ドキュメント変更履歴 2026-09-03

--- ahttps://docs.snowflake.com/en/developer-guide/snowflake-ml/model-registry/overview+++ bhttps://docs.snowflake.com/en/developer-guide/snowflake-ml/model-registry/overview@@ -275,6 +275,9 @@       <td> -List of package specs for PyPI packages required by your model. Models running in a warehouse must also specify a-pip artifact repository (see `artifact_repository_map` argument, next).+List of package specs for PyPI packages required by your model. To install those packages from an artifact+repository (the built-in PyPI repository or a [customer-hosted repository](/developer-guide/udf/python/customer-hosted-python-artifact-repositories)),+also set `artifact_repository_map`. Models that target a warehouse require an artifact repository for pip+packages. For Snowpark Container Services (online or batch inference), specify a repository when the packages aren't+available on public PyPI, such as a private internal package.  </td>@@ -284,9 +287,13 @@       <td> -Dictionary mapping the artifact repository type (must be `"pip"`) to a repository name. For example, to use the built-in-PyPI artifact repository, specify `{"pip": "snowflake.snowpark.pypi_shared_repository"}`.--When specified, pip requirements are installed via the artifact repository in warehouse environments. The following model is runnable in-warehouse; scikit-learn is installed via the built-in `pypi_shared_repository` artifact repository.+Dictionary mapping the artifact repository type (must be `"pip"`) to a repository name. For the built-in+PyPI artifact repository, specify `{"pip": "snowflake.snowpark.pypi_shared_repository"}`. For a private+PyPI-compatible repository, use the fully qualified name of a+[customer-hosted artifact repository](/developer-guide/udf/python/customer-hosted-python-artifact-repositories)+(for example, `{"pip": "my_db.my_schema.my_python_repo"}`).++When specified, pip requirements are installed from that repository when the model runs in a warehouse and when+Snowflake builds the container image for SPCS online or batch inference. See+[Use a private PyPI artifact repository](#label-snowpark-model-registry-private-pypi).  ```python@@ -432,5 +439,10 @@  </td>-      <td>- Users can override dependencies by specifying _conda_dependencies_ and/or _pip_requirements_.</td>+      <td>++- Users can override dependencies by specifying *conda_dependencies* and/or *pip_requirements*.+- To install pip packages from a private or built-in PyPI repository, set *artifact_repository_map*. See [Use a private PyPI artifact repository](#label-snowpark-model-registry-private-pypi).++</td>     </tr>     <tr>@@ -443,5 +455,9 @@  </td>-      <td></td>+      <td>++- To install pip packages from a private or built-in PyPI repository, set *artifact_repository_map*. See [Use a private PyPI artifact repository](#label-snowpark-model-registry-private-pypi).++</td>     </tr>     <tr>@@ -473,5 +489,5 @@  - Users can override dependencies by specifying *conda_dependencies* and/or *pip_requirements*.-- To use a PyPI repository in the warehouse, use Artifact Repository (currently a preview feature). See *artifact_repository_map* below.+- To use a PyPI repository in the warehouse or when deploying to SPCS, use Artifact Repository. See [Use a private PyPI artifact repository](#label-snowpark-model-registry-private-pypi).  </td>@@ -487,5 +503,5 @@  </td>-      <td>- To use a PyPI repository in the warehouse, use Artifact Repository (currently a preview feature). See _artifact_repository_map_ below.</td>+      <td>- To use a PyPI repository in the warehouse or when deploying to SPCS, use Artifact Repository. See [Use a private PyPI artifact repository](#label-snowpark-model-registry-private-pypi).</td>     </tr>     <tr>@@ -517,5 +533,5 @@  - Users can override dependencies by specifying *conda_dependencies* and/or *pip_requirements*.-- To use a PyPI repository in the warehouse, use Artifact Repository (currently a preview feature). See *artifact_repository_map* below.+- To use a PyPI repository in the warehouse or when deploying to SPCS, use Artifact Repository. See [Use a private PyPI artifact repository](#label-snowpark-model-registry-private-pypi).  </td>@@ -531,9 +547,73 @@  </td>-      <td>- To use a PyPI repository in the warehouse, use Artifact Repository (currently a preview feature). See _artifact_repository_map_ below.</td>+      <td>- To use a PyPI repository in the warehouse or when deploying to SPCS, use Artifact Repository. See [Use a private PyPI artifact repository](#label-snowpark-model-registry-private-pypi).</td>     </tr>   </tbody>  </div>++<a id="label-snowpark-model-registry-private-pypi"></a>++## Use a private PyPI artifact repository++If the model depends on packages that aren't on public PyPI (internal libraries, or a governed mirror of PyPI),+point `log_model` at a Snowflake [artifact repository](/developer-guide/udf/python/udf-python-packages). Use the+built-in `snowflake.snowpark.pypi_shared_repository` for public PyPI, or a+[customer-hosted artifact repository](/developer-guide/udf/python/customer-hosted-python-artifact-repositories) for a+private index such as JFrog Artifactory, Nexus, Azure Artifacts, Google Artifact Registry, or AWS CodeArtifact.