Inter-app Communication¶

Inter-app Communication: Overview¶

Inter-app communication (IAC) allows a Snowflake Native App to provide additional functionality to other Snowflake Native Apps in the same consumer account by providing access to functions and procedures that other apps can call.

For example, a Snowflake Native App that resolves customer IDs can help other Snowflake Native Apps enhance customer data by joining data sets from different vendors.

IAC provides the infrastructure for two or more independent apps to communicate with each other while respecting their needs for management and security. App developers enable IAC for their app by doing the following:

• Creating interfaces

• Using app roles to control access to the interfaces.

• Choosing synchronous or asynchronous interaction. Synchronous interaction uses stored procedures or functions that other apps can call directly, while asynchronous interaction provides access to request results that are stored in tables or views, which other apps can poll to check for results.

Terminology¶

IAC uses the following terms:

Client

The app that initiates the connection request and calls the server app’s functions and procedures.

Server

The app that provides access to its functions and procedures using app roles.

Consumer

The user who installs the client and server apps.

Application configuration

A SQL object that the client app uses to request the name of the server app. IAC uses an application configuration of type APPLICATION_NAME to store the server app name.

Application specification

A SQL object that the client app creates to request a connection to the server app. IAC uses an application specification of type CONNECTION. For information about app specifications, see Overview of app specifications.

Workflow for Inter-app communication¶

Establishing and using a connection involves a handshake process between the client app and the server app.

1. Obtain app role names from the server app provider: The client app provider coordinates with the server app provider outside of Snowflake to determine which server app roles to request in the connection specification.

2. Identify the target app: The client app creates a configuration definition object to request the name of the server app. The consumer detects incoming requests, and provides the server app name to the client app through the configuration object.

3. Request and approve a connection: The client app creates an application specification to request a connection to the server app, and the consumer approves the connection request.

4. Communicate with the Server App: The client app calls the server app’s procedures or functions.

ALTER APPLICATION
  SET CONFIGURATION DEFINITION my_server_app_name_configuration
    TYPE = APPLICATION_NAME
    LABEL = 'Server App'
    DESCRIPTION = 'Request for an app that will provide access to server procedures and functions. The server app version must be greater than or equal to 3.2.'
    APPLICATION_ROLES = (my_server_app_role);

SHOW CONFIGURATIONS IN APPLICATION my_server_app_name;

name                             | created_on              | updated_on              | type               | ...
my_server_app_name_configuration | 2026-02-09 10:00:00.000 | 2026-02-09 10:00:00.000 | APPLICATION_NAME   | ...

ALTER APPLICATION my_client_app_name
  SET CONFIGURATION my_server_app_name_configuration
  VALUE = MY_SERVER_APP_NAME;

ALTER APPLICATION SET SPECIFICATION my_server_app_name_connection_specification
  TYPE = CONNECTION
  LABEL = 'Server App'
  DESCRIPTION = 'Request for an app that will provide access to server procedures and functions. The server app version must be greater than or equal to 3.2.'
  SERVER_APPLICATION = MY_SERVER_APP_NAME -- server name obtained from Step 1
  SERVER_APPLICATION_ROLES = (my_server_app_role);

ALTER APPLICATION my_server_app_name
  APPROVE SPECIFICATION my_server_app_name_connection_specification
  SEQUENCE_NUMBER = 1;

SHOW APPROVED SPECIFICATIONS ->>
  SELECT PARSE_JSON("definition"):"SERVER_APPLICATION"::STRING
  FROM $1
  WHERE "name" = 'MY_SERVER_APP_NAME_CONNECTION_SPECIFICATION';

session.call("server_app_name.customer_schema.get_customer_data", customer_id);

session.call("server_app_name.customer_schema.request_customer_data_async", customer_id);

session.call("server_app_name.customer_schema.check_customer_data_requests_async", customer_id);

Managing connections¶

To view existing connections in Snowsight, do the following:

1. Sign in to Snowsight.

2. In the navigation menu, select Catalog » Apps.

3. Select the app. All app connections are shown in a section titled Configurations. Below that section, there is a sub-section titled Application connections.

