Collects ClickHouse Cloud console and database access settings
v0.1.0 passed its nightly check on Nov 7, 2026: 147 of 147 values matched. See the checked values
epack install collector clickhouse
Adds to epack.yaml, resolves dependencies, downloads binary.
Run all configured collectors and build a pack:
epack collect
Runs all collectors in epack.yaml and outputs an evidence pack.
Or add manually to epack.yaml:
collectors:
clickhouse:
source: https://github.com/locktivity/epack-collector-clickhouse
Then run epack install to lock and sync.
epack-collector-clickhouse collects evidence of who can reach a ClickHouse Cloud organization and its data: the people and keys that can use the console and the Cloud API, and the database users, roles, and grants in each service.
From the Cloud API:
control-plane:organization:manage (see configuration.md).control-plane:organization:manage.From each service you list, read with SQL over HTTPS as a read-only database user:
ClickHouse Cloud creates its own database users, roles, settings profiles, and quotas in every service. The collector lists them apart from the customer's, with the grants, settings, and limits that belong to them, and counts them separately. Cloud's own are the users, profiles, quotas, and row policies stored in users_xml, and the roles clickpipes_system, default_role, sql_console_admin, and sql_console_read_only. Cloud also creates the default and sql-console users, and they count as the customer's.
audit level.artifacts/clickhouse.access-posture.json holds the console's members, admins, and API keys in the evidencepack/access-posture@v1 form. Its admins are the members who hold the system Admin role. Its credentials are the API keys that are enabled and have not expired.
ClickHouse Cloud has no API that says whether the organization uses SAML SSO or whether a member signs in with MFA. The detailed artifact holds both as null, and the collector result records an unsupported gap for each.
The access-posture file leaves out these values, each with an unsupported gap:
The access-posture file leaves out inactive members with a not_read gap. ClickHouse Cloud's activities list reports member sign-ins. Reading it needs control-plane:organization:view-activities, which is not among the permissions in configuration.md. A not_read gap does not make the run partial.
artifacts/clickhouse.details.json, described by docs/schema/v1.0.0.json.artifacts/clickhouse.access-posture.json, described by epack's evidencepack/access-posture@v1 schema, with the collector's methods from docs/schema/methods.json.artifacts/clickhouse.collector-result.json, which records each value left out and why, the run's steps, and its calls.See levels.md for what each collection level adds and examples.md for sample output.
The collector reads the console through the ClickHouse Cloud API with an API key, and each service you list through its HTTPS interface as a database user.
The key's role decides what the collector reads from the console:
| Permissions on the organization | The collector reads |
|---|---|
control-plane:organization:view and control-plane:organization:view-api-keys |
The organization, its invitations, and its API keys |
Both of those and control-plane:organization:manage |
Also the members, their console roles, and what each console role grants |
control-plane:organization:manage also lets the key change the organization, including its members and their roles. Without it, the collector leaves the members and the role definitions out with a permission_denied gap. The members and admins in artifacts/clickhouse.access-posture.json are left out with the same gap. ClickHouse's API reference says control-plane:organization:view is enough to list members, but the API returns an empty list without control-plane:organization:manage.
epack-collector, select Allow, and give it the permissions from the table.epack-collector role. Add every address the collector runs from to the key's IP access list. If the role has control-plane:organization:manage, also give the key an expiry date.A key created through the Cloud API with no IP access list cannot be used from any address.
Skip this step to read only the console, and leave services out of the configuration.
Run these statements as the default user in each service the collector reads, with a password you generate in place of YOUR-PASSWORD. Use the same password in every service.
CREATE ROLE IF NOT EXISTS epack_access_reader;
GRANT CURRENT GRANTS(SHOW ACCESS ON *.*) TO epack_access_reader;
GRANT SELECT ON system.grants TO epack_access_reader;
GRANT SELECT ON system.role_grants TO epack_access_reader;
GRANT SELECT ON system.settings_profile_elements TO epack_access_reader;
GRANT SELECT ON system.quota_limits TO epack_access_reader;
CREATE USER IF NOT EXISTS epack_collector IDENTIFIED WITH sha256_password BY 'YOUR-PASSWORD' SETTINGS readonly = 1;
GRANT epack_access_reader TO epack_collector;
ClickHouse Cloud refuses GRANT SHOW ACCESS ON *.* from the default user. GRANT CURRENT GRANTS passes on the part of it the default user holds.
Add every address the collector runs from to each service's IP access list, under the service's Settings.
