The enhanced onboarding API is a REST API which allows users to register a Snowflake to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. Then Immuta can manage and enforce access controls on your data through that host. To manage your host, see the Manage a host reference guide.
The following permissions and personas are used in the registration process:
Immuta permission: CREATE_DATA_SOURCE
Snowflake permissions for the user registering the host and running the script:
CREATE DATABASE ON ACCOUNT WITH GRANT OPTION
CREATE ROLE ON ACCOUNT WITH GRANT OPTION
CREATE USER ON ACCOUNT WITH GRANT OPTION
MANAGE GRANTS ON ACCOUNT WITH GRANT OPTION
APPLY MASKING POLICY ON ACCOUNT WITH GRANT OPTION
APPLY ROW ACCESS POLICY ON ACCOUNT WITH GRANT OPTION
REFERENCES on all tables
USAGE on the schema and database to register data sources
Snowflake permissions for the new Immuta system account that is created:
APPLY MASKING POLICY ON ACCOUNT
APPLY ROW ACCESS POLICY ON ACCOUNT
Additional grants associated with the IMMUTA database
Complete the following steps to register a Snowflake host:
Use the /integrations/scripts/create endpoint to receive a script.
Run the script in Snowflake.
Use the /data/connection endpoint to finish registering your host in Immuta.
POST /integrations/scripts/create
Using the example request, update the <placeholder_values> with your connection details.
Copy the config object to use later in the setup process.
Run the request.
Copy the returned script and use it in the next step.
Find descriptions of the editable attributes in the table below and of the full payload in the Integration configuration payload reference guide.
Payload parameters
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
config.username string
The new username of the system account that can act on Snowflake objects and configure the host. The system account will be created by the script in step two.
Yes
config.password string
The password of the system account that can act on Snowflake objects and configure the host. The system account will be created by the script in step two.
Yes
config.audit object
This object enables Snowflake query audit.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled. Set to true for the recommended configuration.
No
config.workspaces object
This object represents an Immuta project workspace configured for Snowflake.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to false because table grants and project workspaces cannot be used together. Set to false for the recommended configuration.
No
config.impersonation object
This object enables user impersonation.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, set to false because that mode and impersonation cannot be used together.
No
config.lineage object
This object enables Snowflake lineage ingestion.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled. Set false for the recommended configuration.
No
config.userRolePattern object
This object excludes roles and users from authorization checks.
No
config.userRolePattern.exclude array
This array is a list of roles and users to exclude from authorization checks. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
Payload parameters
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
config.username string
The username of the system account that can act on Snowflake objects and configure the host.
Yes
config.privateKey string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
Yes
config.audit object
This object enables Snowflake query audit.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled. Set to true for the recommended configuration.
No
config.workspaces object
This object represents an Immuta project workspace configured for Snowflake.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to false because table grants and project workspaces cannot be used together. Set to false for the recommended configuration.
No
config.impersonation object
This object enables user impersonation.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, set to false because that mode and impersonation cannot be used together.
No
config.lineage object
This object enables Snowflake lineage ingestion.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled. Set false for the recommended configuration.
No
config.userRolePattern object
This object excludes roles and users from authorization checks.
No
config.userRolePattern.exclude array
This array is a list of roles and users to exclude from authorization checks. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
Payload parameters
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
config.oAuthClientConfig.provider string
The identity provider for OAuth, such as Okta.
Yes
config.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
config.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
config.oAuthClientConfig.publicCertificateThumbprint string
Your certificate thumbprint.
Yes
config.oAuthClientConfig.oauthPrivateKey string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
Yes
config.audit object
This object enables Snowflake query audit.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled. Set to true for the recommended configuration.
No
config.workspaces object
This object represents an Immuta project workspace configured for Snowflake.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to false because table grants and project workspaces cannot be used together. Set to false for the recommended configuration.
No
config.impersonation object
This object enables user impersonation.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, set to false because that mode and impersonation cannot be used together.
No
config.lineage object
This object enables Snowflake lineage ingestion.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled. Set false for the recommended configuration.
No
config.userRolePattern object
This object excludes roles and users from authorization checks.
No
config.userRolePattern.exclude array
This array is a list of roles and users to exclude from authorization checks. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
Payload parameters
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
config.oAuthClientConfig.provider string
The identity provider for OAuth, such as Okta.
Yes
config.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
config.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
config.oAuthClientConfig.clientSecret string
Client secret of the application.
Yes
config.audit object
This object enables Snowflake query audit.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled. Set to true for the recommended configuration.
No
config.workspace object
This object represents an Immuta project workspace configured for Snowflake.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to false because table grants and project workspaces cannot be used together. Set to false for the recommended configuration.
No
config.impersonation object
This object enables user impersonation.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, set to false because that mode and impersonation cannot be used together.
No
config.lineage object
This object enables Snowflake lineage ingestion.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled. Set false for the recommended configuration.
No
config.userRolePattern object
This object excludes roles and users from authorization checks.
No
config.userRolePattern array
This array is a list of roles and users to exclude from authorization checks. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
Using your generated script, run it in your Snowflake environment as a user with the permissions listed in the requirements section.
The script will create an Immuta system user that will authenticate using the credentials you specified in the script generation. This new system user will have the permissions listed above. Additionally, the script will create the database you specified in the earlier step.
POST /data/connection
Using the tabs below, copy the request and update the <placeholder_values> with your connection details. The connection details here should match the ones used when generating the script, and the payload from the script generation should be pasted exactly into nativeIntegration. Then submit the request.
