Integration Configuration Payload
Understand the payloads and parameters for configuring an integration via the API
The parameters for configuring an integration in Immuta are outlined in the table below.
type string
The type of integration to configure.
Required
-
autoBootstrap boolean
When true, Immuta will automatically configure the integration in your Azure Synapse Analytics environment for you. When false, you must set up your environment manually before configuring the integration with the API. This parameter must be set to false in the Amazon Redshift Spectrum, Amazon S3, and Google BigQuery configurations. See the Azure Synapse Analytics how-to guide for details.
Required for all integrations
-
true or false
config object
This object specifies the integration settings. See the config object description for your integration for details: Amazon Redshift Spectrum, Amazon S3, Azure Synapse Analytics, or Google BigQuery.
Required for all integrations
-
-
Amazon S3 configuration object
The config object configures the S3 integration. The table below outlines its child parameters.
name string
A name for the integration that is unique across all Amazon S3 integrations configured in Immuta.
Required
-
-
awsAccountId string
The ID of your AWS account.
Required
-
-
awsRegion string
The AWS region to use.
Required
-
Any valid AWS region (us-east-1, for example)
awsLocationRole string
The AWS IAM role ARN assigned to the base access grants location. This is the role the AWS Access Grants service assumes to vend credentials to the grantee. When a grantee accesses S3 data, the AWS Access Grants service attaches session policies and assumes this role in order to vend scoped down credentials to the grantee. This role needs full access to all paths under the S3 location prefix.
Required
-
-
awsLocationPath string
The base S3 location prefix that Immuta will use for this connection when registering S3 data sources. This path must be unique across all S3 integrations configured in Immuta.
Required
-
-
awsRoleToAssume string
The AWS IAM role ARN Immuta assumes when interacting with AWS.
Required when authenticationType is auto.
[]
-
authenticationType string
The method used to authenticate with AWS when configuring the S3 integration.
Required
-
autoaccessKey
awsAccessKeyId string
The AWS access key ID for the AWS account configuring the integration.
Required when authenticationType is accessKey.
-
-
awsSecretAccessKey string
The AWS secret access key for the AWS account configuring the integration.
Required when authenticationType is accessKey.
-
-
port number
The port to use when connecting to your S3 Access Grants instance.
Optional
443
0-65535
Azure Synapse Analytics configuration objects
The config object configures the Azure Synapse Analytics integration. The table below outlines its child parameters.
host string
The URL of your Azure Synapse Analytics account.
Required
-
Valid URL hostnames.
database string
Name of an existing database where the Immuta system user will store all Immuta-generated schemas and views.
Required
-
-
schema string
Name of the Immuta-managed schema where all your secure views will be created and stored.
Required
-
-
authenticationType string
The method used to authenticate with Azure Synapse Analytics when configuring the integration.
Required
-
entraIdOAuthClientSecretuserPassword
username string
The username of the system account that can act on Azure Synapse Analytics objects and configure the integration.
Required when authenticationType is userPassword.
-
-
password string
The password of the system account that can act on Azure Synapse Analytics objects and configure the integration.
Required when authenticationType is userPassword.
-
-
displayName string
The application display name. This value must match the name of the application you registered in Microsoft Entra ID.
Required when authenticationType is entraIdOAuthClientSecret.
-
-
clientId string
The application client ID, which can be found on the overview page of the application you created in Microsoft Entra ID.
Required when authenticationType is entraIdOAuthClientSecret.
-
-
tenantId string
The application tenant ID, which can be found on the overview page of the application you created in Microsoft Entra ID.
Required when authenticationType is entraIdOAuthClientSecret.
-
-
clientSecret string
The secret string Immuta will use to prove its identity when requesting a token. Use the value of the secret, not the secret ID.
Required when authenticationType is entraIdOAuthClientSecret.
-
-
metadataDelimiters object
This object is a set of delimiters that Immuta uses to store profile data in Azure Synapse Analytics. See the object description for parameters.
Optional
See the object description for default values.
-
port number
The port to use when connecting to your Azure Synapse Analytics account host.
Optional
1433
0-65535
impersonation object
Enables user impersonation. See the impersonation object description for parameters.
Optional
Disabled by default. See the impersonation object description for parameters.
-
connectArgs string
The connection string arguments to pass to the Node.js driver when connecting as the Immuta system user.
Optional
-
-
Azure Synapse Analytics impersonation object
The impersonation object enables and defines roles for user impersonation for Azure Synapse Analytics. The table below outlines its child parameters.
enabled boolean
When true, enables user impersonation.
false
true or false
role string
The name of the user impersonation role.
IMMUTA_IMPERSONATION
-
Delete Azure Synapse Analytics payload
The credentials you used when configuring your integration are required in the payload when autoBootstrap was set to true when setting up your integration. For integration configurations with autoBootstrap set to false, no payload is required when deleting the integration.
authenticationType string
The type of authentication used when originally configuring the Azure Synapse Analytics integration.
Required
userPassword
username string
The username of the system account that configured the integration.
Required if autoBootstrap was true when setting up the integration.
-
password string
The password of the system account that configured the integration.
Required if autoBootstrap was true when setting up the integration.
-
Metadata delimiters object
The metadataDelimiters object specifies the delimiters that Immuta uses to store profile data in Azure Synapse Analytics. The table below outlines its child parameters.
hashDelimiter string
A delimiter used to separate key-value pairs.
`
`
hashKeyDelimiter string
A delimiter used to separate a key from its value.
:
-
arrayDelimiter string
A delimiter used to separate array elements.
,
-
Google BigQuery configuration object
The config object configures the Google BigQuery view-based integration. The table below outlines its child parameters.
role string
Google Cloud role used to connect to Google BigQuery.
Required
-
-
datasetSuffix string
Suffix to postfix to the name of each dataset created to store secure views. This string must start with an underscore.
Required
-
-
dataset string
Name of the BigQuery dataset to provision inside of the project for Immuta metadata storage.
Optional
immuta
-
location string
The dataset's location. After a dataset is created, the location can't be changed.
Required
-
Any valid GCP location (us-east-1, for example).
credential string
The Google BigQuery service account JSON keyfile credential content. See the Google documentation for guidance on generating and downloading this keyfile.
Required
-
-
port number
The port to use when connecting to your BigQuery account host.
Optional
443
0-65535
Redshift Spectrum configuration objects
The config object configures the Amazon Redshift Spectrum integration. The table below outlines its child parameters.
host string
The URL of your Redshift account.
Required
-
Valid URL hostnames
database string
Name of a new or existing database that the Immuta system user will manage and store metadata in.
Required
-
-
authenticationType string
The type of authentication to use when connecting to Redshift.
Required
-
userPassword
username string
The username of the system account that can act on Redshift objects and configure the integration.
Required if you selected userPassword as your authenticationType.
-
-
password string
The password of the system account that can act on Redshift objects and configure the integration.
Required if you selected userPassword as your authenticationType.
-
-
port number
The port to use when connecting to your Redshift account host.
Optional
5439
0-65535
impersonation object
Enables user impersonation. See the impersonation object description for parameters.
Optional
Disabled by default. See the impersonation object description for parameters.
-
connectArgs string
The connection string arguments to pass to the Node.js driver when connecting as the Immuta system user.
Optional
-
-
Redshift Spectrum impersonation object
The impersonation object enables and defines roles for user impersonation for Amazon Redshift Spectrum. The table below outlines its child parameters.
enabled boolean
When true, enables user impersonation.
false
true or false
role string
The name of the user impersonation role.
immuta_impersonation
-
Last updated
Was this helpful?