++To create a private repository object, you configure a secret, an API integration, and an+[`ARTIFACT REPOSITORY`](/sql-reference/sql/create-artifact-repository). For the full procedure, see+[](/developer-guide/udf/python/customer-hosted-python-artifact-repositories#label-customer-hosted-repos-configure).++Snowflake installs those pip packages from the repository when the model runs in a warehouse and when it builds the+container image for [online inference](/developer-guide/snowflake-ml/inference/real-time-inference-rest-api) or+[batch inference jobs](/developer-guide/snowflake-ml/inference/batch-inference-jobs) on Snowpark Container Services.+You don't pass the repository again to `create_service` or `run_batch`. The mapping is stored with the model version.++The role that logs and deploys the model must be able to use the artifact repository (typically USAGE on a+customer-hosted repository, or the `SNOWFLAKE.PYPI_REPOSITORY_USER` database role for the built-in PyPI repository).++The following example logs a model that depends on an internal package and deploys it for online inference. The same+logged model can also call `run_batch` for batch inference.++```python+from snowflake.ml.model import target_platform+from snowflake.ml.model.batch import OutputSpec+from snowflake.ml.registry import Registry++reg = Registry(session=session)++mv = reg.log_model(+    model=my_model,+    model_name="internal_scoring_model",+    version_name="v1",+    target_platforms=target_platform.SNOWPARK_CONTAINER_SERVICES_ONLY,+    pip_requirements=["internal-scoring-lib==1.2.3", "scikit-learn"],+    artifact_repository_map={+        "pip": "my_db.my_schema.my_python_repo"+    },+    sample_input_data=train_features,+)++# Online inference+mv.create_service(+    service_name="internal_scoring_service",+    service_compute_pool="my_cpu_pool",+    ingress_enabled=True,+)++# Batch inference on the same model version+job = mv.run_batch(+    compute_pool="my_cpu_pool",+    X=session.table("my_feature_table"),+    output_spec=OutputSpec(stage_location="@my_db.my_schema.my_stage/path/"),+)+```++For a complete online-inference workflow, see+[](/developer-guide/snowflake-ml/inference/real-time-inference-examples#label-real-time-inference-private-pypi).+If image build fails because a package isn't found, check the `model-build` logs as described in+[](/developer-guide/snowflake-ml/inference/real-time-inference-troubleshooting).  <a id="label-snowpark-model-registry-model-artifacts"></a> 

--- ahttps://docs.snowflake.com/en/user-guide/tables-iceberg-configure-catalog-integration-vended-credentials+++ bhttps://docs.snowflake.com/en/user-guide/tables-iceberg-configure-catalog-integration-vended-credentials@@ -34,4 +34,6 @@ To use this feature, your external catalog must also support credential vending. +<a id="label-tables-iceberg-vended-credentials-considerations"></a>+ ## Considerations @@ -39,4 +41,17 @@  - This feature is supported for tables that store their data and metadata in Amazon S3, Azure Storage, or Google Cloud Storage.+- **Google Cloud Storage:** For improved query performance with tables backed by Google Cloud+  Storage, set the+  `VENDED_CREDENTIAL_STORAGE_REGION` parameter to the+  [location](https://cloud.google.com/storage/docs/locations) of your Google Cloud Storage bucket.+  You can set this at the table, schema, or database level:++  ```sql+  ALTER TABLE <table_name>+    SET VENDED_CREDENTIAL_STORAGE_REGION = '<gcs_region>';+  ```++  For multi-region buckets, use the multi-region identifier, for example, `'us'`.+  Contact Snowflake Support to enable this feature for your account. - Table files must be stored in a single bucket; they can't be spread across multiple buckets. @@ -65,4 +80,55 @@ - The CREATE ICEBERG TABLE … AS SELECT command isn't supported. - To use private connectivity with vended credentials, see [Configure private connectivity to storage for catalog-vended credentials](/user-guide/tables-iceberg-vended-credentials-private-connectivity).++<a id="label-tables-iceberg-vended-credentials-permissions"></a>++## Required storage permissions++Your external catalog controls the permissions that it grants to Snowflake in a vended credential.+Configure your catalog to vend credentials that grant at least the following permissions on the+locations that contain your table files.++<div className="colwidths-given">++  <colgroup>+    <col style={{width: "20%"}} />+    <col style={{width: "40%"}} />+    <col style={{width: "40%"}} />+  </colgroup>+  <thead>+    <tr>+      <th>Cloud storage</th>+      <th>Read access</th>+      <th>Read and write access</th>+    </tr>+  </thead>+  <tbody>+    <tr>+      <td>Amazon S3</td>+      <td>`s3:GetObject`</td>+      <td>`s3:GetObject`, `s3:PutObject`</td>+    </tr>+    <tr>+      <td>Azure Storage</td>+      <td>Shared access signature (SAS) permission `r` (read)</td>+      <td>SAS permissions `r` (read) and `c` (create)</td>+    </tr>+    <tr>+      <td>Google Cloud Storage</td>+      <td>`storage.objects.get`</td>+      <td>`storage.objects.get`, `storage.objects.create`</td>+    </tr>+  </tbody>++</div>++Note the following:++- Read access is sufficient to query a table with `SELECT`. Grant write access if you also run DML+  statements such as `INSERT`, `UPDATE`, `DELETE`, or `MERGE` against the table.