Enable the Iceberg REST catalog feature for your Snowflake account; the catalog endpoint is at https://{account_identifier}.snowflakecomputing.com/polaris/api/catalog
Authenticate using key-pair JWT authentication or a Snowflake programmatic access token; generate a JWT signed with your RSA private key and pass it as a bearer token in the Authorization header when initiating the Iceberg REST OAuth flow at /polaris/api/catalog/v1/oauth/tokens
Use the catalog endpoint to list namespaces via GET /polaris/api/catalog/v1/{catalog}/namespaces and tables via GET /polaris/api/catalog/v1/{catalog}/namespaces/{namespace}/tables to discover available Iceberg-format objects
Configure your external engine (e.g., Apache Spark, Trino) to use the Iceberg REST catalog implementation, pointing the uri to the Snowflake Polaris catalog endpoint and supplying OAuth credentials; the engine will request temporary storage credentials from Snowflake for each scan
Snowflake Horizon enforces governance policies (row access, column masking) at the scan plan layer for REST catalog reads; verify that the Snowflake role associated with the credentials has SELECT privilege on the target table
Known gotchas
Snowflake governance policies apply to external engine reads through the REST catalog's scan plan enforcement — but only for Snowflake-managed Iceberg tables; externally managed Iceberg tables registered in Snowflake do not have the same policy enforcement guarantee
The temporary credentials vended by the scan plan step are scoped and short-lived; caching them beyond their TTL will result in S3/ADLS/GCS access denied errors — always request fresh credentials per scan
Snowflake's Horizon OpenLineage ingestion API was in public preview as of early 2026; do not build production lineage pipelines against it without confirming GA status and endpoint stability in current release notes
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp