Before you get started, check to see if your team has already set up their Client ID and Client Secret for Parabola. If you or someone else on your team has already set this up on the Snowflake side, you will not need to go through this process again and can jump straight to the Parabola Step Set Up section**.**

Connect your Snowflake account

In order to perform these steps, you must have the right permission level in Snowflake to create a security integration.

Login to your Snowflake account. Once you’re logged in, click on “Worksheets” tab in the sidebar and click + Worksheet button in the upper right hand corner

In the worksheet, paste the query below into the worksheets query box. This will instantiate a custom client OAuth server on your Snowflake instance that Parabola will use to connect to.

create security integration oauth_parabola_prod
type = oauth
enabled = true
oauth_client = custom
oauth_client_type = 'CONFIDENTIAL'
oauth_redirect_uri = 'https://parabola.io/api/auth/snowflake/callback'
oauth_issue_refresh_tokens = true
oauth_refresh_token_validity = 86400

The configuration above is the basic default settings for OAuth server up, but can be customized further for your needs. Additional information located on Snowflake documents here.

Click the Run/Play button.  If successful, you should see a notification on the lower portion of the screen confirming integration creation was successful.

Retrieving the Client ID and Client Secret

Run the following query:

select system$show_oauth_client_secrets('OAUTH_PARABOLA_PROD');

Note: The name of your integration passed into this statement should be all capitalized. Ex “oauth_parabola_prod” should be entered as 'OAUTH_PARABOLA_PROD'

Click on the result in the lower half of the page and copy the oauth_client_id and oauth_client_secret values in the resulting json

‍

Parabola Step Set Up

In your builder, bring in the Snowflake step and Click on “Authorize Snowflake”. You will see a form asking for client_id, client_secret, and account_identifier.  For client_id and client_secret, paste the values you received above.

For account_identifier, paste your Snowflake account id.  Your account ID will be the located in your URL:

<account_identifier>.snowflakecomputing.com

If your Snowflake URL has a region included in it, along with an account identifier, you may need to include that region as well in this step.

After you hit Submit, a module will pop up which will ask to authenticate. Login to your Snowflake account as you always would. After logging in, you should be taken back to Parabola. You will now be able to query data from Snowflake!

Step Permissions

When a user authorizes our "Pull from Snowflake" step, their access to data within the Parabola step will be the same as their access to data within the Snowflake platform. If a user has granular permissions configured in Snowflake, their access will be gated in the same fashion within Parabola.

While credentials like Client ID and Client Secret are at the organization level, when a user actually authenticates the step through their Snowflake login, we ensure that the actual user account permissions are enforced within the step itself.

Helpful Tips

By default Parabola will mimic the permissions you have within your Snowflake instance. The request will check the users default role, warehouse, and database/schema.  If these values are not set, or the users default values are not sufficient to make a certain request, you will see an error message like below:

Settings Error: Error occurred with Snowflake API (status_code: 422, message: “SQL compilation error: Object ‘CUSTOMER’ does not exist or not authorized.”)

If this occurs, open up the settings on the left-hand side labeled Connection Options and manually enter the values you would like to use to make a query:

‍

You can play around with these values in the Snowflake worksheets section to find a configuration that works for you. In the upper left hand corner of the page select for role or warehouse, and the sidebar for database or schema respectively:

‍

‍

‍

Before you get started, check to see if your team has already set up their Client ID and Client Secret for Parabola. If you or someone else on your team has already set this up on the Snowflake side, you will not need to go through this process again and can jump straight to the Parabola Step Set Up section.

Connect your Snowflake account

In order to perform these steps, you must have the right permission level in Snowflake to create a security integration.

Login to your Snowflake account. Once you’re logged in, click on “Worksheets” tab in the sidebar and click + Worksheet button in the upper right hand corner

In the worksheet, paste the query below into the worksheets query box. This will instantiate a custom client OAuth server on your Snowflake instance that Parabola will use to connect to.

create security integration oauth_parabola_prod

The configuration above is the basic default settings for OAuth server up, but can be customized further for your needs. Additional information located on Snowflake documents here.

Click the Run/Play button.  If successful, you should see a notification on the lower portion of the screen confirming integration creation was successful.

Retrieving the Client ID and Client Secret

Run the following query:

select system$show_oauth_client_secrets('OAUTH_PARABOLA_PROD');

Note: The name of your integration passed into this statement should be all capitalized. Ex “oauth_parabola_prod” should be entered as 'OAUTH_PARABOLA_PROD'

Click on the result in the lower half of the page and copy the oauth_client_id and oauth_client_secret values in the resulting json

Parabola Step Set Up

In your Flow builder, add the Send to Snowflake step and click on “Authorize Snowflake”. You will see a form asking for client_id, client_secret, and account_identifier.  For client_id and client_secret, paste the values you received above.

For account_identifier, paste your Snowflake account id.  Your account ID will be the located in your URL:

<account_identifier>.snowflakecomputing.com

If your Snowflake URL has a region included in it, along with an account identifier, you may need to include that region as well in this step.

After you hit “Submit”, a window will pop up which will ask to authenticate. Login to your Snowflake account as you always would. After logging in, you should be taken back to Parabola. You will now be able to send data to Snowflake!

Step Permissions

When a user authorizes our Send to Snowflake step, their access to data within the Parabola step will be the same as their access to data within the Snowflake platform. If a user has granular permissions configured in Snowflake, their access will be gated in the same fashion within Parabola.

While credentials like Client ID and Client Secret are at the organization level, when a user actually authenticates the step through their Snowflake login, we ensure that the actual user account permissions are enforced within the step itself.

Sending data

This step can send data in 3 different ways:

• Insert - adds new rows to Snowflake
• Update - uses a unique identifier to find existing rows to update
• Merge (upsert) - attempts an update, and if no matching rows are found, inserts the data instead

Both update and merge require a Snowflake column to be used as the unique identifier.

This step cannot create or remove tables within Snowflake. A database table must already exist in Snowflake, with a schema of columns, to use this step.

Any columns within Parabola that are not mapped to corresponding columns in Snowflake will not be sent. If any Snowflake columns do not have corresponding columns mapped within Parabola, the resulting new rows will have blank values in those columns.

⚠️ Note: when using the “update” option, Snowflake will not send back an error if an update was unable to find a matching row. The Parabola Flow will indicate success and look like it sent a number of rows, but if any of those rows during the update process were unable to match any rows in Snowflake, no error will be returned. This is unfortunately a Snowflake limitation.

Helpful Tips

By default Parabola will mimic the permissions you have within your Snowflake instance. The request will check the users default role, warehouse, and database/schema.  If these values are not set, or the users default values are not sufficient to make a certain request, you will see an error message like below:

Settings Error: Error occurred with Snowflake API (status_code: 422, message: “SQL compilation error: Object ‘CUSTOMER’ does not exist or not authorized.”)

If this occurs, try updating the Role, Warehouse, Database, or Schema settings.

You can play around with these values in the Snowflake worksheets section to find a configuration that works for you. In the upper left hand corner of the page select for role or warehouse, and the sidebar for database or schema respectively: