# Register a Snowflake Host The enhanced onboarding API is a REST API which allows users to register a Snowflake host[^1] to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. Then Immuta can manage and enforce access controls on your data through that host. To manage your host, see the [Manage a host reference guide](https://documentation.immuta.com/saas/~/changes/l3NnvynMHxi6VvqRtJhK/developer-guides/api-intro/enhanced-onboarding-api/how-to-guides/manage-a-host). #### Requirements The following permissions and personas are used in the registration process: * **Immuta permission**: `CREATE_DATA_SOURCE` * **Snowflake permissions for the user registering the host and running the script**: * `CREATE DATABASE ON ACCOUNT WITH GRANT OPTION` * `CREATE ROLE ON ACCOUNT WITH GRANT OPTION` * `CREATE USER ON ACCOUNT WITH GRANT OPTION` * `MANAGE GRANTS ON ACCOUNT WITH GRANT OPTION` * `APPLY MASKING POLICY ON ACCOUNT WITH GRANT OPTION` * `APPLY ROW ACCESS POLICY ON ACCOUNT WITH GRANT OPTION` * `REFERENCES` on all tables * `USAGE` on the schema and database to register data sources * **Snowflake permissions for the new Immuta system account that is created:** * `APPLY MASKING POLICY ON ACCOUNT` * `APPLY ROW ACCESS POLICY ON ACCOUNT` * Additional grants associated with the `IMMUTA` database Complete the following steps to register a Snowflake host: 1. Use the `/integrations/scripts/create` endpoint to receive a script. 2. Run the script in Snowflake. 3. Use the `/data/connection` endpoint to finish registering your host in Immuta. ## Step 1: Generate the script `POST` `/integrations/scripts/create` 1. Using the example request, update the **``** with your connection details. 2. Copy the `config` object to use later in the setup process. 3. Run the request. 4. Copy the returned script and use it in the next step. Find descriptions of the editable attributes in the table below and of the full payload in the [Integration configuration payload reference guide](https://documentation.immuta.com/saas/~/changes/l3NnvynMHxi6VvqRtJhK/developer-guides/integrations-api/reference-guides/payload#snowflake-configuration-objects). {% tabs %} {% tab title="Username and password" %} ``` curl -X 'POST' \ 'https:///integrations/scripts/create' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -H 'Authorization: ' \ -d '{ "type": "Snowflake", "autoBootstrap": false, "config": { "host": "", "warehouse": "", "database": "", "authenticationType": "userPassword", "username": "", "password": "", "audit": {"enabled": true}, "workspaces": {"enabled": false}, "impersonation": {"enabled": false}, "lineage": { "enabled": false }, "userRolePattern": { "exclude": [] } } }' ``` **Payload parameters** | Attribute | Description | Required | | ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | config.**host** `string` | The URL of your Snowflake account. | **Yes** | | config.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | config.**database** `string` | Name of a new empty database that the Immuta system user will manage and store metadata in. | **Yes** | | config.**username** `string` | The new username of the system account that can act on Snowflake objects and configure the host. The system account will be created by the script in step two. | **Yes** | | config.**password** `string` | The password of the system account that can act on Snowflake objects and configure the host. The system account will be created by the script in step two. | **Yes** | | config.**audit** `object` | This object enables Snowflake query audit. | No | | config.audit.**enabled** `boolean` | If `true`, Snowflake query audit is enabled. Set to `true` for the recommended configuration. | No | | config.**workspaces** `object` | This object represents an Immuta project workspace configured for Snowflake. | No | | config.workspaces.**enabled** `boolean` | If `true`, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to `false` because table grants and project workspaces cannot be used together. Set to `false` for the recommended configuration. | No | | config.**impersonation** `object` | This object enables user impersonation. | No | | config.impersonation.**enabled** `boolean` | If `true`, user impersonation is enabled. If you use Snowflake low row access policy mode, set to `false` because that mode and impersonation cannot be used together. | No | | config.**lineage** `object` | This object enables Snowflake lineage ingestion. | No | | config.lineage.**enabled** `boolean` | If `true`, Snowflake lineage is enabled. Set `false` for the recommended configuration. | No | | config.**userRolePattern** `object` | This object excludes roles and users from authorization checks. | No | | config.userRolePattern.**exclude** `array` | This array is a list of roles and users to exclude from authorization checks. