Snowflake Native App

The Paradime Bolt App is a Snowflake Native App on the Snowflake Marketplace. It reads your Bolt runs and schedules from the Paradime API on a schedule you set, and stores them in tables inside the app in your own Snowflake account. Bolt is Paradime’s scheduler and orchestrator.

What you can do

Monitor every Bolt run across the Paradime workspaces you choose: status, duration, who or what triggered it, and the git branch, commit and pull request.
Use the dashboard in the app for run activity over 14 days, schedule health over 30 days and recent failures. Each failure links to the run in Paradime.
Query runs and schedules with SQL, point a BI tool at them, or join them with your own Snowflake data.
Refresh on Snowflake serverless compute, every 30 minutes by default. The refresh doesn’t need a warehouse.

Prerequisites

A Paradime account API key (it starts with prdm_cmp_) with the Bolt schedules metadata viewer capability, and access to every workspace you want to monitor. Workspace API keys don’t work with the app. Step 1 below shows how to generate the key.
A Paradime account hosted in US East (N. Virginia), Europe (London) or Europe (Ireland). The app can’t reach accounts hosted in Europe (Frankfurt) at the moment.
The ACCOUNTADMIN role in Snowflake for installation and setup. Setup creates an external access integration and grants account-level task privileges to the app, and ACCOUNTADMIN can do both by default.

Set up the app

Step 1: Generate an account API key in Paradime

Go to Settings and select API Keys in the left panel.
Click Generate API Key.
Grant the Bolt schedules metadata viewer capability. The app only reads metadata, so it needs nothing more.
Select every workspace you want to monitor.
Copy the API key and the API endpoint shown with it. You can’t see the key again after you leave this screen.

Only users with the Admin role can generate account API keys, and only for workspaces where they are an Admin. The Workspace Admin role isn’t enough. See API Keys.

Step 2: Install the app from the Snowflake Marketplace

Open the Paradime Bolt App listing and click Get. If Paradime sent you an offer link, open that link and accept the offer instead.
Follow Snowflake’s steps to install the app.

You choose the name of the app when you install it. This page calls it <app_name>.

Step 3: Connect the app to Paradime

Open the app in Snowsight. The first time you open it, it takes you through four steps: Connect, Authorize, Pipeline and First sync. Connecting has two parts, in two different places:

Where	What you enter
The app’s form	Your region, company token or API endpoint, and API key. The app turns them into one JSON value. Nothing is saved yet.
Snowflake’s dialog	That JSON value, pasted into the secret’s value field. Snowflake saves it as a secret in your account, and the app reads it on every refresh.

In the app’s form, choose your Paradime hosting region, then fill in Company token or full endpoint URL and Account API key. Paste the full API endpoint from step 1 into the endpoint field. It already includes the right host, so the region choice doesn’t matter.

The app shows a JSON value like this one. Copy it with the copy icon.

{"api_endpoint": "https://api.us.paradime.io/api/v1/<company_token>/graphql", "api_key": "prdm_cmp_..."}

Click Grant network access + credentials. Snowflake opens its own dialog to create a network rule, a secret and an external access integration in your account.
In Snowflake’s dialog, paste the JSON value from the app into the secret’s value field and finish the dialog.

Paste the whole JSON value, including the braces, not only the API key. If the secret holds anything else, Test connection fails with The Paradime credentials secret must be JSON like {"api_endpoint": "...", "api_key": "..."}. To fix the secret, see Troubleshooting.

When both grants are done, the app marks Network access to the Paradime API and Credentials secret as complete. If only network access is granted, click Grant credentials secret. The secret value has two fields:

Field	Required	Description
`api_endpoint`	Yes	Your Paradime API endpoint, in the form `https://<api_host>/api/v1/<company_token>/graphql`.
`api_key`	Yes	Your account API key. It starts with `prdm_cmp_`.

The API host depends on where your Paradime account is hosted:

Paradime region	Region in the app	API host
US East, N. Virginia (`us-east-1`)	US	`api.us.paradime.io`
Europe, London (`eu-west-2`)	EU (London)	`api.paradime.io`
Europe, Ireland (`eu-west-1`)	Ireland	`eu-w1-api.paradime.io`

Step 4: Allow scheduled refreshes

Click Grant task privileges. This grants the app EXECUTE TASK and EXECUTE MANAGED TASK, so the refresh runs on Snowflake serverless compute without a warehouse.

