# Register a Snowflake Connection The connection API is a REST API which allows users to register a Snowflake connection[^1] to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. Then Immuta can manage and enforce access controls on your data through that connection. To manage your connection, see the [Manage a connection reference guide](https://documentation.immuta.com/saas/developer-guides/api-intro/connections-api/how-to-guides/manage-a-connection). #### Requirements The following permissions and personas are used in the registration process: * `APPLICATION_ADMIN` Immuta permission * The Snowflake user registering the connection and running the script must have the following privileges: * `CREATE DATABASE ON ACCOUNT WITH GRANT OPTION` * `CREATE ROLE ON ACCOUNT WITH GRANT OPTION` * `CREATE USER ON ACCOUNT WITH GRANT OPTION` * `MANAGE GRANTS ON ACCOUNT WITH GRANT OPTION` * `APPLY MASKING POLICY ON ACCOUNT WITH GRANT OPTION` * `APPLY ROW ACCESS POLICY ON ACCOUNT WITH GRANT OPTION` #### Prerequisites No Snowflake integration configured in Immuta. If your Snowflake integration is already configured on the app settings page, follow the [Use the connection upgrade manager](https://documentation.immuta.com/saas/configuration/integrations/data-and-integrations/registering-a-connection/how-to-guides/use-the-connection-upgrade-manager) guide. Complete the following steps to register a Snowflake connection: 1. Create an Immuta system account with the proper Snowflake privileges for Immuta to use to manage policies in Snowflake. 2. Use the `/integrations/scripts/create` endpoint to receive a script. 3. Run the script in Snowflake. 4. Use the `/data/connection` endpoint to finish registering your connection in Immuta. ## Step 1: Set up the Immuta system account Complete the following actions in Snowflake: 1. [Create a new user in Snowflake to be the Immuta system account](https://docs.snowflake.com/en/sql-reference/sql/create-user). Immuta will use this system account continuously to orchestrate Snowflake policies and maintain state between Immuta and Snowflake. 2. [Create a Snowflake role](https://docs.snowflake.com/en/sql-reference/sql/create-role) with a minimum of the following privileges: * `USAGE` on all databases and schemas with registered data sources. * `REFERENCES` on all tables and views registered in Immuta. * [`SELECT` on all tables and views registered in Immuta](#user-content-fn-2)[^2]. 3. [Grant the new Snowflake role](https://docs.snowflake.com/en/sql-reference/sql/grant-role) to the system account you just created. ## Step 2: Generate the script `POST` `/integrations/scripts/create` 1. Using the example request, update the **``** with your connection details and the authentication credentials for the system account you just created. 2. Copy the `config` object to use later in the setup process. 3. Run the request. 4. Copy the returned script and use it in the next step. Find descriptions of the editable attributes in the table below and of the full payload in the [Integration configuration payload reference guide](https://documentation.immuta.com/saas/developer-guides/integrations-api/reference-guides/integration-configuration-payload#snowflake-configuration-objects). {% tabs %} {% tab title="Username and password" %} ``` curl -X 'POST' \ 'https:///integrations/scripts/create' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -H 'Authorization: ' \ -d '{ "type": "Snowflake", "autoBootstrap": false, "config": { "host": "", "warehouse": "", "database": "", "authenticationType": "userPassword", "username": "", "password": "", "audit": {"enabled": true}, "workspaces": {"enabled": false}, "impersonation": { "enabled": true, "role": "IMPERSONATION_ROLE" }, "lineage": { "enabled": false }, "userRolePattern": { "exclude": [] } } }' ``` **Payload parameters** | Attribute | Description | Required | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | | config.**host** `string` | The URL of your Snowflake account. | **Yes** | | config.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | config.**database** `string` | Name of a new empty database that the Immuta system user will manage and store metadata in. | **Yes** | | config.**username** `string` | The new username of the system account that can act on Snowflake objects and register the connection. | **Yes** | | config.**password** `string` | The password of the system account that can act on Snowflake objects and register the connection. | **Yes** | | config.**audit** `object` | This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled. | No | | config.audit.**enabled** `boolean` | If `true`, Snowflake query audit is enabled. | No | | config.**workspaces** `object` | This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled. | No | | config.workspaces.**enabled** `boolean` | If `true`, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used. | No | | config.**impersonation** `object` | This object enables user impersonation. | No | | config.impersonation.**enabled** `boolean` | If `true`, user impersonation is enabled. | No | | config.impersonation.