Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
The connection API is a REST API which allows users to register a connection to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. Then Immuta can manage and enforce access controls on your data through that connection.
These guides provide step-by-step instructions for registering and managing your connection.
Register a connection:
: This guide defines body parameters for registering connections.
The parameters for configuring a connection in Immuta are outlined in the table below.
connectionKey string
A unique name for the connection.
Required
-
connection object
See the following object descriptions:
.
Required
The connection object configures the connection between the technology and Immuta. The sections below outline the child parameters specific to each technology.
The connection object configures the Databricks Unity Catalog connection information. The table below outlines its child parameters.
The connection object configures the AWS Lake Formation connection information. The table below outlines its child parameters.
The settings object configures connection settings. The table below outlines its child parameters.
The options object configures an option for your connection. The table below outlines its child parameter.
The nativeIntegration object configures integration information and options. The table below outlines its child parameters.
The config object configures the Snowflake integration information and options. The table below outlines its child parameters.
The config object configures the Databricks Unity Catalog integration information and options. The table below outlines its child parameters.
The privateKey object represents your private key in Snowflake. This object is required if you set privateKey as your authentication type. The table below outlines the object's child parameters
The oAuthClientConfig object represents your OAuth configuration in Snowflake. This object is required if you set oAuthClientCredentials as your authentication type. The table below outlines the object's child parameters
The oauthPrivateKey object represents your OAuth private key in Snowflake. This object is required if you set oAuthClientCredentials as your authentication type, and useCertificate is set to true. The table below outlines the object's child parameters.
The impersonation object enables and defines roles for user impersonation for Snowflake. The table below outlines its child parameters.
The workspaces object represents an Immuta project workspace configured for Snowflake. The table below outlines its child parameters.
The lineage object enables Snowflake lineage ingestion. When this setting is enabled, Immuta automatically applies tags added to a Snowflake table to its descendant data source columns in Immuta so you can build policies using those tags to restrict access to sensitive data. The table below outlines its child parameters.
The userRolePattern object excludes roles and users from authorization checks in the Snowflake integration. The table below outlines its child parameter.
The groupPattern object excludes the listed group from having data policies applied in the Databricks Unity Catalog integration. This account-level group should be used for privileged users and service accounts that require an unmasked view of data. The table below outlines its child parameter.
The oAuthClientConfig object represents your OAuth configuration in Databricks Unity Catalog. This object is required if you set oAuthM2M as your authentication type. The table below outlines the object's child parameters
The audit object enables query audit. The table below outlines its child parameter.
warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Required
-
role string
The privileged Snowflake role used by the Immuta system account when configuring the Snowflake connection. It must be able to see the data that Immuta will govern.
Required
-
authenticationType string
The authentication type to register the connection. Make sure this auth type is the same used when requesting the script.
Required
keyPair
oAuthClientCredentials
userPassword
username string
The username of the system account that can act on Snowflake objects and register the connection.
Required when authenticationType is keyPair or userPassword.
-
password string
The password of the system account that can act on Snowflake objects and register the connection.
Required when authenticationType is userPassword.
-
privateKeyPassword string
The Snowflake private key password.
Required when authenticationType is keyPair and the private key is encrypted.
-
privateKey object
See .
Required when authenticationType is keyPair.
-
oAuthClientConfig object
See .
Required when authenticationType is oAuthClientCredentials.
-
httpPath string
The HTTP path of your Databricks cluster or SQL warehouse.
Required
-
authenticationType string
The authentication type to register the connection. Make sure this auth type is the same used when requesting the script.
Required
token
oAuthM2M
token string
The Databricks personal access token for the service principal created for Immuta.
Required if authenticationType is token
-
oAuthClientConfig object
See .
Required if authenticationType is oAuthM2M
-
accountId string
The Amazon account ID of the Glue Data Catalog that contains the data you want to register.
Yes
-
accessKeyId string
The access key ID of an AWS account with the .
Required if authenticationType is accessKey.
-
secretAccessKey string
The secret access key of an AWS account with the .
Required if authenticationType is accessKey.
-
roleARN string
The Amazon resource name of the role Immuta will assume from Immuta's AWS account in order to perform any operations in your AWS account.
Required if authenticationType is assumedRole.
-
unityCatalog boolean
When true, the integration is for Databricks Unity Catalog.
Required if type is Databricks.
true
privateKeyPassword string
The Snowflake private key password.
Required when authenticationType is keyPair and the private key is encrypted.
-
keyName string
The Immuta-given name of your private key.
Required when authenticationType is keyPair.
PRIV_KEY_FILE
userFilename string
The name of the private key file on your machine.
Required when authenticationType is keyPair.
-
content string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
In the , this is the config.privateKey attribute.
Required when authenticationType is keyPair.
-
oAuthClientConfig object
See .
Required when authenticationType is oAuthClientCredentials.
-
host string
The URL of your Snowflake account.
Required
-
port integer
The port to use when registering your Snowflake account.
Optional. Defaults to 443.
0-65535
warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Required
-
database string
The name of the Snowflake database Immuta will create to store internal entitlements and other user data specific to Immuta. This database will only be readable for the Immuta user and should not be granted to other users. The database name may only contain letters, numbers, and underscores and cannot start with a number.
Required
-
impersonation object
Enables user impersonation. See the .
Optional
-
audit object
This object enables Snowflake query audit. See the .
Optional
-
workspaces object
This object represents an Immuta project workspace configured for Snowflake. See the .
Optional
-
lineage object
Enables Snowflake lineage ingestion so that Immuta can apply tags added to Snowflake tables to their descendant data source columns. See the .
Optional
-
userRolePattern object
This object excludes roles and users from authorization checks. See the user .
Optional
-
catalog string
The name of the Databricks catalog Immuta will create to store internal entitlements and other user data specific to Immuta. This catalog will only be readable for the Immuta service principal and should not be granted to other users. The catalog name may only contain letters, numbers, and underscores and cannot start with a number.
Required
-
authenticationType string
The authentication type to register the connection. Make sure this auth type is the same used when requesting the script.
Required
token
oAuthM2M
token string
The Databricks personal access token for the service principal created for Immuta.
Required if authenticationType is token
-
oAuthClientConfig object
See .
Required if authenticationType is oAuthM2M
-
audit object
This object enables Databricks Unity Catalog query audit. See the .
Optional
-
workspaceIds array
The optional workspaces to filter audit to.
Optional
-
groupPattern object
Excludes the listed group from having data policies applied in the Databricks Unity Catalog integration. See the .
Optional
-
scope string
The scope limits the operations and roles allowed in Snowflake by the access token.
Required
session:role-any
resource string
An optional resource to pass to the token provider.
Optional
-
publicCertificateThumbprint string
Your certificate thumbprint.
Required if useCertificate is true.
-
oauthPrivateKey object
See
Required if useCertificate is true.
-
clientSecret string
Client secret of the application.
Required if useCertificate is false.
-
lineageConfig.tagFilterRegex string
This child parameter of lineageConfig determines which tags to propagate using lineage. Use a regular expression that excludes / from the beginning and end to filter tags. Without this filter, Immuta will ingest lineage for every tag on your Snowflake instance.
Optional
Regular expression that excludes / from the beginning and end.
lineageConfig.ingestBatchSize number
This child parameter of lineageConfig configures the number of rows Immuta ingests per batch when streaming Access History data from your Snowflake instance.
Optional
Minimum value of 1.
scope string
The scope limits the operations and roles allowed in Databricks. See the for details about scopes.
Required
all-apis
clientSecret string
.
Required
-
-
settings object
See Settings object.
Optional
-
options object
See Options object.
Optional
-
nativeIntegration object
Required for Snowflake and Databricks connections
-
technology string
The technology backing the new connection.
Required
Snowflake
Databricks
Glue
hostname string
The URL of your Snowflake account. This is the same as host.
Required
-
port integer
The port to use when registering your Snowflake account.
Required
technology string
The technology backing the new connection.
Required
Databricks
Snowflake
Glue
hostname string
Your Databricks workspace URL. This is the same as host and workspaceURL.
Required
-
port integer
The port to use when registering your Databricks account connection.
Required
technology string
The technology backing the new connection.
Yes
Glue
Snowflake
Databricks
authenticationType string
The authentication type to register the connection.
Yes
accessKey
assumedRole
region string
The region of the AWS account associated with the Glue Data Catalog.
Yes
isActive boolean
If true, data objects will be active (enabled) by default when created in Immuta.
If you enable a Databricks Unity Catalog data object and it has no subscription policy set on it, Immuta will REVOKE access to the data in Databricks for all Immuta users, even if they had been directly granted access to the table in Unity Catalog.
