REST API Hybrid Runner | Collate Integration Documentation

Connect REST APIs to Collate using the Hybrid Runner. Deploy the ingestion agent in your environment for secure, private network metadata extraction.

In this section, we provide guides and references to use the OpenAPI/REST connector. Configure and schedule REST metadata workflows from the Collate UI:

• Requirements
• Metadata Ingestion
• Troubleshooting

Requirements

Configure the schema source and file format before creating the REST service.

Configure the OpenAPI Schema URL

1. Generate an OpenAPI specification for the service.
2. In the REST service connection form, select OpenAPI Schema URL.
3. In OpenAPI Schema URL, enter an HTTP or HTTPS URL that is reachable from the configured ingestion runner and points directly to the schema file.
4. Optional: In Token, enter a bearer token if the URL requires authentication.

Supported Formats

The connector supports these schema formats:

• JSON (.json)
• YAML (.yaml or .yml)

Configure an S3-Hosted Schema

1. In the REST service connection form, select OpenAPI Schema S3 URL when the OpenAPI schema is stored in Amazon S3, including when the object is private.

2. In OpenAPI Schema S3 URL, enter the HTTPS object URL in the following format:

   https://<bucket>.s3.<region>.amazonaws.com/<object-key>
   

3. In AWS Region, enter the bucket’s Amazon Web Services (AWS) Region.

4. In the AWS credential configuration, choose the credential method used by the ingestion runner:

   • Enable AWS Identity and Access Management (IAM) authentication with IAM Auth to use the runner’s default AWS credential provider chain, including a workload or instance role.
   • Configure an access key and secret. Include the session token when using temporary credentials.
   • Select a named AWS profile that is available in the runner environment.

5. Optional: In assumeRoleArn, enter the target role Amazon Resource Name (ARN) after selecting a source credential method. The target role’s trust policy must allow the source principal. For cross-account role assumption, the source principal’s identity policy must also allow sts:AssumeRole. For same-account role assumption, an identity policy is required unless the trust policy grants the source principal permission directly.

Use the exact S3 object key in the URL. The connector recognizes .json, .yaml, and .yml extensions and detects the format of extensionless objects. Avoid percent-encoded characters in the object key because the connector passes the URL path to S3 without decoding it. The S3 source doesn’t accept an s3:// URI.

The REST connector retrieves the object with the configured AWS credentials. For more information about the URL structure, see Virtual Hosting of General Purpose Buckets.

Configure S3 Access for the Hybrid Runner

For a private schema object in the same AWS account as the effective ingestion principal, grant s3:GetObject through either the principal’s identity policy or the bucket policy. A bucket policy isn’t required when a same-account identity policy already grants access and no policy explicitly denies it.

For a cross-account schema object, configure both sides of the request:

1. Grant the effective ingestion principal s3:GetObject on the exact schema object through an AWS Identity and Access Management (IAM) identity policy.
2. Add a bucket policy that grants the same principal s3:GetObject on the exact schema object.

The following least-privilege bucket policy assumes that the effective principal is an IAM role. It identifies the role by its Amazon Resource Name (ARN). Replace the placeholders with the role and object used by ingestion:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowHybridRunnerOpenAPISchemaRead",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account-id>:role/<effective-ingestion-role>"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::<bucket>/<object-key>"
    }
  ]
}

If static or profile credentials resolve to an IAM user, use the user’s ARN as the bucket-policy principal and grant s3:GetObject to that user through an identity policy.

The assumeRoleArn setting selects the AWS credentials used by ingestion, but it doesn’t grant S3 access. The target role becomes the effective ingestion principal, so it must have s3:GetObject permission. For cross-account S3 access, the bucket policy must also name the target role as the principal. For more information, see Policies and Permissions in Amazon S3.

If the schema object uses server-side encryption with AWS Key Management Service (AWS KMS) keys, grant the effective principal kms:Decrypt permission on the key. Cross-account access requires a customer-managed KMS key because the AWS-managed aws/s3 key can’t be shared across accounts. The customer-managed key policy must also allow the effective principal.

This policy assumes that the bucket owner owns the schema object or uses Bucket owner enforced Object Ownership. If another account owns the object and access control lists (ACLs) are enabled, the object owner must grant read access or transfer ownership to the bucket owner.

Metadata Ingestion

Connection Options

1. Configure the Schema Source

   Configure one schema source:

   • OpenAPI Schema URL: Enter the HTTP or HTTPS location of the OpenAPI schema, such as https://petstore3.swagger.io/api/v3/openapi.json.
   • OpenAPI Schema S3 URL: Enter the HTTPS S3 object URL and configure the AWS Region and credentials described in Configure an S3-Hosted Schema.

   Optional: In Token, enter a bearer token only when the OpenAPI Schema URL requires authentication.

2. Test the Connection

   Once the credentials have been added, click on Test Connection and Save the changes.

   
3. Schedule the Ingestion and Deploy

   Scheduling can be set up at an hourly, daily, weekly, or manual cadence. The timezone is in UTC. Select a Start Date to schedule for ingestion. It is optional to add an End Date.

   Review your configuration settings. If they match what you intended, click Deploy to create the service and schedule metadata ingestion.

   If something doesn’t look right, click the Back button to return to the appropriate step and change the settings as needed.

   After configuring the workflow, you can click on Deploy to create the pipeline.

   
4. View the Ingestion Pipeline

   Once the workflow has been successfully deployed, you can view the Ingestion Pipeline running from the Service Page.

   

   If AutoPilot is enabled, workflows like usage tracking, data lineage, and similar tasks will be handled automatically. Users don’t need to set up or manage them - AutoPilot takes care of everything in the system.

When using a Hybrid Ingestion Runner, any sensitive credential fields—such as passwords, API keys, or private keys—must reference secrets using the following format:

password: secret:/my/database/password

This applies only to fields marked as secrets in the connection form (these typically mask input and show a visibility toggle icon). For a complete guide on managing secrets in hybrid setups, see the Hybrid Ingestion Runner Secret Management Guide.

Troubleshooting

REST Troubleshooting

Learn more about how to troubleshoot common REST connector issues and resolve configuration or ingestion errors.