**role** `string` | The name of the user impersonation role. | No | | config.**lineage** `object` | This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled. | No | | config.lineage.**enabled** `boolean` | If `true`, Snowflake lineage is enabled. | No | | config.**userRolePattern** `object` | This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded. | No | | config.userRolePattern.**exclude** `array` | This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables. | No | | {% endtab %} | | | {% tab title="Key pair" %} ``` curl -X 'POST' \ 'https:///integrations/scripts/create' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -H 'Authorization: ' \ -d '{ "type": "Snowflake", "autoBootstrap": false, "config": { "host": "", "warehouse": "", "database": "", "authenticationType": "keyPair", "username": "", "privateKey": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->", "audit": {"enabled": true}, "workspaces": {"enabled": false}, "impersonation": {"enabled": false}, "lineage": { "enabled": false }, "userRolePattern": { "exclude": [] } } }' ``` **Payload parameters** | Attribute | Description | Required | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | | config.**host** `string` | The URL of your Snowflake account. | **Yes** | | config.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | config.**database** `string` | Name of a new empty database that the Immuta system user will manage and store metadata in. | **Yes** | | config.**username** `string` | The username of the system account that can act on Snowflake objects and register the connection. | **Yes** | | config.**privateKey** `string` | The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. | **Yes** | | config.**audit** `object` | This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled. | No | | config.audit.**enabled** `boolean` | If `true`, Snowflake query audit is enabled. | No | | config.**workspaces** `object` | This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled. | No | | config.workspaces.**enabled** `boolean` | If `true`, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used. | No | | config.**impersonation** `object` | This object enables user impersonation. | No | | config.impersonation.**enabled** `boolean` | If `true`, user impersonation is enabled. | No | | config.**lineage** `object` | This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled. | No | | config.lineage.**enabled** `boolean` | If `true`, Snowflake lineage is enabled. | No | | config.**userRolePattern** `object` | This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded. | No | | config.userRolePattern.**exclude** `array` | This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables. | No | | {% endtab %} | | | {% tab title="OAuth with certificate" %} 
curl -X 'POST' \
    'https://<your-immuta-url>/integrations/scripts/create' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
    "type": "Snowflake",
    "autoBootstrap": false,
    "config": {
      "host": "<your-Snowflake-hostname-url>",
      "warehouse": "<your-Snowflake-warehouse>",
      "database": "<your-Snowflake-database>",
      "authenticationType": "oAuthClientCredentials",
      "oAuthClientConfig": {
        "provider": "<your-provider>",
        "clientId": "<your-client-ID>",
        "authorityUrl": "<your-example.authority.com>",
        "useCertificate": true,
        "publicCertificateThumbprint": "<your-certificate-thumbprint>",
        "oauthPrivateKey": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->",
        "scope": "session:role-any",
      "audit": {"enabled": true},
      "workspaces": {"enabled": false},
      "impersonation": {"enabled": false},
      "lineage": { "enabled": false },
      "userRolePattern": { "exclude": [] }
      }
    }
    }'
**Payload parameters** | Attribute | Description | Required | | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | | config.**host** `string` | The URL of your Snowflake account. | **Yes** | | config.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | config.**database** `string` | Name of a new empty database that the Immuta system user will manage and store metadata in. | **Yes** | | config.oAuthClientConfig.**provider** `string` | The identity provider for OAuth, such as Okta. | **Yes** | | config.oAuthClientConfig.**clientId** `string` | The client identifier of your registered application. | **Yes** | | config.oAuthClientConfig.**authorityUrl** `string` | Authority URL of your identity provider. | **Yes** | | config.oAuthClientConfig.**publicCertificateThumbprint** `string` | Your certificate thumbprint. | **Yes** | | config.oAuthClientConfig.**oauthPrivateKey** `string` | The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. | **Yes** | | config.**audit** `object` | This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled. | No | | config.audit.**enabled** `boolean` | If `true`, Snowflake query audit is enabled. | No | | config.**workspaces** `object` | This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled. | No | | config.workspaces.**enabled** `boolean` | If `true`, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used. | No | | config.**impersonation** `object` | This object enables user impersonation. | No | | config.impersonation.**enabled** `boolean` | If `true`, user impersonation is enabled. | No | | config.**lineage** `object` | This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled. | No | | config.lineage.**enabled** `boolean` | If `true`, Snowflake lineage is enabled. | No | | config.**userRolePattern** `object` | This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded. | No | | config.userRolePattern.**exclude** `array` | This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables. | No | | {% endtab %} | | | {% tab title="OAuth with secret" %} 
curl -X 'POST' \
