Data API reference guide
This section details the /data v1 API, which allows users to register a to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately.
Required Immuta permission: APPLICATION_ADMIN
You can register a connection from the following technologies to Immuta using supported authentication methods:
Username and password
Key pair
Snowflake External OAuth
Personal access token (PAT)
OAuth machine-to-machine (M2M)
To register a connection, you must follow this process:
Run the /integrations/scripts/create endpoint to receive a script.
Run the script in your remote technology, either Snowflake or Databricks Unity Catalog.
Run the /data/connection endpoint to finish registering your connection in Immuta.
Public preview
Connections allow you to register your data objects in a technology through a single connection, instead of registering data sources and an integration separately.
This feature is public preview. It is enabled by default on all tenants created post February 26, 2025 and available to select tenants created prior. Reach out to your Immuta support professional to enable it on your tenant.
The connection API is a REST API which allows users to register a Databricks Unity Catalog to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. Then Immuta can manage and enforce access controls on your data through that connection. To manage your connection, see the Manage a connection reference guide.
The following permissions and personas are used in the registration process.
An Immuta user with the APPLICATION_ADMIN Immuta permission must register the Databricks Unity Catalog connection.
A Databricks user authorized to create a Databricks service principal must create one for Immuta. This service principal is used continuously by Immuta to orchestrate Unity Catalog policies and maintain state between Immuta and Databricks. This service principal needs the following Databricks privileges:
USE CATALOG and MANAGE on all catalogs containing securables registered as Immuta data sources and USE SCHEMA on all schemas containing securables registered as Immuta data sources.
MODIFY and SELECT on all securables registered as Immuta data sources. MANAGE and MODIFY are required so that the service principal can apply row filters and column masks on the securable; to do so, the service principal must also have SELECT on the securable as well as USE CATALOG on its parent catalog and USE SCHEMA on its parent schema. Since privileges are inherited, you can grant the service principal the MODIFY and SELECT privilege on all catalogs or schemas containing Immuta data sources, which automatically grants the service principal the MODIFY and SELECT privilege on all current and future securables in the catalog or schema. The service principal also inherits MANAGE from the parent catalog for the purpose of applying row filters and column masks, but that privilege must be set directly on the parent catalog in order for grants to be fully applied.
See the Databricks documentation for more details about Unity Catalog privileges and securable objects.
Optionally, to include audit, the service principal needs the following additional privileges:
USE CATALOG on system catalog
USE SCHEMA on system.access schema
SELECT on system.access.audit table
SELECT on system.access.table_lineage table
SELECT on system.access.column_lineage table
Access to system tables is governed by Unity Catalog. No user has access to these system schemas by default. To grant access, a user that is both a metastore admin and an account admin must grant USE and SELECT permissions on the system schemas to the service principal. See Manage privileges in Unity Catalog. The system.access schema must also be enabled on the metastore before it can be used.
Unity Catalog metastore created and attached to a Databricks workspace. See the Databricks Unity Catalog reference guide for information on workspaces and catalog isolation support with Immuta.
Unity Catalog enabled on your Databricks cluster or SQL warehouse. All SQL warehouses have Unity Catalog enabled if your workspace is attached to a Unity Catalog metastore. Immuta recommends linking a SQL warehouse to your Immuta tenant rather than a cluster for both performance and availability reasons.
Complete the following steps to register a Databricks Unity Catalog connection:
Create a service principal in Databricks Unity Catalog with the proper Databricks privileges for Immuta to use to manage policies in Unity Catalog.
Set up Unity Catalog system tables for query audit.
Use the /integrations/scripts/create endpoint to receive a script.
Run the script in Databricks Unity Catalog.
Use the /data/connection endpoint to finish registering your connection in Immuta.
Create a Databricks service principal with the Databricks privileges outlined above and set up with personal access token (PAT), which can be an on-behalf token created in Databricks, or OAuth machine-to-machine (M2M) authentication.
The Immuta service principal you create requires specific Databricks privileges to connect to Databricks to create the integration catalog, configure the necessary procedures and functions, and maintain state between Databricks and Immuta.
Enable query audit by completing these steps in Unity Catalog:
Grant the service principal from step 1 access to the Databricks Unity Catalog system tables. For Databricks Unity Catalog audit to work, Immuta must have, at minimum, the following access.
