# CockroachDB: Cloud Deployments Cloud API Reference 2026-09-15 (Latest) ## 2026-09-15 (Latest) ### Overview - [CockroachDB Cloud API](https://docs.cockroachlabs.com/docs/api/cloud/index.md) ### Endpoints #### SCIM - [List groups](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/list-groups.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - AUDITOR - [Create a group](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/create-a-group.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - [Search groups](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/search-groups-deprecated.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - AUDITOR - [Search groups](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/search-groups.md): Similar to GetGroups however search parameters are passed via the POST body. See https://www.rfc-editor.org/rfc/rfc7644.html#section-3.4.3 for more details. - [Get a group by ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/get-a-group-by-id.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - AUDITOR - [Update a group by supplying all values of the user object](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/update-a-group-by-supplying-all-values-of-the-user-object.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - [Delete a group based on ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/delete-a-group-based-on-id.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - [Patch a group by supplying partial updates](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/patch-a-group-by-supplying-partial-updates.md): Apply a sequence of operations to modify attributes of a SCIM Group resource. Supports 'add', 'remove', and 'replace' operations per RFC 7644 Section 3.5.2. Operations are applied atomically — if any operation fails, no changes are applied. The request body must include the 'schemas' field set to 'u… - [Search a group by ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/search-a-group-by-id-deprecated.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - AUDITOR - [Search a group by ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/search-a-group-by-id.md): Similar to GetGroup however search parameters are passed via the POST body. See https://www.rfc-editor.org/rfc/rfc7644.html#section-3.4.3 for more details. - [List the SCIM resource types](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/list-the-scim-resource-types.md): This endpoint may be used by any member of the organization. - [Get a SCIM resource type by ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/get-a-scim-resource-type-by-id.md): This endpoint may be used by any member of the organization. - [List the SCIM schemas](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/list-the-scim-schemas.md): This endpoint may be used by any member of the organization. - [Get a SCIM schema by ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/get-a-scim-schema-by-id.md): This endpoint may be used by any member of the organization. - [Return the SCIM Service Provider configuration](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/return-the-scim-service-provider-configuration.md): This endpoint may be used by any member of the organization. - [List Users](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/list-users.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - AUDITOR - [Create a user](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/create-a-user.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - [Search User](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/search-user-deprecated.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - AUDITOR - [Search Users](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/search-users.md): Similar to GetUsers however search parameters are passed via the POST body. See https://www.rfc-editor.org/rfc/rfc7644.html#section-3.4.3 for more details. - [Get a user by ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/get-a-user-by-id.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - AUDITOR - [Update a user by supplying all values of the user object](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/update-a-user-by-supplying-all-values-of-the-user-object.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - [Delete a user based on ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/delete-a-user-based-on-id.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - [Patch a user by supplying partial updates](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/patch-a-user-by-supplying-partial-updates.md): Apply a sequence of operations to modify attributes of a SCIM User resource. Supports 'add', 'remove', and 'replace' operations per RFC 7644 Section 3.5.2. Operations are applied atomically — if any operation fails, no changes are applied. The request body must include the 'schemas' field set to 'ur… - [Search for a user by ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/search-for-a-user-by-id-deprecated.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - AUDITOR - [Search for a user by ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/scim/search-for-a-user-by-id.md): Similar to GetUser however search parameters are passed via the POST body. See https://www.rfc-editor.org/rfc/rfc7644.html#section-3.4.3 for more details. #### API Keys - [List API Keys](https://docs.cockroachlabs.com/docs/api/cloud/v1/api-keys/list-api-keys.md): Sort order: created_at - [Create a new API Key](https://docs.cockroachlabs.com/docs/api/cloud/v1/api-keys/create-a-new-api-key.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - [Get an API Key by ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/api-keys/get-an-api-key-by-id.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - CLUSTER_ADMIN - AUDITOR - [Delete an API Key](https://docs.cockroachlabs.com/docs/api/cloud/v1/api-keys/delete-an-api-key.