# Integration Configuration Payload The parameters for configuring an integration in Immuta are outlined in the table below. | Parameter | Description | Required or optional | Default values | Accepted values | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **type** `string` | The type of integration to configure. | Required | - | | | **autoBootstrap** `boolean` | When `true`, Immuta will automatically configure the integration in your Azure Synapse Analytics, Databricks Unity Catalog, or Snowflake environment for you. When `false`, you must set up your environment manually before configuring the integration with the API. This parameter must be set to `false` in the Amazon Redshift Spectrum, Amazon S3, and Google BigQuery configurations. See the specific how-to guide for configuring your integration for details: [Azure Synapse Analytics](https://documentation.immuta.com/SaaS/developer-guides/api-intro/integrations-api/how-to-guides/synapse-api), [Databricks Unity Catalog](https://documentation.immuta.com/SaaS/developer-guides/api-intro/integrations-api/how-to-guides/databricks-uc-api), or [Snowflake](https://documentation.immuta.com/SaaS/developer-guides/api-intro/integrations-api/how-to-guides/snowflake-api). | Required for all integrations except Starburst (Trino) | - | `true` or `false` | | **config** `object` | This object specifies the integration settings. See the **config** object description for your integration for details: [Amazon Redshift Spectrum](#redshift-configuration-objects), [Amazon S3](#amazon-s3-configuration-object), [Azure Synapse Analytics](#azure-synapse-analytics-configuration-objects), [Databricks Unity Catalog](https://documentation.immuta.com/SaaS/developer-guides/api-intro/connections-api/how-to-guides/register-a-connection/register-a-databricks-unity-catalog-connection), [Google BigQuery](#google-bigquery-configuration-object), or [Snowflake](#snowflake-configuration-objects). | Required for all integrations except Starburst (Trino) | - | - | ## Amazon S3 configuration object The **config** object configures the S3 integration. The table below outlines its child parameters. | Parameter | Description | Required or optional | Default values | Accepted values | | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | -------------- | ------------------------------------------------------------------ | | **name** `string` | A name for the integration that is unique across all Amazon S3 integrations configured in Immuta. | Required | - | - | | **awsAccountId** `string` | The ID of your AWS account. | Required | - | - | | **awsRegion** `string` | The AWS region to use. | Required | - | Any valid AWS region (us-east-1, for example) | | **awsLocationRole** `string` | The AWS IAM role ARN assigned to the base access grants location. This is the role the AWS Access Grants service assumes to vend credentials to the grantee. When a grantee accesses S3 data, the AWS Access Grants service attaches session policies and assumes this role in order to vend scoped down credentials to the grantee. This role needs full access to all paths under the S3 location prefix. | Required | - | - | | **awsLocationPath** `string` | The base S3 location prefix that Immuta will use for this connection when registering S3 data sources. This path must be unique across all S3 integrations configured in Immuta. | Required | - | - | | **awsRoleToAssume** `string` | The AWS IAM role ARN Immuta assumes when interacting with AWS. | Required when **authenticationType** is `auto`. | `[]` | - | | **authenticationType** `string` | The method used to authenticate with AWS when configuring the S3 integration. | Required | - | | | **awsAccessKeyId** `string` | The AWS access key ID for the AWS account configuring the integration. | Required when **authenticationType** is `accessKey`. | - | - | | **awsSecretAccessKey** `string` | The AWS secret access key for the AWS account configuring the integration. | Required when **authenticationType** is `accessKey`. | - | - | | **port** `number` | The port to use when connecting to your S3 Access Grants instance. | Optional | `443` | `0`-`65535` | ## Azure Synapse Analytics configuration objects The **config** object configures the Azure Synapse Analytics integration. The table below outlines its child parameters. | Parameter | Description | Required or optional | Default values | Accepted values | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------- | | **host** `string` | The URL of your Azure Synapse Analytics account. | Required | - | Valid URL hostnames. | | **database** `string` | Name of an existing database where the Immuta system user will store all Immuta-generated schemas and views. | Required | - | - | | **schema** `string` | Name of the Immuta-managed schema where all your secure views will be created and stored. | Required | - | - | | **authenticationType** `string` | The method used to authenticate with Azure Synapse Analytics when configuring the integration. | Required | - | | | **username** `string` | The username of the system account that can act on Azure Synapse Analytics