Skip to main content

Clean Room

View as Markdown

CleanRoom object

namestring

The name of the clean room. It should follow UC securable naming requirements.

Example: test-clean-room1

remote_detailed_infoobject

Central clean room details. During creation, users need to specify cloud_vendor, region, and collaborators.global_metastore_id. This field will not be filled in the ListCleanRooms call.

Show child attributesHide child attributes
central_clean_room_idstring

Central clean room ID.

Example: b5c8d856-ff41-4c5f-8ccd-2b13b44fec27

cloud_vendorstring

Cloud vendor (aws,azure,gcp) of the central clean room.

Example: aws

regionstring

Region of the central clean room.

Example: us-west-2

collaboratorsarray of object

Collaborators in the central clean room. There should one and only one collaborator in the list that satisfies the owner condition:

  1. It has the creator's global_metastore_id (determined by caller of CreateCleanRoom).

  2. Its invite_recipient_email is empty.

Show child attributesHide child attributes
global_metastore_idstring

The global Unity Catalog metastore ID of the collaborator. The identifier is of format cloud:region:metastore-uuid.

Example: aws:us-west-2:aff56c64-a34e-4c1f-a24c-c2dd2889517a

organization_namestring

Organization name configured in the metastore

Example: acme corporation

invite_recipient_workspace_idint64

Workspace ID of the user who is receiving the clean room "invitation". Must be specified if invite_recipient_email is specified. It should be empty when the collaborator is the creator of the clean room.

Example: 6822898386300992

invite_recipient_emailstring

Email of the user who is receiving the clean room "invitation". It should be empty for the creator of the clean room, and non-empty for the invitees of the clean room. It is only returned in the output when clean room creator calls GET

Example: john.doe@databricks.com

collaborator_aliasstring

Collaborator alias specified by the clean room creator. It is unique across all collaborators of this clean room, and used to derive multiple values internally such as catalog alias and clean room name for single metastore clean rooms. It should follow UC securable naming requirements.

Example: creator

display_namestring

Generated display name for the collaborator. In the case of a single metastore clean room, it is the clean room name. For x-metastore clean rooms, it is the organization name of the metastore. It is not restricted to these values and could change in the future

Example: acme corporation

creatorobject

Collaborator who creates the clean room.

Show child attributesHide child attributes
global_metastore_idstring

The global Unity Catalog metastore ID of the collaborator. The identifier is of format cloud:region:metastore-uuid.

Example: aws:us-west-2:aff56c64-a34e-4c1f-a24c-c2dd2889517a

organization_namestring

Organization name configured in the metastore

Example: acme corporation

invite_recipient_workspace_idint64

Workspace ID of the user who is receiving the clean room "invitation". Must be specified if invite_recipient_email is specified. It should be empty when the collaborator is the creator of the clean room.

Example: 6822898386300992

invite_recipient_emailstring

Email of the user who is receiving the clean room "invitation". It should be empty for the creator of the clean room, and non-empty for the invitees of the clean room. It is only returned in the output when clean room creator calls GET

Example: john.doe@databricks.com

collaborator_aliasstring

Collaborator alias specified by the clean room creator. It is unique across all collaborators of this clean room, and used to derive multiple values internally such as catalog alias and clean room name for single metastore clean rooms. It should follow UC securable naming requirements.

Example: creator

display_namestring

Generated display name for the collaborator. In the case of a single metastore clean room, it is the clean room name. For x-metastore clean rooms, it is the organization name of the metastore. It is not restricted to these values and could change in the future

Example: acme corporation

egress_network_policyobject

Egress network policy to apply to the central clean room workspace.

Show child attributesHide child attributes
internet_accessobject

The access policy enforced for egress traffic to the internet.

Show child attributesHide child attributes
restriction_modestring

Values: RESTRICTION_MODE_UNSPECIFIED, FULL_ACCESS, PRIVATE_ACCESS_ONLY, RESTRICTED_ACCESS

allowed_internet_destinationsarray of object
allowed_storage_destinationsarray of object
log_only_modeobject

Optional. If not specified, assume the policy is enforced for all workloads.

compliance_security_profileobject
Show child attributesHide child attributes
is_enabledboolean

Whether the compliance security profile is enabled.

compliance_standardsarray of string

The list of compliance standards that the compliance security profile is configured to enforce.

