create_policy
Creates an empty masking policy for a tag to control how tagged data is masked. Supports Snowflake and Databricks with platform-specific tag handling.
Instructions
Create an empty masking policy for a specific tag.
Creates a masking policy that controls how data tagged with the
specified tag is masked. Until you add rules with add_rules, all
users will see NULL for tagged columns.
Each tag can only have one policy — check get_policies first to
avoid conflicts.
After creating a policy, use add_rules to define masking behavior.
PLATFORM DIFFERENCES — TAG HANDLING:
Snowflake and Databricks tags are FUNDAMENTALLY DIFFERENT in ALTR:
A Snowflake tag is a connected ALTR object — it has been registered with
connect_tag, owns atag_group_id, a masking configuration, and shows up inget_tags. You reference it here by its UPPERCASE name.A Databricks tag is NOT an ALTR object — it is just a raw string referenced at policy-creation time. There is no
connect_tagstep, notag_group_id, and it will never appear inget_tags. The string you pass here is what gets stored on the policy.
Snowflake: The tag param must be the UPPERCASE tag name as
returned by get_tags. The tag MUST already be connected to ALTR via
connect_tag before creating a policy. Do NOT pass database_ids for
Snowflake — the API will reject it.
Databricks: The tag param is any raw tag name string (e.g.,
"pac_access_level") — case-insensitive, no connection step required.
Do NOT call connect_tag and do NOT look the tag up in get_tags;
Databricks tags will not be there. You MUST set policy_type to
"PUSHDOWN" — the API rejects "TAG" for Databricks metastores.
You MUST also pass database_ids as a list of ALTR database IDs
for the target Databricks metastore(s) (from get_databases).
database_ids is required for Databricks, and it is ALWAYS a
list — even when targeting a single database, wrap the ID in a
list (e.g., database_ids=[2167], not database_ids=2167).
Omitting database_ids will be rejected by the API.
Available masking levels:
10000: No mask (show raw value)
10001: Full mask (replace with * matching data length)
10002: Email mask (show domain only)
10003: Show last four
10004: Constant mask (1 for numbers,
for strings, 1/1/2000 for dates)
10005: Null (replace with NULL)
10006: Full mask hash (replace with hashed value)
10007: Email hash (show domain, hash local part)
10008: Show last four hash (hash prefix, show last 4)
10009: Constant date (replace with 12/31/9999)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tag | Yes | Tag name. For Snowflake: UPPERCASE connected tag from `get_tags`. For Databricks: any raw tag name string — no prior connection required. | |
| policy_type | No | Must be "PUSHDOWN" for Databricks. Omit for Snowflake (defaults to "TAG"). | |
| database_ids | No | REQUIRED for Databricks. Must be a list of ALTR database IDs for the target Databricks metastore(s) (from `get_databases`). Always pass a list — wrap a single ID in a list (e.g., [2167]); do NOT pass a bare int. Omit entirely for Snowflake. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||