ClickStack: Update Role | ClickHouse Docs

PUT/v1/organizations/{organizationId}/services/{serviceId}/clickstack/roles/{clickStackRoleId}

This endpoint is in beta. API contract is stable, and no breaking changes are expected in the future.

ClickStack: Updates a custom role's permissions, name, and description. Predefined roles cannot be modified.

Authorizations

Authorizationstringheaderrequired
Use key ID and key secret obtained in ClickHouse Cloud console: https://clickhouse.com/docs/cloud/manage/openapi

Path parameters

organizationIdstringrequired
ID of the organization that owns the service.

format: uuid
serviceIdstringrequired
ID of the ClickStack service.

format: uuid
clickStackRoleIdstringrequired
id parameter

Request bodyJSON

permissionsarray ofobjectrequired
The replacement set of CASL permissions for the role.
5 properties
- actionstringrequired
  The action this permission grants or denies.
  
  Example: "read"
- subjectstringrequired
  The resource the action applies to.
  
  Example: "dashboard"
- invertedoptionalboolean
  When true, the rule denies rather than grants the action.
  
  Example: false
- integrationoptionalstring
  The integration the permission is scoped to.
  
  Example: "mongodb"
- conditionsoptionalobject
nameoptionalstring
New role name. Omit to leave the name unchanged.

Example: "Deploy Bot"
descriptionoptionalstring
New role description.

Example: "Manages dashboards via Terraform"

Response

JSON

200

Successful response

JSON

statusoptionalnumber
HTTP status code.

Example: 200
requestIdoptionalstring
Unique id assigned to every request. UUIDv4

format: uuid
resultoptionalobject
7 properties
- idstringrequired
  Role ID.
  
  Example: "507f1f77bcf86cd799439011"
- namestringrequired
  Role name.
  
  Example: "Read Only"
- permissionsarray ofobjectrequired
  The CASL permissions granted by this role.
  
  5 properties
  actionstringrequired
  The action this permission grants or denies.
  
  Example: "read"
  subjectstringrequired
  The resource the action applies to.
  
  Example: "dashboard"
  invertedoptionalboolean
  When true, the rule denies rather than grants the action.
  
  Example: false
  integrationoptionalstring
  The integration the permission is scoped to.
  
  Example: "mongodb"
  conditionsoptionalobject
- isPredefinedbooleanrequired
  Whether this is an immutable predefined/system role.
  
  Example: false
- descriptionoptionalstring
  Human-readable role description.
  
  Example: "Read-only access to all resources"
- createdAtoptionalstring
  Creation timestamp.
  
  format: date-time
  Example: "2025-01-01T00:00:00.000Z"
- updatedAtoptionalstring
  Last update timestamp.
  
  format: date-time
  Example: "2025-06-15T10:30:00.000Z"

ClickStack: Update Role

curl --request PUT \
  --url https://api.clickhouse.cloud/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/services/497f6eca-6276-4993-bfeb-53cbbbba6f08/clickstack/roles/string \
  --header 'Authorization: Basic <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Deploy Bot",
  "description": "Manages dashboards via Terraform",
  "permissions": [
    {
      "action": "read",
      "subject": "dashboard",
      "inverted": false,
      "integration": "mongodb",
      "conditions": {}
    }
  ]
}
'

const url = 'https://api.clickhouse.cloud/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/services/497f6eca-6276-4993-bfeb-53cbbbba6f08/clickstack/roles/string';
const options = {
  method: 'PUT',
  headers: {'Content-Type': 'application/json', Authorization: 'Basic <token>'},
  body: JSON.stringify({
    name: 'Deploy Bot',
    description: 'Manages dashboards via Terraform',
    permissions: [
      {
        action: 'read',
        subject: 'dashboard',
        inverted: false,
        integration: 'mongodb',
        conditions: {}
      }
    ]
  })
};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));

import requests

url = "https://api.clickhouse.cloud/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/services/497f6eca-6276-4993-bfeb-53cbbbba6f08/clickstack/roles/string"

payload = {
    "name": "Deploy Bot",
    "description": "Manages dashboards via Terraform",
    "permissions": [
        {
            "action": "read",
            "subject": "dashboard",
            "inverted": False,
            "integration": "mongodb",
            "conditions": {}
        }
    ]
}
headers = {
    "Content-Type": "application/json",
    "Authorization": "Basic <token>"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

Response example

{
  "status": 200,
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "result": {
    "id": "507f1f77bcf86cd799439011",
    "name": "Read Only",
    "description": "Read-only access to all resources",
    "permissions": [
      {
        "action": "read",
        "subject": "dashboard",
        "inverted": false,
        "integration": "mongodb",
        "conditions": {}
      }
    ],
    "isPredefined": false,
    "createdAt": "2025-01-01T00:00:00.000Z",
    "updatedAt": "2025-06-15T10:30:00.000Z"
  }
}

{
  "status": 400,
  "error": "string",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6"
}

{
  "status": 500,
  "error": "string",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6"
}