If a user is not registered in Immuta, Immuta will have no effect on that user's access to data in Unity Catalog. See the Databricks Unity Catalog reference guide for more details.
Optional
true
false
activateNewChildren boolean
If true, all new children found during object sync will be registered as active (enabled).
Optional
true
false
dataOwners array
A list of users and groups that are data owners on the connection. These users will be data owners for all the data sources under the data object they are assigned to.
Optional
forceRecursiveCrawl boolean
When true, both active (enabled) and inactive (disabled) objects will be found by object sync.
Optional
true
false
type string
The type of technology.
Required
Snowflake
Databricks
autoBootstrap boolean
When false, you must set up your environment manually before registering the connection with the API.
Required
false
config object
This object specifies the integration settings. See the config object description for your technology: Snowflake or Databricks Unity Catalog.
Required
authenticationType string
The authentication type to register the connection. Make sure this auth type is the same as the config object.
Required
keyPair
oAuthClientCredentials
userPassword
username string
The username of the system account that can act on Snowflake objects and register the connection.
Required when authenticationType is keyPair or userPassword.
-
password string
The password of the system account that can act on Snowflake objects and register the connection.
Required when authenticationType is userPassword.
host string
Your Databricks workspace URL. This is the same as hostname and workspaceURL.
Required
-
port integer
The port to use when registering your Databricks account connection.
Optional. Defaults to 443.
0-65535
httpPath string
The HTTP path of your Databricks cluster or SQL warehouse.
Required
keyName string
The Immuta-given name of your private key.
PRIV_KEY_FILE
userFilename string
The name of the private key file on your machine.
-
content string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
In the integrations API, this is the config.privateKey attribute.
-
useCertificate boolean
Specifies whether or not to use a certificate and private key for authenticating with OAuth.
Required
true
false
clientId string
The client identifier of your registered application.
Required
-
authorityUrl string
Authority URL of your identity provider.
Required
keyName string
The Immuta-given name of your private key.
oauth client certificate
userFilename string
The name of your private key file on your machine.
-
content string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
In the integrations API, this is the config.oauthPrivateKey attribute.
-
enabled boolean
When true, enables user impersonation.
true or false
role string
The name of the user impersonation role.
-
enabled boolean
This setting enables or disables Snowflake project workspaces. If you use Snowflake secure data sharing with Immuta, set this property to true, as project workspaces are required. If you use Snowflake table grants, set this property to false; project workspaces cannot be used when Snowflake table grants are enabled.
true or false
warehouses array[string]
This array is a list of warehouses workspace users have usage privileges on.
-
enabled boolean
When true, enables Snowflake lineage so that Immuta can apply tags added to Snowflake data sources to their descendant data source columns in Immuta.
Optional
true or false
lineageConfig object
Configures what tables Immuta will ingest lineage history for, the number of rows to ingest per batch, and what tags to propagate. Child parameters include tableFilter, tagFilterRegex, and ingestBatchSize.
Required if enabled is true.
-
lineageConfig.tableFilter string
This child parameter of lineageConfig determines which tables Immuta will ingest lineage for. Use a regular expression that excludes / from the beginning and end to filter tables. Without this filter, Immuta will attempt to ingest lineage for every table on your Snowflake instance.
Optional
exclude array[string]
This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported.
-
deny string
The name of an account-level group in Databricks that will be excluded from having data policies applied. This group should be used for privileged users and service accounts that require an unmasked view of data. See the Databricks Unity Catalog integration reference guide for details.
immuta_exemption_group
-
useCertificate boolean
Specifies whether or not to use a certificate and private key for authenticating with OAuth.
Required
false
clientId string
The client identifier of your registered application.
Required
-
authorityUrl string
Authority URL of your identity provider.
Required
enabled boolean
If true, query audit is enabled. Set to true for the recommended configuration.
true
false
0-65535
0-65535
Any valid AWS region (us-east-1, for example)
-
-
-
-
-
Regular expression that excludes / from the beginning and end.
-
Data API reference guide
This section details the /data v1 API, which allows users to register a connection to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately.
Required Immuta permission: APPLICATION_ADMIN
You can register a connection from the following technologies to Immuta using supported authentication methods:
AWS access key and secret access key
AWS IAM role
Personal access token (PAT)
OAuth machine-to-machine (M2M)
Username and password
Key pair
Snowflake External OAuth
Data API reference guide
Required Immuta permission: APPLICATION_ADMIN
To deregister a connection from Immuta, do the following:
Generate a script to clean up any Immuta-managed resources from your Snowflake or Databricks Unity Catalog environment. For AWS Lake Formation connections, skip to step 2.
POST /integrations/{id}/scripts/delete
Creates a script to remove Immuta-managed resources from your data platform.
The response returns the script that you will run in your Databricks Unity Catalog or Snowflake environment. Copy it for later.
DELETE /data/object/{connectionKey}
Delete the given connection and all its child objects.
Cleaning up your Snowflake environment Until you manually run the cleanup script in your Snowflake environment, Immuta-managed and Immuta policies will still exist in Snowflake.
Using the copied generated cleanup script from earlier, run it in your Snowflake or Databricks Unity Catalog environment as a privileged user.
The script will remove any objects that were initially created during the process.
id integer
The integration ID. Use the GET /integrations endpoint to list all your integrations and their IDs.
Yes
connectionKey string
The key to uniquely identify the connection. This is the same as the display name of the connection in the Immuta UI.
Yes
connectionKey string
The key to uniquely identify the connection.
childCount integer
The number of child objects of the data object that were deleted.
curl -X 'POST' \
'https://www.organization.immuta.com/integrations/1/scripts/delete' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: 846e9e43c86a4ct1be14290d95127d13f'curl -X 'DELETE' \
'https://<your-immuta-url>/data/object/yourConnectionKey' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \{
"objectPath": ['yourConnectionKey'],
"childCount": 5
}The connection API is a REST API that allows users to register an AWS Lake Formation connection to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. Then Immuta can manage and enforce access controls on your data through that connection. To manage your connection, see the Manage a connection reference guide.
These are permissions that the user registering the connection must have in order to successfully complete setup.
APPLICATION_ADMIN Immuta permission
Create LF-Tag AWS permission
DESCRIBE AWS permission. You must have the DESCRIBE
. The account in which this is set up is referred to as the admin account. This is the account that you will use to initially configure IAM and AWS Lake Formation permissions to give the Immuta service principal access to perform operations. The user in this account must be able to manage IAM permissions and Lake Formation permissions for all data in the Glue Data Catalog.
No AWS Lake Formation connections configured in the same Immuta instance for the same Glue Data Catalog.
The databases and tables you want Immuta to govern must be . Immuta cannot govern resources that use IAM access control or hybrid access mode. To ensure Immuta can govern your resources, verify that the default Data Catalog settings in AWS are unchecked. See the screenshot below and for instructions on changing these settings:
The Immuta service principal is the AWS IAM role that Immuta will assume to perform operations in your AWS account. This role must have all the necessary permissions in AWS Glue and AWS Lake Formation to allow Immuta to register data sources and apply policies.
Create an IAM policy with the following AWS Lake Formation and AWS Glue permissions. You will attach this to your service principal once created.
and select AWS Account as the trusted entity type. This role will be used by Immuta to set up the connection and orchestrate AWS Lake Formation policies. Immuta will assume this IAM role from Immuta's AWS account in order to perform any operations in your AWS account.
Add the IAM policy from step 1 to your service principal. These permissions will allow the service principal to register data sources and apply policies on Immuta's behalf.
Add the service principal as an .
This method follows the principle of least privilege and is the most flexible way of granting permissions to the service principal. LF-Tags cascade down from databases to tables, while allowing for exceptions. This means that when you apply this tag to a database, it will automatically apply to all tables within that database and allow you to remove it from any tables if those should be out of the scope of Immuta’s governance.
Create a new LF-Tag, giving yourself permissions to grant that tag to a user, which will ultimately be your service principal.
In the Lake Formation console, navigate to LF-Tags and permissions and click Add LF-Tag. You will need the Create LF-Tag permission to do this.
POST /data/connection
Copy the request and update the <placeholder_values> with your connection details. Then submit the request.
Find descriptions of the editable attributes in the table below.
Immuta will assume this IAM role from Immuta's AWS account in order to perform any operations in your AWS account.
Before proceeding,
Contact your Immuta representative, and Immuta will
Provide the AWS account to add to your trust policy.
Update the Immuta AWS configuration to allow Immuta to assume the role of your service principal.
