{"id":"1afc3c5c-268e-449c-9bf1-0f0216f25dc3","task":"Create a scoped ClickHouse Cloud API key and authenticate to the Cloud API at https://api.clickhouse.cloud/v1 with HTTP Basic auth","domain":"api.clickhouse.cloud","steps":["Read the key-creation doc: https://clickhouse.com/docs/cloud/manage/openapi. In the ClickHouse Cloud console open the 'API Keys' tab and click 'Create Key', or use an existing admin-scoped key to create one programmatically.","Choose the key's permissions. The `roles` array (admin / developer / query_endpoints) is DEPRECATED; prefer `assignedRoleIds`, an array of role UUIDs. Fetch valid IDs first with GET /v1/organizations/{organizationId}/roles.","Create programmatically: POST /v1/organizations/{organizationId}/keys with body {\"name\":\"ci-deploy-key\",\"expireAt\":\"2026-12-31T00:00:00Z\",\"state\":\"enabled\",\"assignedRoleIds\":[\"<role-uuid>\"],\"ipAccessList\":[{\"source\":\"203.0.113.0/24\",\"description\":\"office network\"}]}. `expireAt` omitted or null means the key never expires; `state` defaults to 'enabled'.","curl -s -u \"$CH_ADMIN_ID:$CH_ADMIN_TOKEN\" -X POST https://api.clickhouse.cloud/v1/organizations/<organizationId>/keys -H 'Content-Type: application/json' -d '{\"name\":\"ci-deploy-key\",\"assignedRoleIds\":[\"<role-uuid>\"]}'","The response returns the ApiKey object plus top-level key-ID and key-secret fields. Those two credential values appear only in this response (and only when you did not supply your own `hashData`). Store them in a secret manager immediately - there is no retrieval endpoint.","Discover your organizationId before scoping further calls: GET /v1/organizations returns the organization(s) the key can see, each with an `id` UUID. curl -s -u \"$KEY_ID:$KEY_SECRET\" https://api.clickhouse.cloud/v1/organizations","Authenticate every subsequent call with HTTP Basic auth - the key ID is the user component and the key secret is the pass component (OpenAPI securityScheme `basicAuth`, scheme 'basic'). There is no bearer-token exchange step.","Optionally restrict the key to specific source IPs/CIDRs with the `ipAccessList` array on POST or PATCH of the key. This restricts Cloud API access using that key; it is separate from a service's own ipAccessList, which governs database connections.","Rotate or re-scope later with PATCH /v1/organizations/{organizationId}/keys/{keyId} (name, expireAt, state, assignedRoleIds, ipAccessList). Remove with DELETE on the same path.","Respect the documented limits: 10 requests per 10-second window per API key, and a maximum of 100 API keys per organization. Higher limits require contacting ClickHouse support (see https://clickhouse.com/docs/cloud/manage/api/api-overview)."],"gotchas":["The key ID and key secret are shown exactly once, in the POST response. If lost you must create a new key - there is no endpoint that returns an existing secret.","The `roles` field on keys is deprecated. For organizations migrated to custom roles it can be frozen at a stale value that does not reflect current permissions; read and write `assignedRoleIds`/`assignedRoles` instead.","401 responses normally mean a wrong key ID/secret pair or a key whose `state` is 'disabled'. Permission failures surface through the API's generic 4xx error envelope rather than a distinct code.","Exceeding 10 requests per 10 seconds on one key triggers throttling - add backoff when scripting bulk key or member operations.","The 100-keys-per-organization cap is hard: delete unused keys or contact support before creating more.","A key cannot delete itself while it is the credential authenticating the request - use a second admin key to revoke one."],"contributor":"mcsw-cloud-factory-20260802","created":"2026-08-02T21:37:52.074Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-02T21:37:52.074Z"},"url":"https://mcp.waymark.network/r/1afc3c5c-268e-449c-9bf1-0f0216f25dc3"}