Configure API-Driven On-Demand Sync for Snowflake Connector¶

Overview¶

API-driven On-Demand Sync enables real-time, targeted policy synchronization in Snowflake by allowing customers to invoke resource synchronization directly through REST API calls. Unlike scheduled sync operations that process all resources periodically, API-driven On-Demand Sync provides programmatic control to trigger immediate synchronization for specific resources when changes occur.

Key Benefits¶

How It Works¶

API-driven On-Demand Sync follows this workflow:

1. API Invocation: External systems or applications make REST API calls to trigger resource synchronization
2. Request Processing: The API Server receives and validates the sync request
3. Task Creation: A sync task is created and queued for the Snowflake connector
4. Resource Sync: The connector processes the task, loads resources (specified in the incoming sync requests) from Snowflake and applies policy changes.
5. Response: The API returns the task status (SUCCESS, FAILED, or SKIPPED) along with relevant details

Configuration Properties¶

Required Properties¶

Optional Properties¶

Setup¶

Step 1: Edit Connector Configuration¶

SSH to the instance where Privacera is installed and edit your connector configuration file:

1
2

cd ~/privacera/privacera-manager/config
vi custom-vars/connectors/snowflake/instance1/vars.connector.snowflake.yml

Step 2: Add API-Driven On-Demand Sync Configuration¶

Add the following configuration to your connector YAML file:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Enable API Server for On-Demand Sync
CONNECTOR_SNOWFLAKE_API_SERVER_ENABLED: "true"

# Enable On-Demand Sync V2
CONNECTOR_SNOWFLAKE_ON_DEMAND_V2_ENABLED: "true"

# Enable External Access
CONNECTOR_SNOWFLAKE_EXTERNAL_ACCESS_ENABLED: "true"

# Optional: Kubernetes Nginx Ingress (default: false)
CONNECTOR_SNOWFLAKE_K8S_NGINX_INGRESS_ENABLE: "false"

Step 3: Deploy Configuration¶

Once the properties are configured, run the following commands to update your Privacera Manager platform instance:

Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

1
2

cd ~/privacera/privacera-manager
./privacera-manager.sh setup

1
2

cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade

1
2

cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

API Usage¶

Retrieve Host¶

The host is generated during post-install. After running ./privacera-manager.sh post-install, a service-urls.txt file is generated in the output directory. To retrieve the host, follow these steps:

1. SSH to the instance where Privacera is installed and navigate to the Privacera Manager directory:

   Bash
   1	cd ~/privacera/privacera-manager

2. Read the host URL from the service-urls.txt file:

   Bash
   1	cat output/service-urls.txt

3. For the required connector instance, copy the external URL from the output to use in the API endpoint URL.

Endpoint¶

The REST API endpoint for triggering on-demand sync:

1

POST https://<host>/policysync/api/v1/task

Replace <host> with your connector API server hostname (retrieved using the method described in the Retrieve Host section above).

Authentication¶

The API requires JWT token authentication. To retrieve the JWT token, follow these steps:

1. SSH to the instance where Privacera is installed and navigate to the Privacera Manager directory:

   Bash
   1	cd ~/privacera/privacera-manager

2. Read the JWT token from the file (replace <instance-name> with your connector instance name, e.g., instance1):

   Bash
   1	cat config/api-server-keys/connector/snowflake/<instance-name>/jwt/jwt-token.txt

3. Copy the JWT token from the output to use in the Authorization header.

Request Headers¶

Request Payload Structure¶

To trigger an on-demand sync, send a JSON payload with the following structure:

Sample Request Payload¶

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

{
    "type": "RESOURCE_SYNC",
    "requestInfo": {
        "resources": [
            {
                "type": "table",
                "values": {
                    "database": "AP_PS_OMNI_PROD_DB",
                    "schema": "TEST_SCHEMA1",
                    "table": "TEST_DATA3"
                }
            }
        ]
    }
}

Payload Field Descriptions¶

Resource Types and Values¶

Database:

1
2
3
4
5
6

{
  "type": "database",
  "values": {
    "database": "SALES_DB"
  }
}

Schema:

1
2
3
4
5
6
7

{
  "type": "schema",
  "values": {
    "database": "SALES_DB",
    "schema": "PUBLIC"
  }
}

Table:

1
2
3
4
5
6
7
8

{
  "type": "table",
  "values": {
    "database": "SALES_DB",
    "schema": "PUBLIC",
    "table": "CUSTOMERS"
  }
}

Column:

1
2
3
4
5
6
7
8
9

{
  "type": "column",
  "values": {
    "database": "SALES_DB",
    "schema": "PUBLIC",
    "table": "CUSTOMERS",
    "column": "EMAIL"
  }
}

Multiple Resources Example¶

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

{
    "type": "RESOURCE_SYNC",
    "requestInfo": {
        "resources": [
            {
                "type": "database",
                "values": {
                    "database": "HR_DB"
                }
            },
            {
                "type": "schema",
                "values": {
                    "database": "HR_DB",
                    "schema": "EMPLOYEE_DATA"
                }
            },
            {
                "type": "table",
                "values": {
                    "database": "HR_DB",
                    "schema": "EMPLOYEE_DATA",
                    "table": "EMPLOYEES"
                }
            }
        ]
    }
}

Retrieve Task Status¶

To check the status of a sync task, use the GET endpoint with the task ID returned from the POST API call:

1

GET https://<host>/policysync/api/v1/tasks/<taskId>

The response will include the current status of the task:

1
2
3
4
5

{
    "taskId": "574057046565109672",
    "status": "SUCCESS",
    "message": "Sync completed successfully"
}

Task Status¶

After processing, each sync task will have one of the following statuses: