Skip to main content
PUT
Update service JWT provider
Beta This endpoint is in beta. API contract is stable, and no breaking changes are expected in the future.

Replaces the configuration of a JWT authentication provider. The JWKS URL is fetched and validated before the change is saved.
Errors:
  • 400: invalid provider name or field values, or the JWKS URL is unreachable or does not return a valid RS256 key set.
  • 401: missing, invalid, or disabled API key.
  • 403: caller lacks control-plane:service:manage on the service, or the organization does not have the JWT authentication providers feature (Enterprise tier).
  • 404: service does not exist, is not visible to the caller, or has no provider with this name.

Permission

The API key must have the control-plane:service:manage permission.

Authorizations

Authorization
string
header
required

Use key ID and key secret obtained in ClickHouse Cloud console: https://clickhouse.com/docs/cloud/manage/openapi

Path Parameters

organizationId
string<uuid>
required

ID of the organization that owns the service.

serviceId
string<uuid>
required

ID of the service.

jwtProviderName
string
required

Name of the JWT authentication provider.

Body

application/json
issuer
string
required

Expected iss claim of the tokens. Printable ASCII without whitespace, at most 256 characters.

Maximum string length: 256
Example:

"https://auth.example.com"

audience
string
required

Expected aud claim of the tokens. Printable ASCII without whitespace, at most 256 characters.

Maximum string length: 256
Example:

"my-clickhouse-service"

jwksUrl
string
required

Public https:// URL of the JSON Web Key Set used to verify token signatures, at most 256 characters. The key set must contain at least one RS256 (RSA) key; it is fetched and validated when the provider is created or updated.

Maximum string length: 256
Example:

"https://auth.example.com/.well-known/jwks.json"

rolesClaim
string

Name of the token claim that lists the ClickHouse roles to grant the user. Printable ASCII without whitespace, at most 256 characters, and not a registered JWT claim (iss, sub, aud, exp, nbf, iat, jti). The request replaces the whole provider configuration, so omitting this field removes an existing roles claim.

Example:

"clickhouse:roles"

Response

Successful response

status
number

HTTP status code.

Example:

200

requestId
string<uuid>

Unique id assigned to every request. UUIDv4

result
object