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables. | No | | {% endtab %} | | | {% tab title="Key pair" %} ``` curl -X 'POST' \ 'https:///integrations/scripts/create' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -H 'Authorization: ' \ -d '{ "type": "Snowflake", "autoBootstrap": false, "config": { "host": "", "warehouse": "", "database": "", "authenticationType": "keyPair", "username": "", "privateKey": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->", "audit": {"enabled": true}, "workspaces": {"enabled": false}, "impersonation": {"enabled": false}, "lineage": { "enabled": false }, "userRolePattern": { "exclude": [] } } }' ``` **Payload parameters** | Attribute | Description | Required | | ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | config.**host** `string` | The URL of your Snowflake account. | **Yes** | | config.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | config.**database** `string` | Name of a new empty database that the Immuta system user will manage and store metadata in. | **Yes** | | config.**username** `string` | The username of the system account that can act on Snowflake objects and configure the host. | **Yes** | | config.**privateKey** `string` | The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. | **Yes** | | config.**audit** `object` | This object enables Snowflake query audit. | No | | config.audit.**enabled** `boolean` | If `true`, Snowflake query audit is enabled. Set to `true` for the recommended configuration. | No | | config.**workspaces** `object` | This object represents an Immuta project workspace configured for Snowflake. | No | | config.workspaces.**enabled** `boolean` | If `true`, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to `false` because table grants and project workspaces cannot be used together. Set to `false` for the recommended configuration. | No | | config.**impersonation** `object` | This object enables user impersonation. | No | | config.impersonation.**enabled** `boolean` | If `true`, user impersonation is enabled. If you use Snowflake low row access policy mode, set to `false` because that mode and impersonation cannot be used together. | No | | config.**lineage** `object` | This object enables Snowflake lineage ingestion. | No | | config.lineage.**enabled** `boolean` | If `true`, Snowflake lineage is enabled. Set `false` for the recommended configuration. | No | | config.**userRolePattern** `object` | This object excludes roles and users from authorization checks. | No | | config.userRolePattern.**exclude** `array` | This array is a list of roles and users to exclude from authorization checks. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables. | No | | {% endtab %} | | | {% tab title="OAuth with certificate" %} 
curl -X 'POST' \
    'https://<your-immuta-url>/integrations/scripts/create' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
    "type": "Snowflake",
    "autoBootstrap": false,
    "config": {
      "host": "<your-Snowflake-hostname-url>",
      "warehouse": "<your-Snowflake-warehouse>",
      "database": "<your-Snowflake-database>",
      "authenticationType": "oAuthClientCredentials",
      "oAuthClientConfig": {
        "provider": "<your-provider>",
        "clientId": "<your-client-ID>",
        "authorityUrl": "<your-example.authority.com>",
        "useCertificate": true,
        "publicCertificateThumbprint": "<your-certificate-thumbprint>",
        "oauthPrivateKey": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->",
        "scope": "session:role-any",
      "audit": {"enabled": true},
      "workspaces": {"enabled": false},
      "impersonation": {"enabled": false},
      "lineage": { "enabled": false },
      "userRolePattern": { "exclude": [] }
      }
    }
    }'
**Payload parameters** | Attribute | Description | Required | | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | config.**host** `string` | The URL of your Snowflake account. | **Yes** | | config.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | config.**database** `string` | Name of a new empty database that the Immuta system user will manage and store metadata in. | **Yes** | | config.oAuthClientConfig.**provider** `string` | The identity provider for OAuth, such as Okta. | **Yes** | | config.oAuthClientConfig.**clientId** `string` | The client identifier of your registered application. | **Yes** | | config.oAuthClientConfig.**authorityUrl** `string` | Authority URL of your identity provider. | **Yes** | | config.oAuthClientConfig.**publicCertificateThumbprint** `string` | Your certificate thumbprint. | **Yes** | | config.oAuthClientConfig.**oauthPrivateKey** `string` | The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. | **Yes** | | config.**audit** `object` | This object enables Snowflake query audit. | No | | config.audit.**enabled** `boolean` | If `true`, Snowflake query audit is enabled. Set to `true` for the recommended configuration. | No | | config.**workspaces** `object` | This object represents an Immuta project workspace configured for Snowflake. | No | | config.workspaces.**enabled** `boolean` | If `true`, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to `false` because table grants and project workspaces cannot be used together. Set to `false` for the recommended configuration. | No | | config.**impersonation** `object` | This object enables user impersonation. | No | | config.impersonation.**enabled** `boolean` | If `true`, user impersonation is enabled. If you use Snowflake low row access policy mode, set to `false` because that mode and impersonation cannot be used together. | No | | config.**lineage** `object` | This object enables Snowflake lineage ingestion. | No | | config.lineage.**enabled** `boolean` | If `true`, Snowflake lineage is enabled. Set `false` for the recommended configuration. | No | | config.**userRolePattern** `object` | This object excludes roles and users from authorization checks. | No | | config.userRolePattern.**exclude** `array` | This array is a list of roles and users to exclude from authorization checks. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables. | No | | {% endtab %} | | | {% tab title="OAuth with secret" %} 
curl -X 'POST' \
    'https://<your-immuta-url>/integrations/scripts/create' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
    "type": "Snowflake",
    "autoBootstrap": false,
    "config": {
      "host": "<your-Snowflake-hostname-url>",
      "warehouse": "<your-Snowflake-warehouse>",
      "database": "<your-Snowflake-database>",
      "authenticationType": "oAuth",
      "oAuthClientConfig": {
        "provider": "<your-provider>",
        "clientId": "<your-client-ID>",
        "authorityUrl": "<your-example.authority.com>",
        "clientSecret": "<your-client-secret>",
        "useCertificate": false,
        "scope": "session:role-any",
      "audit": {"enabled": true},
      "workspaces": {"enabled": false},
      "impersonation": {"enabled": false},
      "lineage": { "enabled": false },
      "userRolePattern": { "exclude": [] }
      }
    }
    }'
**Payload parameters** | Attribute | Description | Required | | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | config.**host** `string` | The URL of your Snowflake account. | **Yes** | | config.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | config.**database** `string` | Name of a new empty database that the Immuta system user will manage and store metadata in. | **Yes** | | config.oAuthClientConfig.**provider** `string` | The identity provider for OAuth, such as Okta. | **Yes** | | config.oAuthClientConfig.**clientId** `string` | The client identifier of your registered application. | **Yes** | | config.oAuthClientConfig.**authorityUrl** `string` | Authority URL of your identity provider. | **Yes** | | config.oAuthClientConfig.**clientSecret** `string` | Client secret of the application. | **Yes** | | config.**audit** `object` | This object enables Snowflake query audit. | No | | config.audit.**enabled** `boolean` | If `true`, Snowflake query audit is enabled. Set to `true` for the recommended configuration. | No | | config.**workspace** `object` | This object represents an Immuta project workspace configured for Snowflake. | No | | config.workspaces.**enabled** `boolean` | If `true`, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to `false` because table grants and project workspaces cannot be used together. Set to `false` for the recommended configuration. | No | | config.**impersonation** `object` | This object enables user impersonation. | No | | config.impersonation.**enabled** `boolean` | If `true`, user impersonation is enabled. If you use Snowflake low row access policy mode, set to `false` because that mode and impersonation cannot be used together. | No | | config.lineage `object` | This object enables Snowflake lineage ingestion. | No | | config.lineage.enabled `boolean` | If `true`, Snowflake lineage is enabled. Set `false` for the recommended configuration. | No | | config.userRolePattern `object` | This object excludes roles and users from authorization checks. | No | | config.userRolePattern `array` | This array is a list of roles and users to exclude from authorization checks. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables. | No | | {% endtab %} | | | | {% endtabs %} | | | ## Step 2: Run the script in Snowflake Using your generated script, run it in your Snowflake environment as a user with the permissions listed in [the requirements section](https://documentation.immuta.com/saas/developer-guides/api-intro/immuta-v1-api/connect-your-data/connect-a-host/connect-a-snowflake-host-with-username-and-password#requirements). The script will create an Immuta system user that will authenticate using the credentials you specified in the script generation. This new system user will have the permissions listed [above](#requirements). Additionally, the script will create the database you specified in the earlier step. ## Step 3: Create the host in Immuta `POST` `/data/connection` Using the tabs below, copy the request and update the **``** with your connection details. The `connection` details here should match the ones used when generating the script, and the payload from the script generation should be pasted exactly into `nativeIntegration`. Then submit the request. Find descriptions of the editable attributes in the table below and of the full