+- Snowflake needs these permissions on every location that contains files for the table, not only+  on the location of the current metadata file.+- Your catalog can vend broader permissions than the ones listed here. Snowflake uses only the+  permissions in this table to read and write table data.  ## Create a catalog integration for vended credentials@@ -241,2 +307,32 @@ If you've set a default external volume at the account, database, or schema level, Snowflake ignores the default external volume during table creation as long as you specify a catalog integration configured to use vended credentials.++<a id="label-tables-iceberg-vended-credentials-gcs"></a>++## Google Cloud Storage requirements++When your table files are in Google Cloud Storage, Snowflake accesses your bucket using the access+token that your catalog vends. Configure your catalog with a Google Cloud service account, then+grant that service account access to the bucket that contains your table files.++### Grant object-level permissions++Snowflake reads and writes the objects in your bucket, so a vended token needs object-level+permissions only:++- `storage.objects.get` to query a table.+- `storage.objects.get` and `storage.objects.create` to also run DML statements against a table.++Grant these permissions with a+[custom role](https://cloud.google.com/iam/docs/creating-custom-roles), or with a predefined role+that includes them. For the equivalent permissions on other cloud storage providers, see+[](#label-tables-iceberg-vended-credentials-permissions).++You don't need to grant a role on the bucket resource itself, such as Storage Admin.++### Declare the bucket location++For tables backed by Google Cloud Storage, you must set the `VENDED_CREDENTIAL_STORAGE_REGION`+parameter to your bucket's location. This can significantly reduce query latency. You can set this+parameter at the table, schema, or database level. For more information, see+[Considerations](#label-tables-iceberg-vended-credentials-considerations). 

--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling@@ -12,19 +12,24 @@ Configure this behavior on the agent specification with `orchestration.tool_not_accessible`. The setting applies when you create or update an agent object, and when you pass the full specification to `POST /api/v2/cortex/agent:run`. You can't change it on an `agents/{name}:run` request; update the agent object instead. -<a id="label-cortex-agents-inaccessible-tool-modes"></a>--## Access modes--Set `tool_not_accessible` on the `orchestration` object. Values are case-insensitive.--| Value    | Behavior                                                                                                                                                                                                         |-| -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |-| `accept` | Continue the run. Snowflake emits a `response.warning` event for each inaccessible tool that the caller named, and the agent uses the remaining accessible tools. This is the default when the field is omitted. |-| `reject` | Collect every inaccessible tool in the checked set, then reject the run with a single HTTP 4XX error that lists all of them.                                                                                     |-| `legacy` | Reject the run at the first inaccessible Cortex Search, Cortex Analyst, MCP, or skill tool. Use this when a caller depends on that first-failure HTTP 4XX wire format.                                           |--YAML example:+There is no account-level setting for this behavior. Set the mode in each agent specification. For direct calls to `POST /api/v2/cortex/agent:run` that don't use an agent object, set the mode in each request body.++<a id="label-cortex-agents-inaccessible-tool-where-to-set"></a>++## Where to set the field++An agent specification contains three different keys named `orchestration`. Set `tool_not_accessible` on the top-level one:++| Field                        | Type                                                                                                                               | What it holds                                                                                      |+| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |+| `orchestration`              | [OrchestrationConfig](/user-guide/snowflake-cortex/cortex-agents-rest-api#label-snowflake-agent-object-orchestrationconfig) object | Run controls: `tool_not_accessible`, `budget`, and `capabilities`. Set `tool_not_accessible` here. |+| `models.orchestration`       | string                                                                                                                             | The orchestration model, for example `claude-4-sonnet`.                                            |+| `instructions.orchestration` | string                                                                                                                             | Natural-language instructions that steer tool selection.                                           |++The following specification sets all three. Only the top-level `orchestration` block controls inaccessible-tool handling:  ```yaml+models:+  orchestration: claude-4-sonnet+ orchestration:   tool_not_accessible: accept@@ -32,10 +37,16 @@     seconds: 30     tokens: 16000-```--JSON example:++instructions:+  orchestration: 'Use the search tool for all refund questions.'