ClickHouse Cloud

Probo reads your ClickHouse Cloud organization’s members through the ClickHouse Cloud API so you can review who has access.

Caution

Use a ClickHouse Cloud API key created on the console’s API Keys page, and paste both halves as keyId:keySecret. The Cloud API authenticates with HTTP Basic over the key ID and the key secret, so either half on its own will not work. The key also needs organization-level access. A key scoped only to a service role such as Basic service API reader reaches services but not the organization’s members. A service’s SQL user credentials are a database login and do not authenticate against the Cloud API.

Prerequisites

• Probo organization administrator access
• The Admin organization role in ClickHouse Cloud (Admin performs all administrative activities for the organization, including creating API keys)
• A key whose assigned role carries organization-level access, so it can list the organization’s members. A key limited to a service role, or to the sign-in-only Member organization role, cannot read them
• Both halves of the key, the Key ID and the Key secret, which the console shows only once

Collected Fields

Probo field	ClickHouse Cloud field	Notes
Name	name	Falls back to the email address
Email	email	A member with no email address is skipped
Role	assignedRoles[].roleName	The system and custom roles assigned to the member. Falls back to the deprecated role field for a member with none: admin → Admin, developer → Developer
Admin	assignedRoles[].roleName	Flagged as an administrator when an assigned role is named Admin. With no assigned roles, flagged when the deprecated role is admin. The match is on the exact name, so a custom role such as Billing Admin does not count
Status	Not supported
MFA	Not supported
Last login	Not supported
External ID	userId	Stable identifier used to track the account across reviews. It stays the same when a user belongs to several organizations
Created at	joinedAt	When the member joined the organization

ClickHouse Cloud marks role as deprecated and points API clients to assignedRoles. For an organization that has migrated to custom roles, role is frozen at its pre-migration value, which is why Probo reads assignedRoles first.

Step 1: Create a ClickHouse Cloud API Key

1. In the ClickHouse Cloud console, signed in as an organization Admin, open the API Keys tab in the left menu.
2. Click New API Key (until the organization has its first key, the page shows a create prompt instead of the button), name it (e.g. Probo Access Review), assign a role with organization-level access, and set an expiration.
3. Click Generate API Key, then copy the Key ID and the Key secret. They are shown only on this screen.

Step 2: Connect in Probo

1. In Probo, go to Access Reviews > Sources > Add Source.
2. Find ClickHouse Cloud, click API Key, paste the Key ID and the Key secret joined by a colon (keyId:keySecret), and click Connect.

Probo names the source ClickHouse Cloud and pulls your organization’s members into your campaigns.

Troubleshooting

• Key rejected. Paste both halves joined by a colon, keyId:keySecret, with no spaces. The Key ID alone or the Key secret alone fails HTTP Basic authentication, and so does a key that has been disabled or has passed its expiration date.
• “API key is not associated with any organization”. A key belongs to exactly one organization, and ClickHouse returns only that one. Create the key inside the organization you are reviewing.
• No members appear. The key’s role must grant organization-level access. A key limited to a service role, such as Basic service API reader, reaches services but not the organization’s members.
• Requests fail from Probo but the key works locally. If the key was created with Specific locations under Allow access to this API Key, only the IP addresses you listed can use it. Remove the restriction for Probo Cloud. For a self-hosted deployment, you can instead allowlist that deployment’s fixed egress addresses.