All databases that should be registered in the connection
All tables that should be registered in the connection
Any LF-Tags you are using on the resources that should be registered in the connection
The AWS account credentials or AWS IAM role you provide for the Immuta service principal must have permissions to perform the following actions to register data and apply policies:
glue:GetDatabase
glue:GetTables
glue:GetDatabases
glue:GetTable
lakeformation:ListPermissions
lakeformation:BatchGrantPermissions
lakeformation:BatchRevokePermissions
Enable AWS IAM Identity Center (IDC) (recommended): IDC is the best approach for user provisioning because it treats users as users, not users as roles. Consequently, access controls are enforced for the querying user, nothing more. This approach eliminates over-provisioning and permits granular access control. Furthermore, IDC uses trusted identity propagation, meaning AWS propagates a user's identity wherever that user may operate within the AWS ecosystem. As a result, a user's identity always remains known and consistent as they navigate across AWS services, which is a key requirement for organizations to properly govern that user. Enabling IDC does not impact any existing access controls; it is additive. See the map users section for instructions on mapping users from AWS IDC to user accounts in Immuta.
Select LF-Tags and permissions.
Select LF-Tag creators, and then Add LF-Tag creators.
Enter your service principal, and grant it the Create LF-Tag permission and grantable permission.
Click Add to save your changes.
Grant the service principal permissions on any tables that will be registered in Immuta. There are two ways to give the service principal these permissions: either make a new LF-Tag that gives the appropriate permissions and apply it to all databases or tables that Immuta will manage, or make the role a superuser in Lake Formation.
Create a single tag key with one tag value. For example,
Tag key: immuta_governed
Tag value: true
On the LF-Tag key-value pair, grant the ASSOCIATE LF-Tag permission to your own IAM principal.
Grant this tag to the Immuta service principal.
In the Lake Formation console, navigate to Data permissions and click Grant.
Enter the service principal’s IAM role.
Add the key-value pair of the tag you created in step 1.
Under Table Permissions, select the following grantable permissions: SELECT, DESCRIBE, INSERT, DELETE.
Click Grant.
Apply this tag to the resources you would like Immuta to govern. The Immuta service principal will now have the minimum required permissions on these resources. If new resources are created in AWS, you must repeat this process of applying this tag to those resources if you want Immuta to govern them.
This option enables all Lake Formation operations on all data in the Glue Data Catalog. This is highly privileged and runs the risk of managing permissions on data you did not intend to.
This method will grant all necessary permissions to the service principal, but grants more than the service principal needs without being as flexible, since it does not allow for exceptions like the LF-Tag method. You can make the service principal a superuser on the entire catalog or specify individual resources.
In the Lake Formation console, navigate to Data permissions and click Grant.
Enter your service principal’s IAM role.
Select Named Data Catalog resources, and input the Glue Data Catalog ID and any databases or tables you wish to specify.
Under Grantable permissions, select Super and click Grant.
Follow the to grant ALL permissions to the DataLakePrincipalIdentifier for the Immuta service principal ARN.
Set the external ID Immuta provides to you in a condition on the trust relationship for the cross-account IAM specified above. See the AWS documentation for guidance.
connection.region string
The region of the AWS account associated with the Glue Data Catalog.
Yes
connection.accountId string
The Amazon account ID of the Glue Data Catalog that contains the data you want to register.
Yes
connection.accessKeyId string
The access key ID of an AWS account with the .
Required if authenticationType is accessKey.
connection.secretAccessKey string
The secret access key of an AWS account with the .
Required if authenticationType is accessKey.
connection.roleARN string
The Amazon resource name of the role Immuta will assume from Immuta's AWS account in order to perform any operations in your AWS account.
Required if authenticationType is assumedRole.
settings object
Specifications of the connection's settings, including active status.
No
settings.isActive boolean
When false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration.
No
options object
Specification of the connection's default behavior for object crawls.
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes of the AWS Lake Formation connection.
Yes
connection.technology string
The technology backing the new connection.
Yes
connection.authenticationType string
The authentication type to register the connection.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the associated connectionKey.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
Yes
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"glue:GetDatabase",
"glue:GetTables",
"glue:GetDatabases",
"glue:GetTable",
"lakeformation:ListPermissions",
"lakeformation:BatchGrantPermissions",
"lakeformation:BatchRevokePermissions",
"lakeformation:CreateLFTag",
"lakeformation:UpdateLFTag",
"lakeformation:DeleteLFTag",
"lakeformation:AddLFTagsToResource",
"lakeformation:RemoveLFTagsFromResource",
"lakeformation:GetResourceLFTags",
"lakeformation:ListLFTags",
"lakeformation:GetLFTag",
"lakeformation:SearchTablesByLFTags",
"lakeformation:SearchDatabasesByLFTags"
],
"Resource": "*"
}
]
}curl -X 'POST' \
'https://<your-immuta-url>/data/connection' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connectionKey": "<your-connection-key-name>",
"connection": {
"technology": "Glue",
"authenticationType": "accessKey",
"region": "us-east-1",
"accountId": "<your-aws-account-id>",
"accessKeyId": "<your-access-key-id>",
"secretAccessKey": "<your-secret-access-key>"
},
"settings": {
"isActive": false
},
"options": {
"forceRecursiveCrawl": true
}
}'{
"objectPath": ['<your-connection-key-name>'],
"bulkId": "a-new-uuid"
}curl -X 'POST' \
'https://<your-immuta-url>/data/connection' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connectionKey": "<your-connection-key-name>",
"connection": {
"technology": "Glue",
"authenticationType": "assumedRole",
"region": "us-east-1",
"accountId": "<your-aws-account-id>",
"roleARN": "<your-iam-role-arn>"
},
"settings": {
"isActive": false
},
"options": {
"forceRecursiveCrawl": true
}
}'lakeformation:CreateLFTag
lakeformation:UpdateLFTag
lakeformation:DeleteLFTag
lakeformation:AddLFTagsToResource
lakeformation:RemoveLFTagsFromResource
lakeformation:GetResourceLFTags
lakeformation:ListLFTags
lakeformation:GetLFTag
lakeformation:SearchTablesByLFTags
lakeformation:SearchDatabasesByLFTags
Data API reference guide
This page details the /data v1 API, which allows users to register a connection to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. For a how-to on registering a connection, see the Register a connection reference guide.
GET
Search for a connection using a connection key
GET
GET /data/connection/{connectionKey}Search for a connection using a connection key.
Required Immuta permission: CREATE_DATA_SOURCE, APPLICATION_ADMIN, GOVERNANCE, or Data Owner within the hierarchy
GET /data/object/{objectPath}Search for a specific data object using the object path.
Required Immuta permission: CREATE_DATA_SOURCE, APPLICATION_ADMIN, GOVERNANCE, or Data Owner within the hierarchy
POST /data/object/search/{objectPath}Search for the children of the object defined in the objectPath. Or search all top-level data objects if the objectPath is omitted.
Required Immuta permission: CREATE_DATA_SOURCE, APPLICATION_ADMIN, GOVERNANCE, or Data Owner on the object
PUT /data/connection/{connectionKey}Update the connection information for the specified connection. Partial updates are not supported.
Required Immuta permission: APPLICATION_ADMIN
What can be updated?
Using this endpoint, you can only update connection information. To update other integration details, use the endpoint.
The connection parameters differ based on your backing technology. See the for details about the payloads.
POST /data/crawl/{objectPath}Trigger object sync for the specified data object.
Required Immuta permission: GOVERNANCE or APPLICATION_ADMIN global permission or Data Owner on the object
PUT /data/settings/{objectPath}Update the settings through overrides for the specified data object. All changes will trickle down to child objects as new overrides; however, existing overrides on child objects will still be respected. Data owners cannot be removed, only added. To remove data owners, edit the settings at the connection level.
Required Immuta permission: APPLICATION_ADMIN or GOVERNANCE global permission
DELETE /data/object/{objectPath}Delete the given object and all its child objects. For example, if you delete a database, all its schemas and tables will also be deleted.
Required Immuta permission: GOVERNANCE or APPLICATION_ADMIN global permission or Data Owner on the object
The connection API is a REST API which allows users to register a Databricks Unity Catalog connection to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. Then Immuta can manage and enforce access controls on your data through that connection. To manage your connection, see the .
creator.email string
The email of the user who registered the connection.
updatedAt timestamp
The time the connection was updated in Immuta.
updatedBy integer
The ID of the user who updated the connection.
updater.id integer
The ID of the user who updated the connection.
updater.name string
The name of the user who updated the connection.
updater.email string
The email of the user who updated the connection.
nativeIntegrationId integer
The ID of the integration backing the connection.
createdAt timestamp
The time the data object was created in Immuta.
lastCrawled timestamp
The time object sync was last run on the data object.
remoteId string
The ID of the remote data object.
searchText string
A partial, case-insensitive search on name.
No
hits.dataSourceId integer
The ID of the data source if it is a table object that is active (enabled).
hits.createdAt timestamp
The time the data object was created in Immuta.
hits.lastCrawled timestamp
The time object sync was last run on the data object.
hits.remoteId string
The ID of the remote data object.
overrides.dataOwners.id integer
The ID of the user or group to make data owner.
No
overrides.dataOwners.type string
The type to make data owner. Options are user or group.
No
createdAt timestamp
The time the data object was created in Immuta.
lastCrawled timestamp
The time object sync was last run on the data object.
remoteId string
The ID of the remote data object.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
Search for a specific data object
POST
Search for the child objects of the data object defined in the objectPath or search all top-level data objects (connections) if the objectPath is omitted
PUT
Update the connection information for the specified connection
POST
Trigger object sync for the specified data object
PUT
Update the settings through overrides for the specified data object
DELETE
Delete the given data object and all its child objects
connectionKey string
The key to uniquely identify the connection. This is the same as the display name of the connection in the Immuta UI.
Yes
connectionKey string
The key to uniquely identify the connection.
connection object
Integration-specific connection information (i.e., hostname, authentication type, warehouse, etc.)
createdAt timestamp
The time the connection was registered in Immuta.
createdBy integer
The ID of the user who registered the connection.
creator.id integer
The ID of the user who registered the connection.
creator.name string
The name of the user who registered the connection.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.
Yes
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
technology string
The technology that the object comes from: Databricks , Glue , or Snowflake.
state string
Whether the object is currently active (enabled) or inactive (disabled).
settings object
Specifications of the connection's settings, including status, new children status, and data owners.
overrides object
Specifications of the data object's settings that differ from its parents' settings.
dataSourceId integer
The ID of the data source if it is a table object that is active.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.
Yes
sortField string
The field to sort the search results.
No
sortOrder string
Denotes whether to sort the results in ascending (asc) or descending (desc) order. Default is asc.
No
offset integer
Use in combination with limit to fetch pages.
No
limit integer
Limits the number of results displayed per page.
count integer
The number of results for your search.
hits.objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
hits.technology string
The technology that the object comes from (i.e., Snowflake, Databricks, Glue, etc.).
hits.state string
Whether the object is currently active (enabled) or inactive (disabled).
hits.settings object
Specifications of the connection's settings, including status, new children status, and data owners.
hits.overrides object
Specifications of the data object's settings that differ from its parents' settings.
connectionKey string
The key to uniquely identify the connection. This is the same as the display name of the connection in the Immuta UI.
Yes
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.
Yes
forceRecursive boolean
If false, only active (enabled) objects will have object sync run. If true, both active (enabled) and inactive (disabled) data objects will be synced; any child objects from inactive (disabled) objects will be set as inactive (disabled). Defaults to false.
No.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.
Yes
overrides object
A list of settings configured differently from the parent object's settings.
No
overrides.isActive boolean
If true, the object and all its child objects are active (enabled).
If you enable a Databricks Unity Catalog data object and it has no subscription policy set on it, Immuta will REVOKE access to the data in Databricks for all Immuta users, even if they had been directly granted access to the table in Unity Catalog.
If a user is not registered in Immuta, Immuta will have no effect on that user's access to data in Unity Catalog. See the Databricks Unity Catalog reference guide for more details.
No
overrides.activateNewChildren boolean
If true, all new children found during object sync will be registered as active (enabled).
No
overrides.dataOwners array
A list of users and groups that are data owners on the connection. These users will be data owners for all the data sources under the data object they are assigned to.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names should be separated by forward slashes.
technology string
The backing technology of the connection. Options are Databricks , Glue , or Snowflake.
state string
Whether the object is currently active (enabled) or inactive (disabled).
settings object
Specifications of the connection's settings, including status, new children status, and data owners.
overrides object
Specifications of the data object's settings that differ from its parents' settings.
dataSourceId integer
The ID of the data source if it is a table object that is active (enabled).
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.
Yes
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
childCount integer
The number of child objects of the data object that were deleted.
No
No
curl -X 'GET' \
'https://your-immuta-url.com/data/connection/yourConnectionKey' \
-H 'accept: application/json' \
-H 'Authorization: Bearer your-bearer-token'{
"connectionKey": "yourConnectionKey",
"connection": {
"port": 443,
"role": "IMMUTA_SNOWFLAKE_ROLE",
"hostname": "example.us-east-1.snowflakecomputing.com",
"username": "IMMUTA_DB_SYSTEM_ACCOUNT",
"warehouse": "your-warehouse",
"technology": "Snowflake",
"authenticationType": "userPassword"
},
"createdAt": "2023-12-22T18:28:46.328Z",
"createdBy": 2,
"updatedAt": "2023-12-22T18:28:46.328Z",
"updatedBy": 2,
"creator": {
"id": 2,
"name": "Taylor Smith",
"email": "[email protected]"
},
"updater": {
"id": 2,
"name": "Taylor Smith",
"email": "[email protected]"
},
"nativeIntegrationId": 1
}curl -X 'GET' \
'https://your-immuta-url.com/data/object/yourConnectionKey' \
-H 'accept: application/json' \
-H 'Authorization: Bearer your-bearer-token'{
"objectPath": ["yourConnectionKey"],
"technology": "Snowflake",
"state": "active",
"settings": {
"activateNewChildren": {
"value": true,
"hasDescendantsWithOverrides": false
},
"dataOwners": {
"value": [{
"id": 2,
"type": "user"
}],
"hasDescendantsWithOverrides": false
},
"isActive": {
"value": true,
"hasDescendantsWithOverrides": false
}
},
"overrides": [],
"lastCrawled": 2023 - 08 - 21 T10: 39: 00.250 Z,
"createdAt": 2023 - 08 - 21 T10: 39: 00.250 Z,
"remoteId": null
}curl -X 'POST' \
'https://your-immuta-url.com/data/object/search/yourConnectionKey' \
-H 'accept: application/json' \
-H 'Authorization: Bearer your-bearer-token'{
"count": 1,
"hits": [{
"objectPath": ["yourConnectionKey"],
"technology": "Snowflake",
"state": "active",
"settings": {
"activateNewChildren": {
"value": true,
"hasDescendantsWithOverrides": false
},
"dataOwners": {
"value": [{
"id": 2,
"type": "user"
}],
"hasDescendantsWithOverrides": false
},
"isActive": {
"value": true,
"hasDescendantsWithOverrides": false
}
},
"overrides": [],
"lastCrawled": 2023 - 08 - 21 T10: 39: 00.250 Z,
"createdAt": 2023 - 08 - 21 T10: 39: 00.250 Z,
"remoteId": null
}]
}curl -X 'PUT' \
'https://<your-immuta-url>/data/connection/yourConnectionKey' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connection": {
"technology": "Snowflake",
"hostname": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"role": "<your-Snowflake-role>",
"authenticationType": "userPassword",
"username": "<your-Snowflake-username>",
"password": "<your-Snowflake-password>"
}
}'curl -X 'PUT' \
'https://<your-immuta-url>/data/connection/yourConnectionKey' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connection": {
"technology": "Snowflake",
"hostname": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"role": "<your-Snowflake-role>",
"authenticationType": "keyPair",
"username": "<the-Snowflake-username>",
"privateKeyPassword": "<your-Snowflake-key-password>",
"privateKey": {
"keyName": "PRIV_KEY_FILE",
"userFilename": "<your-private-key-file-name>",
"content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
}
}
}'curl -X 'PUT' \
'https://<your-immuta-url>/data/connection/yourConnectionKey' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connection": {
"technology": "Snowflake",
"hostname": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"role": "<your-Snowflake-role>",
"authenticationType": "oAuthClientCredentials",
"oAuthClientConfig": {
"useCertificate": true,
"clientId": "<your-client-ID>",
"authorityUrl": "<your-example.authority.com>",
"scope": "session:role-any",
"publicCertificateThumbprint": "<your-certificate-thumbprint>",
"resource": "<your-optional-resource>",
"oauthPrivateKey": {
"keyName": "oauth client certificate",
"userFilename": "<your-user-file.pem>",
"content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
}
}
}
}'curl -X 'PUT' \
'https://<your-immuta-url>/data/connection/yourConnectionKey' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connection": {
"technology": "Snowflake",
"hostname": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"role": "<your-Snowflake-role>",
"authenticationType": "oAuthClientCredentials",
"oAuthClientConfig": {
"useCertificate": false,
"clientId": "<your-client-ID>",
"authorityUrl": "<your-example.authority.com>",
"scope": "session:role-any",
"resource": "<your-optional-resource>",
"clientSecret": "<your-client-secret>"
}
}
}'curl -X 'PUT' \
'https://<your-immuta-url>/data/connection/yourConnectionKey' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connection": {
"technology": "Databricks",
"hostname": "<www.your-workspace.cloud.databricks.com>",
"port": <your-Databricks-port>,
"httpPath": "<your-Databricks-warehouse-path>",
"authenticationType": "token",
"token": "<your-service-principal-pat>"
}
}'{
"objectPath": ['yourConnectionKey'],
"bulkId": "a-new-uuid"
}curl -X 'POST' \
'https://<your-immuta-url>/data/crawl/yourConnectionKey/yourDatabase/yourSchema' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"forceRecursive": false
}'{
"objectPath": ['yourConnectionKey', 'yourDatabase', 'yourSchema'],
"bulkId": 'the-job's-unique-identifier'
}curl -X 'PUT' \
'https://<your-immuta-url>/data/settings/yourConnectionKey/yourDatabase' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"overrides": {
"isActive": true,
"activateNewChildren": true,
"dataOwners": [{
"id": 3,
"type": "group"
}]
}
}'{
"objectPath": ["yourConnectionKey/yourDatabase"],
"technology": "Snowflake",
"state": "active",
"settings": {
"activateNewChildren": {
"value": true,
"hasDescendantsWithOverrides": true
},
"dataOwners": {
"value": [{
"id": 2,
"type": "user"
}],
"hasDescendantsWithOverrides": true
},
"isActive": {
"value": true,
"hasDescendantsWithOverrides": true
}
},
"overrides": [
"isActive",
"activateNewChildren",
"dataOwners"
],
"dataSourceId": null,
"lastCrawled": 2023 - 08 - 21 T10: 39: 00.250 Z,
"createdAt": 2023 - 08 - 21 T10: 39: 00.250 Z,
"remoteId": null,
"bulkId": 'the-job's-unique-identifier'
}
curl -X 'DELETE' \
'https://<your-immuta-url>/data/object/yourConnectionKey/yourDatabase/yourSchema' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' {
"objectPath": ['yourConnectionKey', 'yourDatabase', 'yourSchema'],
"childCount": 5
}APPLICATION_ADMIN Immuta permissionThe Databricks user registering the connection and running the script must have the following privileges:
Metastore admin and account admin
CREATE CATALOG privilege on the Unity Catalog metastore to create an Immuta-owned catalog and tables
See the Databricks documentation for more details about Unity Catalog privileges and securable objects.
