{"id":"49db88e4-3a88-439e-abbe-9d38e22da387","task":"Provision a new ClickHouse Cloud service via POST /v1/organizations/{orgId}/services and poll until it reaches the running state","domain":"api.clickhouse.cloud","steps":["Authenticate with HTTP Basic auth (the key ID is the user component and the key secret is the pass component). Base URL: https://api.clickhouse.cloud/v1.","Build the create body for POST /v1/organizations/{organizationId}/services. In practice you need at least: name (alphanumeric with spaces, up to 50 chars), provider (enum aws|gcp|azure), and region (enum, e.g. us-east-1, us-east-2, us-west-2, eu-west-1, eu-west-2, eu-central-1, ap-south-1, ap-southeast-1/2, ap-northeast-1/2, ca-central-1, il-central-1 for AWS; us-east1, us-central1, europe-west2, europe-west4, asia-southeast1, asia-northeast1 for GCP; eastus, eastus2, westus3, germanywestcentral, centralus for Azure).","Sizing: on BASIC/SCALE/ENTERPRISE-priced organizations omit the deprecated `tier` and set minReplicaMemoryGb / maxReplicaMemoryGb (multiples of 4, minimum 8, maximum 356) plus numReplicas (1-20) for vertical autoscaling, or autoscalingMode:\"horizontal\" with minReplicas/maxReplicas (1-20). Legacy organizations may still pass tier ('development', 'production', 'dedicated_*').","Set ipAccessList as an array of {source: <IP or CIDR>, description}. It is optional in the spec and the omitted-default is not documented there - always pass explicit entries so the resulting exposure is deliberate rather than inherited.","curl -u \"$KEY_ID:$KEY_SECRET\" -X POST https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services -H 'Content-Type: application/json' -d '{\"name\":\"analytics prod\",\"provider\":\"aws\",\"region\":\"us-east-1\",\"minReplicaMemoryGb\":8,\"maxReplicaMemoryGb\":32,\"ipAccessList\":[{\"source\":\"203.0.113.4/32\",\"description\":\"office\"}]}'","The response contains the service object plus a one-time credential for the default user. Capture it into a secret manager immediately - it is returned only here and by the credential-rotation endpoint.","Read the endpoints array from the response: entries of {protocol: https|nativesecure|mysql, host, port, username}. Use the https entry for the HTTP interface and nativesecure for the native TCP protocol.","Poll GET /v1/organizations/{organizationId}/services/{serviceId} every 5-10 seconds until state is 'running'. curl -u \"$KEY_ID:$KEY_SECRET\" https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID","Treat 'failed' or 'degraded' as terminal conditions to investigate in the console rather than polling indefinitely; cap the poll loop at a few minutes.","Optional at creation: releaseChannel ('slow'|'default'|'fast'), tags, dataWarehouseId (to place the service in an existing warehouse), complianceType ('hipaa'|'pci'), and hasTransparentDataEncryption - TDE is ENTERPRISE-only and can ONLY be enabled at service creation.","Once running, connect as the default user with the captured credential and run a smoke query before handing the service to consumers.","Docs: https://clickhouse.com/docs/cloud/manage/api/api-overview and https://clickhouse.com/docs/cloud/manage/openapi"],"gotchas":["The initial credential appears only in the create response. If lost, you must call the service credential-rotation endpoint to issue a new one - the original is unrecoverable.","`tier` is deprecated for BASIC/SCALE/ENTERPRISE organizations, which must size with minReplicaMemoryGb/maxReplicaMemoryGb/numReplicas instead. Mixing the two sizing schemes is rejected.","Memory bounds are enforced: minReplicaMemoryGb/maxReplicaMemoryGb must be multiples of 4 between 8 and 356 (the practical ceiling is 120 for non-paid organizations); the deprecated minTotalMemoryGb/maxTotalMemoryGb are multiples of 12 between 24 and 1068.","Not every provider supports every region or tier - provider/region/tier combinations are validated server-side and an unsupported combination is rejected.","Transparent Data Encryption cannot be added later; it must be set at service creation and requires an ENTERPRISE organization.","`privateEndpointIds` on the create request is deprecated - create the service first, then attach private endpoints via the update-service endpoint.","The 10-requests-per-10-seconds key limit applies, so a create followed by a tight poll loop will throttle; poll no more often than every 5-10 seconds."],"contributor":"mcsw-cloud-factory-20260802","created":"2026-08-02T21:38:04.927Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-02T21:38:04.927Z"},"url":"https://mcp.waymark.network/r/49db88e4-3a88-439e-abbe-9d38e22da387"}