CREDENTIAL_ID |
NUMBER |
Internal/system-generated identifier for the credential. |
NAME |
VARCHAR |
Name of the credential. |
USER_NAME |
VARCHAR |
Name of the user associated with the credential. |
TYPE |
VARCHAR |
Type of the credential. These types include:
|
DOMAIN |
VARCHAR |
Domain of the credential. The domains include:
A given domain can have one or more possible types (specified in the TYPE column).
|
COMMENT |
VARCHAR |
Comment about the credential. |
STATUS |
VARCHAR |
Status of the credential. The status depends on the value in the TYPE column:
For TYPE = 'PAT' (programmatic access tokens), the status can be one
of the following:
ACTIVE: The programmatic access token can be used to authenticate and has not expired yet.
EXPIRED: The programmatic access token cannot be used to authenticate because the expiration date has passed.
DISABLED: The programmatic access token is disabled because user login access is disabled or
the user is locked out of logging in.
For other types of credentials, the status can be one of the following:
PENDING: The user started the enrollment process for an MFA method but has not completed the process. For example,
the user started registering an authenticator but never finished the setup process for the authenticator. As a result,
the MFA method is not considered to be valid yet.
ENROLLED: The user has completed the enrollment process for the MFA method, and the MFA method can be used for
second-factor authentication.
|
ADDITIONAL_DETAILS |
OBJECT |
Additional details about the credential. The additional details depend on the type of the credential (the value in the
TYPE column):
For TYPE = 'PAT' (programmatic access tokens), the column contains
an OBJECT value with the following key-value pairs:
For the MINS_TO_BYPASS_NETWORK_POLICY_REQUIREMENT key, the value is an integer representing the number of minutes
during which the requirement of having a network policy is bypassed. You can
specify this value when generating the token. For the ROLE_RESTRICTION key, the value is an array of the roles that are used for privilege evaluation and
object creation during the session authenticated with this token. You can specify these roles when
generating the token. For the ROTATED_TO key, the value is the name of the newer token that this token was replaced by during
rotation.
These key-value pairs are present only if the corresponding properties are set in the token. For example:
{
"MINS_TO_BYPASS_NETWORK_POLICY_REQUIREMENT":
60,
"ROLE_RESTRICTION": [
"MY_ROLE"
],
"ROTATED_TO": "MY_PAT_NAME"
}
If none of these are specified for the token, the column contains an empty object ({}).
For TYPE = 'PASSKEY' (passkey), the column contains
an OBJECT value with the key-value pair aaguid. For example:
{
"aaguid": "a12345678-..."
}
For TYPE = 'TOTP' (time-based one-time passcode), the column contains NULL. For TYPE = 'AWS' (workload identity federation), the column contains
an OBJECT value with the following key-value pairs:
For the aws_partition key, the value is the AWS partition for the federated identity. For the aws_account key, the value is the AWS account identifier for the federated identity. For the type key, the value is the type of the federated identity. This can be IAM_USER or IAM_ROLE. For the iam_role key, the value is the name of the federated IAM role or user.
For TYPE = 'AZURE' (workload identity federation), the column contains
an OBJECT value with the following key-value pairs:
For the issuer key, the value is the Entra ID tenant’s Authority URL. For the subject key, the value is the Object ID (Principal ID) assigned to the Azure workload that is using a
managed identity.
For TYPE = 'GCP' (workload identity federation), the column contains
an OBJECT value with the following key-value pairs:
For TYPE = 'OIDC' (workload identity federation), the column contains
an OBJECT value with the following key-value pairs:
For the issuer key, the value is the issuer URL of the OpenID Connect (OIDC) provider. For the subject key, the value is the identifier of the federated workload. For the audience_list key, the value is the custom audiences that are allowed in an OIDC ID token. An empty value means
the default audience snowflakecomputing.cn is required.
|
CREATED_BY |
VARCHAR |
Name of the user who created the credential. |
LAST_ALTERED_BY |
VARCHAR |
Name of the user who last modified the credential. |
CREATED_ON |
TIMESTAMP_LTZ |
Date and time when the credential was created. |
LAST_USED_ON |
TIMESTAMP_LTZ |
Date and time when the credential was last used for authentication. |
LAST_ALTERED |
TIMESTAMP_LTZ |
Date and time when the credential was last modified. |
EXPIRATION_DATE |
TIMESTAMP_LTZ |
Date and time when the credential expires. |