An external access integration is a Snowflake object that enables governed outbound calls from Snowflake code to approved external network locations. It combines a network rule, which identifies permitted destinations, with an authentication secret, which holds a token, key, or password. The integration is then supplied to a Python UDF or stored procedure that calls an API endpoint. section 7.1 section 7.5
Use an integration when a pipeline needs data from an external API without embedding credentials in application code. An administrator or sufficiently privileged user enables the external location; a data engineer receives access to use the integration. Administrators can monitor requests and limit access to external locations. External network access requires a paid Snowflake account rather than a trial account. section 7.0 section 7.1 section 7.5
Configure external access in three connected steps:
- Create an egress network rule for one or more approved host locations, such as api.yelp.com. section 7.1
- Create a secret for the API credential, and grant READ on that secret to the role that needs it. section 7.1 section 7.5
- Create and enable the integration with the network rule and secret, then grant users access to use it. section 7.1 section 7.5
Calling a review API from a Python UDF
A GET_CUSTOMER_REVIEWS UDF declares YELP_API_INTEGRATION in external_access_integrations and maps YELP_API_TOKEN through secrets. Its Python handler retrieves the token with _snowflake.get_generic_secret_string(), builds a Yelp reviews URL from a business alias, and uses requests.get() with a Bearer authorization header. The returned JSON can be selected like a normal UDF result, then parsed and flattened for SQL use when necessary. section 7.2.1 section 7.5
Figure 7.1 Snowflake's external network access architecture consists of a network rule pointing to an external network location and a secret containing a token, key, or password. The network rule and secret are included as parameters when creating an external access integration object. This object is passed as a parameter to a Python function or stored procedure so that the function or procedure can call the external API.
The architecture shows the boundary between approved destinations, protected credentials, and the UDF or stored procedure that receives the integration. section 7.1
Before configuration, identify the API endpoint URL and its authentication method. Keep the credential in a Snowflake secret rather than passing its value directly. The calling UDF must declare the external integration, map the secret name used by handler code, and include third-party packages such as requests in its definition. section 7.2.1 section 7.5