payload in the [Host registration payloads reference guide](https://documentation.immuta.com/saas/~/changes/l3NnvynMHxi6VvqRtJhK/developer-guides/api-intro/enhanced-onboarding-api/host-connection-payloads-reference-guide). The recommended setting values are included in the example. {% hint style="info" %} **Test run** Opt to test and validate the create connection payload using a dry run: `POST` `/data/connection/test` {% endhint %} {% tabs %} {% tab title="Username and password" %} ``` curl -X 'POST' \ 'https:///data/connection' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -H 'Authorization: ' \ -d '{ "connectionKey": "", "connection": { "technology": "Snowflake", "hostname": "", "port": , "warehouse": "", "role": "", "authenticationType": "userPassword", "username": "", "password": "", }, "settings": { "isActive": false }, "options": { "forceRecursiveCrawl": true }, "nativeIntegration": { "type": "Snowflake", "autoBootstrap": false, "config": { "authenticationType": "userPassword", "username": "", "password": "", "host": "", "port": , "warehouse": "", "database": "", "impersonation": { "enabled": false }, "audit": { "enabled": true }, "workspaces": { "enabled": false }, "lineage": { "enabled": false }, "userRolePattern": { "exclude": [] } } } }' ``` **Payload parameters** | Attribute | Description | Required | | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | | **connectionKey** `string` | A unique name for the host connection. | **Yes** | | **connection** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | connection.**hostname** `string` | The URL of your Snowflake account. This should be the same as `nativeIntegration.config.host`. | **Yes** | | connection.**port** `integer` | The port to use when connecting to your Snowflake account host. Defaults to `443`. | **Yes** | | connection.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | connection.**role** `string` | The privileged Snowflake role used by the Immuta system account when configuring the Snowflake host. At minimum, it must be able to see the data that Immuta will govern. | **Yes** | | connection.**username** `string` | The username of the system account that can act on Snowflake objects and configure the host. | **Yes** | | connection.**password** `string` | The password of the system account that can act on Snowflake objects and configure the host. | **Yes** | | **settings** `array` | Specifications of the host's settings, including active status. | No | | settings.**isActive** `boolean` | When `false`, data objects will be inactive by default when created in Immuta. Set to `false` for the recommended configuration. | No | | options.**forceRecursiveCrawl** `boolean` | If `false`, only active objects will be crawled. If `true`, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to `true` for the recommended configuration. | No | | **nativeIntegration** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. See the [table above](#step-1-generate-the-script) for descriptions. | **Yes** | | {% endtab %} | | | {% tab title="Key pair" %} 
curl -X 'POST' \
    'https://<your-immuta-url>/data/connection' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connectionKey": "<your-connection-key-name>",
     "connection": {
       "technology": "Snowflake",
       "hostname": "<your-Snowflake-hostname-url>",
       "port": <your-Snowflake-port>,
       "warehouse": "<your-Snowflake-warehouse>",
       "role": "<your-Snowflake-role>",
       "authenticationType": "keyPair",
       "username": "<the-Snowflake-username>",
       "privateKeyPassword": "<your-Snowflake-key-password>",
       "privateKey": {
         "keyName": "PRIV_KEY_FILE",
         "userFilename": "<your-private-key-file-name>",
         "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
       }
     },
     "settings": {
         "isActive": false
     },
     "options": {
       "forceRecursiveCrawl": true
     },
     "nativeIntegration": {
       "type": "Snowflake",
       "autoBootstrap": false,
       "config": {
         "authenticationType": "keyPair",
         "username": "<the-Snowflake-username>",
         "privateKeyPassword": "<your-Snowflake-key-password>",
         "privateKey": {
           "keyName": "PRIV_KEY_FILE",
           "userFilename": "<your-private-key-file-name>",
           "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
       }
         "host": "<your-Snowflake-hostname-url>",
         "port": <your-Snowflake-port>,
         "warehouse": "<your-Snowflake-warehouse>",
         "database": "<your-Snowflake-database>",
         "impersonation": { "enabled": false },
         "audit": { "enabled": true },
         "workspaces": { "enabled": false },
         "lineage": { "enabled": false },
         "userRolePattern": { "exclude": [] }
       }
     }
    }'