4. To modify a connection, click the pencil icon for the connection. You can change the following:

   • Which app is connected to the app

   • The approval status of the connection

5. To view the connected app, click the View app button.

6. To change security settings for the connection, click the gear icon.

Security considerations¶

When approving a specification request, consumers should be aware that granting server app access to a client app can elevate the privileges the client app has. For example, if a server app has external access, the client app might gain indirect access to the Internet or other external resources through the server app. If the server app is a client app of another server app, the client app may be able to access the resources of the other server app through the first server app.

Consumers should inspect the capabilities and privileges of the server app before approving a connection. Use an admin role (for example, ACCOUNTADMIN) to inspect the capabilities of the server. Inspecting the server with a lower privileged role won’t reveal all of the server’s capabilities and privileges. Consumers should note that the server app code is not visible to the consumer, and the server app permissions and capabilities can be changed after the consumer approves the connection.

Example SQL commands to inspect the capabilities and privileges of the server app include, but are not limited to the following:

• SHOW GRANTS TO APPLICATION: This command lists what grants on the client app have been granted to the server app.

• SHOW PRIVILEGES IN APPLICATION: This command lists what potential account-level privileges could be granted to the client app.

• SHOW REFERENCES IN APPLICATION: This command lists references that the client app could potentially use without using grants.

• SHOW SPECIFICATIONS IN APPLICATION: This command lists the application specifications that the consumer has approved, including external access integrations (EAIs), security integrations, shares, listings, and connections.

SQL Reference¶

The following SQL commands are used to manage inter-app communication.

• ALTER APPLICATION SET SPECIFICATION: Creates an app specification that the server app uses to grant access to its functions and procedures to the client app.

• ALTER APPLICATION DROP SPECIFICATION: Deletes an app specification.

• ALTER APPLICATION … { APPROVE | DECLINE} SPECIFICATION: Approves or refuses an app specification request.

• SHOW SPECIFICATIONS: Lists all of the application specifications in an app.

• DESCRIBE SPECIFICATION: Describes the app specifications for an app.

• ALTER APPLICATION SET CONFIGURATION DEFINITION: Creates or updates an application configuration (a key-value pair) that requests the name of another application from the consumer.

• ALTER APPLICATION DROP CONFIGURATION DEFINITION: Deletes an application configuration.

• ALTER APPLICATION SET CONFIGURATION VALUE: Sets a value in an application configuration.

• ALTER APPLICATION UNSET CONFIGURATION: Unsets the value to the specified application configuration.

• SHOW CONFIGURATIONS: Lists all of the application configurations in an app.

• DESCRIBE CONFIGURATION: Describes the details of an application configuration.

• IS_CONFIGURATION_SET (SYS_CONTEXT function): Returns whether or not the configuration has a value set.

• GET_CONFIGURATION_VALUE (SYS_CONTEXT function): Returns the current value of the configuration.

• SHOW GRANTS TO APPLICATION: Lists all the privileges and database/application roles granted to the specified app.

• SHOW GRANTS TO APPLICATION ROLE: Lists all the permissions that the application role has.

• SHOW GRANTS OF APPLICATION ROLE: Lists all the roles and applications to whom the specified application role is granted.

Callbacks¶

The Snowflake Native App Framework provides lifecycle callbacks to help manage the inter-app communication workflow. These callbacks let an app react to changes in configurations, connections, and specifications. To use callbacks, register them in the lifecycle_callbacks section of the app’s manifest file.

For general information about callbacks, see Callbacks.

Examples¶

The following examples show how to configure an app to use inter-app communication.

• Example: Setup script and manifest files

• Example: Asynchronous communication between apps

CREATE OR ALTER VERSIONED SCHEMA app_schema;

-- create a callback that creates the connection request before the config value of the server name is saved
CREATE OR REPLACE PROCEDURE app_schema.before_config_change_callback(config_name STRING, config_value STRING)
RETURNS STRING
LANGUAGE SQL
AS
$$
DECLARE
    spec_name VARCHAR;
    existing_target VARCHAR;
BEGIN
    IF (config_value IS NOT NULL AND config_name = 'MY_SERVER_APP_NAME_CONFIGURATION') THEN
        SHOW SPECIFICATIONS;
        SELECT PARSE_JSON("definition"):SERVER_APPLICATION::STRING
            INTO existing_target
            FROM TABLE(RESULT_SCAN(LAST_QUERY_ID()));

