Uninstallation

This guide is for the Snowflake administrator (ACCOUNTADMIN) of an account where Genesis runs as a Snowflake Native App. The default app name is GENESIS_DATA_AGENTS. If you installed it under another name, use that name in every command below.

Before you start

Back up the encryption master key before uninstalling if you enabled encryption. In Genesis, open Config → Secrets and use Back up key to save a copy of GENESIS_SECRETS.PUBLIC.GENESIS_ENCRYPTION_KEY in your own secret store. See Secrets — encryption setup and status.
Export anything you want to keep. Everything inside Genesis is deleted permanently. Export threads, agents or missions from Genesis, or take a full snapshot to S3/GCS (Genesis 1.19.95+).
Check your event table. Run SHOW PARAMETERS LIKE 'EVENT_TABLE' IN ACCOUNT;. If it points into a database you will drop below, run ALTER ACCOUNT UNSET EVENT_TABLE; first.

Uninstall the app

First list what the app owns outside itself, so nothing you want to keep is dropped unseen:

SHOW OBJECTS OWNED BY APPLICATION GENESIS_DATA_AGENTS;
-- For each object you want to keep, transfer its ownership to one of your roles, e.g.:
-- GRANT OWNERSHIP ON DATABASE <db> TO ROLE <your_role>;

Then drop the app:

DROP APPLICATION GENESIS_DATA_AGENTS CASCADE;

Or in Snowsight: Catalog › Apps › … › Uninstall, then choose “No, delete all objects created outside the app”.This removes:

the app and all its data: threads, agents, missions, knowledge, files, connections, stored credentials, users and settings
the compute pool GENESIS_DATA_AGENTS_POOL and its running service
the warehouse GENESIS_XSMALL
the service endpoint integration (SNOWSERVICE-…)
any database the app created, including ones agents built
every grant you gave the app, and its event-sharing settings

This also deletes databases the app created. If you want to keep one, transfer its ownership to one of your roles first. The uninstall cannot be undone.

Optional cleanup

These objects were created by your team, not by the app, so they stay behind. Open each question that applies to you. Each block is already in the right order.

Did you enable the encryption key?

A secrets database with the key, its network rule and an external access integration remain.

-- Save the key first (see "Before you start")
DROP EXTERNAL ACCESS INTEGRATION IF EXISTS GENESIS_ENCRYPTION_EAI;
DROP DATABASE IF EXISTS GENESIS_SECRETS;   -- also drops GENESIS_ENCRYPTION_KEY and its network rule

Did you approve external connections in Snowsight (OpenAI, Slack, GitHub, Google, Jira, …)?

Snowsight created one external access integration per connection you approved. It also created a database that holds their network rules.

SHOW INTEGRATIONS LIKE 'GENESIS_DATA_AGENTS_%_EXTERNAL_ACCESS';
-- repeat for each name listed, e.g.:
DROP EXTERNAL ACCESS INTEGRATION IF EXISTS GENESIS_DATA_AGENTS_OPENAI_EXTERNAL_ACCESS_EXTERNAL_ACCESS;
DROP EXTERNAL ACCESS INTEGRATION IF EXISTS GENESIS_DATA_AGENTS_<CONNECTION>_EXTERNAL_ACCESS_EXTERNAL_ACCESS;
DROP DATABASE IF EXISTS GENESIS_DATA_AGENTS_APP_DATA;

Did you use the "Grant Data Access" helper, or give Genesis a key-pair secret?

The helper database GENESIS_LOCAL_DB remains, along with any key-pair secret you bound to Genesis. Your team may also have put other things in it, such as the account event table. Look inside before you drop it.

SHOW SCHEMAS IN DATABASE GENESIS_LOCAL_DB;
DROP SECRET IF EXISTS <db>.<schema>.<private_key_secret>;   -- only if stored outside GENESIS_LOCAL_DB
-- If nothing in it needs to be kept (unset the event table first if it lives here):
DROP DATABASE IF EXISTS GENESIS_LOCAL_DB;
-- Otherwise remove only the Genesis helper schema and keep the rest:
-- DROP SCHEMA IF EXISTS GENESIS_LOCAL_DB.SETTINGS;

Did you set up restricted caller's rights?

A network rule for the Genesis compute pool remains, and it is still listed in your account network policy.