USE CATALOG on the system catalog
USE SCHEMA on the system.access schema
SELECT on the following system tables:
system.access.audit
system.access.table_lineage
system.access.column_lineage
POST /integrations/scripts/create
Using the example request, update the <placeholder_values> with your connection details.
Copy the config object to use later in the setup process.
Run the request.
Copy the returned script and use it in the next step.
Find descriptions of the editable attributes in the table below and of the full payload in the Integration configuration payload reference guide.
Payload parameters
config.workspaceUrl string
Your Databricks workspace URL.
Yes
config.httpPath string
The HTTP path of your Databricks cluster or SQL warehouse.
Yes
config.token string
The Databricks personal access token for the service principal created in step one for Immuta.
Yes
config.catalog string
The name of the Databricks catalog Immuta will create to store internal entitlements and other user data specific to Immuta. This catalog will only be readable for the Immuta service principal and should not be granted to other users. The catalog name may only contain letters, numbers, and underscores and cannot start with a number.
Yes
config.audit object
This object enables Databricks Unity Catalog query audit.
No
config.audit.enabled boolean
If true, Databricks Unity Catalog query audit is enabled. Set to true for the recommended configuration.
No
Payload parameters
config.workspaceUrl string
Your Databricks workspace URL.
Yes
config.httpPath string
The HTTP path of your Databricks cluster or SQL warehouse.
Yes
config.oAuthClientConfig object
The oAuthClientConfig object represents your OAuth configuration in Databricks Unity Catalog.
Yes
config.oAuthClientConfig.clientId string
The client identifier of the Immuta service principal you configured. This is the client ID displayed in Databricks when creating the client secret for the service principal.
Yes
config.oAuthClientConfig.clientSecret string
Yes
config.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
config.catalog string
The name of the Databricks catalog Immuta will create to store internal entitlements and other user data specific to Immuta. This catalog will only be readable for the Immuta service principal and should not be granted to other users. The catalog name may only contain letters, numbers, and underscores and cannot start with a number.
Yes
config.audit object
This object enables Databricks Unity Catalog query audit.
No
config.audit.enabled boolean
If true, Databricks Unity Catalog query audit is enabled. Set to true for the recommended configuration.
No
The previous step will return a script. Copy the script and run it in your Databricks Unity Catalog environment as a user with the privileges listed in the requirements section.
The script will use the service principal that will authenticate using the authentication that you specified. Additionally, the script will create the catalog you specified.
POST /data/connection
Copy the request and update the <placeholder_values> with your connection details. Note that the connection details here should match the ones used when generating the script. Then submit the request.
Find descriptions of the editable attributes in the table below and of the full payload in the Databricks Unity Catalog connection payload table. All values should be included and those you should not edit are noted.
Test run
Opt to test and validate the create connection payload using a dry run:
POST /data/connection/test
Payload parameters
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.technology string
The technology backing the new connection.
Yes
connection.hostname string
Your Databricks workspace URL. This is the same as host and workspaceURL.
Yes
connection.port integer
The port to use when connecting to your Databricks account. Defaults to 443.
Yes
connection.httpPath string
The HTTP path of your Databricks cluster or SQL warehouse.
Yes
connection.authenticationType string
The authentication type to register the connection. Make sure this auth type is the same used when requesting the script.
Yes
connection.token string
The Databricks personal access token for the service principal created in step one for Immuta.
Yes
settings array
Specifications of the connection's settings, including active status.
No
settings.isActive boolean
When false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration.
No
options array
Specification of the connection's default behavior for object crawls.
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.type string
Same as connection.technology
Yes
nativeIntegration.autoBootstrap boolean
Use the same setting as the script generation.
Yes
nativeIntegration.unityCatalog boolean
Use the same setting as the script generation.
Yes
nativeIntegration.config.authenticationType string
Same as connection.authenticationType
Yes
nativeIntegration.config.token string
Same as connection.token
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.catalog string
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaceIds array
Use the same setting as the script generation.
No
nativeIntegration.config.enableNativeQueryParsing boolean
Use the same setting as the script generation.
No
nativeIntegration.config.groupPattern object
Use the same setting as the script generation.
No
nativeIntegration.config.jobConfig.workspaceDirectoryPath string
Use the same setting as the script generation.
No
nativeIntegration.config.jobConfig.jobClusterId string
Use the same setting as the script generation.
No
Payload parameters
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.technology string
The technology backing the new connection.