        IF(existing_target IS NOT NULL AND UPPER(existing_target) != UPPER(config_value)) THEN
            EXECUTE IMMEDIATE 'ALTER APPLICATION DROP SPECIFICATION CONNECTION_' || UPPER(existing_target);
        END IF;

        spec_name := 'CONNECTION_' || UPPER(config_value);
        EXECUTE IMMEDIATE
        'ALTER APPLICATION SET SPECIFICATION ' || spec_name || '
            TYPE = CONNECTION
            LABEL = ''Server App''
            DESCRIPTION = ''Request for an app that will provide access to server procedures and functions. The server app version must be greater than or equal to 3.2.''
            SERVER_APPLICATION = ' || config_value || '
            SERVER_APPLICATION_ROLES = (my_server_app_role)';
    END IF;
RETURN 'success';
END;
$$;

CREATE APPLICATION ROLE IF NOT EXISTS client_app_user;
GRANT USAGE ON SCHEMA app_schema TO APPLICATION ROLE client_app_user;
ALTER APPLICATION SET CONFIGURATION DEFINITION my_server_app_name_configuration
    TYPE = APPLICATION_NAME
    LABEL = 'Server App'
    DESCRIPTION = 'Request for an application that will provide access to server procedures and functions. The server app version must be greater than or equal to 3.2'
    APPLICATION_ROLES = (client_app_user);

manifest_version: 2

artifacts:
  setup_script: setup.sql

lifecycle_callbacks:
    before_configuration_change: app_schema.before_config_change_callback

CREATE TABLE IF NOT EXISTS app_schema.processing_queue (
  request_id NUMBER AUTOINCREMENT,
  operation STRING,
  input STRING,
  status STRING DEFAULT 'PENDING',
  response STRING DEFAULT ''
);

CREATE OR REPLACE PROCEDURE app_schema.submit_request(operation STRING, input STRING)
RETURNS STRING
LANGUAGE SQL
EXECUTE AS OWNER
AS
$$
BEGIN
    INSERT INTO app_schema.processing_queue (operation, input) VALUES (:operation, :input);
    RETURN 'Request submitted successfully';
END;
$$;

CREATE OR REPLACE PROCEDURE app_schema.process_requests()
RETURNS STRING
LANGUAGE SQL
EXECUTE AS OWNER
AS
$$
DECLARE
    -- Cursor to find all PENDING requests
    c1 CURSOR FOR SELECT * FROM app_schema.processing_queue WHERE status = 'PENDING';
    result STRING;
BEGIN
    FOR request IN c1 DO

        IF (request.operation = 'OPERATION_X') THEN
            -- assuming there is a UDF func_x(input) to perform operation_x
            result := (SELECT func_x(:request.input));
        END IF;

        -- update the processing queue with the result
        LET stmt STRING :=
            'UPDATE app_schema.processing_queue SET status = 'DONE', response = ' ||
            result ||
            ' WHERE request_id = ' ||
            request.request_id;
        EXECUTE IMMEDIATE (:stmt);

    END FOR;

    RETURN 'Processed pending requests.';
END;
$$;

CREATE OR REPLACE PROCEDURE app_schema.fetch_response(operation STRING, input STRING)
RETURNS STRING
LANGUAGE SQL
EXECUTE AS OWNER
AS
$$
BEGIN
    LET res STRING := (SELECT response FROM app_schema.processing_queue WHERE operation = :operation AND input = :input);
    RETURN res;
END;
$$;

CREATE APPLICATION ROLE IF NOT EXISTS my_server_app_role;
GRANT USAGE ON SCHEMA app_schema TO APPLICATION ROLE my_server_app_role;
GRANT USAGE ON PROCEDURE app_schema.submit_request(string, string) TO APPLICATION ROLE my_server_app_role;
GRANT USAGE ON PROCEDURE app_schema.process_requests() TO APPLICATION ROLE my_server_app_role;
GRANT USAGE ON PROCEDURE app_schema.fetch_response(string, string) TO APPLICATION ROLE my_server_app_role;