Values: COMPLIANCE_STANDARD_UNSPECIFIED, NONE, HIPAA, PCI_DSS, FEDRAMP_MODERATE, IRAP_PROTECTED, FEDRAMP_HIGH, FEDRAMP_IL5, ITAR_EAR, CYBER_ESSENTIAL_PLUS, CANADA_PROTECTED_B, ISMAP, HITRUST, K_FSI, GERMANY_C5, GERMANY_TISAX, KSA_ECC_CCC_DCC

enable_shared_outputboolean

Whether to enable shared output for the central clean room. When enabled, clean room task runs can write to the run-scoped shared output schema which is accessible by all collaborators.

Example: false

package_provider_collaborator_aliasstring

Alias of the provider collaborator. If set, packaged clean rooms mode is enabled. The consumer's experience is restricted: they can view notebook names and READMEs, add their own data assets, and trigger runs, but cannot view notebook code, provider data assets, or notebook run output.

ownerstring

This is the <Databricks> username of the owner of the local clean room securable for permission management.

Example: alice@example.com

commentstring

Example: This is a clean room for demo

Constraints: <= 1000 characters

created_atint64

When the clean room was created, in epoch milliseconds.

Example: 1716424663321

updated_atint64

When the clean room was last updated, in epoch milliseconds.

Example: 1716424663321

statusstring

Clean room status.

Values: ENUM_UNSPECIFIED, ACTIVE, PROVISIONING, DELETED, FAILED

local_collaborator_aliasstring

The alias of the collaborator tied to the local clean room.

Example: creator

output_catalogobject

Output catalog of the clean room. It is an output only field. Output catalog is manipulated using the separate CreateCleanRoomOutputCatalog API.

Show child attributesHide child attributes
statusstring

Values: OUTPUT_CATALOG_STATUS_UNSPECIFIED, NOT_ELIGIBLE, NOT_CREATED, CREATED

catalog_namestring

The name of the output catalog in UC. It should follow UC securable naming requirements. The field will always exist if status is CREATED.

access_restrictedstring

Whether clean room access is restricted due to CSP

Values: NO_RESTRICTION, CSP_MISMATCH

enable_shared_outputboolean

Whether allow task to write to shared output schema. When enabled, clean room task runs triggered by the current collaborator can write to the run-scoped shared output schema which is accessible by all collaborators.

Example: false

Get

GET /api/2.0/clean-rooms/{name}

Get the details of a clean room given its name.

API scopes: cleanrooms

Parameters

namestringpath

Response

Returns the CleanRoom object.

List

GET /api/2.0/clean-rooms

Get a list of all clean rooms of the metastore. Only clean rooms the caller has access to are returned.

API scopes: cleanrooms

Parameters

page_sizeint32query

Maximum number of clean rooms to return (i.e., the page length). Defaults to 100.

page_tokenstringquery

Opaque pagination token to go to next page based on previous query.

Response

Returns a list of CleanRoom objects.

Create

POST /api/2.0/clean-rooms

Create a new clean room with the specified collaborators. This method is asynchronous; the returned name field inside the clean_room field can be used to poll the clean room status, using the cleanrooms/get method. When this method returns, the clean room will be in a PROVISIONING state, with only name, owner, comment, created_at and status populated. The clean room will be usable once it enters an ACTIVE state.

The caller must be a metastore admin or have the CREATE_CLEAN_ROOM privilege on the metastore.

API scopes: cleanrooms

Request body

clean_roomobject
Show child attributesHide child attributes
namestring

The name of the clean room. It should follow UC securable naming requirements.

Example: test-clean-room1

remote_detailed_infoobject

Central clean room details. During creation, users need to specify cloud_vendor, region, and collaborators.global_metastore_id. This field will not be filled in the ListCleanRooms call.

Show child attributesHide child attributes
central_clean_room_idstring

Central clean room ID.

Example: b5c8d856-ff41-4c5f-8ccd-2b13b44fec27

cloud_vendorstring

Cloud vendor (aws,azure,gcp) of the central clean room.

Example: aws

regionstring

Region of the central clean room.