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - [Update an API Key](https://docs.cockroachlabs.com/docs/api/cloud/v1/api-keys/update-an-api-key.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN #### Audit Logs - [List audit logs](https://docs.cockroachlabs.com/docs/api/cloud/v1/audit-logs/list-audit-logs.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - AUDITOR #### Clusters - [List available major cluster versions](https://docs.cockroachlabs.com/docs/api/cloud/v1/clusters/list-available-major-cluster-versions.md): Sort order: Version number descending - [List clusters in the organization](https://docs.cockroachlabs.com/docs/api/cloud/v1/clusters/list-clusters-in-the-organization.md): By default, clusters are sorted alphabetically by name in ascending A to Z order. To customize sorting, use the pagination.sort_by and pagination.sort_order query parameters. - [Create and initialize a new cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/clusters/create-and-initialize-a-new-cluster.md): Can be used by the following roles assigned at the organization or folder scope: - CLUSTER_ADMIN - CLUSTER_CREATOR - [List the regions available for new clusters and nodes](https://docs.cockroachlabs.com/docs/api/cloud/v1/clusters/list-the-regions-available-for-new-clusters-and-nodes.md): Sort order: Distance (based on client IP address) - [Get extended information about a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/clusters/get-extended-information-about-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - ORG_ADMIN - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - FOLDER_ADMIN - FOLDER_MOVER - METRICS_VIEWER - CLUSTER_MONITOR - AUDITOR - CLUSTER_DATA_ACCESSOR - [Delete a cluster and all of its data](https://docs.cockroachlabs.com/docs/api/cloud/v1/clusters/delete-a-cluster-and-all-of-its-data.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - [Scale, edit or upgrade a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/clusters/scale-edit-or-upgrade-a-cluster.md): In addition to adding nodes and changing cluster fields, the PATCH Cluster endpoint can be used to upgrade the cluster version. A cluster can be upgraded when its `upgrade_status` field is equal to `UPGRADE_AVAILABLE`. The `/api/v1/cluster-versions` endpoint can be used to enumerate versions which a… - [Get a formatted generic connection string for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/clusters/get-a-formatted-generic-connection-string-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - ORG_ADMIN - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - FOLDER_ADMIN - FOLDER_MOVER - METRICS_VIEWER - CLUSTER_MONITOR - AUDITOR - CLUSTER_DATA_ACCESSOR - [List nodes for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/clusters/list-nodes-for-a-cluster.md): Sort order: Region name, node name #### Backup/Restore - [List cluster backups](https://docs.cockroachlabs.com/docs/api/cloud/v1/backuprestore/list-cluster-backups.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Get the backup configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/backuprestore/get-the-backup-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Update the backup configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/backuprestore/update-the-backup-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [List restore jobs](https://docs.cockroachlabs.com/docs/api/cloud/v1/backuprestore/list-restore-jobs.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [View a restore job](https://docs.cockroachlabs.com/docs/api/cloud/v1/backuprestore/view-a-restore-job.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Create a restore](https://docs.cockroachlabs.com/docs/api/cloud/v1/backuprestore/create-a-restore.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Blackout Windows - [List all blackout windows for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/blackout-windows/list-all-blackout-windows-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Create a blackout window for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/blackout-windows/create-a-blackout-window-for-a-cluster.md): Blackout windows are supported for ADVANCED clusters only. - [Get a blackout window by its ID for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/blackout-windows/get-a-blackout-window-by-its-id-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Delete a blackout window for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/blackout-windows/delete-a-blackout-window-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Update a blackout window for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/blackout-windows/update-a-blackout-window-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Client CA Certificates - [Get Client CA Cert information for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/client-ca-certificates/get-client-ca-cert-information-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Set Client CA Cert for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/client-ca-certificates/set-client-ca-cert-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Delete Client CA Cert for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/client-ca-certificates/delete-client-ca-cert-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Update Client CA Cert for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/client-ca-certificates/update-client-ca-cert-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Customer-managed Encryption Keys - [Get CMEK-related information for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/customer-managed-encryption-keys/get-cmek-related-information-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Enable or update the CMEK spec for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/customer-managed-encryption-keys/enable-or-update-the-cmek-spec-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Enable CMEK for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/customer-managed-encryption-keys/enable-cmek-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Update the CMEK-related status for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/customer-managed-encryption-keys/update-the-cmek-related-status-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Databases - [List databases for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/databases/list-databases-for-a-cluster.md): Sort order: Database name ascending - [Create a new database](https://docs.cockroachlabs.com/docs/api/cloud/v1/databases/create-a-new-database.