+```++The same specification in JSON:  ```json {+  "models": {+    "orchestration": "claude-4-sonnet"+  },   "orchestration": {     "tool_not_accessible": "accept",@@ -44,7 +55,22 @@       "tokens": 16000     }+  },+  "instructions": {+    "orchestration": "Use the search tool for all refund questions."   } } ```++<a id="label-cortex-agents-inaccessible-tool-modes"></a>++## Access modes++Set `tool_not_accessible` on the top-level `orchestration` object, as shown in [](#label-cortex-agents-inaccessible-tool-where-to-set). Values are case-insensitive.++| Value    | Behavior                                                                                                                                                                                                         |+| -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |+| `accept` | Continue the run. Snowflake emits a `response.warning` event for each inaccessible tool that the caller named, and the agent uses the remaining accessible tools. This is the default when the field is omitted. |+| `reject` | Collect every inaccessible tool in the checked set, then reject the run with a single HTTP 4XX error that lists all of them.                                                                                     |+| `legacy` | Reject the run at the first inaccessible Cortex Search, Cortex Analyst, MCP, or skill tool. Use this when a caller depends on that first-failure HTTP 4XX wire format.                                           |  <a id="label-cortex-agents-inaccessible-tool-checked-tools"></a>@@ -115,5 +141,32 @@ In `reject` mode, the HTTP 4XX body lists every inaccessible tool in the checked set. In `legacy` mode, the HTTP 4XX body describes the first Cortex Search, Analyst, MCP, or skill failure. -These warnings also appear in agent traces and the event table. For where to view traces, see [](/user-guide/snowflake-cortex/cortex-agents-monitor).+Where the warning appears depends on how you run the agent:++- **Cortex Agents REST API, streaming response:** The client receives a `response.warning` SSE event before the first model call. Applications should display or otherwise handle this event so users know the answer might not use every configured tool.+- **Cortex Agents REST API, non-streaming response:** The final JSON response includes the warning in its top-level `warnings` array.+- **`SNOWFLAKE.CORTEX.DATA_AGENT_RUN`:** The function returns the final aggregated JSON response, including the top-level `warnings` array. Parse the returned string as JSON to inspect it.+- **%sf-intelligence%:** The warning is displayed with the answer in the conversation.++For example, a non-streaming REST response or parsed `DATA_AGENT_RUN` result includes:++```json+{+  "role": "assistant",+  "content": [+    {+      "type": "text",+      "text": "..."+    }+  ],+  "warnings": [+    {+      "code": "399569",+      "message": "TOOL_NOT_ACCESSIBLE: Search1 (cortex_search) - The Cortex Search Service does not exist or access is not authorized for the current role: db.schema.css1"+    }+  ]+}+```++The warning is also recorded in the agent trace in `SNOWFLAKE.LOCAL.AI_OBSERVABILITY_EVENTS`, so administrators can audit it after the run. View the trace in the agent **Observability** tab or query it with [](/sql-reference/functions/get_ai_observability_events-snowflake-local). Entries in the event table can't be modified. For access requirements and query examples, see [](/user-guide/snowflake-cortex/cortex-agents-monitor#label-cortex-agents-query-observability-events).  <a id="label-cortex-agents-inaccessible-tool-choose-mode"></a>@@ -124,4 +177,6 @@ - Use `reject` when you want a strict gate: the run must not start unless every nam... (truncated) 

差分が長いため、途中まで表示しています。

--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-backup-set+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-backup-set@@ -20,4 +20,8 @@ [](#label-backup-objects). +This command supports the following variants:++- [](#label-create-or-alter-backup-set-syntax): Creates a backup set if it doesn't exist or alters an existing backup set.+ <dl> <dt>See also:</dt>@@ -27,5 +31,6 @@ [](/sql-reference/sql/drop-backup-set), [](/sql-reference/sql/show-backup-sets),-[](/sql-reference/sql/create-backup-policy)+[](/sql-reference/sql/create-backup-policy),+[](/sql-reference/sql/create-or-alter)  </dd>@@ -54,4 +59,38 @@   FOR DATABASE <database_name>    [ [ WITH ] TAG ( <tag_name> = '<tag_value>' [ , <tag_name> = '<tag_value>' , ... ] ) ]+   [ WITH BACKUP POLICY <policy_name> ]+   [ COMMENT = <string> ]+```++## Variant syntax++<a id="label-create-or-alter-backup-set-syntax"></a>++### CREATE OR ALTER BACKUP SET++Creates a new backup set if it doesn't already exist, or updates an existing one.+A CREATE OR ALTER BACKUP SET statement follows the syntax rules of a CREATE BACKUP SET statement and has the same limitations as an+[](/sql-reference/sql/alter-backup-set) statement.++For an existing backup set, you can update the `COMMENT` and attach a `WITH BACKUP POLICY` if one isn't already set. The `FOR` target+can't be changed, and an attached backup policy can't be replaced or removed.