Unity Catalog metastore created and attached to a Databricks workspace.
Unity Catalog enabled on your Databricks cluster or SQL warehouse. All SQL warehouses have Unity Catalog enabled if your workspace is attached to a Unity Catalog metastore. Immuta recommends linking a SQL warehouse to your Immuta tenant rather than a cluster for both performance and availability reasons.
Complete the following steps to register a Databricks Unity Catalog connection:
Create a service principal in Databricks Unity Catalog with the proper Databricks privileges for Immuta to use to manage policies in Unity Catalog.
Set up Unity Catalog system tables for query audit.
Use the /integrations/scripts/create endpoint to receive a script.
Run the script in Databricks Unity Catalog.
Use the /data/connection endpoint to finish registering your connection in Immuta.
Create a Databricks service principal with the Databricks privileges listed below and set up with personal access token (PAT), which can be an on-behalf token created in Databricks, or OAuth machine-to-machine (M2M) authentication. Immuta uses this service principal continuously to orchestrate Unity Catalog policies and maintain state between Immuta and Databricks.
USE CATALOG and MANAGE on all catalogs containing securables registered as Immuta data sources.
USE SCHEMA on all schemas containing securables registered as Immuta data sources.
MODIFY and SELECT on all securables you want registered as Immuta data sources. The MODIFY privilege is not required for materialized views registered as Immuta data sources, since MODIFY is not a supported privilege on that object type in .
Grant the service principal from step 1 access to the Databricks Unity Catalog system tables. For Databricks Unity Catalog audit to work, Immuta must have, at minimum, the following access.
USE CATALOG on the system catalog
USE SCHEMA on the system.access and system.query schemas
SELECT on the following system tables:
system.access.table_lineage
system.access.column_lineage
system.access.audit
Access to system tables is governed by Unity Catalog. No user has access to these system schemas by default. To grant access, a user that is both a metastore admin and an account admin must grant USE_SCHEMA and SELECT permissions on the system schemas to the service principal. See .
POST /integrations/scripts/create
Using the example request, update the <placeholder_values> with your connection details.
Copy the config object to use later in the setup process.
Run the request.
Copy the returned script and use it in the next step.
Find descriptions of the editable attributes in the table below and of the full payload in the Integration configuration payload reference guide.
Create a separate Immuta catalog for each Immuta tenant
If multiple Immuta tenants are connected to your Databricks environment, create a separate Immuta catalog for each of those tenants. Having multiple Immuta tenants use the same Immuta catalog causes failures in policy enforcement.
Payload parameters
Create a separate Immuta catalog for each Immuta tenant
If multiple Immuta tenants are connected to your Databricks environment, create a separate Immuta catalog for each of those tenants. Having multiple Immuta tenants use the same Immuta catalog causes failures in policy enforcement.
Payload parameters
The previous step will return a script. Copy the script and run it in your Databricks Unity Catalog environment as a user with the privileges listed in the requirements section.
The script will use the service principal that will authenticate using the authentication that you specified. Additionally, the script will create the catalog you specified.
POST /data/connection
Copy the request and update the <placeholder_values> with your connection details. Note that the connection details here should match the ones used when generating the script. Then submit the request.
Find descriptions of the editable attributes in the table below and of the full payload in the Databricks Unity Catalog connection payload table. All values should be included and those you should not edit are noted.
Create a separate Immuta catalog for each Immuta tenant
If multiple Immuta tenants are connected to your Databricks environment, create a separate Immuta catalog for each of those tenants. Having multiple Immuta tenants use the same Immuta catalog causes failures in policy enforcement.
Payload parameters
Create a separate Immuta catalog for each Immuta tenant
If multiple Immuta tenants are connected to your Databricks environment, create a separate Immuta catalog for each of those tenants. Having multiple Immuta tenants use the same Immuta catalog causes failures in policy enforcement.
Payload parameters
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the associated connectionKey.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
curl -X 'POST' \
'https://<your-immuta-url>/integrations/scripts/create' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"type": "Databricks",
"autoBootstrap": false,
"config": {
"workspaceUrl": "<www.your-workspace.cloud.databricks.com>",
"httpPath": "<sql/protocolv1/o/0/your-path>",
"authenticationType": "token",
"token": "<service-principal-pat>",
"catalog": "<new-catalog>",
"groupPattern": { "deny": "<your-exemption-group>" },
"audit": {"enabled": true}
}
}'curl -X 'POST' \
'https://<your-immuta-url>/data/connection' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connectionKey": "<your-connection-key-name>",
"connection": {
"technology": "Databricks",
"hostname": "<www.your-workspace.cloud.databricks.com>",
"port": <your-Databricks-port>,
"httpPath": "<your-Databricks-warehouse-path>",
"authenticationType": "token",
"token": "<your-service-principal-pat>"
},
"settings": {
"isActive": false
},
"options": {
"forceRecursiveCrawl": true
},
"nativeIntegration": {
"type": "Databricks",
"autoBootstrap": false,
"unityCatalog": true,
"config": {
"authenticationType": "token",
"token": "<your-service-principal-pat>",
"host": "<www.your-workspace.cloud.databricks.com>",
"port": <your-Databricks-port>,
"catalog": "<your-immuta-catalog>",
"audit": { "enabled": true },
"workspaceIds": ["<your-workspace>", <"another-workspace">],
"groupPattern": { "deny": "<your-exemption-group>" },
"jobConfig": {
"workspaceDirectoryPath": "/Workspace/ImmutaArtifacts",
"jobClusterId": "undefined"
}
}
}'{
"objectPath": ['<your-connection-key-name>'],
"bulkId": "a-new-uuid"
}system.query.historyNo
config.audit.enabled boolean
If true, Databricks Unity Catalog query audit is enabled. Set to true for the recommended configuration.
No
config.workspaceUrl string
Your Databricks workspace URL.
Yes
config.httpPath string
The HTTP path of your Databricks cluster or SQL warehouse.
Yes
config.oAuthClientConfig object
The oAuthClientConfig object represents your OAuth configuration in Databricks Unity Catalog.
Yes
config.oAuthClientConfig.clientId string
The client identifier of the Immuta service principal you configured. This is the client ID displayed in Databricks when creating the client secret for the service principal.
