The parameters for configuring an integration in Immuta are outlined in the table below.
type string
The type of integration to configure.
Required
-
Trino
autoBootstrap boolean
Required for all integrations except Starburst (Trino)
-
true or false
config object
Required for all integrations except Starburst (Trino)
-
-
The config object configures the S3 integration. The table below outlines its child parameters.
name string
A name for the integration that is unique across all Amazon S3 integrations configured in Immuta.
Required
-
-
awsAccountId string
The ID of your AWS account.
Required
-
-
awsRegion string
The AWS region to use.
Required
-
Any valid AWS region (us-east-1, for example)
awsLocationRole string
The AWS IAM role ARN assigned to the base access grants location. This is the role the AWS Access Grants service assumes to vend credentials to the grantee. When a grantee accesses S3 data, the AWS Access Grants service attaches session policies and assumes this role in order to vend scoped down credentials to the grantee. This role needs full access to all paths under the S3 location prefix.
Required
-
-
awsLocationPath string
The base S3 location prefix that Immuta will use for this connection when registering S3 data sources. This path must be unique across all S3 integrations configured in Immuta.
Required
-
-
awsRoleToAssume string
The AWS IAM role ARN Immuta assumes when interacting with AWS.
Required when authenticationType is auto.
[]
-
authenticationType string
The method used to authenticate with AWS when configuring the S3 integration.
Required
-
auto
accessKey
awsAccessKeyId string
The AWS access key ID for the AWS account configuring the integration.
Required when authenticationType is accessKey.
-
-
awsSecretAccessKey string
The AWS secret access key for the AWS account configuring the integration.
Required when authenticationType is accessKey.
-
-
port number
The port to use when connecting to your S3 Access Grants instance.
Optional
443
0-65535
The table below outlines the parameters for creating an S3 data source.
type string
The type of integration.
Required
-
Native S3
integrationId number
The unique identifier of the S3 integration.
Required
-
-
dataSources.dataSourceName string
The name of the S3 data source you want to create.
Required
-
-
dataSources.prefix string
The S3 prefix that creates a data source for the prefix, bucket, or object provided in the path.
Required
-
-
The table below outlines the response schema for successful requests.
dataSourceId integer
The unique identifier of the data source.
prefix string
The S3 path of the prefix, bucket, or object used to create the data source.
dataSourceName string
The name of the data source.
The config object configures the Azure Synapse Analytics integration. The table below outlines its child parameters.
host string
The URL of your Azure Synapse Analytics account.
Required
-
Valid URL hostnames.
database string
Name of an existing database where the Immuta system user will store all Immuta-generated schemas and views.
Required
-
-
schema string
Name of the Immuta-managed schema where all your secure views will be created and stored.
Required
-
-
authenticationType string
The method used to authenticate with Azure Synapse Analytics when configuring the integration.
Required
-
userPassword
username string
The username of the system account that can act on Azure Synapse Analytics objects and configure the integration.
Required
-
-
password string
The password of the system account that can act on Azure Synapse Analytics objects and configure the integration.
Required
-
-
Optional
-
port number
The port to use when connecting to your Azure Synapse Analytics account host.
Optional
1433
0-65535
Optional
-
connectArgs string
The connection string arguments to pass to the ODBC driver when connecting as the Immuta system user.
Optional
-
-
The impersonation object enables and defines roles for user impersonation for Azure Synapse Analytics. The table below outlines its child parameters.
enabled boolean
When true, enables user impersonation.
false
true or false
role string
The name of the user impersonation role.
IMMUTA_IMPERSONATION
-
The credentials you used when configuring your integration are required in the payload when autoBootstrap was set to true when setting up your integration. For integration configurations with autoBootstrap set to false, no payload is required when deleting the integration.
authenticationType string
The type of authentication used when originally configuring the Azure Synapse Analytics integration.
Required
userPassword
username string
The username of the system account that configured the integration.
Required if autoBootstrap was true when setting up the integration.
-
password string
The password of the system account that configured the integration.
Required if autoBootstrap was true when setting up the integration.
-
The metadataDelimiters object specifies the delimiters that Immuta uses to store profile data in Azure Synapse Analytics. The table below outlines its child parameters.
hashDelimiter string
A delimiter used to separate key-value pairs.
`
`
hashKeyDelimiter string
A delimiter used to separate a key from its value.
:
-
arrayDelimiter string
A delimiter used to separate array elements.
,
-
The config object configures the Databricks Unity Catalog integration. The table below outlines its child parameters.
port number
The port to use when connecting to your Databricks account host.
Optional
443
0-65535
workspaceUrl string
Databricks workspace URL. For example, my-workspace.cloud.databricks.com.
Required
-
-
httpPath string
The HTTP path of your Databricks cluster or SQL warehouse.
Required
-
-
authenticationType string
The type of authentication to use when connecting to Databricks.
Required
-
token
oAuthM2M
token string
The Databricks personal access token. This is the access token for the Immuta service principal.
Required if authenticationType is token.
-
-
Optional
[]
-
Required if you selected oAuthM2M as your authenticationType.
-
-
Optional
-
workspaceIds array[integer]
This array can be used to scope query audit to only ingest activity for specified workspaces.
Optional
[]
catalog string
The name of the Databricks catalog Immuta will create to store internal entitlements and other user data specific to Immuta. This catalog will only be readable for the Immuta service principal and should not be granted to other users. The catalog name may only contain letters, numbers, and underscores and cannot start with a number.
Optional
immuta
-
Optional
[]
-
Optional
[]
-
The additionalWorkspaceConnections array allows you to configure additional workspace connections for your Databricks Unity Catalog integration. The table below outlines its child attributes.
workspaceUrl string
Databricks workspace URL. For example, my-workspace.cloud.databricks.com.
Required
-
-
httpPath string
The HTTP path of the compute for the workspace.
Required
-
-
authenticationType string
The type of authentication to use when connecting to Databricks. The additional workspace credentials will be used when processing objects in bound catalogs that are not accessible via the default workspace.
Required
-
token
oAuthM2M
token string
The Databricks personal access token. This is the access token for the Immuta service principal. The additional workspace credentials will be used when processing objects in bound catalogs that are not accessible via the default workspace.
Required if authenticationType is token.
-
-
Required if you selected oAuthM2M as your authenticationType.
-
-
catalogs string
The name of the catalog to use for this additional workspace connection. The catalog name may only contain letters, numbers, and underscores and cannot start with a number. Users may configure one additional workspace connection per catalog.
Users may still bind a catalog to more than one workspace in Databricks, as long as there is only one additional workspace connection in Immuta, as Immuta requires a single connection from which to control the catalog.
Required
-
-
The audit object enables Databricks Unity Catalog query audit. The table below outlines its child parameter.
enabled boolean
This setting enables or disables Databricks Unity Catalog query audit.
false
true or false
The groupPattern object excludes the listed group from having data policies applied in the Databricks Unity Catalog integration. This account-level group should be used for privileged users and service accounts that require an unmasked view of data. The table below outlines its child parameters.
deny string
The name of a group in Databricks that will be excluded from having data policies applied. This account-level group should be used for privileged users and service accounts that require an unmasked view of data.
immuta_exemption_group
-
The proxyOptions object represents your proxy server configuration in Databricks Unity Catalog. The table below outlines the object's child attributes.
host string
The hostname of the proxy server.
Required
-
Valid URL hostnames
port number
The port to use when connecting to your proxy server.
Optional
443
0-65535
username string
The username to use with the proxy server.
Optional
[]
-
password string
The password to use with the proxy server.
Optional
[]
-
The oAuthClientConfig object represents your OAuth configuration in Databricks Unity Catalog. This object is required if you set oAuthM2M as your authentication type in the Databricks Unity Catalog integration configuration. The table below outlines the object's child parameters.
clientId string
The client identifier of the Immuta service principal you configured. This is the client ID displayed in Databricks when creating the client secret for the service principal.
Required
-
-
authorityUrl string
Authority URL of your identity provider.