**Payload parameters** | Attribute | Description | Required | | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | | **connectionKey** `string` | A unique name for the host connection. | **Yes** | | **connection** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | connection.**hostname** `string` | The URL of your Snowflake account. This is the same as `host`. | **Yes** | | connection.**port** `integer` | The port to use when connecting to your Snowflake account host. Defaults to `443`. | **Yes** | | connection.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | connection.**role** `string` | The privileged Snowflake role used by the Immuta system account when configuring the Snowflake host. At minimum, it must be able to see the data that Immuta will govern. | **Yes** | | connection.**username** `string` | The username of the system account that can act on Snowflake objects and configure the host. | **Yes** | | connection.**privateKeyPassword** `string` | The Snowflake private key password. Required if the private key is encrypted. | No | | connection.privateKey.**userFilename** `string` | The name of your private key file on your machine. | **Yes** | | connection.privateKey.**content** `string` | The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as `config.privateKey`. | **Yes** | | **settings** `array` | Specifications of the host's settings, including active status. | No | | settings.**isActive** `boolean` | If `false`, data objects will be inactive by default when created in Immuta. Set to `false` for the recommended configuration. | No | | options.**forceRecursiveCrawl** `boolean` | If `false`, only active objects will be crawled. If `true`, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to `true` for the recommended configuration. | No | | **nativeIntegration** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | nativeIntegration.config.**username** `string` | Same as `connection.username` | **Yes** | | nativeIntegration.config.**privateKeyPassword** `string` | Same as `connection.privateKeyPassword` | No | | nativeIntegration.config.privateKey.**keyName** `string` | Same as `connection.keyName` | **Yes** | | nativeIntegration.config.privateKey.**userFilename** `string` | Same as `connection.userFilename` | **Yes** | | nativeIntegration.config.privateKey.**content** `string` | Same as `connection.content` | **Yes** | | nativeIntegration.config.**host** `string` | Same as `connection.hostname` | **Yes** | | nativeIntegration.config.**port** `integer` | Same as `connection.port` | **Yes** | | nativeIntegration.config.**warehouse** `string` | Same as `connection.warehouse` | **Yes** | | nativeIntegration.config.**database** `string` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**impersonation** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**audit** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**workspaces** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**lineage** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.**userRolePattern** `object` | Use the same setting as the script generation. | **Yes** | | {% endtab %} | | | {% tab title="OAuth and certificate" %} 
curl -X 'POST' \
    'https://<your-immuta-url>/data/connection' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connectionKey": "<your-connection-key-name>",
     "connection": {
       "technology": "Snowflake",
       "hostname": "<your-Snowflake-hostname-url>",
       "port": <your-Snowflake-port>,
       "warehouse": "<your-Snowflake-warehouse>",
       "role": "<your-Snowflake-role>",
       "authenticationType": "oAuthClientCredentials",
       "oAuthClientConfig": {
         "useCertificate": true,
         "clientId": "<your-client-ID>",
         "authorityUrl": "<your-example.authority.com>",
         "scope": "session:role-any",
         "publicCertificateThumbprint": "<your-certificate-thumbprint>",
         "resource": "<your-optional-resource>",
         "oauthPrivateKey": {
           "keyName": "oauth client certificate",
           "userFilename": "<your-user-file.pem>",
           "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
         }
       }
     },
     "settings": {
         "isActive": false
     },
     "options": {
       "forceRecursiveCrawl": true
     },
     "nativeIntegration": {
       "type": "Snowflake",
       "autoBootstrap": false,
       "config": {
         "authenticationType": "oAuthClientCredentials",
         "oAuthClientConfig": {
           "useCertificate": true,
           "clientId": "<your-client-ID>",
           "authorityUrl": "<your-example.authority.com>",
           "scope": "session:role-any",
           "publicCertificateThumbprint": "<your-certificate-thumbprint>",
           "resource": "<your-optional-resource>",
           "oauthPrivateKey": {
             "keyName": "oauth client certificate",
             "userFilename": "<your-user-file.pem>",
             "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
           }
         }
         "host": "<your-Snowflake-hostname-url>",
         "port": <your-Snowflake-port>,
         "warehouse": "<your-Snowflake-warehouse>",
         "database": "<your-Snowflake-database>",
         "impersonation": { "enabled": false },
         "audit": { "enabled": true },
         "workspaces": { enabled": false },