Step 5: Create the pipeline

Click Create pipeline. This creates the procedure that calls the Paradime API and the task that runs it. The task starts paused.

Step 6: Test the connection and run the first sync

Click Test connection. When it works, the app shows the API host it reached and how many workspaces and schedules your API key can see.
Click Sync now. The first sync finds your workspaces and starts monitoring the ones your API key can read.

Step 7: Choose workspaces and turn on the schedule

In the Setup tab:

In Workspaces, select Monitor for each workspace you want, then click Save workspace selection. The API key access column shows whether your API key can read each workspace.
In Refresh schedule, set Refresh every (minutes) to a value from 5 to 1440 and click Apply interval. The default is 30.
Click Enable to start the scheduled refresh. Click Pause to stop it.

Use the app

The app has three tabs:

Dashboard: run activity over the last 14 days, schedule health over the last 30 days, and recent failures with a View in Paradime link to each one.
Runs: the latest 1,000 synced runs, which you can filter by workspace, state and schedule name. Each run links to Paradime.
Setup: the Paradime connection, the pipeline, workspace selection, the refresh schedule and the sync history.

Query the data

The app’s tables and views are standard Snowflake objects, so you can query them with SQL or connect a BI tool to them.

Object	What it holds
`core.v_bolt_runs`	One row per run, with the workspace name.
`core.v_schedule_health`	One row per schedule: runs, successes and failures in the last 30 days, success rate, average duration of successful runs, and the last run.
`data.bolt_runs`	The runs as synced from Paradime.
`data.bolt_schedules`	Your schedules: name, cron schedule, owner, source, whether it’s suspended, and the last and next run.
`data.sync_history`	One row for each sync, with its status.

For example, to see the schedules with the lowest success rate first:

SELECT workspace_name, schedule_name, runs_30d, success_rate_30d,
       failures_30d, avg_success_duration_s, last_run_state, last_run_at
FROM <app_name>.core.v_schedule_health
ORDER BY success_rate_30d ASC NULLS LAST;

Roles and access

The app has two application roles. The role that installed the app holds both.

Application role	Lets you
`app_public`	Open the app and query its tables and views.
`app_admin`	Everything `app_public` can do, plus run the app’s setup and sync procedures with SQL.

To give other Snowflake roles access:

GRANT APPLICATION ROLE <app_name>.app_public TO ROLE analysts;
GRANT APPLICATION ROLE <app_name>.app_admin TO ROLE data_platform_admins;

Everyone who can open the app sees the Setup tab and can use it, whichever application role they hold.

What the app stores

The app stores Bolt run and schedule metadata only: schedule names, cron schedules and owners, run ids and states, start and end times, durations, who triggered each run, and the git branch, commit and pull request. It doesn’t store dbt™ logs or any data from your warehouse. Your API key stays in the Snowflake secret in your account. The app only calls the API endpoint in your secret, over HTTPS. Its network rule allows only the three Paradime API hosts listed in step 3.

Troubleshooting

`The Paradime credentials secret must be JSON like {"api_endpoint": "...", "api_key": "..."}`

This message appears at the end of a longer Connection test failed error with a Python traceback. The Snowflake secret the app reads doesn’t hold the JSON value from step 3. Usually only the API key was pasted into Snowflake’s dialog, or the field was left empty. You don’t need to reinstall the app or grant access again. Update the secret instead:

Find the secret the app uses:
SHOW REFERENCES IN APPLICATION <app_name>;
In the row for PARADIME_API_CREDENTIALS, the database_name, schema_name and object_name columns give the secret’s full name.

Set the secret’s value to the JSON value. Use the role that owns the secret, usually the role that granted access during setup, such as ACCOUNTADMIN:

ALTER SECRET <database_name>.<schema_name>.<object_name>
  SET SECRET_STRING = '{"api_endpoint": "https://api.us.paradime.io/api/v1/<company_token>/graphql", "api_key": "prdm_cmp_..."}';

In the app, open Setup and click Test connection.

`Credentials secret is missing api_endpoint` or `Credentials secret is missing api_key`

The secret holds JSON, but one of the two fields is missing or empty. Set the full value as described in the first entry above.