    'https://<your-immuta-url>/integrations/scripts/create' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
    "type": "Snowflake",
    "autoBootstrap": false,
    "config": {
      "host": "<your-Snowflake-hostname-url>",
      "warehouse": "<your-Snowflake-warehouse>",
      "database": "<your-Snowflake-database>",
      "authenticationType": "oAuthClientCredentials",
      "oAuthClientConfig": {
        "provider": "<your-provider>",
        "clientId": "<your-client-ID>",
        "authorityUrl": "<your-example.authority.com>",
        "clientSecret": "<your-client-secret>",
        "useCertificate": false,
        "scope": "session:role-any",
      "audit": {"enabled": true},
      "workspaces": {"enabled": false},
      "impersonation": {"enabled": false},
      "lineage": { "enabled": false },
      "userRolePattern": { "exclude": [] }
      }
    }
    }'
**Payload parameters** | Attribute | Description | Required | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | | config.**host** `string` | The URL of your Snowflake account. | **Yes** | | config.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | config.**database** `string` | Name of a new empty database that the Immuta system user will manage and store metadata in. | **Yes** | | config.oAuthClientConfig.**provider** `string` | The identity provider for OAuth, such as Okta. | **Yes** | | config.oAuthClientConfig.**clientId** `string` | The client identifier of your registered application. | **Yes** | | config.oAuthClientConfig.**authorityUrl** `string` | Authority URL of your identity provider. | **Yes** | | config.oAuthClientConfig.**clientSecret** `string` | Client secret of the application. | **Yes** | | config.**audit** `object` | This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled. | No | | config.audit.**enabled** `boolean` | If `true`, Snowflake query audit is enabled. | No | | config.**workspaces** `object` | This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled. | No | | config.workspaces.**enabled** `boolean` | If `true`, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used. | No | | config.**impersonation** `object` | This object enables user impersonation. | No | | config.impersonation.**enabled** `boolean` | If `true`, user impersonation is enabled. | No | | config.**lineage** `object` | This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled. | No | | config.lineage.**enabled** `boolean` | If `true`, Snowflake lineage is enabled. | No | | config.**userRolePattern** `object` | This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded. | No | | config.userRolePattern.**exclude** `array` | This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables. | No | | {% endtab %} | | | | {% endtabs %} | | | ## Step 3: Run the script in Snowflake {% hint style="info" %} **Snowflake impersonation** If enabling Snowflake impersonation, add the following content to the script that is generated before you run it in Snowflake: ``` CREATE ROLE "YOUR IMPERSONATION ROLE NAME"; GRANT OWNERSHIP ON ROLE "YOUR IMPERSONATION ROLE NAME" TO ROLE "SYSTEM ACCOUNT ROLE"; ``` Once you finish configuring the integration, you can grant the `IMPERSONATE_USER` permission to Immuta users. See the [Managing users and permissions guide](https://documentation.immuta.com/saas/configuration/people/users-index/how-to-guides/managing-personas-and-permissions#add-permission-to-user) for instructions. {% endhint %} Using your generated script, run it in your Snowflake environment as a user with the permissions listed in the [requirements section](#requirements). The script will use the provided Immuta system user credentials to create the database you specified in the earlier step and set up Immuta-managed resources in Snowflake. ## Step 4: Create the connection in Immuta `POST` `/data/connection` Using the tabs below, copy the request and update the **``** with your connection details. The `connection` details here should match the ones used when generating the script, and the payload from the script generation should be pasted exactly into `nativeIntegration`. Then submit the request. Find descriptions of the editable attributes in the table below and of the full payload in the [Connection registration payloads reference guide](https://documentation.immuta.com/saas/developer-guides/api-intro/connections-api/connection-registration-payloads-reference-guide). The