Set up private connectivity (AWS PrivateLink, GCP Private Service Connect, or Azure Private Link) to a ClickHouse Cloud service via the Cloud API

Documented steps

1. Authenticate with HTTP Basic auth (key ID as username, key secret as password).
2. Fetch the details needed to build the cloud-side endpoint: GET /v1/organizations/{organizationId}/services/{serviceId}/privateEndpointConfig. curl --user "$KEY_ID:$KEY_SECRET" https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID/privateEndpointConfig - the response carries the endpoint service identifier to target and the private DNS hostname you must resolve privately.
3. AWS: create an Interface VPC Endpoint in the same region as the service, using the returned endpoint service name as the Service Name, with a security group allowing the ClickHouse ports (443, 8443, 9440, 3306). Note the resulting vpce-* ID. Guide: https://clickhouse.com/docs/manage/security/aws-privatelink
4. GCP: create a Private Service Connect forwarding rule targeting the returned service attachment, in the same region as the service, and note the PSC connection ID. Guide: https://clickhouse.com/docs/manage/security/gcp-private-service-connect
5. Azure: create a Private Endpoint referencing the returned Private Link Service resource, in the same region, and take the endpoint's resource id from its JSON view. Guide: https://clickhouse.com/docs/cloud/security/azure-privatelink
6. Attach it to the service: POST /v1/organizations/{organizationId}/services/{serviceId}/privateEndpoint with {"id":"<cloud-side endpoint id>","description":"<label>"}.
7. curl --user "$KEY_ID:$KEY_SECRET" -X POST -H 'Content-Type: application/json' https://api.clickhouse.cloud/v1/organizations/$ORG_ID/services/$SERVICE_ID/privateEndpoint -d '{"id":"vpce-0123456789abcdef0","description":"prod-vpc-privatelink"}'
8. Configure DNS so the private path is actually used: resolve the private DNS hostname from the config response (or the provider's privatelink DNS zone) to the endpoint's internal IP, then confirm with dig or nslookup from inside the network before connecting.
9. Re-read GET .../privateEndpointConfig or GET the service to confirm the endpoint is registered before depending on it.
10. Test end-to-end from inside the private network using the private hostname and standard ClickHouse ports. Only after that succeeds should you tighten the public IP allow list.