Update service JWT provider
This endpoint is in beta. API contract is stable, and no breaking changes are expected in the future.
Replaces the configuration of a JWT authentication provider. The JWKS URL is fetched and validated before the change is saved.
Errors:
- 400: invalid provider name or field values, or the JWKS URL is unreachable or does not return a valid RS256 key set.
- 401: missing, invalid, or disabled API key.
- 403: caller lacks
control-plane:service:manageon the service, or the organization does not have the JWT authentication providers feature (Enterprise tier). - 404: service does not exist, is not visible to the caller, or has no provider with this name.
Replaces the configuration of a JWT authentication provider. The JWKS URL is fetched and validated before the change is saved. Errors:
- 400: invalid provider name or field values, or the JWKS URL is unreachable or does not return a valid RS256 key set.
- 401: missing, invalid, or disabled API key.
- 403: caller lacks
control-plane:service:manageon the service, or the organization does not have the JWT authentication providers feature (Enterprise tier). - 404: service does not exist, is not visible to the caller, or has no provider with this name.
Permission
control-plane:service:manage permission.Authorizations
Use key ID and key secret obtained in ClickHouse Cloud console: https://clickhouse.com/docs/cloud/manage/openapi
Path Parameters
ID of the organization that owns the service.
ID of the service.
Name of the JWT authentication provider.
Body
Expected iss claim of the tokens. Printable ASCII without whitespace, at most 256 characters.
256"https://auth.example.com"
Expected aud claim of the tokens. Printable ASCII without whitespace, at most 256 characters.
256"my-clickhouse-service"
Public https:// URL of the JSON Web Key Set used to verify token signatures, at most 256 characters. The key set must contain at least one RS256 (RSA) key; it is fetched and validated when the provider is created or updated.
256"https://auth.example.com/.well-known/jwks.json"
Name of the token claim that lists the ClickHouse roles to grant the user. Printable ASCII without whitespace, at most 256 characters, and not a registered JWT claim (iss, sub, aud, exp, nbf, iat, jti). The request replaces the whole provider configuration, so omitting this field removes an existing roles claim.
"clickhouse:roles"