recommended setting values are included in the example. {% hint style="info" %} **Test run** Opt to test and validate the create connection payload using a dry run: `POST` `/data/connection/test` {% endhint %} {% tabs %} {% tab title="Username and password" %} ``` curl -X 'POST' \ 'https:///data/connection' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -H 'Authorization: ' \ -d '{ "connectionKey": "", "connection": { "technology": "Snowflake", "hostname": "", "port": , "warehouse": "", "role": "", "authenticationType": "userPassword", "username": "", "password": "" }, "settings": { "isActive": false }, "options": { "forceRecursiveCrawl": true }, "nativeIntegration": { "type": "Snowflake", "autoBootstrap": false, "config": { "authenticationType": "userPassword", "username": "", "password": "", "host": "", "port": , "warehouse": "", "database": "", "impersonation": { "enabled": true, "role": "IMPERSONATION_ROLE" }, "audit": { "enabled": true }, "workspaces": { "enabled": false }, "lineage": { "enabled": false }, "userRolePattern": { "exclude": [] } } } }' ``` **Payload parameters** | Attribute | Description | Required | | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | **connectionKey** `string` | A unique name for the connection. Avoid the use of periods (`.`) or [restricted words](#user-content-fn-6)[^6] in your connection key. | **Yes** | | **connection** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | connection.**hostname** `string` | The URL of your Snowflake account. This should be the same as `nativeIntegration.config.host`. | **Yes** | | connection.**port** `integer` | The port to use when registering your Snowflake connection. | **Yes** | | connection.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | connection.**role** `string` | The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern. | **Yes** | | connection.**username** `string` | The username of the system account that can act on Snowflake objects and register the connection. | **Yes** | | connection.**password** `string` | The password of the system account that can act on Snowflake objects and register the connection. | **Yes** | | **settings** `object` | Specifications of the connection's settings, including status. | No | | settings.**isActive** `boolean` | When `false`, data objects will be inactive (disabled) by default when created in Immuta. Set to `false` for the recommended configuration. | No | | options.**forceRecursiveCrawl** `boolean` | If `false`, only active (enabled) objects will be crawled. If `true`, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to `true` for the recommended configuration. | No | | **nativeIntegration** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. See the [table above](#step-2-generate-the-script) for descriptions. | **Yes** | | {% endtab %} | | | {% tab title="Key pair" %} 
curl -X 'POST' \
    'https://<your-immuta-url>/data/connection' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connectionKey": "<your-connection-key-name>",
     "connection": {
       "technology": "Snowflake",
       "hostname": "<your-Snowflake-hostname-url>",
       "port": <your-Snowflake-port>,
       "warehouse": "<your-Snowflake-warehouse>",
       "role": "<your-Snowflake-role>",
       "authenticationType": "keyPair",
       "username": "<the-Snowflake-username>",
       "privateKeyPassword": "<your-Snowflake-key-password>",
       "privateKey": {
         "keyName": "PRIV_KEY_FILE",
         "userFilename": "<your-private-key-file-name>",
         "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
       }
     },
     "settings": {
         "isActive": false
     },
     "options": {
       "forceRecursiveCrawl": true
     },
     "nativeIntegration": {
       "type": "Snowflake",
       "autoBootstrap": false,
       "config": {
         "authenticationType": "keyPair",
         "username": "<the-Snowflake-username>",
         "privateKeyPassword": "<your-Snowflake-key-password>",
         "privateKey": {
           "keyName": "PRIV_KEY_FILE",
           "userFilename": "<your-private-key-file-name>",
           "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
       }
         "host": "<your-Snowflake-hostname-url>",
         "port": <your-Snowflake-port>,
         "warehouse": "<your-Snowflake-warehouse>",
         "database": "<your-Snowflake-database>",
         "impersonation": { "enabled": false },
         "audit": { "enabled": true },
         "workspaces": { "enabled": false },
         "lineage": { "enabled": false },
         "userRolePattern": { "exclude": [] }
       }
     }
    }'
**Payload parameters** | Attribute | Description | Required | | ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | **connectionKey** `string` | A unique name for the connection. Avoid the use of periods (`.`) or [restricted words](#user-content-fn-6)[^6] in your connection key. | **Yes** | | **connection** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | connection.**hostname** `string` | The URL of your Snowflake account. This is the same as `host`. | **Yes** | | connection.**port** `integer` | The port to use when registering your Snowflake connection. | **Yes** | | connection.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | connection.**role** `string` | The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern. | **Yes** | | connection.**username** `string` | The username of the system account that can act on Snowflake objects and register the connection. | **Yes** | | connection.**privateKeyPassword** `string` | The Snowflake private key password. Required if the private key is encrypted. | No | | connection.privateKey.**userFilename** `string` | The name of your private key file on your machine. | **Yes** | | connection.privateKey.**content** `string` | The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as `config.privateKey`. | **Yes** | | **settings** `object` | Specifications of the connection's settings, including status. | No | | settings.**isActive** `boolean` | If `false`, data objects will be inactive (disabled) by default when created in Immuta. Set to `false` for the recommended configuration. | No | | options.**forceRecursiveCrawl** `boolean` | If `false`, only active (enabled) objects will be crawled. If `true`, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to `true` for the recommended configuration. | No | | **nativeIntegration** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | nativeIntegration.config.**username** `string` | Same as `connection.username` | **Yes** | | nativeIntegration.config.**privateKeyPassword** `string` | Same as `connection.privateKeyPassword` | No | | nativeIntegration.config.privateKey.**keyName** `string` | Same as `connection.keyName` | **Yes** | | nativeIntegration.config.privateKey.**userFilename** `string` | Same as `connection.userFilename` | **Yes** | | nativeIntegration.config.privateKey.**content** `string` | Same as `connection.content` | **Yes** | | nativeIntegration.config.**host** `string` | Same as `connection.hostname` | **Yes** | | nativeIntegration.config.**port** `integer` | Same as `connection.port` | **Yes** | | nativeIntegration.config.**warehouse** `string` | Same as `connection.warehouse` | **Yes** | | nativeIntegration.config.**database** `string` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**impersonation** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**audit** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**workspaces** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**lineage** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.**userRolePattern** `object` | Use the same setting as the script generation. | **Yes** | | {% endtab %} | | | {% tab title="OAuth and certificate" %} 
curl -X 'POST' \
    'https://<your-immuta-url>/data/connection' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connectionKey": "<your-connection-key-name>",
     "connection": {
       "technology": "Snowflake",
       "hostname": "<your-Snowflake-hostname-url>",
       "port": <your-Snowflake-port>,
       "warehouse": "<your-Snowflake-warehouse>",
       "role": "<your-Snowflake-role>",
       "authenticationType": "oAuthClientCredentials",
       "oAuthClientConfig": {
         "useCertificate": true,
         "clientId": "<your-client-ID>",
         "authorityUrl": "<your-example.authority.com>",
         "scope": "session:role-any",
         "publicCertificateThumbprint": "<your-certificate-thumbprint>",
         "resource": "<your-optional-resource>",
         "oauthPrivateKey": {
           "keyName": "oauth client certificate",
           "userFilename": "<your-user-file.pem>",
           "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
         }
       }
     },
     "settings": {
         "isActive": false
     },
     "options": {
       "forceRecursiveCrawl": true
     },
     "nativeIntegration": {
       "type": "Snowflake",
       "autoBootstrap": false,
       "config": {
         "authenticationType": "oAuthClientCredentials",
         "oAuthClientConfig": {
           "useCertificate": true,
           "clientId": "<your-client-ID>",
           "authorityUrl": "<your-example.authority.com>",
           "scope": "session:role-any",
           "publicCertificateThumbprint": "<your-certificate-thumbprint>",
           "resource": "<your-optional-resource>",
           "oauthPrivateKey": {
             "keyName": "oauth client certificate",
             "userFilename": "<your-user-file.pem>",
             "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
           }
         }
         "host": "<your-Snowflake-hostname-url>",
         "port": <your-Snowflake-port>,
         "warehouse": "<your-Snowflake-warehouse>",
         "database": "<your-Snowflake-database>",
         "impersonation": { "enabled": false },
         "audit": { "enabled": true },
         "workspaces": { "enabled": false },
         "lineage": { "enabled": false },
         "userRolePattern": { "exclude": [] }
       }
     }
    }'
