Manage a Connection

This page details the /data v1 API, which allows users to register a connection to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. For a how-to on registering a connection, see the Register a connection reference guide.

Method	Endpoint	Description
GET	/data/connection/{connectionKey}	Search for a connection using a connection key
GET	/data/object/{objectPath}	Search for a specific data object
POST	/data/object/search/{objectPath}	Search for the child objects of the data object defined in the objectPath or search all top-level data objects (connections) if the objectPath is omitted
PUT	/data/connection/{connectionKey}	Update the connection information for the specified connection
POST	/data/crawl/{objectPath}	Trigger object sync for the specified data object
PUT	/data/settings/{objectPath}	Update the settings through overrides for the specified data object
DELETE	/data/object/{objectPath}	Delete the given data object and all its child objects

GET /data/connection/{connectionKey}

Search for a connection using a connection key.

Required Immuta permission: CREATE_DATA_SOURCE, APPLICATION_ADMIN, GOVERNANCE, or Data Owner within the hierarchy

curl -X 'GET' \
  'https://your-immuta-url.com/data/connection/yourConnectionKey' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer your-bearer-token'

Path parameters

Attribute	Description	Required
connectionKey string	The key to uniquely identify the connection. This is the same as the display name of the connection in the Immuta UI.	Yes

Response schema

Attribute	Description
connectionKey string	The key to uniquely identify the connection.
connection object	Integration-specific connection information (i.e., hostname, authentication type, warehouse, etc.)
createdAt timestamp	The time the connection was registered in Immuta.
createdBy integer	The ID of the user who registered the connection.
creator.id integer	The ID of the user who registered the connection.
creator.name string	The name of the user who registered the connection.
creator.email string	The email of the user who registered the connection.
updatedAt timestamp	The time the connection was updated in Immuta.
updatedBy integer	The ID of the user who updated the connection.
updater.id integer	The ID of the user who updated the connection.
updater.name string	The name of the user who updated the connection.
updater.email string	The email of the user who updated the connection.
nativeIntegrationId integer	The ID of the integration backing the connection.

Example response

{
  "connectionKey": "yourConnectionKey",
  "connection": {
    "port": 443,
    "role": "IMMUTA_SNOWFLAKE_ROLE",
    "hostname": "example.us-east-1.snowflakecomputing.com",
    "username": "IMMUTA_DB_SYSTEM_ACCOUNT",
    "warehouse": "your-warehouse",
    "technology": "Snowflake",
    "authenticationType": "userPassword"
  },
  "createdAt": "2023-12-22T18:28:46.328Z",
  "createdBy": 2,
  "updatedAt": "2023-12-22T18:28:46.328Z",
  "updatedBy": 2,
  "creator": {
    "id": 2,
    "name": "Taylor Smith",
    "email": "[e-mail]"
  },
  "updater": {
    "id": 2,
    "name": "Taylor Smith",
    "email": "[e-mail]"
  },
  "nativeIntegrationId": 1
}

GET /data/object/{objectPath}

Search for a specific data object using the object path.

Required Immuta permission: CREATE_DATA_SOURCE, APPLICATION_ADMIN, GOVERNANCE, or Data Owner within the hierarchy

curl -X 'GET' \
  'https://your-immuta-url.com/data/object/yourConnectionKey' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer your-bearer-token'

Path parameters

Attribute	Description	Required
objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.	Yes

Response schema

Attribute	Desciription
objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
technology string	The technology that the object comes from: Databricks , Glue , or Snowflake.
state string	Whether the object is currently active (enabled) or inactive (disabled).
settings array	Specifications of the connection's settings, including status, new children status, and data owners.
overrides array	Specifications of the data object's settings that differ from its parents' settings.
dataSourceId integer	The ID of the data source if it is a table object that is active.
createdAt timestamp	The time the data object was created in Immuta.
lastCrawled timestamp	The time object sync was last run on the data object.
remoteId string	The ID of the remote data object.