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DATA_ACCESSOR - [Update a database](https://docs.cockroachlabs.com/docs/api/cloud/v1/databases/update-a-database.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DATA_ACCESSOR - [Delete a database](https://docs.cockroachlabs.com/docs/api/cloud/v1/databases/delete-a-database.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DATA_ACCESSOR - [Update a database](https://docs.cockroachlabs.com/docs/api/cloud/v1/databases/update-a-database-1.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DATA_ACCESSOR #### Cluster Disruption - [Get disruption specifications for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/cluster-disruption/get-disruption-specifications-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Update disruption specifications for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/cluster-disruption/update-disruption-specifications-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Log Export - [Get the Log Export configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/log-export/get-the-log-export-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - ORG_ADMIN - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - METRICS_VIEWER - AUDITOR - [Create or update the Log Export configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/log-export/create-or-update-the-log-export-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - ORG_ADMIN - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Delete the Log Export configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/log-export/delete-the-log-export-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - ORG_ADMIN - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Maintenance Windows - [Get the maintenance window for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/maintenance-windows/get-the-maintenance-window-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Set the maintenance window for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/maintenance-windows/set-the-maintenance-window-for-a-cluster.md): Maintenance windows are supported for ADVANCED clusters. - [Delete the maintenance window for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/maintenance-windows/delete-the-maintenance-window-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Metric Export - [Get the CloudWatch Metric Export configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/metric-export/get-the-cloudwatch-metric-export-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - METRICS_VIEWER - AUDITOR - [Create or update the CloudWatch Metric Export configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/metric-export/create-or-update-the-cloudwatch-metric-export-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Delete the CloudWatch Metric Export configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/metric-export/delete-the-cloudwatch-metric-export-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Get the Datadog Metric Export configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/metric-export/get-the-datadog-metric-export-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - METRICS_VIEWER - AUDITOR - [Create or update the Datadog Metric Export configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/metric-export/create-or-update-the-datadog-metric-export-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Delete the Datadog Metric Export configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/metric-export/delete-the-datadog-metric-export-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Get the Prometheus Metric Export configuration for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/metric-export/get-the-prometheus-metric-export-configuration-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - METRICS_VIEWER - AUDITOR - [Enable Prometheus Metric Export for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/metric-export/enable-prometheus-metric-export-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Disable Prometheus Metric Export for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/metric-export/disable-prometheus-metric-export-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Migration Assistant - [Get the Migration Assistant for a cluster.](https://docs.cockroachlabs.com/docs/api/cloud/v1/migration-assistant/get-the-migration-assistant-for-a-cluster.md): Includes the lifecycle status and, while RUNNING, the URL and sign-in credentials for the assistant; treat the response as sensitive. - [Provision a Migration Assistant for a cluster.](https://docs.cockroachlabs.com/docs/api/cloud/v1/migration-assistant/provision-a-migration-assistant-for-a-cluster.md): The assistant is a per-cluster, dedicated-cluster-only migration tool. Poll GetMigrationAssistant until its status is RUNNING to retrieve the URL and credentials used to sign in, or FAILED to inspect last_error. - [Delete the Migration Assistant for a cluster.](https://docs.cockroachlabs.com/docs/api/cloud/v1/migration-assistant/delete-the-migration-assistant-for-a-cluster.md): Tears down the deployment and returns