COF-C03 Question 248
Single answerAPI integrationA data engineering team wants Snowflake to enrich incoming customer records during SQL execution by calling an external REST service that returns a risk score. The service is hosted outside Snowflake and must be invoked securely without embedding secrets in user-defined code. The team also wants administrators to control which external endpoint can be called. Which Snowflake approach best meets these requirements?
- A
Create an external function that uses an API integration, and configure the allowed endpoint through that integration
- B
Create a JavaScript UDF that uses embedded credentials to call the REST endpoint directly from Snowflake
- C
Create a secure view that references the REST endpoint URL and let Snowflake fetch the data when the view is queried
- D
Create a user-defined table function that opens outbound network access automatically because Snowflake functions can call any public API by default
Show answer and explanation
Correct answer: A
Explanation
The correct solution is to use an external function backed by an API integration. In Snowflake, external functions enable SQL statements to invoke code or services outside Snowflake, typically through a proxy/service layer such as API Gateway or equivalent cloud-native components. The API integration object provides centralized administrative control and secure configuration for that external access, helping avoid hardcoding secrets in user-defined logic and allowing governance over approved endpoints. This aligns with Snowflake best practices for secure external API invocation. By contrast, standard UDFs and views are not general-purpose mechanisms for making outbound REST calls. Relevant Snowflake documentation covers external functions and CREATE API INTEGRATION, including how API integrations are used to control and secure access to external API services.
- A. Correct.
Correct. External functions are designed to let Snowflake call external services during SQL execution. They are configured with an API integration, which provides secure administrative control over the external service configuration rather than placing secrets in application code. API integrations are used to define and govern connectivity to external API resources, including restricting allowed prefixes/endpoints depending on the cloud/provider setup. This is the Snowflake-native pattern for invoking an external REST-based service from SQL.
- B. Incorrect.
Incorrect. Standard JavaScript UDFs do not directly make arbitrary outbound HTTP calls to public REST endpoints. Embedding credentials in UDF code is also not a recommended or secure design. Snowflake provides external functions with API integrations specifically to handle external API invocation in a governed manner.
- C. Incorrect.
Incorrect. Secure views protect the exposure of underlying data and logic, but they do not provide a mechanism for Snowflake to call an external REST API during query execution. A view can only reference database objects and expressions available within Snowflake SQL semantics.
- D. Incorrect.
Incorrect. Snowflake functions do not automatically have unrestricted outbound network access to any public API. Calling external services requires supported mechanisms and explicit configuration. For API-style calls during SQL execution, the relevant feature is an external function with an API integration, not a generic table function with automatic internet access.