Required
https://<your workspace name>.cloud.databricks.com/oidc/v1/token
-
scope
Optional
[]
-
clientSecret string
Required
-
-
The config object configures the Google BigQuery integration. The table below outlines its child parameters.
role string
Google Cloud role used to connect to Google BigQuery.
Required
-
-
datasetSuffix string
Suffix to postfix to the name of each dataset created to store secure views. This string must start with an underscore.
Required
-
-
dataset string
Name of the BigQuery dataset to provision inside of the project for Immuta metadata storage.
Optional
immuta
-
location string
The dataset's location. After a dataset is created, the location can't be changed.
Required
-
Any valid GCP location (us-east1, for example).
credential string
Required
-
-
port number
The port to use when connecting to your BigQuery account host.
Optional
443
0-65535
The config object configures the Redshift integration. The table below outlines its child parameters.
host string
The URL of your Redshift account.
Required
-
Valid URL hostnames
database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Required
-
-
initialDatabase string
Name of the existing database in Redshift that Immuta initially connects to and creates the Immuta-managed database.
Required if autoBootstrap is true.
-
-
authenticationType string
The type of authentication to use when connecting to Redshift.
Required
-
userPassword
accessKey
okta
username string
The username of the system account that can act on Redshift objects and configure the integration.
Required if you selected userPassword as your authenticationType.
-
-
password string
The password of the system account that can act on Redshift objects and configure the integration.
Required if you selected userPassword as your authenticationType.
-
-
Required if you selected okta as your authenticationType.
-
-
databaseUser string
The Redshift database username.
Required if you selected accessKey as your authenticationType.
-
-
accessKeyId string
The Redshift access key ID.
Required if you selected accessKey as your authenticationType.
-
-
secretKey string
The Redshift secret key.
Required if you selected accessKey as your authenticationType.
-
-
sessionToken string
The Redshift session token.
Optional if you selected accessKey as your authenticationType.
-
-
port number
The port to use when connecting to your Redshift account host.
Optional
5439
0-65535
Optional
-
connectArgs string
The connection string arguments to pass to the ODBC driver when connecting as the Immuta system user.
Optional
-
-
The authentication type and credentials you used when configuring your integration are required in the payload when autoBootstrap was set to true when setting up your integration. For integration configurations with autoBootstrap set to false, no payload is required when deleting the integration.
authenticationType string
The type of authentication used when originally configuring the Redshift integration.
Required if autoBootstrap was true when setting up the integration.
userPassword
accessKey
okta
username string
The username of the system account that configured the integration.
Required if you selected userPassword as your authenticationType.
-
password string
The password of the system account that configured the integration.
Required if you selected userPassword as your authenticationType.
-
databaseUser string
The Redshift database username.
Required if you selected accessKey as your authenticationType.
-
accessKeyId string
The Redshift access key ID.
Required if you selected accessKey as your authenticationType.
-
secretKey string
The Redshift secret key.
Required if you selected accessKey as your authenticationType.
-
sessionToken string
The Redshift session token.
Optional if you selected accessKey as your authenticationType.
-
Required if you selected okta as your authenticationType.
-
The impersonation object enables and defines roles for user impersonation for Redshift. The table below outlines its child parameters.
enabled boolean
When true, enables user impersonation.
false
true or false
role string
The name of the user impersonation role.
immuta_impersonation
-
The okta object represents your Okta configuration. This object is required if you set okta as your authentication type in the Redshift integration configuration. The table below outlines its child parameters.
username string
The username of the system account that can act on Redshift objects and configure the integration.
Required
-
-
password string
The password of the system account that can act on Redshift objects and configure the integration.
Required
-
-
appId string
The Okta application ID.
Required
-
-
idpHost string
The Okta identity provider host URL.
Required
-
-
role string
The Okta role.
Required
-
-
The config object configures the Snowflake integration. The table below outlines its child parameters.
host string
The URL of your Snowflake account.
Required
-
Valid URL hostnames
warehouse string
The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.
Required
-
-
database string
Name of a new empty database that the Immuta system user will manage and store metadata in.