objects and configure the integration. | Required when **authenticationType** is `userPassword`. | - | - | | **password** `string` | The password of the system account that can act on Azure Synapse Analytics objects and configure the integration. | Required when **authenticationType** is `userPassword`. | - | - | | **displayName** `string` | The application display name. This value must match the name of the application you registered in Microsoft Entra ID. | Required when **authenticationType** is `entraIdOAuthClientSecret`. | - | - | | **clientId** `string` | The application client ID, which can be found on the overview page of the application you created in Microsoft Entra ID. | Required when **authenticationType** is `entraIdOAuthClientSecret`. | - | - | | **tenantId** `string` | The application tenant ID, which can be found on the overview page of the application you created in Microsoft Entra ID. | Required when **authenticationType** is `entraIdOAuthClientSecret`. | - | - | | **clientSecret** `string` | The secret string Immuta will use to prove its identity when requesting a token. Use the **value** of the secret, not the secret ID. | Required when **authenticationType** is `entraIdOAuthClientSecret`. | - | - | | [**metadataDelimiters**](#metadata-delimiters-object) `object` | This object is a set of delimiters that Immuta uses to store profile data in Azure Synapse Analytics. See the [object description](#metadata-delimiters-object) for parameters. | Optional | See the [object description](#metadata-delimiters-object) for default values. | - | | **port** `number` | The port to use when connecting to your Azure Synapse Analytics account host. | Optional | `1433` | `0`-`65535` | | [**impersonation**](#azure-synapse-analytics-impersonation-object) `object` | Enables user impersonation. See the [impersonation object description](#azure-synapse-analytics-impersonation-object) for parameters. | Optional | Disabled by default. See the [impersonation object description](#azure-synapse-analytics-impersonation-object) for parameters. | - | | **connectArgs** `string` | The connection string arguments to pass to the Node.js driver when connecting as the Immuta system user. | Optional | - | - | ### Azure Synapse Analytics impersonation object The **impersonation** object enables and defines roles for user impersonation for Azure Synapse Analytics. The table below outlines its child parameters. | Parameter | Description | Default values | Accepted values | | --------------------- | ---------------------------------------- | ---------------------- | ----------------- | | **enabled** `boolean` | When `true`, enables user impersonation. | `false` | `true` or `false` | | **role** `string` | The name of the user impersonation role. | `IMMUTA_IMPERSONATION` | - | ### Delete Azure Synapse Analytics payload The credentials you used when configuring your integration are required in the payload when **autoBootstrap** was set to `true` when setting up your integration. For integration configurations with **autoBootstrap** set to `false`, no payload is required when deleting the integration. | Parameter | Description | Required or optional | Accepted values | | ------------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | --------------- | | **authenticationType** `string` | The type of authentication used when originally configuring the Azure Synapse Analytics integration. | Required | `userPassword` | | **username** `string` | The username of the system account that configured the integration. | Required if **autoBootstrap** was `true` when setting up the integration. | - | | **password** `string` | The password of the system account that configured the integration. | Required if **autoBootstrap** was `true` when setting up the integration. | - | ### Metadata delimiters object The **metadataDelimiters** object specifies the delimiters that Immuta uses to store profile data in Azure Synapse Analytics. The table below outlines its child parameters. | Parameter | Description | Default values | Accepted values | | ----------------------------- | -------------------------------------------------- | -------------- | --------------- | | **hashDelimiter** `string` | A delimiter used to separate key-value pairs. | \` | \` | | **hashKeyDelimiter** `string` | A delimiter used to separate a key from its value. | `:` | - | | **arrayDelimiter** `string` | A delimiter used to separate array elements. | `,` | - | ## Databricks Unity Catalog configuration objects {% hint style="info" %} The objects and attributes in this section are for the Databricks Unity Catalog legacy integration. See the [Register a Databricks Unity Catalog connection guide](https://documentation.immuta.com/SaaS/developer-guides/api-intro/connections-api/how-to-guides/register-a-connection/register-a-databricks-unity-catalog-connection) to configure the Databricks Unity Catalog integration and register data in a single step. {% endhint %} The **config** object configures the Databricks Unity Catalog integration. The table below outlines its child parameters. | Parameter | Description | Required or optional | Default values | Accepted values | | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | | **port** `number` | The port to use when connecting to your Databricks account host. | Optional | `443` | `0`-`65535` | | **workspaceUrl** `string` | Databricks workspace URL. For example, `my-workspace.cloud.databricks.com`. | Required | - | - | | **httpPath** `string` | The HTTP path of your Databricks cluster or SQL warehouse. | Required | - | - | | **authenticationType** `string` | The type of authentication to use when connecting to Databricks. | Required | - | | | **token** `string` | The Databricks personal access token. This is the access token for the Immuta service principal. | Required if **authenticationType** is `token`. | - | - | | [**proxyOptions**](#databricks-unity-catalog-proxy-options-object) `object` | This object allows you to configure your integration to use a proxy server. See the [proxy options object description](#databricks-unity-catalog-proxy-options-object) for child attributes. | Optional | `[]` | - | | [**oAuthClientConfig**](#databricks-unity-catalog-oauth-configuration-object) `object` | This object represents your OAuth configuration. To use this authentication method, **authenticationType** must be `oAuthM2M`. See the [oAuthClientConfig object description](#databricks-unity-catalog-oauth-configuration-object) for parameters. | Required if you selected `oAuthM2M` as your **authenticationType**. | - | - | | [**audit**](#databricks-unity-catalog-audit-object) `object` | This object enables Databricks Unity Catalog query audit. See the [audit object description](#databricks-unity-catalog-audit-object) for parameters. | Optional | Disabled by default. See the [audit object description](#databricks-unity-catalog-audit-object) for parameters. | - | | **workspaceIds** `array[integer]` | This array can be used to scope query audit to only ingest activity for specified workspaces. | Optional | `[]` | | | **catalog** `string` | The name of the Databricks catalog Immuta will create to store internal entitlements and other user data specific to Immuta. This catalog will only be readable for the Immuta service principal and should not be granted to other users. The catalog name may only contain letters, numbers, and underscores and cannot start with a number. | Optional | `immuta` | - | | [**groupPattern**](#group-pattern-object) `object` | This object allows you to exclude an account-level group in Databricks from data policies. See the [groupPattern object description](#group-pattern-object) for parameters. | Optional | `[]` | - | | [**additionalWorkspaceConnections**](#additional-workspace-connections) `array[ object]` | This object allows you to configure additional workspace connections for your integration. See the [additionalWorkspaceConnections description](#additional-workspace-connections) for child attributes. | Optional | `[]` | - | ### Additional workspace connections {% hint style="info" %} The objects and attributes in this section are currenlty only supported for the Databricks Unity Catalog legacy integration. {% endhint %} The **additionalWorkspaceConnections** array allows you to configure additional workspace connections for your Databricks Unity Catalog integration. The table below outlines its child attributes. | Attribute | Description | Required or optional | Default values | Accepted values | | -------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------ | | **workspaceUrl** `string` | Databricks workspace URL. For example, `my-workspace.cloud.databricks.com`. | Required | - | - | | **httpPath** `string` | The HTTP path of the compute for the workspace. | Required | - | - | | **authenticationType** `string` | The type of authentication to use when connecting to Databricks. The additional workspace credentials will be used when processing objects in bound catalogs that are not accessible via the default workspace. | Required | - | | | **token** `string` | The Databricks personal access token. This is the access token for the Immuta service principal. The additional workspace credentials will be used when processing objects in bound catalogs that are not accessible via the default workspace. | Required if **authenticationType** is `token`. | - | - | | [**oAuthClientConfig**](#databricks-unity-catalog-oauth-configuration-object) `object` | This object represents your OAuth configuration. To use this authentication method, **authenticationType** must be `oAuthM2M`. See the [oAuthClientConfig object description](#databricks-unity-catalog-oauth-configuration-object) for parameters. The additional workspace credentials will be used when processing objects in bound catalogs that are not accessible via the default workspace. | Required if you selected `oAuthM2M` as your **authenticationType**. | - | - | | **catalogs** `string` |

The name of the catalog to use for this additional workspace connection. The catalog name may only contain letters, numbers, and underscores and cannot start with a number. Users may configure one additional workspace connection per catalog.