Example response

{
  "objectPath": ["yourConnectionKey"],
  "technology": "Snowflake",
  "state": "active",
  "settings": {
    "activateNewChildren": {
      "value": true,
      "hasDescendantsWithOverrides": false
    },
    "dataOwners": {
      "value": [{
        "id": 2,
        "type": "user"
      }, ],
      "hasDescendantsWithOverrides": false
    },
    "isActive": {
      "value": true,
      "hasDescendantsWithOverrides": false
    }
  },
  "overrides": [],
  "lastCrawled": 2023 - 08 - 21 T10: 39: 00.250 Z,
  "createdAt": 2023 - 08 - 21 T10: 39: 00.250 Z,
  "remoteId": null
}

POST /data/object/search/{objectPath}

Search for the children of the object defined in the objectPath. Or search all top-level data objects if the objectPath is omitted.

Required Immuta permission: CREATE_DATA_SOURCE, APPLICATION_ADMIN, GOVERNANCE, or Data Owner on the object

curl -X 'POST' \
  'https://your-immuta-url.com/data/object/search/yourConnectionKey' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer your-bearer-token'

Path parameters

Attribute	Description	Required
objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.	Yes

Query parameters

Attribute	Description	Required
sortField string	The field to sort the search results.	No
sortOrder string	Denotes whether to sort the results in ascending (asc) or descending (desc) order. Default is asc.	No
offset integer	Use in combination with limit to fetch pages.	No
limit integer	Limits the number of results displayed per page.	No
searchText string	A partial, case-insensitive search on name.	No

Response schema

Attribute	Description
count integer	The number of results for your search.
hits.objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
hits.technology string	The technology that the object comes from (i.e., Snowflake, Databricks, Glue, etc.).
hits.state string	Whether the object is currently active (enabled) or inactive (disabled).
hits.settings array	Specifications of the connection's settings, including status, new children status, and data owners.
hits.overrides array	Specifications of the data object's settings that differ from its parents' settings.
hits.dataSourceId integer	The ID of the data source if it is a table object that is active (enabled).
hits.createdAt timestamp	The time the data object was created in Immuta.
hits.lastCrawled timestamp	The time object sync was last run on the data object.
hits.remoteId string	The ID of the remote data object.

Example response

{
  "count": 1,
  "hits": [{
    "objectPath": ["yourConnectionKey"],
    "technology": "Snowflake",
    "state": "active",
    "settings": {
      "activateNewChildren": {
        "value": true,
        "hasDescendantsWithOverrides": false
      },
      "dataOwners": {
        "value": [{
          "id": 2,
          "type": "user"
        }, ],
        "hasDescendantsWithOverrides": false
      },
      "isActive": {
        "value": true,
        "hasDescendantsWithOverrides": false
      }
    },
    "overrides": [],
    "lastCrawled": 2023 - 08 - 21 T10: 39: 00.250 Z,
    "createdAt": 2023 - 08 - 21 T10: 39: 00.250 Z,
    "remoteId": null
  }]
}

PUT /data/connection/{connectionKey}

Update the connection information for the specified connection. Partial updates are not supported.

Required Immuta permission: APPLICATION_ADMIN

What can be updated?

Using this endpoint, you can only update connection information. To update other integration details, use the PUT /integrations/{id} endpoint.

Snowflake username and password

curl -X 'PUT' \
    'https://<your-immuta-url>/data/connection/yourConnectionKey' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connection": {
       "technology": "Snowflake",
       "hostname": "<your-Snowflake-hostname-url>",
       "port": < your - Snowflake - port > ,
       "warehouse": "<your-Snowflake-warehouse>",
       "role": "<your-Snowflake-role>",
       "authenticationType": "userPassword",
       "username": "<your-Snowflake-username>",
       "password": "<your-Snowflake-password>"
     }
    }'

