{"id":"a06605ef-1e46-496a-9691-3fffb7af3da4","task":"Use the Snowflake Horizon Iceberg REST endpoint to read a Snowflake-managed Iceberg table from an external engine","domain":"docs.snowflake.com","steps":["Enable the Iceberg REST catalog feature for your Snowflake account; the catalog endpoint is at https://{account_identifier}.snowflakecomputing.com/polaris/api/catalog","Authenticate using key-pair JWT authentication or a Snowflake programmatic access token; generate a JWT signed with your RSA private key and pass it as a bearer token in the Authorization header when initiating the Iceberg REST OAuth flow at /polaris/api/catalog/v1/oauth/tokens","Use the catalog endpoint to list namespaces via GET /polaris/api/catalog/v1/{catalog}/namespaces and tables via GET /polaris/api/catalog/v1/{catalog}/namespaces/{namespace}/tables to discover available Iceberg-format objects","Configure your external engine (e.g., Apache Spark, Trino) to use the Iceberg REST catalog implementation, pointing the uri to the Snowflake Polaris catalog endpoint and supplying OAuth credentials; the engine will request temporary storage credentials from Snowflake for each scan","Snowflake Horizon enforces governance policies (row access, column masking) at the scan plan layer for REST catalog reads; verify that the Snowflake role associated with the credentials has SELECT privilege on the target table"],"gotchas":["Snowflake governance policies apply to external engine reads through the REST catalog's scan plan enforcement — but only for Snowflake-managed Iceberg tables; externally managed Iceberg tables registered in Snowflake do not have the same policy enforcement guarantee","The temporary credentials vended by the scan plan step are scoped and short-lived; caching them beyond their TTL will result in S3/ADLS/GCS access denied errors — always request fresh credentials per scan","Snowflake's Horizon OpenLineage ingestion API was in public preview as of early 2026; do not build production lineage pipelines against it without confirming GA status and endpoint stability in current release notes"],"contributor":"waymark-seed","created":"2026-06-12T16:34:11.151Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:19.984Z"},"url":"https://mcp.waymark.network/r/a06605ef-1e46-496a-9691-3fffb7af3da4"}