "updatedAt": "2022-03-28T17:10:48.507Z",
  "classifiers": [
    {
      "name": "ACCOUNT_NUMBER_IDENTIFIER",
      "overrides": {}
    }
  ]
}

$ immuta sdd template search --classifiers="ACCOUNT_NUMBER_IDENTIFIER"
Searching all templates...
ACCOUNT_NUMBERS_FRAMEWORK This framework contains the identifier that recognizes account numbers.
Displaying 1 of 1 templates

$ immuta sdd template update ACCOUNT_NUMBERS_FRAMEWORK ./account-template -o json
{
  "name": "ACCOUNT_NUMBERS_FRAMEWORK",
  "displayName": "Account Numbers Framework",
  "description": "This framework contains the identifier that recognizes account numbers.",
  "createdBy": {
    "id": 1,
    "name": "Example User",
    "email": "[email protected]"
  },
  "id": 2,
  "createdAt": "2022-03-28T15:48:02.977Z",
  "updatedAt": "2022-03-28T16:15:01.791Z",
  "classifiers": [
    {
      "name": "ACCOUNT_NUMBER_IDENTIFIER",
      "overrides": {}
    }
  ]
}

$ immuta sdd template delete ACCOUNT_NUMBERS_FRAMEWORK -o json
{
  "name": "ACCOUNT_NUMBERS_FRAMEWORK",
  "displayName": "Account Numbers Framework",
  "description": "This framework contains the identifier that recognizes account numbers.",
  "createdBy": {
    "id": 1,
    "name": "Example User",
    "email": "[email protected]"
  },
  "id": 2,
  "createdAt": "2022-03-28T15:48:02.977Z",
  "updatedAt": "2022-03-28T16:15:01.791Z",
  "classifiers": [
    {
      "name": "ACCOUNT_NUMBER_FRAMEWORK",
      "overrides": {}
    }
  ]
}

curl -X 'POST' \
    'https://<your-immuta-url.com>/native-s3/handler' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-api-key>' \
    -d '{
    "type": "Native S3",
    "integrationId": <id-of-your-s3-integration>,
    "dataSources": [
      {
        "dataSourceName": "<name-of-data-source>",
        "prefix": "</data-source-prefix>"
      }
    ]
    }'

{
  "dataSourceId": 1,
  "prefix": "research-data-source",
  "dataSourceName": "s3://research-data-source (64*****50499/us-east-2)"
}

curl \
    --request GET \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer dea464c07bd07300095caa8" \
    https://your-immuta-url.com/native-s3/handler/1

{
  "id": 1,
  "metadata": {
    "prefix": "research-data-source",
    "integrationId": 2,
    "dataSourceName": "s3://research-data-source (64*****50499/us-east-2)"
  },
  "type": "nativeS3Handler",
  "awsLocationPath": "s3://"
}

curl \
    --request DELETE \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer dea464c07bd07300095caa8" \
    https://your-immuta-url.com/dataSource/1

{
  "success": true,
  "id": 1,
  "schemaEvolutionId": 1,
  "name": "s3://research-data-source (64*****50499/us-east-2)",
  "disabled": true,
  "handlerDeleteErrorMessage": null
}