> ## Documentation Index > Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update BYOC infrastructure customer-authorized access > **This endpoint is in beta.** API contract is stable, and no breaking changes are expected in the future.

Replaces the customer setting that controls when ClickHouse personnel may access the BYOC infrastructure. Allow access with `mode: always`, deny it with `mode: never`, or allow it for a single window with `mode: window`, `startTimestamp` and `durationSeconds`. Returns the stored setting together with the data plane verdict. Beta **This endpoint is in beta.** API contract is stable, and no breaking changes are expected in the future. \ \ Replaces the customer setting that controls when ClickHouse personnel may access the BYOC infrastructure. Allow access with `mode: always`, deny it with `mode: never`, or allow it for a single window with `mode: window`, `startTimestamp` and `durationSeconds`. Returns the stored setting together with the data plane verdict. #### Permission The API key must have the `control-plane:organization:manage` permission. ## OpenAPI ````yaml _specs/cloud-openapi.json PATCH /v1/organizations/{organizationId}/byocInfrastructure/{byocInfrastructureId}/customerAuthorizedAccess openapi: 3.1.1 info: title: OpenAPI spec for ClickHouse Cloud version: '1.0' contact: name: ClickHouse Support url: >- https://clickhouse.com/docs/en/cloud/manage/openapi?referrer=openapi-1415590 email: support@clickhouse.com servers: - url: https://api.clickhouse.cloud security: - basicAuth: [] tags: - name: Organization - name: Notifications - name: User management - name: Billing - name: Role Management - name: Service - name: Backup - name: Snapshot - name: API keys - name: Prometheus - name: ClickPipes - name: ClickStack - name: Postgres - name: UDF - name: Query API endpoints - name: Saved queries paths: /v1/organizations/{organizationId}/byocInfrastructure/{byocInfrastructureId}/customerAuthorizedAccess: patch: tags: - Organization summary: Update BYOC infrastructure customer-authorized access description: >- **This endpoint is in beta.** API contract is stable, and no breaking changes are expected in the future.

Replaces the customer setting that controls when ClickHouse personnel may access the BYOC infrastructure. Allow access with `mode: always`, deny it with `mode: never`, or allow it for a single window with `mode: window`, `startTimestamp` and `durationSeconds`. Returns the stored setting together with the data plane verdict. operationId: organizationByocInfrastructureCustomerAuthorizedAccessUpdate parameters: - in: path name: organizationId description: ID of the organization that owns the BYOC infrastructure. required: true schema: type: string format: uuid - in: path name: byocInfrastructureId description: ID of the BYOC infrastructure. required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/ByocCustomerAuthorizedAccessPatchRequest' responses: '200': description: Successful response content: application/json: schema: type: object properties: status: type: number description: HTTP status code. example: 200 requestId: type: string description: Unique id assigned to every request. UUIDv4 format: uuid result: $ref: '#/components/schemas/ByocCustomerAuthorizedAccess' '400': description: >- The request cannot be processed due to a client error. Please verify your request parameters and try again. content: application/json: schema: type: object properties: status: type: number description: HTTP status code. example: 400 error: type: string description: Detailed error description. requestId: type: string description: Unique id assigned to every request. UUIDv4 format: uuid '500': description: >- An internal server error has occurred. If this issue persists, please contact ClickHouse Cloud support for assistance. content: application/json: schema: type: object properties: status: type: integer description: HTTP status code. example: 500 error: type: string description: Detailed error description. requestId: type: string description: Unique id assigned to every request. UUIDv4 format: uuid components: schemas: ByocCustomerAuthorizedAccessPatchRequest: properties: mode: description: >- When ClickHouse personnel may access the infrastructure. Current values: always, never, window. New values may be added over time. `always` allows access, `never` denies it, and `window` allows it during a single time window described by `startTimestamp` and `durationSeconds` type: string example: window startTimestamp: description: >- Start of the access window. ISO-8601. Required when `mode` is `window`, not allowed otherwise type: string format: date-time durationSeconds: description: >- Length of the access window in seconds, from 1 to 172800 (48 hours). Required when `mode` is `window`, not allowed otherwise type: integer example: 14400 required: - mode ByocCustomerAuthorizedAccess: properties: mode: description: >- When ClickHouse personnel may access the infrastructure. Current values: always, never, window. New values may be added over time. When the setting has never been configured this is `always`, the data plane default type: string example: window startTimestamp: description: >- Start of the access window. ISO-8601. Present only when `mode` is `window` type: string format: date-time durationSeconds: description: >- Length of the access window in seconds, counted from `startTimestamp`. Present only when `mode` is `window` type: integer example: 14400 allowed: description: >- Whether the data plane currently allows ClickHouse personnel access, evaluated at the time of the request type: boolean windowEndTimestamp: description: >- End of the current access window. ISO-8601. Present only while access is allowed until a deadline type: string format: date-time required: - mode - allowed securitySchemes: basicAuth: type: http scheme: basic description: >- Use key ID and key secret obtained in ClickHouse Cloud console: https://clickhouse.com/docs/cloud/manage/openapi x-permission-scopes: >- The scope list of a `security` requirement holds ClickHouse Cloud API key permission ids (for example `control-plane:organization:view`), not OAuth scopes. OpenAPI has no field for API key permissions, so this is the closest available place. A key must hold every permission listed on an operation to call it; an operation with no scopes needs none beyond a valid key. Every operation declares at most one requirement object, always for this scheme, so the list is only ever conjunctive — alternative sets of permissions are never expressed. ````