++```sqlsyntax+CREATE OR ALTER BACKUP SET <name>+   FOR [ DYNAMIC ] TABLE <table_name>+   [ WITH BACKUP POLICY <policy_name> ]+   [ COMMENT = <string> ]+```++```sqlsyntax+CREATE OR ALTER BACKUP SET <name>+  FOR SCHEMA <schema_name>+   [ WITH BACKUP POLICY <policy_name> ]+   [ COMMENT = <string> ]+```++```sqlsyntax+CREATE OR ALTER BACKUP SET <name>+  FOR DATABASE <database_name>    [ WITH BACKUP POLICY <policy_name> ]    [ COMMENT = <string> ]@@ -178,4 +217,5 @@ | APPLY                       | The role used to apply a backup policy on a backup set must have this privilege on the backup policy.                                                                                                                                                                                                                             | | APPLY BACKUP RETENTION LOCK | The role used to apply a backup policy with retention lock on a backup set must have this privilege on the account.                                                                                                                                                                                                               |+| OWNERSHIP                   | Required to execute a [](#label-create-or-alter-backup-set-syntax) statement for an *existing* backup set.                                                                                                                                                                                                                        |  </div>@@ -201,4 +241,14 @@ period in a backup policy. +<a id="label-create-or-alter-backup-set-usage-notes"></a>++### CREATE OR ALTER BACKUP SET++- All limitations of the [](/sql-reference/sql/alter-backup-set) command apply.+- The `FOR` target can't be changed.+- A backup policy can be attached if the backup set doesn't already have one, but an existing backup policy can't be replaced or+  removed.+- Tags aren't supported.+ ## Examples @@ -233,2 +283,13 @@   WITH BACKUP POLICY hourly_backup_policy; ```++### CREATE OR ALTER BACKUP SET++Create a backup set for table `t1`, or update its comment and attach a backup policy if it already exists without one:++```sql+CREATE OR ALTER BACKUP SET t1_backups+  FOR TABLE t1+  WITH BACKUP POLICY hourly_backup_policy+  COMMENT = 'Backups for t1';+``` 

--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-backup-policy+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-backup-policy@@ -17,4 +17,8 @@ associated backup set. +This command supports the following variants:++- [](#label-create-or-alter-backup-policy-syntax): Creates a backup policy if it doesn't exist or alters an existing backup policy.+ The backup policy is optional for a backup set. If you don't need scheduled backups, a retention lock, or an expiration period, you can create a backup set without a backup policy. You can also use@@ -29,6 +33,7 @@ [](/sql-reference/sql/drop-backup-policy), [](/sql-reference/sql/show-backup-policies),-[](/sql-reference/sql/create-backup-set)-[](/sql-reference/sql/alter-backup-set)+[](/sql-reference/sql/create-backup-set),+[](/sql-reference/sql/alter-backup-set),+[](/sql-reference/sql/create-or-alter)  </dd>@@ -40,4 +45,27 @@ CREATE [ OR REPLACE ] BACKUP POLICY [ IF NOT EXISTS ] <name>    [ [ WITH ] TAG ( <tag_name> = '<tag_value>' [ , <tag_name> = '<tag_value>' , ... ] ) ]+   [ WITH RETENTION LOCK ]+   [ SCHEDULE = '{ <num> MINUTE | <num> HOUR | USING CRON <expr> <time_zone> }' ]+   [ EXPIRE_AFTER_DAYS = <days_integer> ]+   [ COMMENT = <string> ]+```++## Variant syntax++<a id="label-create-or-alter-backup-policy-syntax"></a>++### CREATE OR ALTER BACKUP POLICY++Creates a new backup policy if it doesn't already exist, or transforms an existing backup policy into the backup policy defined in the+statement. A CREATE OR ALTER BACKUP POLICY statement follows the syntax rules of a CREATE BACKUP POLICY statement and has the same+limitations as an [](/sql-reference/sql/alter-backup-policy) statement.++The following modifications are supported when altering a backup policy:++- Updating `SCHEDULE` or `EXPIRE_AFTER_DAYS`.+- Adding, updating, or removing a `COMMENT`.++```sqlsyntax+CREATE OR ALTER BACKUP POLICY <name>    [ WITH RETENTION LOCK ]    [ SCHEDULE = '{ <num> MINUTE | <num> HOUR | USING CRON <expr> <time_zone> }' ]@@ -246,8 +274,9 @@ <div className="colwidths-auto"> -| Privilege                   | Notes                                                                                                          |-| --------------------------- | -------------------------------------------------------------------------------------------------------------- |-| CREATE BACKUP POLICY        | The role used to create a backup policy must have this privilege on the schema in which the policy is created. |-| APPLY BACKUP RETENTION LOCK | Only a user with this privilege on the account can create a backup policy with retention lock.                 |+| Privilege                   | Notes                                                                                                            |+| --------------------------- | ---------------------------------------------------------------------------------------------------------------- |+| CREATE BACKUP POLICY        | The role used to create a backup policy must have this privilege on the schema in which the policy is created.   |+| APPLY BACKUP RETENTION LOCK | Only a user with this privilege on the account can create a backup policy with retention lock.                   |+| OWNERSHIP                   | Required to execute a [](#label-create-or-alter-backup-policy-syntax) statement for an *existing* backup policy. |  </div>@@ -275,4 +304,12 @@ period in a backup policy. +<a id="label-create-or-alter-backup-policy-usage-notes"></a>++### CREATE OR ALTER BACKUP POLICY++- All limitations of the [](/sql-reference/sql/alter-backup-policy) command apply.+- Setting or unsetting a tag is not supported.+- The `WITH RETENTION LOCK` clause can't be changed for an existing backup policy.+ ## Examples @@ -306,2 +343,13 @@   COMMENT = 'Twice-weekly backups that expire after 7 days'; ```++### CREATE OR ALTER BACKUP POLICY++Create a new backup policy, or update the schedule and expiration period of an existing one:++```sql+CREATE OR ALTER BACKUP POLICY hourly_backup_policy+  SCHEDULE = '60 MINUTE'+  EXPIRE_AFTER_DAYS = 90+  COMMENT = 'Hourly backups that expire after 90 days';+``` 

--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-run+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-run@@ -209,4 +209,16 @@ } ```++The `orchestration` configuration, including `tool_not_accessible`, comes from the agent object's specification. You can't set `tool_not_accessible` in this run request. To change it, set it on the top-level `orchestration` object of the agent specification, not on `models.orchestration` or `instructions.orchestration`:++```json+{+  "orchestration": {+    "tool_not_accessible": "accept"+  }+}+```++For the update endpoint and full agent specification, see [](/user-guide/snowflake-cortex/cortex-agents-rest-api#label-snowflake-agents-rest-api-update).  The request body supports an optional `stream` boolean field:@@ -471,4 +483,39 @@ ``` +For a run without an agent object, set `tool_not_accessible` in the top-level `orchestration` object of the request body. This request body has three different keys named `orchestration`: the top-level `orchestration` object holds run controls such as `tool_not_accessible` and `budget`, `models.orchestration` names the orchestration model, and `instructions.orchestration` holds natural-language instructions. Only the top-level object accepts `tool_not_accessible`:++```json+{+  "messages": [+    {+      "role": "user",+      "content": [+        {+          "type": "text",+          "text": "What is the total revenue for 2025?"+        }+      ]+    }+  ],+  "models": {+    "orchestration": "claude-4-sonnet"+  },+  "instructions": {+    "orchestration": "Use the search tool for all refund questions."+  },+  "orchestration": {+    "tool_not_accessible": "accept",+    "budget": {+      "seconds": 30,+      "tokens": 16000+    }+  },+  "tools": [],+  "tool_resources": {}+}+```++If you omit `tool_not_accessible`, the default is `accept`. For all values and their behavior, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling#label-cortex-agents-inaccessible-tool-where-to-set).+ The request body supports an optional `stream` boolean field: @@ -494,5 +541,5 @@ Make sure your application can handle unknown event types. -When a named tool isn't accessible and `tool_not_accessible` is `accept`, the stream includes `response.warning` events before the first model call. For the warning format and the other access modes, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling).+When a named tool isn't accessible and `tool_not_accessible` is `accept`, the stream includes a `response.warning` event before the first model call. The warning is also included in the top-level `warnings` array of the final `response` event. Applications should handle the SSE event or inspect the final array so users know the answer might not use every configured tool. For the warning format and the other access modes, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling#warnings-and-errors).  **Example Response**@@ -4246,4 +4293,6 @@  The response body is the same object as the `response` event payload in streaming mode (that is, it corresponds to the JSON returned in the SSE `response` event's `data` field).++If non-fatal warnings occur during the run, the response includes a top-level `warnings` array. For example, warning code `399569` indicates that the caller's role couldn't access a named tool and the agent produced an answer with its remaining tools.  **Example response**@@ -4309,4 +4358,10 @@       "type": "text"     }+  ],+  "warnings": [+    {+      "code": "399569",+      "message": "TOOL_NOT_ACCESSIBLE: Search1 (cortex_search) - The Cortex Search Service does not exist or access is not authorized for the current role: db.schema.css1"+    }   ] } 