Yes
config.oAuthClientConfig.clientSecret string
.
Yes
config.oAuthClientConfig.authorityUrl string
Yes
connection.authenticationType string
The authentication type to register the connection. Make sure this auth type is the same used when requesting the script.
Yes
connection.token string
The Databricks personal access token for the service principal created in step one for Immuta.
Yes
settings object
Specifications of the connection's settings, including status.
No
settings.isActive boolean
When false, data objects will be inactive (disabled) by default when created in Immuta. Set to false for the recommended configuration.
If you set this to true for a data object and it has no subscription policy set on it, Immuta will REVOKE access to the data in Databricks for all Immuta users, even if they had been directly granted access to the table in Unity Catalog.
If a user is not registered in Immuta, Immuta will have no effect on that user's access to data in Unity Catalog. See the for more details.
No
options object
Specification of the connection's default behavior for object crawls.
No
options.forceRecursiveCrawl boolean
If false, only active (enabled) objects will be crawled. If true, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.type string
Same as connection.technology
Yes
nativeIntegration.autoBootstrap boolean
Use the same setting as the script generation.
Yes
nativeIntegration.unityCatalog boolean
Use the same setting as the script generation.
Yes
nativeIntegration.config.authenticationType string
Same as connection.authenticationType
Yes
nativeIntegration.config.token string
Same as connection.token
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.catalog string
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaceIds array
Use the same setting as the script generation.
No
nativeIntegration.config.groupPattern object
Use the same setting as the script generation.
No
nativeIntegration.config.jobConfig.workspaceDirectoryPath string
Use the same setting as the script generation.
No
nativeIntegration.config.jobConfig.jobClusterId string
Use the same setting as the script generation.
No
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.technology string
The technology backing the new connection.
Yes
connection.hostname string
Your Databricks workspace URL. This is the same as host and workspaceURL.
Yes
connection.port integer
The port to use when connecting to your Databricks account.
Yes
connection.httpPath string
config.workspaceUrl string
Your Databricks workspace URL.
Yes
config.httpPath string
The HTTP path of your Databricks cluster or SQL warehouse.
Yes
config.token string
The Databricks personal access token for the service principal created in step one for Immuta.
Yes
config.catalog string
The name of the Databricks catalog Immuta will create to store internal entitlements and other user data specific to Immuta. This catalog will only be readable for the Immuta service principal and should not be granted to other users. The catalog name may only contain letters, numbers, and underscores and cannot start with a number.
Yes
config.groupPattern object
This object allows you to exclude an account-level group in Databricks from data policies. See the Databricks Unity Catalog group pattern object description for details.
No
config.audit object
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.technology string
The technology backing the new connection.
Yes
connection.hostname string
Your Databricks workspace URL. This is the same as host and workspaceURL.
Yes
connection.port integer
The port to use when connecting to your Databricks account.
Yes
connection.httpPath string
This object enables Databricks Unity Catalog query audit.
The HTTP path of your Databricks cluster or SQL warehouse.
curl -X 'POST' \
'https://<your-immuta-url>/integrations/scripts/create' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"type": "Databricks",
"autoBootstrap": false,
"config": {
"workspaceUrl": "<www.your-workspace.cloud.databricks.com>",
"httpPath": "<sql/protocolv1/o/0/your-path>",
"authenticationType": "oAuthM2M",
"oAuthClientConfig": {
"useCertificate": false,
"clientId": "<your-client-ID>",
"clientSecret": "<your-client-secret>",
"scope": "all-apis",
"authorityUrl": "<your.authority.com>"
},
"catalog": "<new-catalog>",
"groupPattern": { "deny": "<your-exemption-group>" },
"audit": {"enabled": true}
}
}'curl -X 'POST' \
'https://<your-immuta-url>/data/connection' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connectionKey": "<your-connection-key-name>",
"connection": {
"technology": "Databricks",
"hostname": "<www.your-workspace.cloud.databricks.com>",
"port": <your-Databricks-port>,
"httpPath": "<your-Databricks-warehouse-path>",
"authenticationType": "oAuthM2M",
"oAuthClientConfig": {
"useCertificate": false,
"clientId": "<your-client-ID>",
"clientSecret": "<your-client-secret>",
"scope": "all-apis",
"authorityUrl": "<your.authority.com>"
}
},
"settings": {
"isActive": false
},
"options": {
"forceRecursiveCrawl": true
},
"nativeIntegration": {
"type": "Databricks",
"autoBootstrap": false,
"unityCatalog": true,
"config": {
"host": "<www.your-workspace.cloud.databricks.com>",
"port": <your-Databricks-port>,
"authenticationType": "oAuthM2M",
"oAuthClientConfig": {
"useCertificate": false,
"clientId": "<your-client-ID>",
"clientSecret": "<your-client-secret>",
"scope": "all-apis",
"authorityUrl": "<your.authority.com>"
},
"catalog": "<your-immuta-catalog>",
"audit": { "enabled": true },
"workspaceIds": ["<your-workspace>", <"another-workspace">],
"groupPattern": { "deny": "<your-exemption-group>" },
"jobConfig": {
"workspaceDirectoryPath": "/Workspace/ImmutaArtifacts",
"jobClusterId": "undefined"
}
}
}'Authority URL of your identity provider.
Yes
config.catalog string
The name of the Databricks catalog Immuta will create to store internal entitlements and other user data specific to Immuta. This catalog will only be readable for the Immuta service principal and should not be granted to other users. The catalog name may only contain letters, numbers, and underscores and cannot start with a number.
Yes
config.groupPattern object
This object allows you to exclude an account-level group in Databricks from data policies. See the Databricks Unity Catalog group pattern object description for details.
No
config.audit object
This object enables Databricks Unity Catalog query audit.
No
config.audit.enabled boolean
If true, Databricks Unity Catalog query audit is enabled. Set to true for the recommended configuration.
No
The HTTP path of your Databricks cluster or SQL warehouse.
Yes
connection.authenticationType string
The authentication type to register the connection. Make sure this auth type is the same used when requesting the script.
Yes
connection.oAuthClientConfig object
The oAuthClientConfig object represents your OAuth configuration in Databricks Unity Catalog.
Yes
connection.oAuthClientConfig.clientId string
The client identifier of the Immuta service principal you configured. This is the client ID displayed in Databricks when creating the client secret for the service principal.
Yes
connection.oAuthClientConfig.clientSecret string
Yes
connection.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
settings object
Specifications of the connection's settings, including status.
No
settings.isActive boolean
When false, data objects will be inactive (disabled) by default when created in Immuta. Set to false for the recommended configuration.
If you set this to true for a data object and it has no subscription policy set on it, Immuta will REVOKE access to the data in Databricks for all Immuta users, even if they had been directly granted access to the table in Unity Catalog.
If a user is not registered in Immuta, Immuta will have no effect on that user's access to data in Unity Catalog. See the Databricks Unity Catalog reference guide for more details.
No
options object
Specification of the connection's default behavior for object crawls.
No
options.forceRecursiveCrawl boolean
If false, only active (enabled) objects will be crawled. If true, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.type string
Same as connection.technology
Yes
nativeIntegration.autoBootstrap boolean
Use the same setting as the script generation.
Yes
nativeIntegration.unityCatalog boolean
Use the same setting as the script generation.
Yes
nativeIntegration.config.authenticationType string
Same as connection.authenticationType
Yes
nativeIntegration.config.oAuthClientConfig object
Same as connection.oAuthClientConfig
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.catalog string
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaceIds array
Use the same setting as the script generation.
No
nativeIntegration.config.groupPattern object
Use the same setting as the script generation.
No
nativeIntegration.config.jobConfig.workspaceDirectoryPath string
Use the same setting as the script generation.
No
nativeIntegration.config.jobConfig.jobClusterId string
Use the same setting as the script generation.
No
The connection API is a REST API which allows users to register a Snowflake connection to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. Then Immuta can manage and enforce access controls on your data through that connection. To manage your connection, see the Manage a connection reference guide.
The following permissions and personas are used in the registration process:
APPLICATION_ADMIN Immuta permission
The Snowflake user registering the connection and running the script must have the following privileges:
CREATE DATABASE ON ACCOUNT WITH GRANT OPTION
CREATE ROLE ON ACCOUNT WITH GRANT OPTION
No Snowflake integration configured in Immuta. If your Snowflake integration is already configured on the app settings page, follow the guide.
Complete the following steps to register a Snowflake connection:
Create an Immuta system account with the proper Snowflake privileges for Immuta to use to manage policies in Snowflake.
Use the /integrations/scripts/create endpoint to receive a script.
Run the script in Snowflake.