Required
-
-
authenticationType string
The type of authentication to use when connecting to Snowflake.
Required
-
userPassword
keyPair
oAuthClientCredentials
username string
The username of a Snowflake account that can act on Snowflake objects and configure the integration.
Required if you selected userPassword as your authenticationType.
-
-
password string
The password of a Snowflake account that can act on Snowflake objects and configure the integration.
Required if you selected userPassword as your authenticationType.
-
-
privateKey string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
Required if you selected keyPair as your authenticationType.
-
-
Required if you selected oAuthClientCredentials as your authenticationType.
-
-
role string
The privileged Snowflake role used by the Immuta system account when configuring the Snowflake integration.
Required when autoBootstrap is true.
-
-
port number
The port to use when connecting to your Snowflake account host.
Optional
443
0-65535
Optional
-
Optional
-
Optional
{[]}
-
Optional
-
connectArgs string
The connection string arguments to pass to the Node.js driver when connecting as the Immuta system user.
Optional
-
-
privilegedConnectArgs string
The connection string arguments to pass to the Node.js driver when connecting as the privileged user.
Optional when autoBootstrap is true.
-
-
Optional
-
-
The audit object enables Snowflake query audit. The table below outlines its child parameter.
enabled boolean
This setting enables or disables Snowflake query audit.
false
true or false
The authentication type and credentials you used when configuring your integration are required in the payload when autoBootstrap was set to true when setting up your integration. For integration configurations with autoBootstrap set to false, no payload is required when deleting the integration.
authenticationType string
The type of authentication used when originally configuring the integration.
Required if autoBootstrap was true when configuring the integration.
userPassword
keyPair
oAuthClientCredentials
username string
The username of the system account that configured the integration.
Required for the Azure Synapse Analytics integration or if you selected userPassword as your authenticationType for Redshift or Snowflake.
-
password string
The password of the system account that configured the integration.
Required for the Azure Synapse Analytics integration or if you selected userPassword as your authenticationType for Redshift or Snowflake.
-
privateKey string
The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.
Required if you selected keyPair as your authenticationType.
-
Required if you selected oAuthClientCredentials as your authenticationType.
-
role string
The privileged Snowflake role used by the Immuta system account when configuring the Snowflake integration.
Required when autoBootstrap is true for Snowflake.
-
The impersonation object enables and defines roles for user impersonation for Snowflake. The table below outlines its child parameters.
enabled boolean
When true, enables user impersonation.
false
true or false
role string
The name of the user impersonation role.
IMMUTA_IMPERSONATION
-
The lineage object enables Snowflake native lineage ingestion. When this setting is enabled, Immuta automatically applies tags added to a Snowflake table to its descendant data source columns in Immuta so you can build policies using those tags to restrict access to sensitive data. The table below outlines its child parameters.
enabled boolean
When true, enables Snowflake native lineage so that Immuta can apply tags added to Snowflake data sources to their descendant data source columns in Immuta.
Optional
false
true or false
lineageConfig object
Configures what tables Immuta will ingest lineage history for, the number of rows to ingest per batch, and what tags to propagate. Child parameters include tableFilter, tagFilterRegex, and ingestBatchSize.
Required if enabled is true.
-
-
lineageConfig.tableFilter string
This child parameter of lineageConfig determines which tables Immuta will ingest lineage for. Use a regular expression that excludes / from the beginning and end to filter tables. Without this filter, Immuta will attempt to ingest lineage for every table on your Snowflake instance.
Optional
^.*$
Regular expression that excludes / from the beginning and end.
lineageConfig.tagFilterRegex string
This child parameter of lineageConfig determines which tags to propagate using lineage. Use a regular expression that excludes / from the beginning and end to filter tags. Without this filter, Immuta will ingest lineage for every tag on your Snowflake instance.
Optional
^.*$
Regular expression that excludes / from the beginning and end.
lineageConfig.ingestBatchSize number
This child parameter of lineageConfig configures the number of rows Immuta ingests per batch when streaming Access History data from your Snowflake instance.
Optional
1000
Minimum value of 1.