--- ahttps://docs.snowflake.com/en/sql-reference/functions/system_get_snowflake_egress_ip_ranges+++ bhttps://docs.snowflake.com/en/sql-reference/functions/system_get_snowflake_egress_ip_ranges@@ -33,6 +33,25 @@  ```sqlsyntax-SYSTEM$GET_SNOWFLAKE_EGRESS_IP_RANGES()+SYSTEM$GET_SNOWFLAKE_EGRESS_IP_RANGES( [ <hideAnnotations> ] ) ```++## Arguments++**Required:**++None.++**Optional:**++<dl>+<dt><code className="samp"><em>hideAnnotations</em></code></dt>+<dd>++`BOOLEAN`. Available in Azure regions. When `TRUE`, the function omits the inline comments from the JSON output. When `FALSE` or omitted, Azure output includes those comments.++Default: `FALSE`++</dd>+</dl>  ## Returns@@ -81,4 +100,34 @@ ``` +To hide inline comments, pass `TRUE` for the optional `hideAnnotations` argument:++```sql+SELECT SYSTEM$GET_SNOWFLAKE_EGRESS_IP_RANGES(TRUE);+```++```json+[+  {+    "ipv4_prefix": "153.45.139.0/24",+    "effective": "2026-08-19T00:00:00Z",+    "published": "2026-07-15T14:38:56.923Z",+    "expires": "2026-11-17T00:00:00Z",+    "usage": [+      "Network Identifier - use for Azure services such as Storage, Key Vault",+      "Stable Egress IP - use for endpoints hosted outside of Azure"+    ]+  },+  {+    "ipv4_prefix": "153.45.182.0/24",+    "effective": "2026-08-19T00:00:00Z",+    "published": "2026-07-15T14:38:56.923Z",+    "expires": "2026-11-17T00:00:00Z",+    "usage": [+      "Network Identifier - use for Azure services such as Storage, Key Vault"+    ]+  }+]+```+ On Azure, the output includes the standard `ipv4_prefix`, `effective`, and `expires` fields. The output also includes two additional fields:  

--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/kinesis/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/kinesis/setup@@ -589,10 +589,18 @@ ## Using the connector with Apache Iceberg™ tables -The connector can ingest data into Snowflake-managed Apache Iceberg™ tables but must meet the following requirements:--- You must have been granted the USAGE privilege on the external volume associated with your Apache Iceberg™ table.-- You must create an Apache Iceberg™ table before running the connector.+The connector can ingest data into a Snowflake-managed Apache Iceberg™ table.++The connector doesn't create Iceberg tables automatically. You must create the Iceberg table manually before you run the connector.++The connector supports server-side schema evolution for Iceberg destination tables, the same way it does for standard Snowflake tables. When the destination table has `ENABLE_SCHEMA_EVOLUTION = TRUE`, Snowflake automatically adds new columns that are detected in the incoming stream and drops NOT NULL constraints to accommodate new data patterns. For more information about how schema evolution behaves, see [Table schema evolution](/user-guide/data-load-schema-evolution).++The Iceberg table can use either of the following storage options:++- [Snowflake storage](/user-guide/tables-iceberg-internal-storage): Snowflake stores and manages the Iceberg table files for you, so you don't need to create an external volume or grant the connector access to it.+- External cloud storage that you manage, accessed through an external volume. You must grant the connector role USAGE on the external volume.  ### Grant usage on an external volume++This step applies only when the Iceberg table uses an external volume that you manage. If the table uses [Snowflake storage](/user-guide/tables-iceberg-internal-storage), skip this step.  For example, if your Iceberg table uses the `kinesis_external_volume` external volume and the connector uses the role `openflow_kinesis_connector_role_1`, run the following statement:@@ -604,6 +612,4 @@  ### Create an Apache Iceberg™ table for ingestion--The connector does not create Iceberg tables automatically and does not support schema evolution. Before you run the connector, you must create an Iceberg table manually.  When you create an Iceberg table, you can use Iceberg data types (including VARIANT) or@@ -630,5 +636,33 @@ ``` -To create an Iceberg table for the example message, use one of the following statements:+To create an Iceberg table for the example message, use one of the following statements.++To use [Snowflake storage](/user-guide/tables-iceberg-internal-storage), set `EXTERNAL_VOLUME = 'SNOWFLAKE_MANAGED'` and omit `BASE_LOCATION`:++```sql+CREATE OR REPLACE ICEBERG TABLE my_iceberg_table (+  kinesisMetadata OBJECT(+    stream STRING,+    shardId STRING,+    approximateArrival STRING,+    partitionKey STRING,+    sequenceNumber STRING,+    subSequenceNumber INTEGER,+    shardedSequenceNumber STRING+  ),+  id INT,+  name string,+  body_temperature float,+  approved_coffee_types array(string),+  animals_possessed variant,+  date_added date,+  options object(can_walk boolean, can_talk boolean)+)+EXTERNAL_VOLUME = 'SNOWFLAKE_MANAGED'+CATALOG = 'SNOWFLAKE'+ICEBERG_VERSION = 3;+```++To use your own external volume, set `EXTERNAL_VOLUME` to the volume name and provide a `BASE_LOCATION`:  ```sql 

--- ahttps://docs.snowflake.com/en/developer-guide/snowflake-ml/inference/real-time-inference-examples+++ bhttps://docs.snowflake.com/en/developer-guide/snowflake-ml/inference/real-time-inference-examples@@ -9,4 +9,5 @@ - How to create services, make predictions, and access models via HTTP endpoints. - How to use different model architectures (XGBoost, Hugging Face transformers, PyTorch) and compute options (CPU and GPU).+- How to install model dependencies from a private PyPI artifact repository.  ## Deploy an XGBoost model for CPU-powered inference@@ -192,4 +193,47 @@ ``` +<a id="label-real-time-inference-private-pypi"></a>++## Use a private PyPI artifact repository++If the model needs packages that aren't on public PyPI, log it with `pip_requirements` and+`artifact_repository_map` pointing at a+[customer-hosted artifact repository](/developer-guide/udf/python/customer-hosted-python-artifact-repositories).