List ClickHouse Cloud backups, set retention and frequency, attach a customer-owned backup bucket, and restore into a new service via the Cloud API

Documented steps

1. List backups (most recent first): GET /v1/organizations/{organizationId}/services/{serviceId}/backups. Each item includes id, status ('done'|'error'|'in_progress'), startedAt/finishedAt, sizeInBytes, durationInSeconds, type ('full'|'incremental'), and backupName.
2. Fetch one backup with GET /v1/organizations/{organizationId}/services/{serviceId}/backups/{backupId}.
3. Read current retention settings: GET /v1/organizations/{organizationId}/services/{serviceId}/backupConfiguration returns {backupPeriodInHours, backupRetentionPeriodInHours, backupStartTime}.
4. Update them with PATCH on the same path. backupRetentionPeriodInHours must be a whole number of days between 24 (1 day) and 1080 (45 days), i.e. a multiple of 24. backupStartTime is HH:MM evaluated in UTC. Setting any field to null resets it to its default.
5. curl -u "$KEY_ID:$KEY_SECRET" -X PATCH https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID/backupConfiguration -H 'Content-Type: application/json' -d '{"backupRetentionPeriodInHours":720,"backupStartTime":"02:00"}'
6. To send backups to your own bucket, GET .../backupBucket to inspect the current config, then POST .../backupBucket with a provider-specific body - AWS: {"bucketProvider":"AWS","bucketPath":...,"iamRoleArn":...,"iamRoleSessionName":...}; GCP: {"bucketProvider":"GCP","bucketPath":...,"accessKeyId":...,"secretAccessKey":...} (HMAC keys); Azure: {"bucketProvider":"AZURE","containerName":...,"connectionString":...}. Source all secret values from a secret manager, never from source control.
7. Change it with PATCH .../backupBucket (resend the provider's secrets) or remove it with DELETE .../backupBucket.
8. Restore by creating a NEW service from a backup: POST /v1/organizations/{organizationId}/services with the usual fields plus {"backupId":"<backup-uuid>"}. There is no in-place restore onto the original service.
9. curl -u "$KEY_ID:$KEY_SECRET" -X POST https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services -H 'Content-Type: application/json' -d '{"name":"restored svc","provider":"aws","region":"us-east-1","backupId":"<backup-uuid>"}'
10. Poll GET /v1/organizations/{organizationId}/services/{serviceId} on the new service until it reports 'running', then validate row counts against the source before cutting traffic over.
11. Docs: https://clickhouse.com/docs/cloud/manage/backups/overview and https://clickhouse.com/docs/cloud/manage/backups/configurable-backups