Organization

Validate BYOC infrastructure prerequisites

Disclaimer: This beta endpoint is evolving; the API contract may change. <br /><br /> Preflight-validates that a cloud account is ready for BYOC infrastructure creation: simulates the cloud permissions ClickHouse needs (and, for BYO-VPC, checks the provided network resources) without creating anything. Takes the same parameters as infrastructure creation, so a payload that passes validation will not be rejected by create for the same inputs.

post/v1/organizations/{organizationId}/byocInfrastructure/validate

Request

  • Base URL: https://api.clickhouse.cloud
  • URL: https://api.clickhouse.cloud/v1/organizations/{organizationId}/byocInfrastructure/validate
  • Auth: HTTP basic

Path parameters

organizationIdstring uuid required

ID of the requested organization.

Request body

regionId'ap-northeast-1' | 'ap-northeast-2' | 'ap-south-1' | 'ap-southeast-1' | 'ap-southeast-2' | 'ca-central-1' | 'eu-central-1' | 'eu-west-1' | 'eu-west-2' | 'il-central-1' | 'us-east-1' | 'us-east-2' | 'us-west-2' | 'us-east1' | 'us-central1' | 'europe-west2' | 'europe-west4' | 'asia-southeast1' | 'asia-northeast1' | 'eastus' | 'eastus2' | 'westus3' | 'germanywestcentral' | 'centralus' required

Region in which the BYOC infrastructure will be located

accountIdstring required

Cloud account ID the BYOC infrastructure is configured for: AWS account ID, GCP project ID, or Azure subscription ID

availabilityZoneSuffixesstring[]

List of availability zone suffixes

vpcCidrRangestring

CIDR range for the ClickHouse-managed VPC. Mutually exclusive with the BYO-VPC fields (vpcId, privateSubnetIds, publicSubnetIds)

externalIdstring

AWS only: ExternalID baked into the ClickHouse management role trust policy in your account

tenantIdstring

Azure only (required for Azure regions): Entra tenant ID of the subscription

servicePrincipalClientIdstring

Azure only (required for Azure regions): client ID of the service principal ClickHouse uses to manage the infrastructure

vpcIdstring

BYO-VPC only (AWS and GCP): ID or network name of the customer-provided VPC to deploy into. Requires privateSubnetIds

privateSubnetIdsstring[]

BYO-VPC only: private subnet IDs or names (1-6 entries on AWS, exactly one on GCP)

publicSubnetIdsstring[]

AWS BYO-VPC only: public subnet IDs (at most 6 entries)

gcpPodCidrRangeNamesstring[]

GCP BYO-VPC only: secondary IP range names on the subnet to use for pod IPs. Omitted: all secondary ranges are used

gcpSharedVpcHostProjectIdstring

GCP BYO-VPC only: Shared VPC host project owning the VPC and subnet, when different from accountId

tagsByocInfrastructureTags

Example request

{
  "accountId": "123456789012",
  "vpcCidrRange": "10.0.0.0/16",
  "externalId": "ch-0a1b2c3d4e5f6789",
  "vpcId": "vpc-0abc1234def567890"
}

Response

Successful response

statusnumber

HTTP status code.

requestIdstring uuid

Unique id assigned to every request. UUIDv4

Example response

{
  "status": 200,
  "result": {
    "checks": [
      {
        "name": "Create EKS cluster",
        "action": "eks:CreateCluster",
        "reason": "implicitDeny"
      }
    ]
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.