To monitor updates, such as SCIM API requests sent to Snowflake by the identity provider, an administrator can use the REST EVENT HISTORY feature. This feature allows administrators to query historical data about REST API calls made to Snowflake, including those related to user and role management through SCIM (System for Cross-domain Identity Management).
The REST EVENT HISTORY table function returns information about REST API calls made over a specified period. It is particularly useful for auditing and monitoring purposes, especially when integrating Snowflake with third-party identity providers that use SCIM for automated user provisioning and deprovisioning.
An example query to check for SCIM API requests might look like this:
SELECT * FROM
TABLE(information_schema.rest_event_history(date_range_start=>dateadd('hours',-1,current_timestamp()))) WHERE request_type = 'SCIM'; This query returns details on SCIM API requests made in the last hour, including the request type, the identity provider's details, and the outcome of each request.
Reference: Snowflake Documentation on REST EVENT HISTORY
(https://docs.snowflake.com/en/sql-reference/functions/rest_event_history.html)