`api_key must be an account-level Paradime API key (prdm_cmp_...); legacy workspace keys are not supported`

The secret holds a workspace API key. Generate an account API key as in step 1, then update the secret as described in the first entry above.

`api_endpoint must be a paradime.io URL`

The api_endpoint field isn’t a Paradime API URL. Use the API endpoint shown with your API key, then update the secret as described in the first entry above.

`No workspaces with Bolt schedules are visible to this API key`

The app finds workspaces through their Bolt schedules, so it only lists workspaces that have at least one schedule and that your API key can access. Check which workspaces the key has, or add workspace UIDs in Setup > Workspaces > Add workspace UIDs manually.

`Disabled N workspace(s) this API key cannot access`

A sync turned off workspaces your API key can’t read. To monitor them:

Generate an account API key that includes those workspaces, and update the secret with it as described in the first entry above.
In Setup, click Discover workspaces to check access again.
Select Monitor for the workspaces and click Save workspace selection.

`No workspaces are enabled or visible to this API key`

No workspace is selected for monitoring, or your API key can’t see any workspace. In Setup > Workspaces, select Monitor for at least one workspace and click Save workspace selection. If the list is empty, check which workspaces your API key includes. If your account has an event table, the app writes its logs there. To let Paradime support see them, set up an event table and turn on event sharing. Snowflake’s guide covers both: Enable logging and event sharing for an app. The SQL to turn on sharing is:

ALTER APPLICATION <app_name> SET SHARE_EVENTS_WITH_PROVIDER = TRUE;

FAQ

How do I change the API key the app uses?

In the app, open Setup and expand Change credentials or re-grant access.
Enter your region, endpoint and new API key, and copy the JSON value the app builds.
Update the secret with that value using ALTER SECRET, as described in Troubleshooting.
Click Test connection.

How much run history does the app load?

Each sync loads the 50 most recent runs of each schedule, for up to 500 schedules per workspace, and adds them to the runs already stored. The app keeps every run it loads, so your history grows from the day you install it. It doesn’t load runs older than that.

Does the app read data from my warehouse?

No. The app only stores the Bolt metadata it reads from the Paradime API. See What the app stores.

Does the refresh need a warehouse?

No. The refresh task runs on Snowflake serverless compute. Queries you run on the app’s tables and views use your own warehouse, as with any other query.

​What you can do

​Prerequisites

​Set up the app

​Step 1: Generate an account API key in Paradime

​Step 2: Install the app from the Snowflake Marketplace

​Step 3: Connect the app to Paradime

​Step 4: Allow scheduled refreshes

​Step 5: Create the pipeline

​Step 6: Test the connection and run the first sync

​Step 7: Choose workspaces and turn on the schedule

​Use the app

​Query the data

​Roles and access

​What the app stores

​Troubleshooting

​The Paradime credentials secret must be JSON like {"api_endpoint": "...", "api_key": "..."}

​Credentials secret is missing api_endpoint or Credentials secret is missing api_key

​api_key must be an account-level Paradime API key (prdm_cmp_...); legacy workspace keys are not supported

​api_endpoint must be a paradime.io URL

​No workspaces with Bolt schedules are visible to this API key

​Disabled N workspace(s) this API key cannot access

​No workspaces are enabled or visible to this API key

​Share the app’s logs with Paradime support

​FAQ

What you can do

Prerequisites

Set up the app

Step 1: Generate an account API key in Paradime

Step 2: Install the app from the Snowflake Marketplace

Step 3: Connect the app to Paradime

Step 4: Allow scheduled refreshes

Step 5: Create the pipeline

Step 6: Test the connection and run the first sync

Step 7: Choose workspaces and turn on the schedule

Use the app

Query the data

Roles and access

What the app stores

Troubleshooting

`The Paradime credentials secret must be JSON like {"api_endpoint": "...", "api_key": "..."}`

`Credentials secret is missing api_endpoint` or `Credentials secret is missing api_key`

`api_key must be an account-level Paradime API key (prdm_cmp_...); legacy workspace keys are not supported`

`api_endpoint must be a paradime.io URL`

`No workspaces with Bolt schedules are visible to this API key`

`Disabled N workspace(s) this API key cannot access`

`No workspaces are enabled or visible to this API key`

Share the app’s logs with Paradime support

FAQ