         "lineage": { "enabled": false },
         "userRolePattern": { "exclude": [] }
       }
     }
    }'
**Payload parameters** | Attribute | Description | Required | | ------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | **connectionKey** `string` | A unique name for the host connection. | **Yes** | | **connection** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | connection.**hostname** `string` | The URL of your Snowflake account. This is the same as `host`. | **Yes** | | connection.**port** `integer` | The port to use when connecting to your Snowflake account host. Defaults to `443`. | **Yes** | | connection.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | connection.**role** `string` | The privileged Snowflake role used by the Immuta system account when configuring the Snowflake host. At minimum, it must be able to see the data that Immuta will govern. | **Yes** | | connection.oAuthClientConfig.**clientId** `string` | The client identifier of your registered application. | **Yes** | | connection.oAuthClientConfig.**authorityUrl** `string` | Authority URL of your identity provider. | **Yes** | | connection.oAuthClientConfig.**publicCertificateThumbprint** `string` | Your certificate thumbprint. | **Yes** | | connection.oAuthClientConfig.**resource** `string` | An optional resource to pass to the token provider. | No | | connection.oAuthClientConfig.oauthPrivateKey.**userFilename** `string` | The name of your private key file on your machine. | **Yes** | | connection.oAuthClientConfig.oauthPrivateKey.**content** `string` | The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as `config.oauthPrivateKey` in the script request. | **Yes** | | **settings** `array` | Specifications of the host's settings, including active status. | No | | settings.**isActive** `boolean` | When `false`, data objects will be inactive by default when created in Immuta. Set to `false` for the recommended configuration. | No | | options.**forceRecursiveCrawl** `boolean` | If `false`, only active objects will be crawled. If `true`, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to `true` for the recommended configuration. | No | | **nativeIntegration** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | nativeIntegration.config.oAuthClientConfig.**clientId** `string` | Same as `connection.oAuthClientConfig.clientId` | **Yes** | | nativeIntegration.config.oAuthClientConfig.**authorityUrl** `string` | Same as `connection.oAuthClientConfig.authorityUrl` | **Yes** | | nativeIntegration.config.oAuthClientConfig.**publicCertificateThumbprint** `string` | Same as `connection.oAuthClientConfig.publicCertificateThumbprint` | **Yes** | | nativeIntegration.config.oAuthClientConfig.**resource** `string` | Same as `connection.oAuthClientConfig.resource` | No | | nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.**userFilename** `string` | Same as `connection.oAuthClientConfig.oauthPrivateKey.userFilename` | **Yes** | | nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.**content** `string` | Same as `connection.oAuthClientConfig.oauthPrivateKey.content` | **Yes** | | nativeIntegration.config.**host** `string` | Same as `connection.hostname` | **Yes** | | nativeIntegration.config.**port** `integer` | Same as `connection.port` | **Yes** | | nativeIntegration.config.**warehouse** `string` | Same as `connection.warehouse` | **Yes** | | nativeIntegration.config.**database** `string` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**impersonation** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**audit** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**workspaces** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**lineage** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.**userRolePattern** `object` | Use the same setting as the script generation. | **Yes** | | {% endtab %} | | | {% tab title="OAuth and secret" %} 
curl -X 'POST' \
    'https://<your-immuta-url>/data/connection' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     "connectionKey": "<your-connection-key-name>",
     "connection": {
       "technology": "Snowflake",
       "hostname": "<your-Snowflake-hostname-url>",
       "port": <your-Snowflake-port>,
       "warehouse": "<your-Snowflake-warehouse>",
       "role": "<your-Snowflake-role>",
       "authenticationType": "oAuthClientCredentials",
       "oAuthClientConfig": {
         "useCertificate": false,
         "clientId": "<your-client-ID>",
         "authorityUrl": "<your-example.authority.com>",
         "scope": "session:role-any",
         "resource": "<your-optional-resource>",
         "clientSecret": "<your-client-secret>"
       }
     },
     "settings": {
         "isActive": false
     },
     "options": {
       "forceRecursiveCrawl": true
     },
     "nativeIntegration": {
       "type": "Snowflake",
       "autoBootstrap": false,
       "config": {
         "authenticationType": "oAuthClientCredentials",
         "oAuthClientConfig": {
           "useCertificate": false,
           "clientId": "<your-client-ID>",
           "authorityUrl": "<your-example.authority.com>",