**Payload parameters** | Attribute | Description | Required | | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | **connectionKey** `string` | A unique name for the connection. Avoid the use of periods (`.`) or [restricted words](#user-content-fn-6)[^6] in your connection key. | **Yes** | | **connection** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | connection.**hostname** `string` | The URL of your Snowflake account. This is the same as `host`. | **Yes** | | connection.**port** `integer` | The port to use when registering your Snowflake connection. | **Yes** | | connection.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | connection.**role** `string` | The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern. | **Yes** | | connection.oAuthClientConfig.**clientId** `string` | The client identifier of your registered application. | **Yes** | | connection.oAuthClientConfig.**authorityUrl** `string` | Authority URL of your identity provider. | **Yes** | | connection.oAuthClientConfig.**publicCertificateThumbprint** `string` | Your certificate thumbprint. | **Yes** | | connection.oAuthClientConfig.**resource** `string` | An optional resource to pass to the token provider. | No | | connection.oAuthClientConfig.oauthPrivateKey.**userFilename** `string` | The name of your private key file on your machine. | **Yes** | | connection.oAuthClientConfig.oauthPrivateKey.**content** `string` | The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as `config.oauthPrivateKey` in the script request. | **Yes** | | **settings** `object` | Specifications of the connection's settings, including status. | No | | settings.**isActive** `boolean` | When `false`, data objects will be inactive (disabled) by default when created in Immuta. Set to `false` for the recommended configuration. | No | | options.**forceRecursiveCrawl** `boolean` | If `false`, only active (enabled) objects will be crawled. If `true`, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to `true` for the recommended configuration. | No | | **nativeIntegration** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | nativeIntegration.config.oAuthClientConfig.**clientId** `string` | Same as `connection.oAuthClientConfig.clientId` | **Yes** | | nativeIntegration.config.oAuthClientConfig.**authorityUrl** `string` | Same as `connection.oAuthClientConfig.authorityUrl` | **Yes** | | nativeIntegration.config.oAuthClientConfig.**publicCertificateThumbprint** `string` | Same as `connection.oAuthClientConfig.publicCertificateThumbprint` | **Yes** | | nativeIntegration.config.oAuthClientConfig.**resource** `string` | Same as `connection.oAuthClientConfig.resource` | No | | nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.**userFilename** `string` | Same as `connection.oAuthClientConfig.oauthPrivateKey.userFilename` | **Yes** | | nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.**content** `string` | Same as `connection.oAuthClientConfig.oauthPrivateKey.content` | **Yes** | | nativeIntegration.config.**host** `string` | Same as `connection.hostname` | **Yes** | | nativeIntegration.config.**port** `integer` | Same as `connection.port` | **Yes** | | nativeIntegration.config.**warehouse** `string` | Same as `connection.warehouse` | **Yes** | | nativeIntegration.config.**database** `string` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**impersonation** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**audit** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**workspaces** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**lineage** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.**userRolePattern** `object` | Use the same setting as the script generation. | **Yes** | | {% endtab %} | | | {% tab title="OAuth and secret" %} 
curl -X 'POST' \
    'https://<your-immuta-url>/data/connection' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connectionKey": "<your-connection-key-name>",
     "connection": {
       "technology": "Snowflake",
       "hostname": "<your-Snowflake-hostname-url>",
       "port": <your-Snowflake-port>,
       "warehouse": "<your-Snowflake-warehouse>",
       "role": "<your-Snowflake-role>",
       "authenticationType": "oAuthClientCredentials",
       "oAuthClientConfig": {
         "useCertificate": false,
         "clientId": "<your-client-ID>",
         "authorityUrl": "<your-example.authority.com>",
         "scope": "session:role-any",
         "resource": "<your-optional-resource>",
         "clientSecret": "<your-client-secret>"
       }
     },
     "settings": {
         "isActive": false
     },
     "options": {
       "forceRecursiveCrawl": true
     },
     "nativeIntegration": {
       "type": "Snowflake",
       "autoBootstrap": false,
       "config": {
         "authenticationType": "oAuthClientCredentials",
         "oAuthClientConfig": {
           "useCertificate": false,
           "clientId": "<your-client-ID>",
           "authorityUrl": "<your-example.authority.com>",
           "scope": "session:role-any",
           "resource": "<your-optional-resource>",
           "clientSecret": "<your-client-secret>"           
         }
         "host": "<your-Snowflake-hostname-url>",
         "port": <your-Snowflake-port>,