Users may still bind a catalog to more than one workspace in Databricks, as long as there is only one additional workspace connection in Immuta, as Immuta requires a single connection from which to control the catalog.

| Required | `-` | - | ### Databricks Unity Catalog audit object The **audit** object enables Databricks Unity Catalog query audit. The table below outlines its child parameter. | Parameter | Description | Default values | Accepted values | | --------------------- | ---------------------------------------------------------------------- | -------------- | ----------------- | | **enabled** `boolean` | This setting enables or disables Databricks Unity Catalog query audit. | `false` | `true` or `false` | ### Group pattern object The [**groupPattern**](#user-content-fn-1)[^1] object excludes the listed group from having data policies applied in the Databricks Unity Catalog integration. This account-level group should be used for privileged users and service accounts that require an unmasked view of data. The table below outlines its child parameters. | Parameter | Description | Default values | Accepted values | | ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | --------------- | | **deny** `string` | The name of an account-level group in Databricks that will be excluded from having data policies applied. This group should be used for privileged users and service accounts that require an unmasked view of data. See the [Databricks Unity Catalog integration reference guide](https://documentation.immuta.com/SaaS/configuration/integrations/databricks/databricks-unity-catalog/unity-catalog-overview#policy-exemption-groups) for details. | `immuta_exemption_group` | - | ### Databricks Unity Catalog proxy options object The **proxyOptions** object represents your proxy server configuration in Databricks Unity Catalog. The table below outlines the object's child attributes. | Parameter | Description | Required or optional | Default values | Accepted values | | --------------------- | ----------------------------------------------------- | -------------------- | -------------- | ------------------- | | **host** `string` | The hostname of the proxy server. | Required | - | Valid URL hostnames | | **port** `number` | The port to use when connecting to your proxy server. | Optional | `443` | `0`-`65535` | | **username** `string` | The username to use with the proxy server. | Optional | `[]` | - | | **password** `string` | The password to use with the proxy server. | Optional | `[]` | - | ### Databricks Unity Catalog OAuth configuration object The **oAuthClientConfig** object represents your OAuth configuration in Databricks Unity Catalog. This object is required if you set `oAuthM2M` as your [authentication type in the Databricks Unity Catalog integration configuration](#databricks-unity-catalog-configuration-objects). The table below outlines the object's child parameters. | Parameter | Description | Required or optional | Default values | Accepted values | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------- | ------------------------------------------------------------------ | --------------- | | **clientId** `string` | The client identifier of the Immuta service principal you configured. This is the client ID displayed in Databricks when creating the client secret for the service principal. | Required | - | - | | **authorityUrl** `string` | Authority URL of your identity provider. | Required | `https://.cloud.databricks.com/oidc/v1/token` | - | | **scope** | The scope limits the operations and roles allowed in Databricks by the access token. See the [OAuth 2.0 documentation](https://oauth.net/2/scope/) for details about scopes. | Optional | `[]` | - | | **clientSecret** `string` | [Client secret created for the Immuta service principal](https://docs.databricks.com/en/dev-tools/auth/oauth-m2m.html). | Required | - | - | ## Google BigQuery configuration object The **config** object configures the Google BigQuery integration. The table below outlines its child parameters. | Parameter | Description | Required or optional | Default values | Accepted values | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------- | -------------- | -------------------------------------------------- | | **role** `string` | Google Cloud role used to connect to Google BigQuery. | Required | - | - | | **datasetSuffix** `string` | Suffix to postfix to the name of each dataset created to store secure views. This string must start with an underscore. | Required | - | - | | **dataset** `string` | Name of the BigQuery dataset to provision inside of the project for Immuta metadata storage. | Optional | `immuta` | - | | **location** `string` | The dataset's location. After a dataset is created, the location can't be changed. | Required | - | Any valid GCP location (`us-east-1`, for example). | | **credential** `string` | The Google BigQuery service account JSON keyfile credential content. See the [Google documentation](https://developers.google.com/workspace/guides/create-credentials#create_credentials_for_a_service_account) for guidance on generating and downloading this keyfile. | Required | - | - | | **port** `number` | The port to use when connecting to your BigQuery account host. | Optional | `443` | `0`-`65535` | ## Redshift configuration objects {% hint style="info" %} The objects and attributes in this section are for the Amazon Redshift Spectrum integration. See the [Register an Amazon Redshift connection guide](https://documentation.immuta.com/SaaS/configuration/integrations/redshift/amazon-redshift-integration/register-an-amazon-redshift-connection) to configure the Amazon Redshift integration and register data. {% endhint %} The **config** object configures the Amazon Redshift Spectrum integration. The table below outlines its child parameters. | Parameter | Description | Required or optional | Default values | Accepted values | | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------- | | **host** `string` | The URL of your Redshift account. | Required | - | Valid URL hostnames | | **database** `string` | Name of a new or existing database that the Immuta system user will manage and store metadata in. | Required | - | - | | **authenticationType** `string` | The type of authentication to use when connecting to Redshift. | Required | - | `userPassword` | | **username** `string` | The username of the system account that can act on Redshift objects and configure the integration. | Required if you selected `userPassword` as your **authenticationType**. | - | - | | **password** `string` | The password of the system account that can act on Redshift objects and configure the integration. | Required if you selected `userPassword` as your **authenticationType**. | - | - | | **port** `number` | The port to use when connecting to your Redshift account host. | Optional | `5439` | `0`-`65535` | | [**impersonation**](#redshift-impersonation-object) `object` | Enables user impersonation. See the [impersonation object description](#redshift-impersonation-object) for parameters. | Optional | Disabled by default. See the [impersonation object description](#redshift-impersonation-object) for parameters. | - | | **connectArgs** `string` | The connection string arguments to pass to the Node.js driver when connecting as the Immuta system user. | Optional | - | - | ### Redshift impersonation object The **impersonation** object enables and defines roles for user impersonation for Amazon Redshift Spectrum. The table below outlines its child parameters. | Parameter | Description | Default values | Accepted values | | --------------------- | ---------------------------------------- | ---------------------- | ----------------- | | **enabled** `boolean` | When `true`, enables user impersonation. | `false` | `true` or `false` | | **role** `string` | The name of the user impersonation role. | `immuta_impersonation` | - | ## Snowflake configuration objects {% hint style="info" %} The objects and attributes in this section are for the Snowflake legacy integration. See the [Register a Snowflake connection guide](https://documentation.immuta.com/SaaS/developer-guides/api-intro/connections-api/how-to-guides/register-a-connection/register-a-snowflake-connection) to configure the Snowflake integration and register data in a single step. {% endhint %} The **config** object configures the Snowflake integration. The table below outlines its child parameters. | Parameter | Description | Required or optional | Default values | Accepted values | | ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | | **host** `string` | The URL of your Snowflake account. | Required | - | Valid URL hostnames | | **warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | Required | - | - | | **database** `string` | Name of a new empty database that the Immuta system user will manage and store metadata in. | Required | - | - | | **authenticationType** `string` | The type of authentication to use when connecting to Snowflake. | Required | - | | | **username** `string` | The username of a Snowflake account that can act on Snowflake objects and configure the integration. | Required if you selected `userPassword` as your **authenticationType**. | - | - | | **password** `string` | The password of a Snowflake account that can act on Snowflake objects and configure the integration. | Required if you selected `userPassword` as your **authenticationType**. | - | - | | **privateKey** `string` | The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. | Required if you selected `keyPair` as your **authenticationType**. | - | - | | [**oAuthClientConfig**](#snowflake-oauth-configuration-object) `object` | This object represents your OAuth configuration. To use this authentication method, **autoBootstrap** must be `false`. See the [oAuthClientConfig object description](#snowflake-oauth-configuration-object) for parameters. | Required if you selected `oAuthClientCredentials` as your **authenticationType**. | - | - | | **role** `string` | The privileged Snowflake role used by the Immuta system account when configuring the Snowflake integration. | Required when **autoBootstrap** is `true`. | - | - | | **port** `number` | The port to use when connecting to your Snowflake account host. | Optional | `443` | `0`-`65535` | | [**audit**](#audit-object) `object` | This object enables Snowflake query audit. See the [audit object description](#audit-object) for the parameter. | Optional | Disabled by default. See the [audit object description](#audit-object) for the parameter. | - | | [**impersonation**](#snowflake-impersonation-object) `object` | Enables user impersonation. See the [impersonation object description](#snowflake-impersonation-object) for parameters. | Optional | Disabled by default. See the [impersonation object description](#snowflake-impersonation-object) for parameters. | - | | [**userRolePattern**](#user-role-pattern-object) `object` | This object excludes roles and users from authorization checks. See the [userRolePattern object description](#user-role-pattern-object) for parameters. | Optional | `{[]}` | - | | [**workspaces**](#workspaces-object) `object` | This object represents an Immuta project workspace configured for Snowflake. See the [workspaces object description](#workspaces-object) for parameters. | Optional | Disabled by default. See the [workspaces object description](#workspaces-object) for parameters. | - | | **connectArgs** `string` | The connection string arguments to pass to the Node.js driver when connecting as the Immuta system user. | Optional | - | - | | **privilegedConnectArgs** `string` | The connection string arguments to pass to the Node.js driver when connecting as the privileged user. | Optional when **autoBootstrap** is `true`. | - | - | | [**lineage**](#lineage-object) `object` | Enables Snowflake lineage ingestion so that Immuta can apply tags added to Snowflake tables to their descendant data source columns. See the [lineage ingestion object description](#lineage-object) for parameters. | Optional | - | - | ### Audit object The **audit** object enables Snowflake query audit. The table below outlines its child parameter. | Parameter | Description | Default values | Accepted values | | --------------------- | ------------------------------------------------------- | -------------- | ----------------- | | **enabled** `boolean` | This setting enables or disables Snowflake query audit. | `false` | `true` or `false` | ### Delete Snowflake integration payload The authentication type and credentials you used when configuring your integration are required in the payload when **autoBootstrap** was set to `true` when setting up your integration. For integration configurations with **autoBootstrap** set to `false`, no payload is required when deleting the integration. | Parameter | Description | Required or optional | Accepted values | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | | **authenticationType** `string` | The type of authentication used when originally configuring the integration. | Required if **autoBootstrap** was `true` when configuring the integration. | | | **username** `string` | The username of the system account that configured the integration. | Required if you selected `userPassword` as your **authenticationType**. | - | | **password** `string` | The password of the system account that configured the integration. | Required if you selected `userPassword` as your **authenticationType**. | - | | **privateKey** `string` | The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. | Required if you selected `keyPair` as your **authenticationType**. | - | | [**oAuthClientConfig**](#snowflake-oauth-configuration-object) `object` | This object represents your OAuth configuration. See the [oAuthClientConfig object description](#snowflake-oauth-configuration-object) for parameters. | Required if you selected `oAuthClientCredentials` as your **authenticationType**. | - | | **role** `string` | The privileged Snowflake role used by the Immuta system account when configuring the Snowflake integration. | Required when **autoBootstrap** is `true` for Snowflake. | - | ### Snowflake impersonation object The **impersonation** object enables and defines roles for user impersonation for Snowflake. The table below outlines its child parameters. | Parameter | Description | Default values | Accepted values | | --------------------- | ---------------------------------------- | ---------------------- | ----------------- | | **enabled** `boolean` | When `true`, enables user impersonation. | `false` | `true` or `false` | | **role** `string` | The name of the user impersonation role. | `IMMUTA_IMPERSONATION` | - | ### Lineage object The **lineage** object enables Snowflake lineage ingestion. When this setting is enabled, Immuta automatically applies tags added to a Snowflake table to its descendant data source columns in Immuta so you can build policies using those tags to restrict access to