Provision a new ClickHouse Cloud service via POST /v1/organizations/{orgId}/services and poll until it reaches the running state

Documented steps

1. Authenticate with HTTP Basic auth (the key ID is the user component and the key secret is the pass component). Base URL: https://api.clickhouse.cloud/v1.
2. Build the create body for POST /v1/organizations/{organizationId}/services. In practice you need at least: name (alphanumeric with spaces, up to 50 chars), provider (enum aws|gcp|azure), and region (enum, e.g. us-east-1, us-east-2, us-west-2, eu-west-1, eu-west-2, eu-central-1, ap-south-1, ap-southeast-1/2, ap-northeast-1/2, ca-central-1, il-central-1 for AWS; us-east1, us-central1, europe-west2, europe-west4, asia-southeast1, asia-northeast1 for GCP; eastus, eastus2, westus3, germanywestcentral, centralus for Azure).
3. Sizing: on BASIC/SCALE/ENTERPRISE-priced organizations omit the deprecated `tier` and set minReplicaMemoryGb / maxReplicaMemoryGb (multiples of 4, minimum 8, maximum 356) plus numReplicas (1-20) for vertical autoscaling, or autoscalingMode:"horizontal" with minReplicas/maxReplicas (1-20). Legacy organizations may still pass tier ('development', 'production', 'dedicated_*').
4. Set ipAccessList as an array of {source: <IP or CIDR>, description}. It is optional in the spec and the omitted-default is not documented there - always pass explicit entries so the resulting exposure is deliberate rather than inherited.
5. curl -u "$KEY_ID:$KEY_SECRET" -X POST https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services -H 'Content-Type: application/json' -d '{"name":"analytics prod","provider":"aws","region":"us-east-1","minReplicaMemoryGb":8,"maxReplicaMemoryGb":32,"ipAccessList":[{"source":"203.0.113.4/32","description":"office"}]}'
6. The response contains the service object plus a one-time credential for the default user. Capture it into a secret manager immediately - it is returned only here and by the credential-rotation endpoint.
7. Read the endpoints array from the response: entries of {protocol: https|nativesecure|mysql, host, port, username}. Use the https entry for the HTTP interface and nativesecure for the native TCP protocol.
8. Poll GET /v1/organizations/{organizationId}/services/{serviceId} every 5-10 seconds until state is 'running'. curl -u "$KEY_ID:$KEY_SECRET" https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID
9. Treat 'failed' or 'degraded' as terminal conditions to investigate in the console rather than polling indefinitely; cap the poll loop at a few minutes.
10. Optional at creation: releaseChannel ('slow'|'default'|'fast'), tags, dataWarehouseId (to place the service in an existing warehouse), complianceType ('hipaa'|'pci'), and hasTransparentDataEncryption - TDE is ENTERPRISE-only and can ONLY be enabled at service creation.
11. Once running, connect as the default user with the captured credential and run a smoke query before handing the service to consumers.
12. Docs: https://clickhouse.com/docs/cloud/manage/api/api-overview and https://clickhouse.com/docs/cloud/manage/openapi