Yes
connection.hostname string
Your Databricks workspace URL. This is the same as host and workspaceURL.
Yes
connection.port integer
The port to use when connecting to your Databricks account. Defaults to 443.
Yes
connection.httpPath string
The HTTP path of your Databricks cluster or SQL warehouse.
Yes
connection.authenticationType string
The authentication type to register the connection. Make sure this auth type is the same used when requesting the script.
Yes
connection.oAuthClientConfig object
The oAuthClientConfig object represents your OAuth configuration in Databricks Unity Catalog.
Yes
connection.oAuthClientConfig.clientId string
The client identifier of the Immuta service principal you configured. This is the client ID displayed in Databricks when creating the client secret for the service principal.
Yes
connection.oAuthClientConfig.clientSecret string
Yes
connection.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
settings array
Specifications of the connection's settings, including active status.
No
settings.isActive boolean
When false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration.
No
options array
Specification of the connection's default behavior for object crawls.
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.type string
Same as connection.technology
Yes
nativeIntegration.autoBootstrap boolean
Use the same setting as the script generation.
Yes
nativeIntegration.unityCatalog boolean
Use the same setting as the script generation.
Yes
nativeIntegration.config.authenticationType string
Same as connection.authenticationType
Yes
nativeIntegration.config.oAuthClientConfig object
Same as connection.oAuthClientConfig
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.catalog string
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaceIds array
Use the same setting as the script generation.
No
nativeIntegration.config.enableNativeQueryParsing boolean
Use the same setting as the script generation.
No
nativeIntegration.config.groupPattern object
Use the same setting as the script generation.
No
nativeIntegration.config.jobConfig.workspaceDirectoryPath string
Use the same setting as the script generation.
No
nativeIntegration.config.jobConfig.jobClusterId string
Use the same setting as the script generation.
No
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the associated connectionKey.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
Public preview
allow you to register your data objects in a technology through a single connection, instead of registering data sources and an integration separately.
This feature is public preview. It is enabled by default on all tenants created post February 26, 2025 and available to created prior. Reach out to your Immuta support professional to enable it on your tenant.
The connection API is a REST API which allows users to register a Snowflake to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. Then Immuta can manage and enforce access controls on your data through that connection. To manage your connection, see the .
The following permissions and personas are used in the registration process:
Immuta permission: APPLICATION_ADMIN
Snowflake permissions for the user registering the connection and running the script:
CREATE DATABASE ON ACCOUNT WITH GRANT OPTION
CREATE ROLE ON ACCOUNT WITH GRANT OPTION
CREATE USER ON ACCOUNT WITH GRANT OPTION
MANAGE GRANTS ON ACCOUNT WITH GRANT OPTION
APPLY MASKING POLICY ON ACCOUNT WITH GRANT OPTION
APPLY ROW ACCESS POLICY ON ACCOUNT WITH GRANT OPTION
REFERENCES on all tables
USAGE on the schema and database to register data sources
Snowflake permissions for the new Immuta system user that is created:
APPLY MASKING POLICY ON ACCOUNT
APPLY ROW ACCESS POLICY ON ACCOUNT
Additional grants associated with the IMMUTA database
Complete the following steps to register a Snowflake connection:
Use the /integrations/scripts/create endpoint to receive a script.
Run the script in Snowflake.
Use the /data/connection endpoint to finish registering your connection in Immuta.
POST /integrations/scripts/create
Using the example request, update the <placeholder_values> with your connection details.
Copy the config object to use later in the setup process.
Run the request.
Copy the returned script and use it in the next step.
Payload parameters
Payload parameters
Payload parameters
Payload parameters
POST /data/connection
Using the tabs below, copy the request and update the <placeholder_values> with your connection details. The connection details here should match the ones used when generating the script, and the payload from the script generation should be pasted exactly into nativeIntegration. Then submit the request.
Test run
Opt to test and validate the create connection payload using a dry run:
POST /data/connection/test
Payload parameters
Payload parameters
Payload parameters
Payload parameters
Example response
Data API reference guide
Required Immuta permission: APPLICATION_ADMIN
To deregister a connection from Immuta, do the following:
POST /integrations/{id}/scripts/delete
Creates a script to remove Immuta-managed resources from your data platform.
The response returns the script that you will run in your Databricks Unity Catalog or Snowflake environment. Copy it for later.
