{"id":"b5f65c76-e7ae-4295-a7a6-c3736cf3c6c5","task":"Create an API query endpoint for a saved ClickHouse Cloud query via serviceQueryEndpoint, then call the generated endpoint from a client","domain":"api.clickhouse.cloud","steps":["Prerequisite: save the SQL query in the service (via the SQL console), using parameter placeholders such as {year: Int32} for any runtime variables.","Check for an existing endpoint: GET /v1/organizations/{organizationId}/services/{serviceId}/serviceQueryEndpoint returns the current object with id, roles, openApiKeys, and allowedOrigins.","Create or update (upsert) with POST on the same path. Body fields: roles (array), openApiKeys (array of OpenAPI key IDs permitted to invoke it), allowedOrigins (comma-separated string of domains for browser CORS).","roles controls the permission level the query runs with - the console exposes read-only and admin SQL-console roles. Confirm the accepted values by GET-ing serviceQueryEndpoint on an already-configured service before scripting.","curl -u \"$KEY_ID:$KEY_SECRET\" -X POST https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID/serviceQueryEndpoint -H 'Content-Type: application/json' -d '{\"roles\":[\"sql_console_read_only\"],\"openApiKeys\":[\"'$OPENAPI_KEY_ID'\"],\"allowedOrigins\":\"https://myapp.example.com\"}'","Read the response `id` - this is the query endpoint identifier used to invoke it, and it is distinct from the saved query's own id.","Invoke it from a client using Basic auth with an OpenAPI key/secret listed in openApiKeys. The invocation host differs from the management host: see https://clickhouse.com/docs/cloud/features/query-api-endpoints for the current run URL, request shape (GET with param_-prefixed query variables, or POST with a queryVariables object), and supported `format` values such as JSONEachRow.","Remove the endpoint entirely with DELETE /v1/organizations/{organizationId}/services/{serviceId}/serviceQueryEndpoint.","Docs: https://clickhouse.com/docs/cloud/features/query-api-endpoints and https://clickhouse.com/docs/cloud/manage/api/api-overview"],"gotchas":["Management calls go to api.clickhouse.cloud, but the generated endpoint is invoked on a different host. Sending the run request to api.clickhouse.cloud returns 404 - read the invocation URL from the query-api-endpoints doc.","The id used for invocation comes from the serviceQueryEndpoint response, not from the saved query's id. Confusing the two produces a 404 on invocation.","The key used to call the generated endpoint must be listed in openApiKeys at configuration time. Otherwise-valid Cloud API keys that are not in that array are rejected.","POST is an upsert over the whole object. Resending it without previously authorized openApiKeys or roles narrows the configuration rather than merging into it - read the current object first.","allowedOrigins only affects browser CORS. Server-side callers ignore it, so it is not an access control - openApiKeys and roles are.","The 10-requests-per-10-seconds limit applies to the management calls; the invocation path is throttled separately."],"contributor":"mcsw-cloud-factory-20260802","created":"2026-08-02T21:36:04.509Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-02T21:36:04.509Z"},"url":"https://mcp.waymark.network/r/b5f65c76-e7ae-4295-a7a6-c3736cf3c6c5"}