           "scope": "session:role-any",
           "resource": "<your-optional-resource>",
           "clientSecret": "<your-client-secret>"           
         }
         "host": "<your-Snowflake-hostname-url>",
         "port": <your-Snowflake-port>,
         "warehouse": "<your-Snowflake-warehouse>",
         "database": "<your-Snowflake-database>",
         "impersonation": { "enabled": false },
         "audit": { "enabled": true },
         "workspaces": { "enabled": false },
         "lineage": { "enabled": false },
         "userRolePattern": { "exclude": [] }
       }
     }
    }'
**Payload parameters** | Attribute | Description | Required | | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | | **connectionKey** `string` | A unique name for the host connection. | **Yes** | | **connection** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | connection.**hostname** `string` | The URL of your Snowflake account. This is the same as `host`. | **Yes** | | connection.**port** `integer` | The port to use when connecting to your Snowflake account host. Defaults to `443`. | **Yes** | | connection.**warehouse** `string` | The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations. | **Yes** | | connection.**role** `string` | The privileged Snowflake role used by the Immuta system account when configuring the Snowflake host. At minimum, it must be able to see the data that Immuta will govern. | **Yes** | | connection.oAuthClientConfig.**clientId** `string` | The client identifier of your registered application. | **Yes** | | connection.oAuthClientConfig.**authorityUrl** `string` | Authority URL of your identity provider. | **Yes** | | connection.oAuthClientConfig.**clientSecret** `string` | Client secret of the application. | **Yes** | | connection.oAuthClientConfig.**resource** `string` | An optional resource to pass to the token provider. | No | | **settings** `array` | Specifications of the host's settings, including active status. | No | | settings.**isActive** `boolean` | When `false`, data objects will be inactive by default when created in Immuta. Set to `false` for the recommended configuration | No | | options.**forceRecursiveCrawl** `boolean` | If `false`, only active objects will be crawled. If `true`, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to `true` for the recommended configuration. | No | | **nativeIntegration** `object` | Configuration attributes that should match the values used when getting the script from the integration endpoint. | **Yes** | | nativeIntegration.config.oAuthClientConfig.**clientId** `string` | Same as `connection.oAuthClientConfig.clientId` | **Yes** | | nativeIntegration.config.oAuthClientConfig.**authorityUrl** `string` | Same as `connection.oAuthClientConfig.authorityUrl` | **Yes** | | nativeIntegration.config.oAuthClientConfig.**resource** `string` | Same as `connection.oAuthClientConfig.resource` | No | | nativeIntegration.config.oAuthClientConfig.**clientSecret** `string` | Same as `connection.oAuthClientConfig.clientSecret` | **Yes** | | nativeIntegration.config.**host** `string` | Same as `connection.hostname` | **Yes** | | nativeIntegration.config.**port** `integer` | Same as `connection.port` | **Yes** | | nativeIntegration.config.**warehouse** `string` | Same as `connection.warehouse` | **Yes** | | nativeIntegration.config.**database** `string` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**impersonation** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**audit** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**workspaces** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.config.**lineage** `object` | Use the same setting as the script generation. | **Yes** | | nativeIntegration.**userRolePattern** `object` | Use the same setting as the script generation. | **Yes** | | {% endtab %} | | | | {% endtabs %} | | | #### Response schema | Attribute | Description | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **objectPath** `string` | The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element will be the associated `connectionKey`. | | **bulkId** `string` | A bulk ID that can be used to search for the status of background jobs triggered by this request. | **Example response** ``` { "objectPath": [''], "bulkId": "a-new-uuid" } ``` [^1]: To learn more about hosts in Immuta, see the [Enhanced onboarding and data source registration section](https://documentation.immuta.com/saas/~/changes/l3NnvynMHxi6VvqRtJhK/data-and-integrations/registering-a-host/simplified-registration-reference). [^2]: To use a secret instead of certificate, see other tab. [^3]: This must be `session:role-any`. [^4]: To use a certificate instead of secret, see other tab. [^5]: This must be `PRIV_KEY_FILE`. [^6]: Note this payload differs from the script generation in the `privateKey` object. [^7]: Use the same user file name from above. [^8]: Use the same content from above. [^9]: This must be `oauth client certificate` [^10]: Note this payload differs from the script generation in the `oauthPrivateKey` object.