Find descriptions of the editable attributes in the table below and of the full payload in the Host registration payloads reference guide. The recommended setting values are included in the example.
Test run
Opt to test and validate the create connection payload using a dry run:
POST /data/connection/test
Payload parameters
connectionKey string
A unique name for the host connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This should be the same as nativeIntegration.config.host.
Yes
connection.port integer
The port to use when connecting to your Snowflake account host. Defaults to 443.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when configuring the Snowflake host. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.username string
The username of the system account that can act on Snowflake objects and configure the host.
Yes
connection.password string
The password of the system account that can act on Snowflake objects and configure the host.
Yes
settings array
Specifications of the host's settings, including active status.
No
settings.isActive boolean
When false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration.
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
nativeIntegration object
Yes
Payload parameters
connectionKey string
A unique name for the host connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This is the same as host.
Yes
connection.port integer
The port to use when connecting to your Snowflake account host. Defaults to 443.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when configuring the Snowflake host. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.username string
The username of the system account that can act on Snowflake objects and configure the host.
Yes
connection.privateKeyPassword string
The Snowflake private key password. Required if the private key is encrypted.
No
connection.privateKey.userFilename string
The name of your private key file on your machine.
Yes
connection.privateKey.content string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as config.privateKey.
Yes
settings array
Specifications of the host's settings, including active status.
No
settings.isActive boolean
If false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration.
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.config.username string
Same as connection.username
Yes
nativeIntegration.config.privateKeyPassword string
Same as connection.privateKeyPassword
No
nativeIntegration.config.privateKey.keyName string
Same as connection.keyName
Yes
nativeIntegration.config.privateKey.userFilename string
Same as connection.userFilename
Yes
nativeIntegration.config.privateKey.content string
Same as connection.content
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.warehouse string
Same as connection.warehouse
Yes
nativeIntegration.config.database string
Use the same setting as the script generation.
Yes
nativeIntegration.config.impersonation object
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaces object
Use the same setting as the script generation.
Yes
nativeIntegration.config.lineage object
Use the same setting as the script generation.
Yes
nativeIntegration.userRolePattern object
Use the same setting as the script generation.
Yes
Payload parameters
connectionKey string
A unique name for the host connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This is the same as host.
Yes
connection.port integer
The port to use when connecting to your Snowflake account host. Defaults to 443.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when configuring the Snowflake host. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
connection.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
connection.oAuthClientConfig.publicCertificateThumbprint string
Your certificate thumbprint.
Yes
connection.oAuthClientConfig.resource string
An optional resource to pass to the token provider.
No
connection.oAuthClientConfig.oauthPrivateKey.userFilename string
The name of your private key file on your machine.
Yes
connection.oAuthClientConfig.oauthPrivateKey.content string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as config.oauthPrivateKey in the script request.
Yes
settings array
Specifications of the host's settings, including active status.
No
settings.isActive boolean
When false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration.
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.config.oAuthClientConfig.clientId string
Same as connection.oAuthClientConfig.clientId
Yes
nativeIntegration.config.oAuthClientConfig.authorityUrl string
Same as connection.oAuthClientConfig.authorityUrl
Yes
nativeIntegration.config.oAuthClientConfig.publicCertificateThumbprint string
Same as connection.oAuthClientConfig.publicCertificateThumbprint
Yes
nativeIntegration.config.oAuthClientConfig.resource string
Same as connection.oAuthClientConfig.resource
No
nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.userFilename string
Same as connection.oAuthClientConfig.oauthPrivateKey.userFilename
Yes
nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.content string
Same as connection.oAuthClientConfig.oauthPrivateKey.content
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.warehouse string
Same as connection.warehouse
Yes
nativeIntegration.config.database string
Use the same setting as the script generation.
Yes
nativeIntegration.config.impersonation object
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaces object
Use the same setting as the script generation.
Yes
nativeIntegration.config.lineage object
Use the same setting as the script generation.
Yes
nativeIntegration.userRolePattern object
Use the same setting as the script generation.
Yes
Payload parameters
connectionKey string
A unique name for the host connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This is the same as host.
Yes
connection.port integer
The port to use when connecting to your Snowflake account host. Defaults to 443.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when configuring the Snowflake host. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
connection.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
connection.oAuthClientConfig.clientSecret string
Client secret of the application.
Yes
connection.oAuthClientConfig.resource string
An optional resource to pass to the token provider.
No
settings array
Specifications of the host's settings, including active status.
No
settings.isActive boolean
When false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.config.oAuthClientConfig.clientId string
Same as connection.oAuthClientConfig.clientId
Yes
nativeIntegration.config.oAuthClientConfig.authorityUrl string
Same as connection.oAuthClientConfig.authorityUrl
Yes
nativeIntegration.config.oAuthClientConfig.resource string
Same as connection.oAuthClientConfig.resource
No
nativeIntegration.config.oAuthClientConfig.clientSecret string
Same as connection.oAuthClientConfig.clientSecret
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.warehouse string
Same as connection.warehouse
Yes
nativeIntegration.config.database string
Use the same setting as the script generation.
Yes
nativeIntegration.config.impersonation object
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaces object
Use the same setting as the script generation.
Yes
nativeIntegration.config.lineage object
Use the same setting as the script generation.
Yes
nativeIntegration.userRolePattern object
Use the same setting as the script generation.
Yes
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element will be the associated connectionKey.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
Example response
Configuration attributes that should match the values used when getting the script from the integration endpoint. See the for descriptions.