         "warehouse": "<your-Snowflake-warehouse>",
         "database": "<your-Snowflake-database>",
         "impersonation": { "enabled": false },
         "audit": { "enabled": true },
         "workspaces": { "enabled": false },
         "lineage": { "enabled": false },
         "userRolePattern": { "exclude": [] }
       }
     }
    }'
**Payload parameters** | Attribute | Description | Required | | -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | **connectionKey** `string` | A unique name for the connection. Avoid the use of periods (`.`) or [restricted words](#user-content-fn-6)[^6] in your connection key. | **Yes** | | **connection** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | connection.**hostname** `string` | The URL of your Snowflake account. This is the same as `host`. | **Yes** | | connection.**port** `integer` | The port to use when registering your Snowflake connection. | **Yes** | | connection.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | connection.**role** `string` | The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern. | **Yes** | | connection.oAuthClientConfig.**clientId** `string` | The client identifier of your registered application. | **Yes** | | connection.oAuthClientConfig.**authorityUrl** `string` | Authority URL of your identity provider. | **Yes** | | connection.oAuthClientConfig.**clientSecret** `string` | Client secret of the application. | **Yes** | | connection.oAuthClientConfig.**resource** `string` | An optional resource to pass to the token provider. | No | | **settings** `object` | Specifications of the connection's settings, including status. | No | | settings.**isActive** `boolean` | When `false`, data objects will be inactive (disabled) by default when created in Immuta. Set to `false` for the recommended configuration | No | | options.**forceRecursiveCrawl** `boolean` | If `false`, only active (enabled) objects will be crawled. If `true`, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to `true` for the recommended configuration. | No | | **nativeIntegration** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | nativeIntegration.config.oAuthClientConfig.**clientId** `string` | Same as `connection.oAuthClientConfig.clientId` | **Yes** | | nativeIntegration.config.oAuthClientConfig.**authorityUrl** `string` | Same as `connection.oAuthClientConfig.authorityUrl` | **Yes** | | nativeIntegration.config.oAuthClientConfig.**resource** `string` | Same as `connection.oAuthClientConfig.resource` | No | | nativeIntegration.config.oAuthClientConfig.**clientSecret** `string` | Same as `connection.oAuthClientConfig.clientSecret` | **Yes** | | nativeIntegration.config.**host** `string` | Same as `connection.hostname` | **Yes** | | nativeIntegration.config.**port** `integer` | Same as `connection.port` | **Yes** | | nativeIntegration.config.**warehouse** `string` | Same as `connection.warehouse` | **Yes** | | nativeIntegration.config.**database** `string` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**impersonation** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**audit** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**workspaces** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**lineage** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.**userRolePattern** `object` | Use the same setting as the script generation. | **Yes** | | {% endtab %} | | | | {% endtabs %} | | | #### Response schema | Attribute | Description | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **objectPath** `string` | The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element will be the associated `connectionKey`. | | **bulkId** `string` | A bulk ID that can be used to search for the status of background jobs triggered by this request. | **Example response** ``` { "objectPath": [''], "bulkId": "a-new-uuid" } ``` [^1]: To learn more about connections in Immuta, see the [Connections section](https://documentation.immuta.com/saas/configuration/integrations/data-and-integrations/registering-a-connection/reference-guides/connections-overview). [^2]: Only required when using [identification](https://documentation.immuta.com/saas/configuration/tags/data-discovery) or [specialized masking policies that require fingerprinting](https://documentation.immuta.com/saas/govern/secure-your-data/authoring-policies-in-secure/data-policies/reference-guides/masking-matrix-functions#types-limited-to-snowflake). [^3]: To use a secret instead of certificate, see other tab. [^4]: This must be `session:role-any`. [^5]: To use a certificate instead of secret, see other tab. [^6]: Your display name cannot be any of the following words: `data`, `connection`, `object`, `crawl`, `search`, `settings`, `metadata`, `permission`, `sync`, `bulk`, and `upgrade`. [^7]: This must be `PRIV_KEY_FILE`. [^8]: Note this payload differs from the script generation in the `privateKey` object. [^9]: Use the same user file name from above. [^10]: Use the same content from above. [^11]: This must be `oauth client certificate`. [^12]: Note this payload differs from the script generation in the `oauthPrivateKey` object.