DELETE /data/object/{connectionKey}
Delete the given connection and all its child objects.
Using the copied generated cleanup script from earlier, run it in your Snowflake or Databricks Unity Catalog environment as a privileged user.
Data API reference guide
This page details the /data v1 API, which allows users to register a connection to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. For a how-to on registering a connection, see the .
GET /data/connection/{connectionKey}Search for a connection using a connection key.
Required Immuta permission: CREATE_DATA_SOURCE, APPLICATION_ADMIN, GOVERNANCE, or Infrastructure Admin or Data Owner within the hierarchy
GET /data/object/{objectPath}Search for a specific data object using the object path.
Required Immuta permission: CREATE_DATA_SOURCE, APPLICATION_ADMIN, GOVERNANCE, or Infrastructure Admin or Data Owner within the hierarchy
POST /data/object/search/{objectPath}Search for the children of the object defined in the objectPath. Or search all top-level data objects if the objectPath is omitted.
Required Immuta permission: CREATE_DATA_SOURCE, APPLICATION_ADMIN, GOVERNANCE, or Infrastructure Admin or Data Owner on the object
PUT /data/connection/{connectionKey}Update the connection information for the specified connection. Partial updates are not supported.
Required Immuta permission: APPLICATION_ADMIN
What can be updated?
POST /data/crawl/{objectPath}Trigger object sync for the specified data object.
Required Immuta permission: GOVERNANCE or APPLICATION_ADMIN global permission or Infrastructure Admin or Data Owner on the object
PUT /data/settings/{objectPath}Update the settings through overrides for the specified data object. All changes will trickle down to child objects as new overrides; however, existing overrides on child objects will still be respected. Data owners and infrastructure admins cannot be removed, only added. To remove data owners and infrastructure admins, edit the settings at the connection level.
Required Immuta permission: APPLICATION_ADMIN or GOVERNANCE global permission
DELETE /data/object/{objectPath}Delete the given object and all its child objects. For example, if you delete a database, all its schemas and tables will also be deleted.
Required Immuta permission:GOVERNANCE or APPLICATION_ADMIN global permission or Infrastructure Admin or Data Owner on the object
.
.
Find descriptions of the editable attributes in the table below and of the full payload in the .
Using your generated script, run it in your Snowflake environment as a user with the permissions listed in .
The script will create an Immuta system user that will authenticate using the credentials you specified in the script generation. This new system user will have the permissions listed . Additionally, the script will create the database you specified in the earlier step.
Find descriptions of the editable attributes in the table below and of the full payload in the . The recommended setting values are included in the example.
The script will remove any objects that were initially created during the process.
Using this endpoint, you can only update connection information. To update other integration details, use the endpoint.
The connection parameters differ based on your backing technology. See the for details about the payloads.
See the to delete a connection and all its data objects.
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
config.username string
The new username of the system account that can act on Snowflake objects and register the connection. The system account will be created by the script in step two.
Yes
config.password string
The password of the system account that can act on Snowflake objects and register the connection. The system account will be created by the script in step two.
Yes
config.audit object
This object enables Snowflake query audit.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled. Set to true for the recommended configuration.
No
config.workspaces object
This object represents an Immuta project workspace configured for Snowflake.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to false because table grants and project workspaces cannot be used together. Set to false for the recommended configuration.
No
config.impersonation object
This object enables user impersonation.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, set to false because that mode and impersonation cannot be used together.
No
config.lineage object
This object enables Snowflake lineage ingestion.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled. Set false for the recommended configuration.
No
config.userRolePattern object
This object excludes roles and users from authorization checks.
No
config.userRolePattern.exclude array
This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
config.username string
The username of the system account that can act on Snowflake objects and register the connection.
Yes
config.privateKey string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
Yes
config.audit object
This object enables Snowflake query audit.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled. Set to true for the recommended configuration.
No
config.workspaces object
This object represents an Immuta project workspace configured for Snowflake.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to false because table grants and project workspaces cannot be used together. Set to false for the recommended configuration.
No
config.impersonation object
This object enables user impersonation.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, set to false because that mode and impersonation cannot be used together.
No
config.lineage object
This object enables Snowflake lineage ingestion.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled. Set false for the recommended configuration.
No
config.userRolePattern object
This object excludes roles and users from authorization checks.