Snowflake key pair

curl -X 'PUT' \
    'https://<your-immuta-url>/data/connection/yourConnectionKey' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connection": {
       "technology": "Snowflake",
       "hostname": "<your-Snowflake-hostname-url>",
       "port": <your-Snowflake-port>,
       "warehouse": "<your-Snowflake-warehouse>",
       "role": "<your-Snowflake-role>",
       "authenticationType": "keyPair",
       "username": "<the-Snowflake-username>",
       "privateKeyPassword": "<your-Snowflake-key-password>",
       "privateKey": {
         "keyName": "PRIV_KEY_FILE",
         "userFilename": "<your-private-key-file-name>",
         "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
       }
     }
    }'

Snowflake OAuth with certificate

curl -X 'PUT' \
    'https://<your-immuta-url>/data/connection/yourConnectionKey' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connection": {
       "technology": "Snowflake",
       "hostname": "<your-Snowflake-hostname-url>",
       "port": <your-Snowflake-port>,
       "warehouse": "<your-Snowflake-warehouse>",
       "role": "<your-Snowflake-role>",
       "authenticationType": "oAuthClientCredentials",
       "oAuthClientConfig": {
         "useCertificate": true,
         "clientId": "<your-client-ID>",
         "authorityUrl": "<your-example.authority.com>",
         "scope": "session:role-any",
         "publicCertificateThumbprint": "<your-certificate-thumbprint>",
         "resource": "<your-optional-resource>",
         "oauthPrivateKey": {
           "keyName": "oauth client certificate",
           "userFilename": "<your-user-file.pem>",
           "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
         }
       }
     }
    }'

Snowflake OAuth with secret

curl -X 'PUT' \
    'https://<your-immuta-url>/data/connection/yourConnectionKey' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connection: {
       "technology": "Snowflake",
       "hostname": "<your-Snowflake-hostname-url>",
       "port": <your-Snowflake-port>,
       "warehouse": "<your-Snowflake-warehouse>",
       "role": "<your-Snowflake-role>",
       "authenticationType": "oAuthClientCredentials",
       "oAuthClientConfig": {
         "useCertificate": false,
         "clientId": "<your-client-ID>",
         "authorityUrl": "<your-example.authority.com>",
         "scope": "session:role-any",
         "resource": "<your-optional-resource>",
         "clientSecret": "<your-client-secret>"
       }
     }
    }'

Databricks Unity Catalog

curl -X 'PUT' \
    'https://<your-immuta-url>/data/connection/yourConnectionKey' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connection: {
       "technology": "Databricks",
       "hostname": "<www.your-workspace.cloud.databricks.com>",
       "port": <your-Databricks-port>,
       "httpPath": "<your-Databricks-warehouse-path>",
       "authenticationType": "token",
       "token": "<your-service-principal-pat>"
     }
    }'

Path parameters

Attribute	Description	Required
connectionKey string	The key to uniquely identify the connection. This is the same as the display name of the connection in the Immuta UI.	Yes

Body parameters

The connection parameters differ based on your backing technology. See the Connection registration payload reference guide for details about the payloads.

Response schema

Attribute	Description
objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
bulkId string	A bulk ID that can be used to search for the status of background jobs triggered by this request.

Example response

{
  "objectPath": ['yourConnectionKey'],
  "bulkId": "a-new-uuid"
}

POST /data/crawl/{objectPath}

Trigger object sync for the specified data object.

Required Immuta permission: GOVERNANCE or APPLICATION_ADMIN global permission or Data Owner on the object

curl -X 'POST' \
    'https://<your-immuta-url>/data/crawl/yourConnectionKey/yourDatabase/yourSchema' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "forceRecursive": false
     }'

Path parameters

Attribute	Description	Required
objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.	Yes

Query parameters

Attribute	Description	Required
forceRecursive boolean	If false, only active (enabled) objects will have object sync run. If true, both active (enabled) and inactive (disabled) data objects will be synced; any child objects from inactive (disabled) objects will be set as inactive (disabled). Defaults to false.	No.