-- 1. Take the rule out of your network policy first.
--    On AWS accounts (ADD/REMOVE is in preview there):
ALTER NETWORK POLICY <your_network_policy>
  REMOVE ALLOWED_NETWORK_RULE_LIST = '<db>.<schema>.GENESIS_DATA_AGENTS_RCR_INGRESS';
--    On any account: read the current list, then set it again without the Genesis rule,
--    listing every rule you keep as its own quoted entry.
DESCRIBE NETWORK POLICY <your_network_policy>;
ALTER NETWORK POLICY <your_network_policy>
  SET ALLOWED_NETWORK_RULE_LIST = ('<db>.<schema>.<rule_a>', '<db>.<schema>.<rule_b>');
-- 2. Then drop the rule
DROP NETWORK RULE IF EXISTS <db>.<schema>.GENESIS_DATA_AGENTS_RCR_INGRESS;

If the Genesis rule is the only rule in the policy’s allowed list, the list cannot simply be emptied. Decide with the policy’s owner how to replace or retire the policy before you drop the rule.

Did you enable custom credentials (the GENESIS_SERVICE user)?

The service user and its access token remain, along with its network policy and two network rules.

ALTER USER IF EXISTS GENESIS_SERVICE UNSET NETWORK_POLICY;
DROP USER IF EXISTS GENESIS_SERVICE;              -- also removes its access token
DROP NETWORK POLICY IF EXISTS GENESIS_SERVICE_POLICY;
DROP NETWORK RULE IF EXISTS <db>.<schema>.GENESIS_POOL_INGRESS;
DROP NETWORK RULE IF EXISTS <db>.<schema>.GENESIS_NO_PUBLIC_IPV4;

Did you connect Tailscale?

A database holding your Tailscale auth key remains.

DROP DATABASE IF EXISTS GENESIS_TSNET;   -- also drops the TSNET_AUTH_KEY secret

Did you add Snowflake OAuth connections?

One OAuth security integration per connection remains.

SHOW INTEGRATIONS LIKE 'GENESIS_%_OAUTH';
DROP SECURITY INTEGRATION IF EXISTS GENESIS_<CONNECTION>_OAUTH;   -- repeat per row

Did you set up the Microsoft Teams relay?

The relay’s service user and its role remain.

DROP USER IF EXISTS GENESIS_TEAMS_RELAY;     -- or <relay_user>
DROP ROLE IF EXISTS GENESIS_TEAMS_RELAY;     -- or <relay_role>

Did you connect Airflow (MWAA) without a stored key?

The workload-identity secret remains. The SECURITY_DB database may be shared with other tools, so keep it unless only Genesis used it.

DROP SECRET IF EXISTS SECURITY_DB.IDENTITY.GENESIS_MWAA;
-- only if nothing else uses it:
-- DROP DATABASE IF EXISTS SECURITY_DB;

Did you deploy Genesis apps outside Snowflake (remote app access)?

A service user and role created for remote app access remain.

DROP USER IF EXISTS GENESIS_REMOTE_APP_SVC;
DROP ROLE IF EXISTS GENESIS_REMOTE_APP_ROLE;

Sharing stops when the app is dropped. Your account event table stays, and so do events already shared with Genesis. Ask Genesis support if you want those deleted.

-- Only if no other app or workload uses the event table:
ALTER ACCOUNT UNSET EVENT_TABLE;
DROP TABLE IF EXISTS <db>.<schema>.<event_table>;

Did you create a warehouse, database, role or key for Genesis yourself?

These stay as they are. They include:

a warehouse you gave Genesis;
Cortex model roles you granted to your own roles;
an RSA key you added to a user for a Genesis connection;
optimization-demo databases (CLI805_OPT_…).

Remove only what nothing else uses.

DROP WAREHOUSE IF EXISTS <warehouse>;
REVOKE APPLICATION ROLE SNOWFLAKE."CORTEX-MODEL-ROLE-<MODEL>" FROM ROLE <role>;
ALTER USER <user> UNSET RSA_PUBLIC_KEY;
DROP DATABASE IF EXISTS CLI805_OPT_<scope>;

Confirm it's clean (optional)

SHOW APPLICATIONS LIKE '%GENESIS%';
SHOW DATABASES LIKE '%GENESIS%';
SHOW INTEGRATIONS LIKE '%GENESIS%';
SHOW USERS LIKE '%GENESIS%';
SHOW ROLES LIKE '%GENESIS%';
SHOW NETWORK RULES LIKE '%GENESIS%' IN ACCOUNT;
SHOW WAREHOUSES LIKE '%GENESIS%';

Anything still listed is either something you chose to keep or something to review. Objects you named yourself (a warehouse, secret, role or user without GENESIS in its name) will not show up here, so check those by name.

Snowflake references: DROP APPLICATION · Uninstall a Native App · Manage apps · Set up event tracing for an app

Getting Started

Getting to Know Genesis

Creating A Mission

User Guide

Blueprint

Genesis Data Agents

Genesis Prover

Genesis Apps

Genesis REST API

Genesis Agent Security Controls

Genesis Data Agent's Toolkit

Setup

Slack and Teams

Data Connections

Deployment Options

Before you start

​Before you start

Before you start