> ## Documentation Index
> Fetch the complete documentation index at: https://docs.genesiscomputing.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Uninstallation

> How to remove the Genesis Data Agents Snowflake Native App, and the objects your team created for it, from a Snowflake account.

***

This guide is for the Snowflake administrator (**ACCOUNTADMIN**) of an account where Genesis runs as a Snowflake Native App. The default app name is `GENESIS_DATA_AGENTS`. If you installed it under another name, use that name in every command below.

## Before you start

* **Back up the encryption master key** before uninstalling if you enabled encryption. In Genesis, open **Config → Secrets** and use **Back up key** to save a copy of `GENESIS_SECRETS.PUBLIC.GENESIS_ENCRYPTION_KEY` in your own secret store. See [Secrets — encryption setup and status](/docs/Setup/Secrets#encryption-setup-and-status).
* **Export anything you want to keep.** Everything inside Genesis is deleted permanently. Export threads, agents or missions from Genesis, or take a full snapshot to S3/GCS (Genesis 1.19.95+).
* **Check your event table.** Run `SHOW PARAMETERS LIKE 'EVENT_TABLE' IN ACCOUNT;`. If it points into a database you will drop below, run `ALTER ACCOUNT UNSET EVENT_TABLE;` first.

<Steps>
  <Step title="Uninstall the app">
    First list what the app owns outside itself, so nothing you want to keep is dropped unseen:

    ```sql theme={null}
    SHOW OBJECTS OWNED BY APPLICATION GENESIS_DATA_AGENTS;
    -- For each object you want to keep, transfer its ownership to one of your roles, e.g.:
    -- GRANT OWNERSHIP ON DATABASE <db> TO ROLE <your_role>;
    ```

    Then drop the app:

    ```sql theme={null}
    DROP APPLICATION GENESIS_DATA_AGENTS CASCADE;
    ```

    Or in Snowsight: **Catalog › Apps › … › Uninstall**, then choose **"No, delete all objects created outside the app"**.

    This removes:

    * the app and all its data: threads, agents, missions, knowledge, files, connections, stored credentials, users and settings
    * the compute pool `GENESIS_DATA_AGENTS_POOL` and its running service
    * the warehouse `GENESIS_XSMALL`
    * the service endpoint integration (`SNOWSERVICE-…`)
    * any database the app created, including ones agents built
    * every grant you gave the app, and its event-sharing settings

    <Warning>
      This also deletes databases the app created. If you want to keep one, transfer its ownership to one of your roles first. The uninstall cannot be undone.
    </Warning>
  </Step>

  <Step title="Optional cleanup">
    These objects were created by your team, not by the app, so they stay behind. Open each question that applies to you. Each block is already in the right order.

    <AccordionGroup>
      <Accordion title="Did you enable the encryption key?">
        A secrets database with the key, its network rule and an external access integration remain.

        ```sql theme={null}
        -- Save the key first (see "Before you start")
        DROP EXTERNAL ACCESS INTEGRATION IF EXISTS GENESIS_ENCRYPTION_EAI;
        DROP DATABASE IF EXISTS GENESIS_SECRETS;   -- also drops GENESIS_ENCRYPTION_KEY and its network rule
        ```
      </Accordion>

      <Accordion title="Did you approve external connections in Snowsight (OpenAI, Slack, GitHub, Google, Jira, …)?">
        Snowsight created one external access integration per connection you approved. It also created a database that holds their network rules.

        ```sql theme={null}
        SHOW INTEGRATIONS LIKE 'GENESIS_DATA_AGENTS_%_EXTERNAL_ACCESS';
        -- repeat for each name listed, e.g.:
        DROP EXTERNAL ACCESS INTEGRATION IF EXISTS GENESIS_DATA_AGENTS_OPENAI_EXTERNAL_ACCESS_EXTERNAL_ACCESS;
        DROP EXTERNAL ACCESS INTEGRATION IF EXISTS GENESIS_DATA_AGENTS_<CONNECTION>_EXTERNAL_ACCESS_EXTERNAL_ACCESS;
        DROP DATABASE IF EXISTS GENESIS_DATA_AGENTS_APP_DATA;
        ```
      </Accordion>

      <Accordion title="Did you use the &#x22;Grant Data Access&#x22; helper, or give Genesis a key-pair secret?">
        The helper database `GENESIS_LOCAL_DB` remains, along with any key-pair secret you bound to Genesis. Your team may also have put other things in it, such as the account event table. Look inside before you drop it.

        ```sql theme={null}
        SHOW SCHEMAS IN DATABASE GENESIS_LOCAL_DB;
        DROP SECRET IF EXISTS <db>.<schema>.<private_key_secret>;   -- only if stored outside GENESIS_LOCAL_DB
        -- If nothing in it needs to be kept (unset the event table first if it lives here):
        DROP DATABASE IF EXISTS GENESIS_LOCAL_DB;
        -- Otherwise remove only the Genesis helper schema and keep the rest:
        -- DROP SCHEMA IF EXISTS GENESIS_LOCAL_DB.SETTINGS;
        ```
      </Accordion>

      <Accordion title="Did you set up restricted caller's rights?">
        A network rule for the Genesis compute pool remains, and it is still listed in your account network policy.