The oAuthClientConfig object represents your OAuth configuration in Snowflake. This object is required if you set oAuthClientCredentials as your authentication type in the Snowflake integration configuration, and you must set autoBootstrap to false. The table below outlines the object's child parameters.
provider string
The identity provider for OAuth, such as Okta.
Required
-
-
clientId string
The client identifier of your registered application.
Required
-
-
authorityUrl string
Authority URL of your identity provider.
Required
-
-
useCertificate boolean
Specifies whether or not to use a certificate and private key for authenticating with OAuth.
Required
-
true or false
publicCertificateThumbprint string
Your certificate thumbprint.
Required if useCertificate is true.
-
-
oauthPrivateKey string
The private key content.
Required if useCertificate is true.
-
-
clientSecret string
Client secret of the application.
Required if useCertificate is false.
-
-
resource string
An optional resource to pass to the token provider.
Optional
-
-
scope string
Optional
[]
-
The userRolePattern object excludes roles and users from authorization checks in the Snowflake integration. The table below outlines its child parameter.
exclude array[string]
This array is a list of roles and users to exclude from authorization checks.
[]
-
The workspaces object represents an Immuta project workspace configured for Snowflake. The table below outlines its child parameters.
enabled boolean
This setting enables or disables Snowflake project workspaces. If you use Snowflake secure data sharing with Immuta, set this property to true, as project workspaces are required. If you use Snowflake table grants, set this property to false; project workspaces cannot be used when Snowflake table grants are enabled.
false
true or false
warehouses array[string]
This array is a list of warehouses workspace users have usage privileges on.
[]
-
When true, Immuta will automatically configure the integration in your Azure Synapse Analytics, Databricks Unity Catalog, Redshift, or Snowflake environment for you. When false, you must set up your environment manually before configuring the integration with the API. This parameter must be set to false in the Amazon S3 and Google BigQuery configurations. See the specific how-to guide for configuring your integration for details: , , , .
This object specifies the integration settings. See the config object description for your integration for details: , , , , , or .
object
This object is a set of delimiters that Immuta uses to store profile data in Azure Synapse Analytics. See the for parameters.
See the for default values.
object
Enables user impersonation. See the for parameters.
Disabled by default. See the for parameters.
object
This object allows you to configure your integration to use a proxy server. See the for child attributes.
object
This object represents your OAuth configuration. To use this authentication method, authenticationType must be oAuthM2M. See the for parameters.
object
This object enables Databricks Unity Catalog query audit. See the for parameters.
Disabled by default. See the for parameters.
object
This object allows you to exclude groups in Databricks from authorization checks. See the for parameters.
array[ object]
This object allows you to configure additional workspace connections for your integration. See the for child attributes.
object
This object represents your OAuth configuration. To use this authentication method, authenticationType must be oAuthM2M. See the for parameters. The additional workspace credentials will be used when processing objects in bound catalogs that are not accessible via the default workspace.
The scope limits the operations and roles allowed in Databricks by the access token. See the for details about scopes.
.
The Google BigQuery service account JSON keyfile credential content. See the for guidance on generating and downloading this keyfile.
object
This object represents your Okta configuration. See the for parameters.
object
Enables user impersonation. See the for parameters.
Disabled by default. See the for parameters.
object
This object represents your Okta configuration. See the for parameters.
object
This object represents your OAuth configuration. To use this authentication method, autoBootstrap must be false. See the for parameters.
object
This object enables Snowflake query audit. See the for the parameter.
Disabled by default. See the for the parameter.
object
Enables user impersonation. See the for parameters.
Disabled by default. See the for parameters.
object
This object excludes roles and users from authorization checks. See the for parameters.
object
This object represents an Immuta project workspace configured for Snowflake. See the for parameters.
Disabled by default. See the for parameters.
object
Enables Snowflake lineage ingestion so that Immuta can apply tags added to Snowflake tables to their descendant data source columns. See the for parameters.
object
This object represents your OAuth configuration. See the for parameters.
The scope limits the operations and roles allowed in Snowflake by the access token. See the for details about scopes.