No
config.userRolePattern.exclude array
This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
config.oAuthClientConfig.provider string
The identity provider for OAuth, such as Okta.
Yes
config.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
config.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
config.oAuthClientConfig.publicCertificateThumbprint string
Your certificate thumbprint.
Yes
config.oAuthClientConfig.oauthPrivateKey string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
Yes
config.audit object
This object enables Snowflake query audit.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled. Set to true for the recommended configuration.
No
config.workspaces object
This object represents an Immuta project workspace configured for Snowflake.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to false because table grants and project workspaces cannot be used together. Set to false for the recommended configuration.
No
config.impersonation object
This object enables user impersonation.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, set to false because that mode and impersonation cannot be used together.
No
config.lineage object
This object enables Snowflake lineage ingestion.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled. Set false for the recommended configuration.
No
config.userRolePattern object
This object excludes roles and users from authorization checks.
No
config.userRolePattern.exclude array
This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
config.host string
The URL of your Snowflake account.
Yes
config.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
config.database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Yes
config.oAuthClientConfig.provider string
The identity provider for OAuth, such as Okta.
Yes
config.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
config.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
config.oAuthClientConfig.clientSecret string
Client secret of the application.
Yes
config.audit object
This object enables Snowflake query audit.
No
config.audit.enabled boolean
If true, Snowflake query audit is enabled. Set to true for the recommended configuration.
No
config.workspace object
This object represents an Immuta project workspace configured for Snowflake.
No
config.workspaces.enabled boolean
If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, set to false because table grants and project workspaces cannot be used together. Set to false for the recommended configuration.
No
config.impersonation object
This object enables user impersonation.
No
config.impersonation.enabled boolean
If true, user impersonation is enabled. If you use Snowflake low row access policy mode, set to false because that mode and impersonation cannot be used together.
No
config.lineage object
This object enables Snowflake lineage ingestion.
No
config.lineage.enabled boolean
If true, Snowflake lineage is enabled. Set false for the recommended configuration.
No
config.userRolePattern object
This object excludes roles and users from authorization checks.
No
config.userRolePattern array
This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.
No
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This should be the same as nativeIntegration.config.host.
Yes
connection.port integer
The port to use when registering your Snowflake connection. Defaults to 443.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.username string
The username of the system account that can act on Snowflake objects and register the connection.
Yes
connection.password string
The password of the system account that can act on Snowflake objects and register the connection.
Yes
settings array
Specifications of the connection's settings, including active status.
No
settings.isActive boolean
When false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration.
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint. See the table above for descriptions.
Yes
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This is the same as host.
Yes
connection.port integer
The port to use when registering your Snowflake connection. Defaults to 443.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.username string
The username of the system account that can act on Snowflake objects and register the connection.
Yes
connection.privateKeyPassword string
The Snowflake private key password. Required if the private key is encrypted.
No
connection.privateKey.userFilename string
The name of your private key file on your machine.
Yes
connection.privateKey.content string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as config.privateKey.
Yes
settings array
Specifications of the connection's settings, including active status.
No
settings.isActive boolean
If false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration.
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.config.username string
Same as connection.username
Yes
nativeIntegration.config.privateKeyPassword string
Same as connection.privateKeyPassword
No
nativeIntegration.config.privateKey.keyName string
Same as connection.keyName
Yes
nativeIntegration.config.privateKey.userFilename string
Same as connection.userFilename
Yes
nativeIntegration.config.privateKey.content string
Same as connection.content
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.warehouse string
Same as connection.warehouse
Yes
nativeIntegration.config.database string
Use the same setting as the script generation.
Yes
nativeIntegration.config.impersonation object
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaces object
Use the same setting as the script generation.
Yes
nativeIntegration.config.lineage object
Use the same setting as the script generation.
Yes
nativeIntegration.userRolePattern object
Use the same setting as the script generation.
Yes
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This is the same as host.
Yes
connection.port integer
The port to use when registering your Snowflake connection. Defaults to 443.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
connection.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
connection.oAuthClientConfig.publicCertificateThumbprint string
Your certificate thumbprint.
Yes
connection.oAuthClientConfig.resource string
An optional resource to pass to the token provider.
No
connection.oAuthClientConfig.oauthPrivateKey.userFilename string
The name of your private key file on your machine.
Yes
connection.oAuthClientConfig.oauthPrivateKey.content string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as config.oauthPrivateKey in the script request.