the assistant in its DELETING status. - [Get the source-database CA certificate for a cluster's Migration Assistant.](https://docs.cockroachlabs.com/docs/api/cloud/v1/migration-assistant/get-the-source-database-ca-certificate-for-a-clusters-migration-assistant.md): Returns the custom CA certificate bundle the assistant trusts when connecting to its source database. Returns an empty bundle when the assistant uses the system trust roots. - [Delete the source-database CA certificate for a cluster's Migration Assistant.](https://docs.cockroachlabs.com/docs/api/cloud/v1/migration-assistant/delete-the-source-database-ca-certificate-for-a-clusters-migration-assistant.md): Reverts the assistant to the system trust roots and returns the deleted certificate bundle. - [Update the source-database CA certificate for a cluster's Migration Assistant.](https://docs.cockroachlabs.com/docs/api/cloud/v1/migration-assistant/update-the-source-database-ca-certificate-for-a-clusters-migration-assistant.md): Replaces the custom CA certificate bundle the assistant trusts when connecting to its source database. Returns the updated certificate bundle. #### IP Allowlists - [Get the IP allowlist and propagation status for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/ip-allowlists/get-the-ip-allowlist-and-propagation-status-for-a-cluster.md): Sort order: CIDR address - [Add a new CIDR address to the IP allowlist](https://docs.cockroachlabs.com/docs/api/cloud/v1/ip-allowlists/add-a-new-cidr-address-to-the-ip-allowlist.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Add a new CIDR address to the IP allowlist](https://docs.cockroachlabs.com/docs/api/cloud/v1/ip-allowlists/add-a-new-cidr-address-to-the-ip-allowlist-1.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Delete an IP allowlist entry](https://docs.cockroachlabs.com/docs/api/cloud/v1/ip-allowlists/delete-an-ip-allowlist-entry.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Update an IP allowlist entry](https://docs.cockroachlabs.com/docs/api/cloud/v1/ip-allowlists/update-an-ip-allowlist-entry.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Private Endpoint Services - [List all AwsEndpointConnections for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/list-all-awsendpointconnections-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - AUDITOR - [Set the AWS Endpoint Connection state](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/set-the-aws-endpoint-connection-state.md): The "status" in the response does not reflect the latest post-update status, but rather the status before the state is transitioned. - [List all connections to a cluster's private endpoint service.](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/list-all-connections-to-a-clusters-private-endpoint-service.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - AUDITOR - [Add a connection to a cluster's private endpoint service.](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/add-a-connection-to-a-clusters-private-endpoint-service.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Delete a connection from a cluster's private endpoint service.](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/delete-a-connection-from-a-clusters-private-endpoint-service.md): Remove a private endpoint from a service's trusted endpoints list. Caller should make sure to URL encode the endpoint_id before calling this method. - [List all PrivateEndpointServices for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/list-all-privateendpointservices-for-a-cluster.md): The internal_dns property from the regions field in the ListClusters response can be used to connect to PrivateEndpointServices. - [Create all PrivateEndpointServices for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/create-all-privateendpointservices-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [List all private endpoint trusted owners for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/list-all-private-endpoint-trusted-owners-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Add a private endpoint trusted owner to a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/add-a-private-endpoint-trusted-owner-to-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - [Get a private endpoint trusted owner entry for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/get-a-private-endpoint-trusted-owner-entry-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Remove a private endpoint trusted owner from a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/private-endpoint-services/remove-a-private-endpoint-trusted-owner-from-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN #### Egress Private Endpoints - [List egress private endpoints](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-private-endpoints/list-egress-private-endpoints.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - AUDITOR - [Create an egress private endpoint](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-private-endpoints/create-an-egress-private-endpoint.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Get egress private endpoint](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-private-endpoints/get-egress-private-endpoint.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - AUDITOR - [Delete an egress private endpoint](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-private-endpoints/delete-an-egress-private-endpoint.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Update egress private endpoint.](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-private-endpoints/update-egress-private-endpoint.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Update egress private endpoint domain names](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-private-endpoints/update-egress-private-endpoint-domain-names-this-endpoint-is-deprecatedin-favor-of-patch-apiv1clusters-networkingegress-private-endpoints-and-will-be-removed-in-a-future-version.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Egress Rules - [List all egress rules associated with a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-rules/list-all-egress-rules-associated-with-a-cluster.md): Sort order: Name - [Add an egress rule](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-rules/add-an-egress-rule.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Outbound traffic management](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-rules/outbound-traffic-management.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Get an existing egress rule](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-rules/get-an-existing-egress-rule.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Delete an existing egress rule](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-rules/delete-an-existing-egress-rule.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Edit an existing egress rule](https://docs.cockroachlabs.com/docs/api/cloud/v1/egress-rules/edit-an-existing-egress-rule.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Runtime Scanning - [Get the runtime scanning status of a cluster.](https://docs.cockroachlabs.com/docs/api/cloud/v1/runtime-scanning/get-the-runtime-scanning-status-of-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - AUDITOR - CLUSTER_DATA_ACCESSOR - [Enable runtime scanning on a cluster.](https://docs.cockroachlabs.com/docs/api/cloud/v1/runtime-scanning/enable-runtime-scanning-on-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Disable runtime scanning on a cluster.](https://docs.cockroachlabs.com/docs/api/cloud/v1/runtime-scanning/disable-runtime-scanning-on-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### SQL Users - [List SQL users for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/sql-users/list-sql-users-for-a-cluster.md): Sort order: Username - [Create a new SQL user](https://docs.cockroachlabs.com/docs/api/cloud/v1/sql-users/create-a-new-sql-user.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - [Delete a SQL user](https://docs.cockroachlabs.com/docs/api/cloud/v1/sql-users/delete-a-sql-user.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - [Update a SQL user's password](https://docs.cockroachlabs.com/docs/api/cloud/v1/sql-users/update-a-sql-users-password.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN #### Version Deferral - [Get the version upgrade deferral policy for a cluster.](https://docs.cockroachlabs.com/docs/api/cloud/v1/version-deferral/get-the-version-upgrade-deferral-policy-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - AUDITOR - [Set the version upgrade deferral policy for a cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/version-deferral/set-the-version-upgrade-deferral-policy-for-a-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER #### Folders - [List folders owned by an organization](https://docs.cockroachlabs.com/docs/api/cloud/v1/folders/list-folders-owned-by-an-organization.md): Sort order: Folder name - [Create a folder](https://docs.cockroachlabs.com/docs/api/cloud/v1/folders/create-a-folder.md): Can be used by the following roles assigned at the organization or folder scope: - FOLDER_ADMIN - [Get folder info for a folder](https://docs.cockroachlabs.com/docs/api/cloud/v1/folders/get-folder-info-for-a-folder.md): Can be used by the following roles assigned at the organization or folder scope: - ORG_ADMIN - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - CLUSTER_CREATOR - FOLDER_ADMIN - FOLDER_MOVER - METRICS_VIEWER - CLUSTER_MONITOR - AUDITOR - CLUSTER_DATA_ACCESSOR - [Delete a folder](https://docs.cockroachlabs.com/docs/api/cloud/v1/folders/delete-a-folder.md): Can be used by the following roles assigned at the organization or folder scope: - FOLDER_ADMIN - [Update a folder](https://docs.cockroachlabs.com/docs/api/cloud/v1/folders/update-a-folder.md): Can be used by the following roles assigned at the organization or folder scope: - FOLDER_ADMIN - FOLDER_MOVER - [List contents of a folder](https://docs.cockroachlabs.com/docs/api/cloud/v1/folders/list-contents-of-a-folder.md): Set `folder_id` to 'root' to list root level contents. Sort order: Folders sorted by name, followed by Clusters sorted by name. #### Billing - [List invoices for a given organization](https://docs.cockroachlabs.com/docs/api/cloud/v1/billing/list-invoices-for-a-given-organization.md): Sort order: invoice start date ascending - [Get a specific invoice for an organization](https://docs.cockroachlabs.com/docs/api/cloud/v1/billing/get-a-specific-invoice-for-an-organization.md): Can be used by the following roles assigned at the organization scope: - BILLING_COORDINATOR - CLUSTER_ADMIN #### JWT Issuers - [List all JWT Issuers](https://docs.cockroachlabs.com/docs/api/cloud/v1/jwt-issuers/list-all-jwt-issuers.md): Lists all the JWT Issuer configurations registered for the CockroachDB Cloud organization - [Add a JWT Issuer](https://docs.cockroachlabs.com/docs/api/cloud/v1/jwt-issuers/add-a-jwt-issuer.md): Registers a JWT Issuer with the CockroachDB Cloud to allow verifying JWTs during API authentication - [Get a JWT Issuer](https://docs.cockroachlabs.com/docs/api/cloud/v1/jwt-issuers/get-a-jwt-issuer.md): Retrieves the JWT Issuer configuration - [Delete a JWT Issuer](https://docs.cockroachlabs.com/docs/api/cloud/v1/jwt-issuers/delete-a-jwt-issuer.md): Deletes the JWT Issuer configuration - [Update a JWT Issuer](https://docs.cockroachlabs.com/docs/api/cloud/v1/jwt-issuers/update-a-jwt-issuer.md): Updates the JWT Issuer configuration #### Organizations - [Get information about the caller's organization](https://docs.cockroachlabs.com/docs/api/cloud/v1/organizations/get-information-about-the-callers-organization.