{ "schema": "aaes/capability-pack/1", "provider": "snowflake", "version": "1.0.0", "description": "Snowflake SQL REST API (/api/v2/statements): status checks and result retrieval for one pre-bound statement, and cancellation of that statement's execution.", "notes": "The endpoint host 'snowflake-account.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the customer's own account host (the documented shape is https://.snowflakecomputing.com) before enabling, in the endpoints, the resource locator and the egress allowlist — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. Note that allowlisting the reserved.invalid host does not make an unsubstituted pack safe: an unsubstituted pack cannot resolve to a destination, but it also has no reviewed destination, so it is not a registration of anything. STATEMENT_HANDLE in the status and cancel endpoint paths is a placeholder the deployment substitutes with a concrete statement handle before enabling: the gate requires the request path to exactly equal the registered path, so a caller cannot name a handle per request and each enablement of these capabilities targets exactly one statement. Statement submission is excluded: POST /api/v2/statements takes the SQL statement text in the request body, and Snowflake documents the SQL API as executing standard queries and most DDL and DML statements.\n\nThe http connector injects a credential; it does not constrain the request body, so no registration of that endpoint can pin the statement field, and arbitrary caller-supplied SQL cannot be classified as one fixed action — a read-tiered label would not prevent a DML or DDL statement. For the same reason this pack does not register a SHOW-only metadata capability: it would share the submission endpoint and nothing in the registration could pin the body to SHOW statements.\n\nIf a deployment needs statement execution, that is a separate, purpose-built review (restricting the Snowflake role's grants, statement timeouts, and policy over the capability), not a variant of this pack.\n\nDocumented exclusions: this pack does not register statement submission (POST /api/v2/statements), multi-statement submission (the multi_statement_count request shape), stored-procedure creation or calls through the API, explicit transaction control requests, or any Snowflake administration surface outside the SQL API. Every call here is a status or cancel call against the one statement handle bound at registration; there is no collection endpoint in this API.", "credential": { "secret_ref_id": "secret-ref-snowflake-keypair-jwt", "custody": "customer_vault", "inject": "header", "inject_name": "Authorization", "note": "A bearer token for a dedicated least-privilege Snowflake service user, held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Bearer', one separating space, then the token — 'Bearer '. customer_vault is the only generally-supported production custody model here — identity_federation and customer_broker are refused at startup and inline is lab-only. The reviewed token process is Snowflake key-pair authentication: an external deployment process holds the RSA private key, generates the JWT Snowflake documents (RS256; iss = ..SHA256: with account and user uppercased; sub = .; iat; exp), and writes the complete header value under this reference.\n\nSnowflake states the JWT is valid for at most one hour after issue even if a longer exp is set, so renewal is a scheduled external process — the executor injects the stored value verbatim and performs no token lifecycle itself. Revocation is removing or rotating the public key on the user (Snowflake documents key-pair rotation); an expired or unregistered key fails closed. Snowflake OAuth bearer tokens are a documented alternative; if the deployment chooses OAuth instead, the token-type header (X-Snowflake-Authorization-Token-Type: OAUTH) and the refresh path are that deployment's review, not this pack's.\n\nLeast privilege: the service user's role should carry only the grants needed to read and cancel the statement this pack is bound to — the role's grants are the real access boundary.\n\nExecutor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack." }, "capabilities": [ { "capability_id": "snowflake.sql.statements.status.get", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "snowflake-account.invalid" ], "endpoint": "https://snowflake-account.invalid/api/v2/statements/STATEMENT_HANDLE", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-snowflake-keypair-jwt", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "snowflake-account-sql-api", "description": "Check the status of the statement whose handle is bound in the registered path and, once it has executed successfully, retrieve its result set (paginated in partitions via the partition query parameter and the Link response header). This returns whatever data that statement produced — uncontrolled content the deployment classifies. STATEMENT_HANDLE is a placeholder the deployment substitutes with a concrete statement handle in the endpoint path before enabling: the gate requires the request path to exactly equal the registered path, so a caller cannot name a handle per request and each enablement of this capability reads exactly one statement's status and results.", "requires_review": true }, { "capability_id": "snowflake.sql.statements.cancel", "version": "1.0.0", "kind": "tool", "risk_tier": "R2", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "snowflake-account.invalid" ], "endpoint": "https://snowflake-account.invalid/api/v2/statements/STATEMENT_HANDLE/cancel", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-snowflake-keypair-jwt", "inject": "header", "inject_name": "Authorization", "actions": [ "update" ], "resource_id": "snowflake-account-sql-api", "description": "Cancel the execution of the in-flight statement whose handle is bound in the registered path: it changes the state of an existing executing thing, so the declared action is update at the minimum R2 tier. Cancellation releases the warehouse compute the statement was consuming and cannot be reverted into the same execution — a cancelled statement that is needed again must be resubmitted as a new execution. STATEMENT_HANDLE is a placeholder the deployment substitutes with a concrete statement handle before enabling (the gate requires exact path equality, so the caller cannot name a handle per request); each enablement cancels exactly the statement bound at registration.", "requires_review": true } ], "resources": [ { "resource_id": "snowflake-account-sql-api", "kind": "api", "locator": "https://snowflake-account.invalid/api/v2/statements", "data_class": "internal", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" } ], "review": { "state": "library", "date": "2026-09-22", "sources": [ "https://docs.snowflake.com/en/developer-guide/sql-api/index (retrieved 2026-09-21)", "https://docs.snowflake.com/en/developer-guide/sql-api/reference (retrieved 2026-09-21)", "https://docs.snowflake.com/en/developer-guide/sql-api/authenticating (retrieved 2026-09-21)" ], "reviewer_id": "aaes-eng" } }