> ## Documentation Index
> Fetch the complete documentation index at: https://deepline.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# ClickHouse Cloud: Clickhouse Openapi Key Create

> Create a ClickHouse Cloud API key with a name, roles, expiry and IP access list. Includes inputs, outputs, SDK V2 examples, and Deepline cost.

Create a ClickHouse Cloud API key with a name, roles, expiry and IP access list.

> [!NOTE]
>
> Tool ID: `clickhouse_openapi_key_create`

## Run this action

Use the TypeScript SDK for one call. Use `ctx.tools.execute(...)` inside a Play for durable calls, scheduled calls, or CSV processing.

```ts theme={"languages":{"custom":["/languages/deepline-prompt.json"]}}
import { Deepline } from 'deepline';

const deepline = await Deepline.connect();
const result = await deepline.tools.execute(
  'clickhouse_openapi_key_create',
  {
    "organizationId": "123e4567-e89b-42d3-a456-426614174000"
  },
);

console.log(result.toolResponse.raw);
```

### CLI

```bash theme={"languages":{"custom":["/languages/deepline-prompt.json"]}}
deepline tools execute clickhouse_openapi_key_create --input '{
  "organizationId": "123e4567-e89b-42d3-a456-426614174000"
}' --json
```

## Example response

The SDK returns this shape at `result.toolResponse.raw`. The example values illustrate the response.

```json theme={"languages":{"custom":["/languages/deepline-prompt.json"]}}
{
  "data": {
    "status": 123,
    "requestId": "123e4567-e89b-42d3-a456-426614174000",
    "result": {
      "key": {
        "id": "123e4567-e89b-42d3-a456-426614174000",
        "name": "Example",
        "state": "enabled"
      },
      "keyId": "key_123",
      "keySecret": "example"
    }
  }
}
```

Use `deepline describe clickhouse_openapi_key_create --json` for the latest machine-readable contract.

## Input reference

Creates new API key.

| Name | Type | Required | Default | Details |
| - | - | - | - | - |
| `payload.organizationId` | `string` | Yes | — | ID of the organization that will own the key. Format: `uuid`. |
| `payload.name` | `string` | No | — | Name of the key. |
| `payload.expireAt` | `string` | No | — | Timestamp the key expires. If not present, `null` or is empty the key never expires. ISO-8601. Format: `date-time`. |
| `payload.state` | `"enabled" \| "disabled"` | No | — | Initial state of the key: 'enabled', 'disabled'. If not provided the new key will be 'enabled'. Allowed: `enabled`, `disabled`. |
| `payload.hashData` | `object` | No | — | — |
| `payload.roles` | `array` | No | — | DEPRECATED. Use `assignedRoleIds` instead. List of roles assigned to the key. Contains at least 1 element. |
| `payload.assignedRoleIds` | `array` | No | — | Array of role UUIDs to assign to the API key |
| `payload.ipAccessList` | `array` | No | — | List of IP addresses allowed to access the API using this key |

<details>
  <summary>Show raw input schema</summary>

  ### Input JSON Schema

  ```json theme={"languages":{"custom":["/languages/deepline-prompt.json"]}}
  {
    "type": "object",
    "description": "Creates new API key.",
    "properties": {
      "organizationId": {
        "type": "string",
        "description": "ID of the organization that will own the key.",
        "format": "uuid"
      },
      "name": {
        "type": "string",
        "description": "Name of the key."
      },
      "expireAt": {
        "type": [
          "string",
          "null"
        ],
        "description": "Timestamp the key expires. If not present, `null` or is empty the key never expires. ISO-8601.",
        "format": "date-time"
      },
      "state": {
        "type": "string",
        "description": "Initial state of the key: 'enabled', 'disabled'. If not provided the new key will be 'enabled'.",
        "enum": [
          "enabled",
          "disabled"
        ]
      },
      "hashData": {
        "properties": {
          "keyIdHash": {
            "type": "string",
            "description": "Hash of the key ID."
          },
          "keyIdSuffix": {
            "type": "string",
            "description": "Last 4 digits of the key ID. Algorithm: echo -n \"yourpassword\" | sha256sum | tr -d '-' | xxd -r -p | base64"
          },
          "keySecretHash": {
            "type": "string",
            "description": "Hash of the key secret. Algorithm: echo -n \"yourpassword\" | sha256sum | tr -d '-' | xxd -r -p | base64"
          }
        },
        "additionalProperties": false
      },
      "roles": {
        "type": "array",
        "description": "DEPRECATED. Use `assignedRoleIds` instead. List of roles assigned to the key. Contains at least 1 element.",
        "items": {
          "type": "string",
          "enum": [
            "admin",
            "developer",
            "query_endpoints"
          ]
        }
      },
      "assignedRoleIds": {
        "type": "array",
        "description": "Array of role UUIDs to assign to the API key",
        "items": {
          "type": "string",
          "format": "uuid"
        }
      },
      "ipAccessList": {
        "type": "array",
        "description": "List of IP addresses allowed to access the API using this key",
        "items": {
          "properties": {
            "source": {
              "type": "string",
              "description": "IP or CIDR"
            },
            "description": {
              "type": "string",
              "description": "Optional description of IPv4 address or IPv4 CIDR to allow access from"
            }
          },
          "additionalProperties": false
        }
      }
    },
    "required": [
      "organizationId"
    ],
    "additionalProperties": false
  }
  ```
</details>