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - ORG_MEMBER - AUDITOR #### Physical Cluster Replication - [List physical replication streams](https://docs.cockroachlabs.com/docs/api/cloud/v1/physical-cluster-replication/list-physical-replication-streams.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - [Create a physical replication stream](https://docs.cockroachlabs.com/docs/api/cloud/v1/physical-cluster-replication/create-a-physical-replication-stream.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - [Get a physical replication stream](https://docs.cockroachlabs.com/docs/api/cloud/v1/physical-cluster-replication/get-a-physical-replication-stream.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - [Update a physical replication stream](https://docs.cockroachlabs.com/docs/api/cloud/v1/physical-cluster-replication/update-a-physical-replication-stream.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN #### Role Management - [List all RoleGrants](https://docs.cockroachlabs.com/docs/api/cloud/v1/role-management/list-all-rolegrants.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - CLUSTER_ADMIN - FOLDER_ADMIN - AUDITOR - [Get all role grants for a user, service account, or group](https://docs.cockroachlabs.com/docs/api/cloud/v1/role-management/get-all-role-grants-for-a-user-service-account-or-group.md): Get all role grants for a user, service account, or group by providing its ID in the user_id path parameter. - [Replace the roles for a user, service account, or group with exactly those provided](https://docs.cockroachlabs.com/docs/api/cloud/v1/role-management/replace-the-roles-for-a-user-service-account-or-group-with-exactly-those-provided.md): Replace the entire role set for a user, service account, or group by providing its ID in the user_id path parameter. - [Add a role to a user, service account, or group](https://docs.cockroachlabs.com/docs/api/cloud/v1/role-management/add-a-role-to-a-user-service-account-or-group.md): Add a single role to a user, service account, or group by providing its ID in the user_id path parameter. - [Remove a role from a user, service account, or group](https://docs.cockroachlabs.com/docs/api/cloud/v1/role-management/remove-a-role-from-a-user-service-account-or-group.md): Remove a single role from a user, service account, or group by providing its ID in the user_id path parameter. A principal's last remaining role cannot be removed; because groups do not hold the implicit Org Member role that users and service accounts have, a group must always retain at least one ot… - [Search person users by email address](https://docs.cockroachlabs.com/docs/api/cloud/v1/role-management/search-person-users-by-email-address.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - CLUSTER_ADMIN - FOLDER_ADMIN - AUDITOR #### Service Accounts - [List service accounts for an organization](https://docs.cockroachlabs.com/docs/api/cloud/v1/service-accounts/list-service-accounts-for-an-organization.md): Sort order: Service account name - [Create a service account](https://docs.cockroachlabs.com/docs/api/cloud/v1/service-accounts/create-a-service-account.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - CLUSTER_ADMIN - [Get a service account by ID](https://docs.cockroachlabs.com/docs/api/cloud/v1/service-accounts/get-a-service-account-by-id.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - CLUSTER_ADMIN - AUDITOR - [Delete a service account](https://docs.cockroachlabs.com/docs/api/cloud/v1/service-accounts/delete-a-service-account.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - [Update a service account](https://docs.cockroachlabs.com/docs/api/cloud/v1/service-accounts/update-a-service-account.md): To manage roles associated with a service account after creation, pass the service_account_id instead of a user_id to any [Role Management endpoint](#tag--Role-Management). - [List a service account's OAuth credentials](https://docs.cockroachlabs.com/docs/api/cloud/v1/service-accounts/list-a-service-accounts-oauth-credentials.md): Sort order: created_at - [Create an OAuth credential for a service account](https://docs.cockroachlabs.com/docs/api/cloud/v1/service-accounts/create-an-oauth-credential-for-a-service-account.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - [Delete a service account's OAuth credential](https://docs.cockroachlabs.com/docs/api/cloud/v1/service-accounts/delete-a-service-accounts-oauth-credential.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN #### Virtual Cluster Workspaces - [List workspaces in the organization](https://docs.cockroachlabs.com/docs/api/cloud/v1/virtual-cluster-workspaces/list-workspaces-in-the-organization.md): Sort order: workspace name - [Show details for a specific workspace](https://docs.cockroachlabs.com/docs/api/cloud/v1/virtual-cluster-workspaces/show-details-for-a-specific-workspace.md): Can be used by the following roles assigned at the organization scope: - ORG_ADMIN - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - CLUSTER_DEVELOPER - CLUSTER_CREATOR - AUDITOR - [Update the configuration of a specific workspace](https://docs.cockroachlabs.com/docs/api/cloud/v1/virtual-cluster-workspaces/update-the-configuration-of-a-specific-workspace.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER - [Create a virtual cluster in a workspace](https://docs.cockroachlabs.com/docs/api/cloud/v1/virtual-cluster-workspaces/create-a-virtual-cluster-in-a-workspace.md): Can be used by the following roles assigned at the organization or folder scope: - CLUSTER_ADMIN - CLUSTER_CREATOR - [Update a specific virtual cluster](https://docs.cockroachlabs.com/docs/api/cloud/v1/virtual-cluster-workspaces/update-a-specific-virtual-cluster.md): Can be used by the following roles assigned at the organization, folder or cluster scope: - CLUSTER_ADMIN - CLUSTER_OPERATOR_WRITER ## OpenAPI Specs - [2024-09-16](/openapi/cloud/2024-09-16.json) - [latest](/openapi/cloud/latest.json)