sensitive data. The table below outlines its child parameters. | Parameter | Description | Required or optional | Default values | Accepted values | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------- | -------------- | ---------------------------------------------------------------- | | **enabled** `boolean` | When `true`, enables Snowflake lineage so that Immuta can apply tags added to Snowflake data sources to their descendant data source columns in Immuta. | Optional | `false` | `true` or `false` | | **lineageConfig** `object` | Configures what tables Immuta will ingest lineage history for, the number of rows to ingest per batch, and what tags to propagate. Child parameters include **tableFilter**, **tagFilterRegex**, and **ingestBatchSize**. | Required if **enabled** is `true`. | - | - | | lineageConfig.**tableFilter** `string` | This child parameter of **lineageConfig** determines which tables Immuta will ingest lineage for. Use a regular expression that excludes `/` from the beginning and end to filter tables. Without this filter, Immuta will attempt to ingest lineage for every table on your Snowflake instance. | Optional | `^.*$` | Regular expression that excludes `/` from the beginning and end. | | lineageConfig.**tagFilterRegex** `string` | This child parameter of **lineageConfig** determines which tags to propagate using lineage. Use a regular expression that excludes `/` from the beginning and end to filter tags. Without this filter, Immuta will ingest lineage for every tag on your Snowflake instance. | Optional | `^.*$` | Regular expression that excludes `/` from the beginning and end. | | lineageConfig.**ingestBatchSize** `number` | This child parameter of **lineageConfig** configures the number of rows Immuta ingests per batch when streaming Access History data from your Snowflake instance. | Optional | `1000` | Minimum value of `1`. | ### Snowflake OAuth configuration object The **oAuthClientConfig** object represents your OAuth configuration in Snowflake. This object is required if you set `oAuthClientCredentials` as your authentication type in the Snowflake integration configuration, and you must set **autoBootstrap** to `false`. The table below outlines the object's child parameters. | Parameter | Description | Required or optional | Default values | Accepted values | | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ | -------------- | ----------------- | | **provider** `string` | The identity provider for OAuth, such as Okta. | Required | - | - | | **clientId** `string` | The client identifier of your registered application. | Required | - | - | | **authorityUrl** `string` | Authority URL of your identity provider. | Required | - | - | | **useCertificate** `boolean` | Specifies whether or not to use a certificate and private key for authenticating with OAuth. | Required | - | `true` or `false` | | **publicCertificateThumbprint** `string` | Your certificate thumbprint. | Required if **useCertificate** is `true`. | - | - | | **oauthPrivateKey** `string` | The private key content. | Required if **useCertificate** is `true`. | - | - | | **clientSecret** `string` | Client secret of the application. | Required if **useCertificate** is `false`. | - | - | | **resource** `string` | An optional resource to pass to the token provider. | Optional | - | - | | **scope** `string` | The scope limits the operations and roles allowed in Snowflake by the access token. See the [OAuth 2.0 documentation](https://oauth.net/2/scope/) for details about scopes. | Optional | `[]` | - | ### User role pattern object The **userRolePattern** object excludes roles and users from authorization checks in the Snowflake integration. The table below outlines its child parameter. | Parameter | Description | Default values | Accepted values | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | -------------- | --------------- | | **exclude** `array[string]` | This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. | `[]` | - | ### Workspaces object The **workspaces** object represents an Immuta project workspace configured for Snowflake. The table below outlines its child parameters. | Parameter | Description | Default values | Accepted values | | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- | ----------------- | | **enabled** `boolean` | This setting enables or disables Snowflake project workspaces. If you use Snowflake secure data sharing with Immuta, set this property to `true`, as project workspaces are required. If you use Snowflake table grants, set this property to `false`; project workspaces cannot be used when Snowflake table grants are enabled. | `false` | `true` or `false` | | **warehouses** `array[string]` | This array is a list of warehouses workspace users have usage privileges on. | `[]` | - | [^1]: This is also referred to as a [policy exemption group](https://documentation.immuta.com/SaaS/configuration/integrations/databricks/databricks-unity-catalog/unity-catalog-overview#policy-exemption-groups).