Use the /data/connection
Complete the following actions in Snowflake:
. Immuta will use this system account continuously to orchestrate Snowflake policies and maintain state between Immuta and Snowflake.
with a minimum of the following privileges:
USAGE on all databases and schemas with registered data sources.
POST /integrations/scripts/create
Using the example request, update the <placeholder_values> with your connection details and the authentication credentials for the system account you just created.
Copy the config object to use later in the setup process.
Run the request.
Find descriptions of the editable attributes in the table below and of the full payload in the .
Payload parameters
Using your generated script, run it in your Snowflake environment as a user with the permissions listed in the .
The script will use the provided Immuta system user credentials to create the database you specified in the earlier step and set up Immuta-managed resources in Snowflake.
POST /data/connection
Using the tabs below, copy the request and update the <placeholder_values> with your connection details. The connection details here should match the ones used when generating the script, and the payload from the script generation should be pasted exactly into nativeIntegration. Then submit the request.
Find descriptions of the editable attributes in the table below and of the full payload in the . The recommended setting values are included in the example.
Payload parameters
Example response
CREATE USER ON ACCOUNT WITH GRANT OPTIONMANAGE GRANTS ON ACCOUNT WITH GRANT OPTION
APPLY MASKING POLICY ON ACCOUNT WITH GRANT OPTION
APPLY ROW ACCESS POLICY ON ACCOUNT WITH GRANT OPTION
REFERENCES on all tables and views registered in Immuta.SELECT on all tables and views registered in Immuta.
Grant the new Snowflake role to the system account you just created.
The new username of the system account that can act on Snowflake objects and register the connection.
Yes
config.password string
The password of the system account that can act on Snowflake objects and register the connection.
Yes
config.audit object
This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled.
No
config.workspaces object
This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used.
No
config.impersonation object
This object enables user impersonation. Omit for the recommended configuration: impersonation disabled.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, impersonation cannot be used.
No
config.lineage object
This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled.
No
config.userRolePattern object
This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded.
No
config.userRolePattern.exclude array
This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
Payload parameters
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
Payload parameters
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
Payload parameters
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
The port to use when registering your Snowflake connection.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.username string
The username of the system account that can act on Snowflake objects and register the connection.
Yes
connection.password string
The password of the system account that can act on Snowflake objects and register the connection.
Yes
settings object
Specifications of the connection's settings, including status.
No
settings.isActive boolean
When false, data objects will be inactive (disabled) by default when created in Immuta. Set to false for the recommended configuration.
No
options.forceRecursiveCrawl boolean
If false, only active (enabled) objects will be crawled. If true, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint. See the for descriptions.
Yes
Payload parameters
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This is the same as host.
Yes
Payload parameters
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This is the same as host.
Yes
Payload parameters
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This is the same as host.
Yes
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This should be the same as nativeIntegration.config.host.
Yes
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element will be the associated connectionKey.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
config.username string
connection.port integer
curl -X 'POST' \
'https://<your-immuta-url>/integrations/scripts/create' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"type": "Snowflake",
"autoBootstrap": false,
"config": {
"host": "<your-Snowflake-hostname-url>",
"warehouse": "<your-Snowflake-warehouse>",
"database": "<your-Snowflake-database>",
"authenticationType": "keyPair",
"username": "<the-Snowflake-username>",
"privateKey": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->",
"audit": {"enabled": true},
"workspaces": {"enabled": false},
"impersonation": {"enabled": false},
"lineage": { "enabled": false },
"userRolePattern": { "exclude": [] }
}
}'curl -X 'POST' \
'https://<your-immuta-url>/integrations/scripts/create' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"type": "Snowflake",
"autoBootstrap": false,
"config": {
"host": "<your-Snowflake-hostname-url>",
"warehouse": "<your-Snowflake-warehouse>",
"database": "<your-Snowflake-database>",
"authenticationType": "oAuthClientCredentials",
"oAuthClientConfig": {
"provider": "<your-provider>",
"clientId": "<your-client-ID>",
"authorityUrl": "<your-example.authority.com>",
"useCertificate": true,
"publicCertificateThumbprint": "<your-certificate-thumbprint>",
"oauthPrivateKey": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->",
"scope": "session:role-any",
"audit": {"enabled": true},
"workspaces": {"enabled": false},
"impersonation": {"enabled": false},
"lineage": { "enabled": false },
"userRolePattern": { "exclude": [] }
}
}
}'curl -X 'POST' \
'https://<your-immuta-url>/integrations/scripts/create' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"type": "Snowflake",
"autoBootstrap": false,
"config": {
"host": "<your-Snowflake-hostname-url>",
"warehouse": "<your-Snowflake-warehouse>",
"database": "<your-Snowflake-database>",
"authenticationType": "oAuthClientCredentials",
"oAuthClientConfig": {
"provider": "<your-provider>",
"clientId": "<your-client-ID>",
"authorityUrl": "<your-example.authority.com>",
"clientSecret": "<your-client-secret>",
"useCertificate": false,
"scope": "session:role-any",
"audit": {"enabled": true},
"workspaces": {"enabled": false},
"impersonation": {"enabled": false},
"lineage": { "enabled": false },
"userRolePattern": { "exclude": [] }
}
}
}'curl -X 'POST' \
'https://<your-immuta-url>/data/connection' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connectionKey": "<your-connection-key-name>",
"connection": {
"technology": "Snowflake",
"hostname": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"role": "<your-Snowflake-role>",
"authenticationType": "keyPair",
"username": "<the-Snowflake-username>",
"privateKeyPassword": "<your-Snowflake-key-password>",
"privateKey": {
"keyName": "PRIV_KEY_FILE",
"userFilename": "<your-private-key-file-name>",
"content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
}
},
"settings": {
"isActive": false
},
"options": {
"forceRecursiveCrawl": true
},
"nativeIntegration": {
"type": "Snowflake",
"autoBootstrap": false,
"config": {
"authenticationType": "keyPair",
"username": "<the-Snowflake-username>",
"privateKeyPassword": "<your-Snowflake-key-password>",
"privateKey": {
"keyName": "PRIV_KEY_FILE",
"userFilename": "<your-private-key-file-name>",
"content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
}
"host": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"database": "<your-Snowflake-database>",
"impersonation": { "enabled": false },
"audit": { "enabled": true },
"workspaces": { "enabled": false },
"lineage": { "enabled": false },
"userRolePattern": { "exclude": [] }
}
}
}'
curl -X 'POST' \
'https://<your-immuta-url>/data/connection' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connectionKey": "<your-connection-key-name>",
"connection": {
"technology": "Snowflake",
"hostname": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"role": "<your-Snowflake-role>",
"authenticationType": "oAuthClientCredentials",
"oAuthClientConfig": {
"useCertificate": true,
"clientId": "<your-client-ID>",
"authorityUrl": "<your-example.authority.com>",
"scope": "session:role-any",
"publicCertificateThumbprint": "<your-certificate-thumbprint>",
"resource": "<your-optional-resource>",
"oauthPrivateKey": {
"keyName": "oauth client certificate",
"userFilename": "<your-user-file.pem>",
"content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
}
}
},
"settings": {
"isActive": false
},
"options": {
"forceRecursiveCrawl": true
},
"nativeIntegration": {
"type": "Snowflake",
"autoBootstrap": false,
"config": {
"authenticationType": "oAuthClientCredentials",
"oAuthClientConfig": {
"useCertificate": true,
"clientId": "<your-client-ID>",
"authorityUrl": "<your-example.authority.com>",
"scope": "session:role-any",
"publicCertificateThumbprint": "<your-certificate-thumbprint>",
"resource": "<your-optional-resource>",
"oauthPrivateKey": {
"keyName": "oauth client certificate",
"userFilename": "<your-user-file.pem>",
"content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
}
}
"host": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"database": "<your-Snowflake-database>",
"impersonation": { "enabled": false },
"audit": { "enabled": true },
"workspaces": { "enabled": false },
"lineage": { "enabled": false },
"userRolePattern": { "exclude": [] }
}
}
}'
curl -X 'POST' \
'https://<your-immuta-url>/data/connection' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connectionKey": "<your-connection-key-name>",
"connection": {
"technology": "Snowflake",
"hostname": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"role": "<your-Snowflake-role>",
"authenticationType": "oAuthClientCredentials",
"oAuthClientConfig": {
"useCertificate": false,
"clientId": "<your-client-ID>",
"authorityUrl": "<your-example.authority.com>",
"scope": "session:role-any",
"resource": "<your-optional-resource>",
"clientSecret": "<your-client-secret>"
}
},
"settings": {
"isActive": false
},
"options": {
"forceRecursiveCrawl": true
},
"nativeIntegration": {
"type": "Snowflake",
"autoBootstrap": false,
"config": {
"authenticationType": "oAuthClientCredentials",
"oAuthClientConfig": {
"useCertificate": false,
"clientId": "<your-client-ID>",
"authorityUrl": "<your-example.authority.com>",
"scope": "session:role-any",
"resource": "<your-optional-resource>",
"clientSecret": "<your-client-secret>"
}
"host": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"database": "<your-Snowflake-database>",
"impersonation": { "enabled": false },
"audit": { "enabled": true },
"workspaces": { "enabled": false },
"lineage": { "enabled": false },
"userRolePattern": { "exclude": [] }
}
}
}'
curl -X 'POST' \
'https://<your-immuta-url>/integrations/scripts/create' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"type": "Snowflake",
"autoBootstrap": false,
"config": {
"host": "<your-Snowflake-hostname-url>",
"warehouse": "<your-Snowflake-warehouse>",
"database": "<your-Snowflake-database>",
"authenticationType": "userPassword",
"username": "<new-Snowflake-username>",
"password": "<new-Snowflake-password>",
"audit": {"enabled": true},
"workspaces": {"enabled": false},
"impersonation": {"enabled": false},
"lineage": { "enabled": false },
"userRolePattern": { "exclude": [] }
}
}'curl -X 'POST' \
'https://<your-immuta-url>/data/connection' \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: <your-bearer-token>' \
-d '{
"connectionKey": "<your-connection-key-name>",
"connection": {
"technology": "Snowflake",
"hostname": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"role": "<your-Snowflake-role>",
"authenticationType": "userPassword",
"username": "<your-Snowflake-username>",
"password": "<your-Snowflake-password>"
},
"settings": {
"isActive": false
},
"options": {
"forceRecursiveCrawl": true
},
"nativeIntegration": {
"type": "Snowflake",
"autoBootstrap": false,
"config": {
"authenticationType": "userPassword",
"username": "<your-Snowflake-username>",
"password": "<your-Snowflake-password>",
"host": "<your-Snowflake-hostname-url>",
"port": <your-Snowflake-port>,
"warehouse": "<your-Snowflake-warehouse>",
"database": "<your-Snowflake-database>",
"impersonation": { "enabled": false },
"audit": { "enabled": true },
"workspaces": { "enabled": false },
"lineage": { "enabled": false },
"userRolePattern": { "exclude": [] }
}
}
}'
{
"objectPath": ['<your-connection-key-name>'],
"bulkId": "a-new-uuid"
}config.username string
The username of the system account that can act on Snowflake objects and register the connection.
