Skip to main content
The Snowflake integration brings your warehouse into client work. Ask how Contoso’s weekly unit sales moved by store cluster since the October price change, check a figure in a draft against the source tables, or profile a table before analysis, and Hebno writes and runs a read-only SQL query in Snowflake, shows the query, and cites the tables it used. Hebno never writes to Snowflake.

​
At a glance

​
Before you start

You need:
  • An owner or admin role in Hebno.
  • Your Snowflake account identifier, for example northwind-analytics, in the orgname-accountname form shown under Admin → Accounts in Snowsight.
  • A Snowflake administrator with the SECURITYADMIN and SYSADMIN roles, or equivalent, to create the user, role and grants below.
Create a dedicated role, warehouse and service user. Hebno authenticates with key-pair authentication, so the user has no password.
Repeat the database and schema grants for each schema Hebno may read. Grant only USAGE and SELECT. Hebno runs statements through the Snowflake SQL API and accepts only SELECT, SHOW and DESCRIBE, and the role has no rights to change data.
If your account uses network policies, add the Hebno IP addresses shown on the Snowflake card to the policy for the service user. Row access and masking policies apply to HEBNO_READER as they do to any role.

​
Connect Snowflake

1

Allow the integration

Open Admin → Connectors → Catalogue, find Snowflake under Data and analytics, and set it to Allow.
2

Connect the organisation

Select Connect, enter the account identifier, user, role and warehouse, and copy the public key Hebno generates into RSA_PUBLIC_KEY for the service user. Select Test connection. Hebno connects and lists the databases and schemas the role can read.
3

Choose teams and data areas

Under Who can use it, choose All teams or pick teams. Under Data areas, choose the databases and schemas each team can query. See Data areas.
4

Confirm access

Access is Read only. Snowflake has no write actions in Hebno.
The card shows Connected with the account identifier. Members in the selected teams can use Snowflake in chat straight away. Members can link their own Snowflake account so queries run with their own default role, grants and row access policies.
  1. In Hebno, open Settings → Connections, find Snowflake and select Link your account.
  2. Sign in to Snowflake and select Allow.
Linking uses Snowflake OAuth. A Snowflake administrator creates a security integration once with TYPE = OAUTH and OAUTH_CLIENT = CUSTOM, using the redirect URI shown on the Snowflake card in Admin → Connectors. Roles such as ACCOUNTADMIN and SECURITYADMIN are blocked from OAuth sessions by default.

​
Data areas

Data areas control what members of the allowed teams can query through the organisation connection. They apply on top of the grants on HEBNO_READER.
Admin connector panel showing who can use it, access and data areas

An organisation connection with team access and data areas. Financial figures default to owners and admins.

To let the Contoso team query only its own schema, open the Snowflake card in Admin → Connectors, select Databases and schemas, and give RETAIL.CONTOSO to that team only.
When a member has linked their own account, Hebno uses that member’s Snowflake role instead of the organisation connection. Data areas still apply, so a member never sees more through Hebno than both Snowflake and your Hebno settings allow.

​
What Hebno reads

Chat reply citing a Snowflake query result

A Snowflake query result attached to a chat.

Hebno reads column names, types and comments from INFORMATION_SCHEMA to write the query, runs it, and shows the SQL with the reply so you can rerun it in Snowsight. Results are capped at a row limit set on the card, and the reply says when a result was cut off. Hebno sets the query tag hebno on each query, so a Snowflake admin can find it in QUERY_HISTORY. Reads are live. Hebno runs each query in Snowflake when a request needs it and does not copy tables. Only what a reply used is stored with the conversation as its sources.

​
Hebno reads only

Hebno does not write to Snowflake. It does not run INSERT, UPDATE, DELETE, MERGE, CREATE or GRANT statements, load or unload data, or change warehouses. Linking marks which schemas, tables or views belong to an engagement, so you can ask “how did units move last week?” without naming the table.
  1. Open the project and select Brain.
  2. Under Linked records, select Link record, then Snowflake.
  3. Search by database, schema or table name and select it. Repeat for each one the engagement uses.
In chats tagged to the project, Hebno starts with the linked schemas and tables when it writes a query. See Linked records.

​
Use Snowflake in chat

  • Attach: open the + menu, choose Sources → Snowflake, and pick a schema, a table or a view. Or type / and choose Snowflake.
  • Ask: name the metric, table or period in your request. For example:
    Show weekly Contoso units and average selling price by store cluster since 1 September, from RETAIL.CONTOSO.
    Check the 4.2% margin figure in the draft readout against the store sales tables and show the query.
    Profile STORE_SALES_WEEKLY: row count, date range, null rates and distinct stores.
  • Research runs show a Querying Snowflake step, with the SQL and a chip for each table it read.
  • Agents can query Snowflake on a schedule, for example a Monday table of last week’s units by cluster. Writes an agent proposes elsewhere appear in agent approvals for review.

​
Troubleshooting