Example: us-west-2

collaboratorsarray of object

Collaborators in the central clean room. There should one and only one collaborator in the list that satisfies the owner condition:

  1. It has the creator's global_metastore_id (determined by caller of CreateCleanRoom).

  2. Its invite_recipient_email is empty.

Show child attributesHide child attributes
global_metastore_idstring

The global Unity Catalog metastore ID of the collaborator. The identifier is of format cloud:region:metastore-uuid.

Example: aws:us-west-2:aff56c64-a34e-4c1f-a24c-c2dd2889517a

organization_namestring

Organization name configured in the metastore

Example: acme corporation

invite_recipient_workspace_idint64

Workspace ID of the user who is receiving the clean room "invitation". Must be specified if invite_recipient_email is specified. It should be empty when the collaborator is the creator of the clean room.

Example: 6822898386300992

invite_recipient_emailstring

Email of the user who is receiving the clean room "invitation". It should be empty for the creator of the clean room, and non-empty for the invitees of the clean room. It is only returned in the output when clean room creator calls GET

Example: john.doe@databricks.com

collaborator_aliasstring

Collaborator alias specified by the clean room creator. It is unique across all collaborators of this clean room, and used to derive multiple values internally such as catalog alias and clean room name for single metastore clean rooms. It should follow UC securable naming requirements.

Example: creator

display_namestring

Generated display name for the collaborator. In the case of a single metastore clean room, it is the clean room name. For x-metastore clean rooms, it is the organization name of the metastore. It is not restricted to these values and could change in the future

Example: acme corporation

creatorobject

Collaborator who creates the clean room.

Show child attributesHide child attributes
global_metastore_idstring

The global Unity Catalog metastore ID of the collaborator. The identifier is of format cloud:region:metastore-uuid.

Example: aws:us-west-2:aff56c64-a34e-4c1f-a24c-c2dd2889517a

organization_namestring

Organization name configured in the metastore

Example: acme corporation

invite_recipient_workspace_idint64

Workspace ID of the user who is receiving the clean room "invitation". Must be specified if invite_recipient_email is specified. It should be empty when the collaborator is the creator of the clean room.

Example: 6822898386300992

invite_recipient_emailstring

Email of the user who is receiving the clean room "invitation". It should be empty for the creator of the clean room, and non-empty for the invitees of the clean room. It is only returned in the output when clean room creator calls GET

Example: john.doe@databricks.com

collaborator_aliasstring

Collaborator alias specified by the clean room creator. It is unique across all collaborators of this clean room, and used to derive multiple values internally such as catalog alias and clean room name for single metastore clean rooms. It should follow UC securable naming requirements.

Example: creator

display_namestring

Generated display name for the collaborator. In the case of a single metastore clean room, it is the clean room name. For x-metastore clean rooms, it is the organization name of the metastore. It is not restricted to these values and could change in the future

Example: acme corporation

egress_network_policyobject

Egress network policy to apply to the central clean room workspace.

Show child attributesHide child attributes
internet_accessobject

The access policy enforced for egress traffic to the internet.

compliance_security_profileobject
Show child attributesHide child attributes
is_enabledboolean

Whether the compliance security profile is enabled.

compliance_standardsarray of string

The list of compliance standards that the compliance security profile is configured to enforce.

Values: COMPLIANCE_STANDARD_UNSPECIFIED, NONE, HIPAA, PCI_DSS, FEDRAMP_MODERATE, IRAP_PROTECTED, FEDRAMP_HIGH, FEDRAMP_IL5, ITAR_EAR, CYBER_ESSENTIAL_PLUS, CANADA_PROTECTED_B, ISMAP, HITRUST, K_FSI, GERMANY_C5, GERMANY_TISAX, KSA_ECC_CCC_DCC

enable_shared_outputboolean

Whether to enable shared output for the central clean room. When enabled, clean room task runs can write to the run-scoped shared output schema which is accessible by all collaborators.

Example: false

package_provider_collaborator_aliasstring

Alias of the provider collaborator. If set, packaged clean rooms mode is enabled. The consumer's experience is restricted: they can view notebook names and READMEs, add their own data assets, and trigger runs, but cannot view notebook code, provider data assets, or notebook run output.

ownerstring

This is the <Databricks> username of the owner of the local clean room securable for permission management.