        ```sql theme={null}
        -- 1. Take the rule out of your network policy first.
        --    On AWS accounts (ADD/REMOVE is in preview there):
        ALTER NETWORK POLICY <your_network_policy>
          REMOVE ALLOWED_NETWORK_RULE_LIST = '<db>.<schema>.GENESIS_DATA_AGENTS_RCR_INGRESS';
        --    On any account: read the current list, then set it again without the Genesis rule,
        --    listing every rule you keep as its own quoted entry.
        DESCRIBE NETWORK POLICY <your_network_policy>;
        ALTER NETWORK POLICY <your_network_policy>
          SET ALLOWED_NETWORK_RULE_LIST = ('<db>.<schema>.<rule_a>', '<db>.<schema>.<rule_b>');
        -- 2. Then drop the rule
        DROP NETWORK RULE IF EXISTS <db>.<schema>.GENESIS_DATA_AGENTS_RCR_INGRESS;
        ```

        If the Genesis rule is the only rule in the policy's allowed list, the list cannot simply be emptied. Decide with the policy's owner how to replace or retire the policy before you drop the rule.
      </Accordion>

      <Accordion title="Did you enable custom credentials (the GENESIS_SERVICE user)?">
        The service user and its access token remain, along with its network policy and two network rules.

        ```sql theme={null}
        ALTER USER IF EXISTS GENESIS_SERVICE UNSET NETWORK_POLICY;
        DROP USER IF EXISTS GENESIS_SERVICE;              -- also removes its access token
        DROP NETWORK POLICY IF EXISTS GENESIS_SERVICE_POLICY;
        DROP NETWORK RULE IF EXISTS <db>.<schema>.GENESIS_POOL_INGRESS;
        DROP NETWORK RULE IF EXISTS <db>.<schema>.GENESIS_NO_PUBLIC_IPV4;
        ```
      </Accordion>

      <Accordion title="Did you connect Tailscale?">
        A database holding your Tailscale auth key remains.

        ```sql theme={null}
        DROP DATABASE IF EXISTS GENESIS_TSNET;   -- also drops the TSNET_AUTH_KEY secret
        ```
      </Accordion>

      <Accordion title="Did you add Snowflake OAuth connections?">
        One OAuth security integration per connection remains.

        ```sql theme={null}
        SHOW INTEGRATIONS LIKE 'GENESIS_%_OAUTH';
        DROP SECURITY INTEGRATION IF EXISTS GENESIS_<CONNECTION>_OAUTH;   -- repeat per row
        ```
      </Accordion>

      <Accordion title="Did you set up the Microsoft Teams relay?">
        The relay's service user and its role remain.

        ```sql theme={null}
        DROP USER IF EXISTS GENESIS_TEAMS_RELAY;     -- or <relay_user>
        DROP ROLE IF EXISTS GENESIS_TEAMS_RELAY;     -- or <relay_role>
        ```
      </Accordion>

      <Accordion title="Did you connect Airflow (MWAA) without a stored key?">
        The workload-identity secret remains. The `SECURITY_DB` database may be shared with other tools, so keep it unless only Genesis used it.

        ```sql theme={null}
        DROP SECRET IF EXISTS SECURITY_DB.IDENTITY.GENESIS_MWAA;
        -- only if nothing else uses it:
        -- DROP DATABASE IF EXISTS SECURITY_DB;
        ```
      </Accordion>

      <Accordion title="Did you deploy Genesis apps outside Snowflake (remote app access)?">
        A service user and role created for remote app access remain.

        ```sql theme={null}
        DROP USER IF EXISTS GENESIS_REMOTE_APP_SVC;
        DROP ROLE IF EXISTS GENESIS_REMOTE_APP_ROLE;
        ```
      </Accordion>

      <Accordion title="Did you share events (logs) with Genesis?">
        Sharing stops when the app is dropped. Your account event table stays, and so do events already shared with Genesis. Ask Genesis support if you want those deleted.

        ```sql theme={null}
        -- Only if no other app or workload uses the event table:
        ALTER ACCOUNT UNSET EVENT_TABLE;
        DROP TABLE IF EXISTS <db>.<schema>.<event_table>;
        ```
      </Accordion>

      <Accordion title="Did you create a warehouse, database, role or key for Genesis yourself?">
        These stay as they are. They include:

        * a warehouse you gave Genesis;
        * Cortex model roles you granted to your own roles;
        * an RSA key you added to a user for a Genesis connection;
        * optimization-demo databases (`CLI805_OPT_…`).

        Remove only what nothing else uses.

        ```sql theme={null}
        DROP WAREHOUSE IF EXISTS <warehouse>;
        REVOKE APPLICATION ROLE SNOWFLAKE."CORTEX-MODEL-ROLE-<MODEL>" FROM ROLE <role>;
        ALTER USER <user> UNSET RSA_PUBLIC_KEY;
        DROP DATABASE IF EXISTS CLI805_OPT_<scope>;
        ```
      </Accordion>
    </AccordionGroup>
  </Step>

  <Step title="Confirm it's clean (optional)">
    ```sql theme={null}
    SHOW APPLICATIONS LIKE '%GENESIS%';
    SHOW DATABASES LIKE '%GENESIS%';
    SHOW INTEGRATIONS LIKE '%GENESIS%';
    SHOW USERS LIKE '%GENESIS%';
    SHOW ROLES LIKE '%GENESIS%';
    SHOW NETWORK RULES LIKE '%GENESIS%' IN ACCOUNT;
    SHOW WAREHOUSES LIKE '%GENESIS%';
    ```

    Anything still listed is either something you chose to keep or something to review. Objects you named yourself (a warehouse, secret, role or user without `GENESIS` in its name) will not show up here, so check those by name.
  </Step>
</Steps>

**Snowflake references:** [DROP APPLICATION](https://docs.snowflake.com/en/sql-reference/sql/drop-application) · [Uninstall a Native App](https://docs.snowflake.com/en/developer-guide/native-apps/consumer-guide-uninstall) · [Manage apps](https://docs.snowflake.com/en/developer-guide/native-apps/ui-consumer-managing-applications) · [Set up event tracing for an app](https://docs.snowflake.com/en/developer-guide/native-apps/ui-consumer-enable-logging)