+Snowflake installs those packages when it builds the inference image. For the logging arguments, see+[](/developer-guide/snowflake-ml/model-registry/overview#label-snowpark-model-registry-private-pypi).++[Create the artifact repository](/developer-guide/udf/python/customer-hosted-python-artifact-repositories#label-customer-hosted-repos-configure)+first. The following example assumes `my_db.my_schema.my_python_repo` already exists and that your role can use it.++```python+from snowflake.ml.model import target_platform+from snowflake.ml.registry import Registry++reg = Registry(session=session, database_name="my_registry_db", schema_name="my_registry_schema")++mv = reg.log_model(+    my_model,+    model_name="internal_scoring_model",+    version_name="v1",+    target_platforms=target_platform.SNOWPARK_CONTAINER_SERVICES_ONLY,+    sample_input_data=pandas_test_df,+    pip_requirements=["internal-scoring-lib==1.2.3", "scikit-learn"],+    artifact_repository_map={+        "pip": "my_db.my_schema.my_python_repo"+    },+)++mv.create_service(+    service_name="internal_scoring_service",+    service_compute_pool="my_cpu_pool",+    ingress_enabled=True,+)++mv.run(pandas_test_df, function_name="predict", service_name="internal_scoring_service")+```++The same `artifact_repository_map` applies if you later call `run_batch` on this model version. You don't pass the+repository to `create_service` or `run_batch`.+ ## Deploy a PyTorch model for GPU-powered inference  

--- ahttps://docs.snowflake.com/en/sql-reference/functions/data_agent_run-snowflake-cortex+++ bhttps://docs.snowflake.com/en/sql-reference/functions/data_agent_run-snowflake-cortex@@ -205,4 +205,6 @@ Returns a JSON string containing the agent's response. +The function returns the final aggregated response rather than the individual SSE events produced by the Cortex Agents Run API. If a non-fatal warning occurs, the response includes a top-level `warnings` array. For example, warning code `399569` means that the caller's role couldn't access a named tool and the agent continued with its remaining tools.+ ## Access control requirements @@ -213,4 +215,5 @@  - The function returns a JSON string. Pass this string to [](/sql-reference/functions/try_parse_json) to convert the response to a VARIANT value.+- Inspect the top-level `warnings` array in the parsed response and surface relevant warnings to users. For inaccessible-tool warning behavior, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling#warnings-and-errors). - When `create_thread_if_not_present` is set to `TRUE`, a new thread is automatically created if the request body does not contain a `thread_id`. The response includes the `thread_id` of the newly created thread, which you can use in subsequent requests to continue the conversation. - To run the agent asynchronously, set `"background": true` in the request body and include a `thread_id`. The function returns immediately with an in-progress status and a `run_id`. Use [](/sql-reference/functions/thread_messages-snowflake-cortex) to poll for the completed response.@@ -269,4 +272,10 @@     }   ],+  "warnings": [+    {+      "code": "399569",+      "message": "TOOL_NOT_ACCESSIBLE: Search1 (cortex_search) - The Cortex Search Service does not exist or access is not authorized for the current role: db.schema.css1"+    }+  ],   "metadata": {     "run_id": "<run_id>"@@ -275,4 +284,30 @@ ``` +To return only inaccessible-tool warnings from a synchronous run:++```sql+WITH agent_response AS (+  SELECT TRY_PARSE_JSON(+    SNOWFLAKE.CORTEX.DATA_AGENT_RUN(+      'MY_DB.MY_SCHEMA.MY_AGENT',+      $${+        "messages": [+          {+            "role": "user",+            "content": [+              { "type": "text", "text": "What are some types of products?" }+            ]+          }+        ]+      }$$+    )+  ) AS response+)+SELECT warning.value+  FROM agent_response,+    LATERAL FLATTEN(input => response:warnings) AS warning+  WHERE warning.value:code::STRING = '399569';+```+ Run an agent with automatic thread creation:  

--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-snapshot-set+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-snapshot-set@@ -21,4 +21,7 @@ For the kinds of objects that are included in schema snapshots and database snapshots, see [](#label-backup-objects).++CREATE OR ALTER SNAPSHOT SET is also supported as an alias of [CREATE OR ALTER BACKUP SET](/sql-reference/sql/create-backup-set#label-create-or-alter-backup-set-syntax);+see that topic for the variant syntax, usage notes, and examples.  <dl> 

--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-snapshot-policy+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-snapshot-policy@@ -18,4 +18,7 @@ The expiration period determines how long each snapshot is retained before Snowflake automatically deletes it from the associated snapshot set.++CREATE OR ALTER SNAPSHOT POLICY is also supported as an alias of [CREATE OR ALTER BACKUP POLICY](/sql-reference/sql/create-backup-policy#label-create-or-alter-backup-policy-syntax);+see that topic for the variant syntax, usage notes, and examples.  The snapshot policy is optional for a snapshot set. If you don't need scheduled backups, a retention lock,