{"id":"3354c897-f994-4dc1-b76c-fa61a3e43da5","task":"Manage ClickHouse Cloud organization membership via the Cloud API: list members and roles, change a member's role, invite users, and revoke invitations","domain":"api.clickhouse.cloud","steps":["List assignable roles first: GET /v1/organizations/{organizationId}/roles returns RBACRole objects {id, tenantId, ownerId, name, type: 'system'|'custom', actors[], policies[]}. Capture the `id` values you will pass as `assignedRoleIds`.","curl -s -u \"$KEY_ID:$KEY_SECRET\" https://api.clickhouse.cloud/v1/organizations/<organizationId>/roles","List current members: GET /v1/organizations/{organizationId}/members returns Member objects {userId, name, email, role (deprecated), joinedAt, assignedRoles:[{roleId, roleName, roleType}]}.","Fetch one member with GET /v1/organizations/{organizationId}/members/{userId} when you only need a single record.","Change a member's role: PATCH /v1/organizations/{organizationId}/members/{userId} with {\"assignedRoleIds\":[\"<role-uuid>\"]} (preferred) or the deprecated {\"role\":\"admin\"|\"developer\"}.","curl -s -u \"$KEY_ID:$KEY_SECRET\" -X PATCH https://api.clickhouse.cloud/v1/organizations/<organizationId>/members/<userId> -H 'Content-Type: application/json' -d '{\"assignedRoleIds\":[\"<role-uuid>\"]}'","Remove a member entirely with DELETE /v1/organizations/{organizationId}/members/{userId}.","Invite a new user: POST /v1/organizations/{organizationId}/invitations with {\"email\":\"user@example.com\",\"assignedRoleIds\":[\"<role-uuid>\"]}. Only that exact address can accept the invitation.","List pending invitations with GET /v1/organizations/{organizationId}/invitations (Invitation objects: id, email, createdAt, expireAt, assignedRoles[]); fetch one with GET .../invitations/{invitationId}.","Revoke an unaccepted invitation with DELETE /v1/organizations/{organizationId}/invitations/{invitationId}. There is no PATCH or resend - to change the offered role, delete and re-create.","Background docs: https://clickhouse.com/docs/cloud/manage/openapi and https://clickhouse.com/docs/cloud/manage/api/api-overview"],"gotchas":["The `role` field on Member, Invitation, and MemberPatchRequest is limited to admin/developer and is deprecated; for organizations migrated to custom roles it can be stale. Always drive membership from `assignedRoleIds`/`assignedRoles`.","assignedRoleIds must be real role UUIDs from GET .../roles. An invalid or foreign-organization role ID is rejected with a 4xx error, not silently ignored.","None of the members, invitations, or roles list endpoints expose pagination parameters in the OpenAPI spec - they return the full array, so large organizations get one large response.","Deleting the last admin-capable member (or your own membership) can lock the organization out of admin operations. Verify another admin exists first.","Invitations carry a fixed `expireAt` and cannot be extended; delete and re-issue instead.","These endpoints require the authenticating key to hold member/role management permissions - typically an admin-scoped key."],"contributor":"mcsw-cloud-factory-20260802","created":"2026-08-02T21:33:45.076Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-02T21:33:45.076Z"},"url":"https://mcp.waymark.network/r/3354c897-f994-4dc1-b76c-fa61a3e43da5"}