Yes
config.privateKey string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
Yes
config.audit object
This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled.
No
config.workspaces object
This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used.
No
config.impersonation object
This object enables user impersonation. Omit for the recommended configuration: impersonation disabled.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, impersonation cannot be used.
No
config.lineage object
This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled.
No
config.userRolePattern object
This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded.
No
config.userRolePattern.exclude array
This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
config.oAuthClientConfig.provider string
The identity provider for OAuth, such as Okta.
Yes
config.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
config.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
config.oAuthClientConfig.publicCertificateThumbprint string
Your certificate thumbprint.
Yes
config.oAuthClientConfig.oauthPrivateKey string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
Yes
config.audit object
This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled.
No
config.workspaces object
This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used.
No
config.impersonation object
This object enables user impersonation. Omit for the recommended configuration: impersonation disabled.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, impersonation cannot be used.
No
config.lineage object
This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled.
No
config.userRolePattern object
This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded.
No
config.userRolePattern.exclude array
This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
config.oAuthClientConfig.provider string
The identity provider for OAuth, such as Okta.
Yes
config.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
config.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
config.oAuthClientConfig.clientSecret string
Client secret of the application.
Yes
config.audit object
This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled.
No
config.workspaces object
This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used.
No
config.impersonation object
This object enables user impersonation. Omit for the recommended configuration: impersonation disabled.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, impersonation cannot be used.
No
config.lineage object
This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled.
No
config.userRolePattern object
This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded.
No
config.userRolePattern.exclude array
This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
connection.port integer
The port to use when registering your Snowflake connection.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.username string
The username of the system account that can act on Snowflake objects and register the connection.
Yes
connection.privateKeyPassword string
The Snowflake private key password. Required if the private key is encrypted.
No
connection.privateKey.userFilename string
The name of your private key file on your machine.
Yes
connection.privateKey.content string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as config.privateKey.
Yes
settings object
Specifications of the connection's settings, including status.
No
settings.isActive boolean
If false, data objects will be inactive (disabled) by default when created in Immuta. Set to false for the recommended configuration.
No
options.forceRecursiveCrawl boolean
If false, only active (enabled) objects will be crawled. If true, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.config.username string
Same as connection.username
Yes
nativeIntegration.config.privateKeyPassword string
Same as connection.privateKeyPassword
No
nativeIntegration.config.privateKey.keyName string
Same as connection.keyName
Yes
nativeIntegration.config.privateKey.userFilename string
Same as connection.userFilename
Yes
nativeIntegration.config.privateKey.content string
Same as connection.content
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.warehouse string
Same as connection.warehouse
Yes
nativeIntegration.config.database string
Use the same setting as the script generation.
Yes
nativeIntegration.config.impersonation object
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaces object
Use the same setting as the script generation.
Yes
nativeIntegration.config.lineage object
Use the same setting as the script generation.
Yes
nativeIntegration.userRolePattern object
Use the same setting as the script generation.
Yes
connection.port integer
The port to use when registering your Snowflake connection.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
connection.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
connection.oAuthClientConfig.publicCertificateThumbprint string
Your certificate thumbprint.
Yes
connection.oAuthClientConfig.resource string
An optional resource to pass to the token provider.
No
connection.oAuthClientConfig.oauthPrivateKey.userFilename string
The name of your private key file on your machine.
Yes
connection.oAuthClientConfig.oauthPrivateKey.content string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as config.oauthPrivateKey in the script request.
Yes
settings object
Specifications of the connection's settings, including status.
No
settings.isActive boolean
When false, data objects will be inactive (disabled) by default when created in Immuta. Set to false for the recommended configuration.
No
options.forceRecursiveCrawl boolean
If false, only active (enabled) objects will be crawled. If true, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.config.oAuthClientConfig.clientId string
Same as connection.oAuthClientConfig.clientId
Yes
nativeIntegration.config.oAuthClientConfig.authorityUrl string
Same as connection.oAuthClientConfig.authorityUrl
Yes
nativeIntegration.config.oAuthClientConfig.publicCertificateThumbprint string
Same as connection.oAuthClientConfig.publicCertificateThumbprint
Yes
nativeIntegration.config.oAuthClientConfig.resource string
Same as connection.oAuthClientConfig.resource
No
nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.userFilename string
Same as connection.oAuthClientConfig.oauthPrivateKey.userFilename
Yes
nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.content string
Same as connection.oAuthClientConfig.oauthPrivateKey.content
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.warehouse string
Same as connection.warehouse
Yes
nativeIntegration.config.database string
Use the same setting as the script generation.
Yes
nativeIntegration.config.impersonation object
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaces object
Use the same setting as the script generation.
Yes
nativeIntegration.config.lineage object
Use the same setting as the script generation.
Yes
nativeIntegration.userRolePattern object
Use the same setting as the script generation.
Yes
connection.port integer
The port to use when registering your Snowflake connection.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
connection.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
connection.oAuthClientConfig.clientSecret string
Client secret of the application.
Yes
connection.oAuthClientConfig.resource string
An optional resource to pass to the token provider.
No
settings object
Specifications of the connection's settings, including status.
No
settings.isActive boolean
When false, data objects will be inactive (disabled) by default when created in Immuta. Set to false for the recommended configuration
No
options.forceRecursiveCrawl boolean
If false, only active (enabled) objects will be crawled. If true, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.config.oAuthClientConfig.clientId string
Same as connection.oAuthClientConfig.clientId
Yes
nativeIntegration.config.oAuthClientConfig.authorityUrl string
Same as connection.oAuthClientConfig.authorityUrl
Yes
nativeIntegration.config.oAuthClientConfig.resource string
Same as connection.oAuthClientConfig.resource
No
nativeIntegration.config.oAuthClientConfig.clientSecret string
Same as connection.oAuthClientConfig.clientSecret
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.warehouse string
Same as connection.warehouse
Yes
nativeIntegration.config.database string
Use the same setting as the script generation.
Yes
nativeIntegration.config.impersonation object
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaces object
Use the same setting as the script generation.
Yes
nativeIntegration.config.lineage object
Use the same setting as the script generation.
Yes
nativeIntegration.userRolePattern object
Use the same setting as the script generation.
Yes