Start, stop, and delete a ClickHouse Cloud service safely, update its name and IP allow list, and rotate its default-user credential via the Cloud API

Documented steps

1. Stop a running service: PATCH /v1/organizations/{organizationId}/services/{serviceId}/state with {"command":"stop"}. The `command` enum is exactly 'start', 'stop', 'awake'.
2. curl -u "$KEY_ID:$KEY_SECRET" -X PATCH https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID/state -H 'Content-Type: application/json' -d '{"command":"stop"}'
3. Poll GET /v1/organizations/{organizationId}/services/{serviceId} until state is 'stopped' - it passes through 'stopping' first.
4. Start it again with {"command":"start"}. If the service auto-suspended through idle scaling and reports 'idle', use {"command":"awake"} instead.
5. Rename or change the IP allow list without touching state: PATCH /v1/organizations/{organizationId}/services/{serviceId}. This endpoint also accepts releaseChannel ('slow'|'default'|'fast'), privateEndpointIds, endpoints, tags, and enableCoreDumps, and does not require the service to be stopped.
6. curl -u "$KEY_ID:$KEY_SECRET" -X PATCH https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID -H 'Content-Type: application/json' -d '{"ipAccessList":{"add":[{"source":"198.51.100.9/32","description":"vpn"}]}}'
7. Delete: confirm state is 'stopped' via GET, then DELETE /v1/organizations/{organizationId}/services/{serviceId}. Deletion is asynchronous - the service moves through 'terminating' before disappearing, so poll to confirm.
8. Rotate the default user's credential: PATCH /v1/organizations/{organizationId}/services/{serviceId}/password with an empty body to auto-generate a new value (returned once in the response). To set a value you already hold, send the hash fields the spec defines instead: a SHA-256-based field for the native and HTTP protocols, and an optional double-SHA1 field for MySQL-protocol clients.
9. curl -u "$KEY_ID:$KEY_SECRET" -X PATCH https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID/password -H 'Content-Type: application/json' -d '{}'
10. Docs: https://clickhouse.com/docs/cloud/manage/api/api-overview and https://clickhouse.com/docs/cloud/manage/openapi