Example: alice@example.com

commentstring

Example: This is a clean room for demo

Constraints: <= 1000 characters

created_atint64

When the clean room was created, in epoch milliseconds.

Example: 1716424663321

updated_atint64

When the clean room was last updated, in epoch milliseconds.

Example: 1716424663321

statusstring

Clean room status.

Values: ENUM_UNSPECIFIED, ACTIVE, PROVISIONING, DELETED, FAILED

local_collaborator_aliasstring

The alias of the collaborator tied to the local clean room.

Example: creator

output_catalogobject

Output catalog of the clean room. It is an output only field. Output catalog is manipulated using the separate CreateCleanRoomOutputCatalog API.

Show child attributesHide child attributes
statusstring

Values: OUTPUT_CATALOG_STATUS_UNSPECIFIED, NOT_ELIGIBLE, NOT_CREATED, CREATED

catalog_namestring

The name of the output catalog in UC. It should follow UC securable naming requirements. The field will always exist if status is CREATED.

access_restrictedstring

Whether clean room access is restricted due to CSP

Values: NO_RESTRICTION, CSP_MISMATCH

enable_shared_outputboolean

Whether allow task to write to shared output schema. When enabled, clean room task runs triggered by the current collaborator can write to the run-scoped shared output schema which is accessible by all collaborators.

Example: false

Response

Returns the CleanRoom object.

Update

PATCH /api/2.0/clean-rooms/{name}

Update a clean room. The caller must be the owner of the clean room, have MODIFY_CLEAN_ROOM privilege, or be metastore admin.

When the caller is a metastore admin, only the owner field can be updated.

API scopes: cleanrooms

Parameters

namestringpath

Name of the clean room.

Example: test-clean-room1

Request body

clean_roomobject
Show child attributesHide child attributes
namestring

The name of the clean room. It should follow UC securable naming requirements.

Example: test-clean-room1

remote_detailed_infoobject

Central clean room details. During creation, users need to specify cloud_vendor, region, and collaborators.global_metastore_id. This field will not be filled in the ListCleanRooms call.

Show child attributesHide child attributes
central_clean_room_idstring

Central clean room ID.

Example: b5c8d856-ff41-4c5f-8ccd-2b13b44fec27

cloud_vendorstring

Cloud vendor (aws,azure,gcp) of the central clean room.

Example: aws

regionstring

Region of the central clean room.

Example: us-west-2

collaboratorsarray of object

Collaborators in the central clean room. There should one and only one collaborator in the list that satisfies the owner condition:

  1. It has the creator's global_metastore_id (determined by caller of CreateCleanRoom).

  2. Its invite_recipient_email is empty.

Show child attributesHide child attributes
global_metastore_idstring

The global Unity Catalog metastore ID of the collaborator. The identifier is of format cloud:region:metastore-uuid.

Example: aws:us-west-2:aff56c64-a34e-4c1f-a24c-c2dd2889517a

organization_namestring

Organization name configured in the metastore

Example: acme corporation

invite_recipient_workspace_idint64

Workspace ID of the user who is receiving the clean room "invitation". Must be specified if invite_recipient_email is specified. It should be empty when the collaborator is the creator of the clean room.

Example: 6822898386300992

invite_recipient_emailstring

Email of the user who is receiving the clean room "invitation". It should be empty for the creator of the clean room, and non-empty for the invitees of the clean room. It is only returned in the output when clean room creator calls GET

Example: john.doe@databricks.com

collaborator_aliasstring

Collaborator alias specified by the clean room creator. It is unique across all collaborators of this clean room, and used to derive multiple values internally such as catalog alias and clean room name for single metastore clean rooms. It should follow UC securable naming requirements.

Example: creator

display_namestring

Generated display name for the collaborator. In the case of a single metastore clean room, it is the clean room name. For x-metastore clean rooms, it is the organization name of the metastore. It is not restricted to these values and could change in the future

Example: acme corporation

creatorobject

Collaborator who creates the clean room.

Show child attributesHide child attributes
global_metastore_idstring

The global Unity Catalog metastore ID of the collaborator. The identifier is of format cloud:region:metastore-uuid.