## Output reference

Standard tool result payload.

| Name | Type | Required | Default | Details |
| - | - | - | - | - |
| `result.data` | `object` | Yes | — | Provider response payload. |
| `result.data.status` | `number` | No | — | HTTP status code. |
| `result.data.requestId` | `string` | No | — | Unique id assigned to every request. UUIDv4 Format: `uuid`. |
| `result.data.result` | `object` | No | — | — |
| `result.data.result.key` | `object` | No | — | — |
| `result.data.result.key.id` | `string` | No | — | Unique API key ID. Format: `uuid`. |
| `result.data.result.key.name` | `string` | No | — | Name of the key |
| `result.data.result.key.state` | `"enabled" \| "disabled"` | No | — | State of the key: 'enabled', 'disabled'. Allowed: `enabled`, `disabled`. |
| `result.data.result.key.roles` | `array` | No | — | DEPRECATED. Use `assignedRoles` instead. List of roles assigned to the key. For organizations that have migrated to custom roles, this field is frozen at the pre-migration value and does not reflect current role assignments. |
| `result.data.result.key.assignedRoles` | `array` | No | — | Custom roles and System roles assigned to this API key |
| `result.data.result.key.assignedRoles[].roleId` | `string` | No | — | Unique identifier of the role Format: `uuid`. |
| `result.data.result.key.assignedRoles[].roleName` | `string` | No | — | Human-readable name of the role |
| `result.data.result.key.assignedRoles[].roleType` | `"system" \| "custom"` | No | — | Type of role: system (predefined) or custom (organization-defined) Allowed: `system`, `custom`. |
| `result.data.result.key.keySuffix` | `string` | No | — | Last 4 letters of the key. |
| `result.data.result.key.createdAt` | `string` | No | — | Timestamp the key was created. ISO-8601. Format: `date-time`. |
| `result.data.result.key.expireAt` | `string \| null` | No | — | Timestamp the key expires. If not present, `null` or is empty the key never expires. ISO-8601. Format: `date-time`. |
| `result.data.result.key.usedAt` | `string` | No | — | Timestamp the key was used last time, with one-minute precision. If not present the key was never used. ISO-8601. Format: `date-time`. |
| `result.data.result.key.ipAccessList` | `array` | No | — | List of IP addresses allowed to access the API using this key |
| `result.data.result.key.ipAccessList[].source` | `string` | No | — | IP or CIDR |
| `result.data.result.key.ipAccessList[].description` | `string` | No | — | Optional description of IPv4 address or IPv4 CIDR to allow access from |
| `result.data.result.keyId` | `string` | No | — | Generated key ID. Provided only if there was no 'hashData' in the request. |
| `result.data.result.keySecret` | `string` | No | — | Generated key secret. Provided only if there was no 'hashData' in the request. |
| `result.meta` | `object` | No | — | Additional response metadata (status, paging). |