Response schema

Attribute	Description
objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
bulkId string	A bulk ID that can be used to search for the status of background jobs triggered by this request.

Example response

{
  "objectPath": ['yourConnectionKey', 'yourDatabase', 'yourSchema'],
  "bulkId": 'the-job's-unique-identifier'
}

PUT /data/settings/{objectPath}

Update the settings through overrides for the specified data object. All changes will trickle down to child objects as new overrides; however, existing overrides on child objects will still be respected. Data owners cannot be removed, only added. To remove data owners, edit the settings at the connection level.

Required Immuta permission: APPLICATION_ADMIN or GOVERNANCE global permission

curl -X 'PUT' \
    'https://<your-immuta-url>/data/settings/yourConnectionKey/yourDatabase' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
        "overrides": {
          "isActive": true,
          "activateNewChildren": true,
          "dataOwners": [{
            "id": 3,
            "type": "group"
          }]
        }
      }'

Path parameters

Attribute	Description	Required
objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.	Yes

Body parameters

Attribute	Description	Required
overrides array	A list of settings configured differently from the parent object's settings.
overrides.isActive boolean	If true, the object and all its child objects are active (enabled).
overrides.activateNewChildren boolean	If true, all new children found during object sync will be registered as active (enabled).
overrides.dataOwners array	A list of users and groups that are data owners on the connection. These users will be data owners for all the data sources under the data object they are assigned to.
overrides.dataOwners.id integer	The ID of the user or group to make data owner.
overrides.dataOwners.type string	The type to make data owner. Options are user or group.

Response schema

Attribute	Description
objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names should be separated by forward slashes.
technology string	The backing technology of the connection. Options are Databricks , Glue , or Snowflake.
state string	Whether the object is currently active (enabled) or inactive (disabled).
settings array	Specifications of the connection's settings, including status, new children status, and data owners.
overrides array	Specifications of the data object's settings that differ from its parents' settings.
dataSourceId integer	The ID of the data source if it is a table object that is active (enabled).
createdAt timestamp	The time the data object was created in Immuta.
lastCrawled timestamp	The time object sync was last run on the data object.
remoteId string	The ID of the remote data object.
bulkId string	A bulk ID that can be used to search for the status of background jobs triggered by this request.

Example response

{
  "objectPath": ["yourConnectionKey/yourDatabase"],
  "technology": "Snowflake",
  "state": "active",
  "settings": {
    "activateNewChildren": {
      "value": true,
      "hasDescendantsWithOverrides": true
    },
    "dataOwners": {
      "value": [{
        "id": 2,
        "type": "user"
      }, ],
      "hasDescendantsWithOverrides": true
    },
    "isActive": {
      "value": true,
      "hasDescendantsWithOverrides": true
    }
  },
  "overrides": [
    "isActive",
    "activateNewChildren",
    "dataOwners"
  ],
  "dataSourceId": null,
  "lastCrawled": 2023 - 08 - 21 T10: 39: 00.250 Z,
  "createdAt": 2023 - 08 - 21 T10: 39: 00.250 Z,
  "remoteId": null,
  "bulkId": "the-job's-unique-identifier"
}

DELETE /data/object/{objectPath}

Delete the given object and all its child objects. For example, if you delete a database, all its schemas and tables will also be deleted.

Required Immuta permission:GOVERNANCE or APPLICATION_ADMIN global permission or Data Owner on the object

See the Deregister a connection guide to delete a connection and all its data objects.

curl -X 'DELETE' \
    'https://<your-immuta-url>/data/object/yourConnectionKey/yourDatabase/yourSchema' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \

Path parameters

Attribute	Description	Required
objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.	Yes

Response schema

Attribute	Description
objectPath string	The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
childCount integer	The number of child objects of the data object that were deleted.

Example response

{
  "objectPath": ['yourConnectionKey', 'yourDatabase', 'yourSchema'],
  "childCount": 5
}