Yes
settings array
Specifications of the connection's settings, including active status.
No
settings.isActive boolean
When false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration.
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.config.oAuthClientConfig.clientId string
Same as connection.oAuthClientConfig.clientId
Yes
nativeIntegration.config.oAuthClientConfig.authorityUrl string
Same as connection.oAuthClientConfig.authorityUrl
Yes
nativeIntegration.config.oAuthClientConfig.publicCertificateThumbprint string
Same as connection.oAuthClientConfig.publicCertificateThumbprint
Yes
nativeIntegration.config.oAuthClientConfig.resource string
Same as connection.oAuthClientConfig.resource
No
nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.userFilename string
Same as connection.oAuthClientConfig.oauthPrivateKey.userFilename
Yes
nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.content string
Same as connection.oAuthClientConfig.oauthPrivateKey.content
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.warehouse string
Same as connection.warehouse
Yes
nativeIntegration.config.database string
Use the same setting as the script generation.
Yes
nativeIntegration.config.impersonation object
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaces object
Use the same setting as the script generation.
Yes
nativeIntegration.config.lineage object
Use the same setting as the script generation.
Yes
nativeIntegration.userRolePattern object
Use the same setting as the script generation.
Yes
connectionKey string
A unique name for the connection.
Yes
connection object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
connection.hostname string
The URL of your Snowflake account. This is the same as host.
Yes
connection.port integer
The port to use when registering your Snowflake connection. Defaults to 443.
Yes
connection.warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Yes
connection.role string
The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.
Yes
connection.oAuthClientConfig.clientId string
The client identifier of your registered application.
Yes
connection.oAuthClientConfig.authorityUrl string
Authority URL of your identity provider.
Yes
connection.oAuthClientConfig.clientSecret string
Client secret of the application.
Yes
connection.oAuthClientConfig.resource string
An optional resource to pass to the token provider.
No
settings array
Specifications of the connection's settings, including active status.
No
settings.isActive boolean
When false, data objects will be inactive by default when created in Immuta. Set to false for the recommended configuration
No
options.forceRecursiveCrawl boolean
If false, only active objects will be crawled. If true, both active and inactive data objects will be crawled; any child objects from inactive objects will be set as inactive. Set to true for the recommended configuration.
No
nativeIntegration object
Configuration attributes that should match the values used when getting the script from the integration endpoint.
Yes
nativeIntegration.config.oAuthClientConfig.clientId string
Same as connection.oAuthClientConfig.clientId
Yes
nativeIntegration.config.oAuthClientConfig.authorityUrl string
Same as connection.oAuthClientConfig.authorityUrl
Yes
nativeIntegration.config.oAuthClientConfig.resource string
Same as connection.oAuthClientConfig.resource
No
nativeIntegration.config.oAuthClientConfig.clientSecret string
Same as connection.oAuthClientConfig.clientSecret
Yes
nativeIntegration.config.host string
Same as connection.hostname
Yes
nativeIntegration.config.port integer
Same as connection.port
Yes
nativeIntegration.config.warehouse string
Same as connection.warehouse
Yes
nativeIntegration.config.database string
Use the same setting as the script generation.
Yes
nativeIntegration.config.impersonation object
Use the same setting as the script generation.
Yes
nativeIntegration.config.audit object
Use the same setting as the script generation.
Yes
nativeIntegration.config.workspaces object
Use the same setting as the script generation.
Yes
nativeIntegration.config.lineage object
Use the same setting as the script generation.
Yes
nativeIntegration.userRolePattern object
Use the same setting as the script generation.
Yes
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element will be the associated connectionKey.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
connectionKey string
The key to uniquely identify the connection. This is the same as the display name of the connection in the Immuta UI.
Yes
connectionKey string
The key to uniquely identify the connection.
childCount integer
The number of child objects of the data object that were deleted.
connectionKey string
The key to uniquely identify the connection.
connection object
Integration-specific connection information (i.e., hostname, authentication type, warehouse, etc.)
createdAt timestamp
The time the connection was registered in Immuta.
createdBy integer
The ID of the user who registered the connection.
creator.id integer
The ID of the user who registered the connection.
creator.name string
The name of the user who registered the connection.
creator.email string
The email of the user who registered the connection.
updatedAt timestamp
The time the connection was updated in Immuta.
updatedBy integer
The ID of the user who updated the connection.
updater.id integer
The ID of the user who updated the connection.
updater.name string
The name of the user who updated the connection.
updater.email string
The email of the user who updated the connection.
nativeIntegrationId integer
The ID of the integration backing the connection.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.