Example: aws:us-west-2:aff56c64-a34e-4c1f-a24c-c2dd2889517a

organization_namestring

Organization name configured in the metastore

Example: acme corporation

invite_recipient_workspace_idint64

Workspace ID of the user who is receiving the clean room "invitation". Must be specified if invite_recipient_email is specified. It should be empty when the collaborator is the creator of the clean room.

Example: 6822898386300992

invite_recipient_emailstring

Email of the user who is receiving the clean room "invitation". It should be empty for the creator of the clean room, and non-empty for the invitees of the clean room. It is only returned in the output when clean room creator calls GET

Example: john.doe@databricks.com

collaborator_aliasstring

Collaborator alias specified by the clean room creator. It is unique across all collaborators of this clean room, and used to derive multiple values internally such as catalog alias and clean room name for single metastore clean rooms. It should follow UC securable naming requirements.

Example: creator

display_namestring

Generated display name for the collaborator. In the case of a single metastore clean room, it is the clean room name. For x-metastore clean rooms, it is the organization name of the metastore. It is not restricted to these values and could change in the future

Example: acme corporation

egress_network_policyobject

Egress network policy to apply to the central clean room workspace.

Show child attributesHide child attributes
internet_accessobject

The access policy enforced for egress traffic to the internet.

compliance_security_profileobject
Show child attributesHide child attributes
is_enabledboolean

Whether the compliance security profile is enabled.

compliance_standardsarray of string

The list of compliance standards that the compliance security profile is configured to enforce.

Values: COMPLIANCE_STANDARD_UNSPECIFIED, NONE, HIPAA, PCI_DSS, FEDRAMP_MODERATE, IRAP_PROTECTED, FEDRAMP_HIGH, FEDRAMP_IL5, ITAR_EAR, CYBER_ESSENTIAL_PLUS, CANADA_PROTECTED_B, ISMAP, HITRUST, K_FSI, GERMANY_C5, GERMANY_TISAX, KSA_ECC_CCC_DCC

enable_shared_outputboolean

Whether to enable shared output for the central clean room. When enabled, clean room task runs can write to the run-scoped shared output schema which is accessible by all collaborators.

Example: false

package_provider_collaborator_aliasstring

Alias of the provider collaborator. If set, packaged clean rooms mode is enabled. The consumer's experience is restricted: they can view notebook names and READMEs, add their own data assets, and trigger runs, but cannot view notebook code, provider data assets, or notebook run output.

ownerstring

This is the <Databricks> username of the owner of the local clean room securable for permission management.

Example: alice@example.com

commentstring

Example: This is a clean room for demo

Constraints: <= 1000 characters

created_atint64

When the clean room was created, in epoch milliseconds.

Example: 1716424663321

updated_atint64

When the clean room was last updated, in epoch milliseconds.

Example: 1716424663321

statusstring

Clean room status.

Values: ENUM_UNSPECIFIED, ACTIVE, PROVISIONING, DELETED, FAILED

local_collaborator_aliasstring

The alias of the collaborator tied to the local clean room.

Example: creator

output_catalogobject

Output catalog of the clean room. It is an output only field. Output catalog is manipulated using the separate CreateCleanRoomOutputCatalog API.

Show child attributesHide child attributes
statusstring

Values: OUTPUT_CATALOG_STATUS_UNSPECIFIED, NOT_ELIGIBLE, NOT_CREATED, CREATED

catalog_namestring

The name of the output catalog in UC. It should follow UC securable naming requirements. The field will always exist if status is CREATED.

access_restrictedstring

Whether clean room access is restricted due to CSP

Values: NO_RESTRICTION, CSP_MISMATCH

enable_shared_outputboolean

Whether allow task to write to shared output schema. When enabled, clean room task runs triggered by the current collaborator can write to the run-scoped shared output schema which is accessible by all collaborators.

Example: false

Response

Returns the CleanRoom object.

Delete

DELETE /api/2.0/clean-rooms/{name}

Delete a clean room. After deletion, the clean room will be removed from the metastore. If the other collaborators have not deleted the clean room, they will still have the clean room in their metastore, but it will be in a DELETED state and no operations other than deletion can be performed on it.

API scopes: cleanrooms

Parameters

namestringpath

Name of the clean room.