<details>
  <summary>Show raw output schema</summary>

  ### Output JSON Schema

  ```json theme={"languages":{"custom":["/languages/deepline-prompt.json"]}}
  {
    "type": "object",
    "description": "Standard tool result payload.",
    "properties": {
      "data": {
        "type": "object",
        "description": "Provider response payload.",
        "properties": {
          "status": {
            "type": "number",
            "description": "HTTP status code."
          },
          "requestId": {
            "type": "string",
            "description": "Unique id assigned to every request. UUIDv4",
            "format": "uuid"
          },
          "result": {
            "properties": {
              "key": {
                "properties": {
                  "id": {
                    "type": "string",
                    "description": "Unique API key ID.",
                    "format": "uuid"
                  },
                  "name": {
                    "type": "string",
                    "description": "Name of the key"
                  },
                  "state": {
                    "type": "string",
                    "description": "State of the key: 'enabled', 'disabled'.",
                    "enum": [
                      "enabled",
                      "disabled"
                    ]
                  },
                  "roles": {
                    "type": "array",
                    "description": "DEPRECATED. Use `assignedRoles` instead. List of roles assigned to the key. For organizations that have migrated to custom roles, this field is frozen at the pre-migration value and does not reflect current role assignments.",
                    "items": {
                      "type": "string",
                      "enum": [
                        "admin",
                        "developer",
                        "query_endpoints"
                      ]
                    }
                  },
                  "assignedRoles": {
                    "type": "array",
                    "description": "Custom roles and System roles assigned to this API key",
                    "items": {
                      "properties": {
                        "roleId": {
                          "type": "string",
                          "description": "Unique identifier of the role",
                          "format": "uuid"
                        },
                        "roleName": {
                          "type": "string",
                          "description": "Human-readable name of the role"
                        },
                        "roleType": {
                          "type": "string",
                          "description": "Type of role: system (predefined) or custom (organization-defined)",
                          "enum": [
                            "system",
                            "custom"
                          ]
                        }
                      },
                      "additionalProperties": false
                    }
                  },
                  "keySuffix": {
                    "type": "string",
                    "description": "Last 4 letters of the key."
                  },
                  "createdAt": {
                    "type": "string",
                    "description": "Timestamp the key was created. ISO-8601.",
                    "format": "date-time"
                  },
                  "expireAt": {
                    "type": [
                      "string",
                      "null"
                    ],
                    "description": "Timestamp the key expires. If not present, `null` or is empty the key never expires. ISO-8601.",
                    "format": "date-time"
                  },
                  "usedAt": {
                    "type": "string",
                    "description": "Timestamp the key was used last time, with one-minute precision. If not present the key was never used. ISO-8601.",
                    "format": "date-time"
                  },
                  "ipAccessList": {
                    "type": "array",
                    "description": "List of IP addresses allowed to access the API using this key",
                    "items": {
                      "properties": {
                        "source": {
                          "type": "string",
                          "description": "IP or CIDR"
                        },
                        "description": {
                          "type": "string",
                          "description": "Optional description of IPv4 address or IPv4 CIDR to allow access from"
                        }
                      },
                      "additionalProperties": false
                    }
                  }
                },
                "additionalProperties": false
              },
              "keyId": {
                "type": "string",
                "description": "Generated key ID. Provided only if there was no 'hashData' in the request."
              },
              "keySecret": {
                "type": "string",
                "description": "Generated key secret. Provided only if there was no 'hashData' in the request."
              }
            },
            "additionalProperties": false
          }
        },
        "additionalProperties": false
      },
      "meta": {
        "type": "object",
        "description": "Additional response metadata (status, paging).",
        "additionalProperties": true
      }
    },
    "required": [
      "data"
    ],
    "additionalProperties": false
  }
  ```
</details>

## Deepline cost

* Pricing model: `fixed` (per call).
* Estimated Deepline credits: `0` per pricing unit.
* Provider-native pricing may still exist outside Deepline credit billing.

## Related documentation

* [ClickHouse Cloud provider guide](https://deepline.com/docs/providers/clickhouse/guide.md)
* [SDK V2 quickstart](https://deepline.com/docs/sdk-v2/quickstart.md)
* [SDK reference](https://deepline.com/docs/sdk-v2/sdk-reference.md)
* [Run tools across a CSV](https://deepline.com/docs/sdk-v2/batch-csv.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.