Yes
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
technology string
The technology that the object comes from: Snowflake or Databricks.
state string
Whether the object is currently active or inactive.
settings array
Specifications of the connection's settings, including active status, new children status, infrastructure admins, and data owners.
overrides array
Specifications of the data object's settings that differ from its parents' settings.
dataSourceId integer
The ID of the data source if it is a table object that is active.
createdAt timestamp
The time the data object was created in Immuta.
lastCrawled timestamp
The time object sync was last run on the data object.
remoteId string
The ID of the remote data object.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.
Yes
sortField string
The field to sort the search results.
No
sortOrder string
Denotes whether to sort the results in ascending (asc) or descending (desc) order. Default is asc.
No
offset integer
Use in combination with limit to fetch pages.
No
limit integer
Limits the number of results displayed per page.
No
searchText string
A partial, case-insensitive search on name.
No
count integer
The number of results for your search.
hits.objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
hits.technology string
The technology that the object comes from (i.e., Snowflake, Databricks, etc.).
hits.state string
Whether the object is currently active or inactive.
hits.settings array
Specifications of the connection's settings, including active status, new children status, infrastructure admins, and data owners.
hits.overrides array
Specifications of the data object's settings that differ from its parents' settings.
hits.dataSourceId integer
The ID of the data source if it is a table object that is active.
hits.createdAt timestamp
The time the data object was created in Immuta.
hits.lastCrawled timestamp
The time object sync was last run on the data object.
hits.remoteId string
The ID of the remote data object.
connectionKey string
The key to uniquely identify the connection. This is the same as the display name of the connection in the Immuta UI.
Yes
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.
Yes
forceRecursive boolean
If false, only active objects will have object sync run. If true, both active and inactive data objects will be synced; any child objects from inactive objects will be set as inactive. Defaults to false.
No.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.
Yes
overrides array
A list of settings configured differently from the parent object's settings.
overrides.isActive boolean
If true, the object and all its child objects are active.
overrides.activateNewChildren boolean
If true, all new children found during object sync will be registered as active.
overrides.infrastructureAdmins array
A list of the users and groups that are infrastructure admins on the connection. These users can run object sync on the connection, edit the connection, and delete data objects.
overrides.infrastructureAdmins.id integer
The ID of the user or group to make infrastructure admin.
overrides.infrastructureAdmins.type string
The type to make infrastructure admin. Options are user or group.
overrides.dataOwners array
A list of users and groups that are data owners on the connection. These users will be data owners for all the data sources under the data object they are assigned to.
overrides.dataOwners.id integer
The ID of the user or group to make data owner.
overrides.dataOwners.type string
The type to make data owner. Options are user or group.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names should be separated by forward slashes.
technology string
The backing technology of the connection. Options are Databricks or Snowflake.
state string
Whether the object is currently active or inactive.
settings array
Specifications of the connection's settings, including active status, new children status, infrastructure admins, and data owners.
overrides array
Specifications of the data object's settings that differ from its parents' settings.
dataSourceId integer
The ID of the data source if it is a table object that is active.
createdAt timestamp
The time the data object was created in Immuta.
lastCrawled timestamp
The time object sync was last run on the data object.
remoteId string
The ID of the remote data object.
bulkId string
A bulk ID that can be used to search for the status of background jobs triggered by this request.
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the and all names should be separated by forward slashes (/). For example, yourConnectionKey/yourDatabase/yourSchema.
Yes
objectPath string
The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element should be the connectionKey and all names are separated by forward slashes.
childCount integer
The number of child objects of the data object that were deleted.
id integer
The integration ID. Use the GET /integrations endpoint to list all your integrations and their IDs.
Yes
GET
Search for a connection using a connection key
GET
Search for a specific data object
POST
Search for the child objects of the data object defined in the objectPath or search all top-level data objects (connections) if the objectPath is omitted
PUT
Update the connection information for the specified connection
POST
Trigger object sync for the specified data object
PUT
Update the settings through overrides for the specified data object
DELETE
Delete the given data object and all its child objects
connectionKey string
The key to uniquely identify the connection. This is the same as the display name of the connection in the Immuta UI.
Yes