collectors:
clickhouse:
source: locktivity/epack-collector-clickhouse@^0.1
config:
organization_id: 8c1f2a4e-5b6d-4e7f-9a0b-1c2d3e4f5a6b
services:
- host: abc123xyz.us-east-1.aws.clickhouse.cloud
level: audit
secrets:
- CLICKHOUSE_KEY_ID
- CLICKHOUSE_KEY_SECRET
- CLICKHOUSE_DB_PASSWORD
export CLICKHOUSE_KEY_ID=YOUR-KEY-ID CLICKHOUSE_KEY_SECRET=YOUR-KEY-SECRET CLICKHOUSE_DB_PASSWORD=YOUR-PASSWORD
| Option | Required | Description |
|---|---|---|
organization_id |
Yes | The organization's ID, from Organization details in the console. |
services |
No | The services whose database access the collector reads. Each has a host, the service's HTTPS host name without https:// or a port, and an optional user, which is epack_collector unless you set it. Leave services out to read only the console. |
level |
No | trust (the default), audit, or internal. See levels.md. |
collect |
No | The kinds of evidence to collect. details is artifacts/clickhouse.details.json, and access-posture is artifacts/clickhouse.access-posture.json. Leave it out to collect both. With only access-posture, the collector reads the members and API keys and skips the invitations, console roles, and services. |
| Variable | Description |
|---|---|
CLICKHOUSE_KEY_ID |
The API key's ID. |
CLICKHOUSE_KEY_SECRET |
The API key's secret. |
CLICKHOUSE_DB_PASSWORD |
The database user's password. Required when services lists a service. |
A service that has gone idle starts again when the collector's first query reaches it, which can take a minute or more. The collector waits up to three minutes for each service.
The run fails only when the configuration is invalid (exit 2), when the Cloud API rejects the key or refuses its address (exit 3), or when the Cloud API cannot be reached (exit 4). Every other read that fails leaves its values out of artifacts/clickhouse.details.json and artifacts/clickhouse.access-posture.json. artifacts/clickhouse.collector-result.json records a gap for each, with the call that failed and what to check.
Some values are left out every time their condition holds:
| Value | Code | When |
|---|---|---|
members |
permission_denied |
The key's role lacks control-plane:organization:manage. |
console_roles |
permission_denied |
The key's role lacks control-plane:organization:manage. |
organization.sso_enabled |
unsupported |
Always. ClickHouse Cloud has no API that reports SAML SSO. |
members.mfa_enabled_count |
unsupported |
Whenever the members are read. ClickHouse Cloud has no API that reports a member's MFA. |
members and admins in the access-posture file |
permission_denied |
The key's role lacks control-plane:organization:manage. |
credentials in the access-posture file |
permission_denied |
The key's role lacks control-plane:organization:view-api-keys. |
members.inactive_member_count and members.inactive_pct in the access-posture file |
not_read |
Always. They need ClickHouse Cloud's activities list, which the collector does not read. |
The access-posture file also leaves out the values ClickHouse Cloud does not report, such as its sign-in rules, each with an unsupported gap. overview.md lists them. An unsupported or not_read gap does not make the run partial.
Counts for the console and one service, at the default trust level:
collectors:
clickhouse:
source: locktivity/epack-collector-clickhouse@^0.1
config:
organization_id: 8c1f2a4e-5b6d-4e7f-9a0b-1c2d3e4f5a6b
services:
- host: abc123xyz.us-east-1.aws.clickhouse.cloud
secrets:
- CLICKHOUSE_KEY_ID
- CLICKHOUSE_KEY_SECRET
- CLICKHOUSE_DB_PASSWORD
At audit, for two services, the second read as a database user named evidence_reader:
collectors:
clickhouse:
source: locktivity/epack-collector-clickhouse@^0.1
config:
organization_id: 8c1f2a4e-5b6d-4e7f-9a0b-1c2d3e4f5a6b
services:
- host: abc123xyz.us-east-1.aws.clickhouse.cloud
- host: def456uvw.eu-west-1.aws.clickhouse.cloud
user: evidence_reader
level: audit
secrets:
- CLICKHOUSE_KEY_ID
- CLICKHOUSE_KEY_SECRET
- CLICKHOUSE_DB_PASSWORD
With no services, the collector reads only the Cloud API and needs no database password:
collectors:
clickhouse:
source: locktivity/epack-collector-clickhouse@^0.1
config:
organization_id: 8c1f2a4e-5b6d-4e7f-9a0b-1c2d3e4f5a6b
secrets:
- CLICKHOUSE_KEY_ID
- CLICKHOUSE_KEY_SECRET
With a key whose role has control-plane:organization:manage, at the trust level, artifacts/clickhouse.details.json holds:
{
"schema_version": "1.0.0",
"collected_at": "2026-10-22T12:00:00Z",
"collected_at_level": "trust",
"organization": {
"id": "8c1f2a4e-5b6d-4e7f-9a0b-1c2d3e4f5a6b",
"name": "Example Org",
"created_at": "2026-10-21T13:58:12Z",
"sso_enabled": null
},
"members": {"total_count": 4, "admin_count": 1, "mfa_enabled_count": null},
"invitations": {"total_count": 2, "pending_count": 1, "expired_count": 1},
"api_keys": {
"total_count": 6,
"enabled_count": 5,
"admin_count": 1,
"never_expires_count": 4,
"any_address_count": 5,
"never_used_count": 4
},
"console_roles": {"total_count": 4, "custom_count": 2},
"services": [
{
"host": "abc123xyz.us-east-1.aws.clickhouse.cloud",
"user": "epack_collector",
"version": "26.8.1.2045",
"users": {
"customer_count": 9,
"cloud_managed_count": 2,
"no_password_count": 1,
"plaintext_password_count": 1,
"any_host_count": 7
},
"roles": {"customer_count": 3, "cloud_managed_count": 4},
"role_grants": {"customer_count": 5, "cloud_managed_count": 2, "with_admin_option_count": 2},
"grants": {"customer_count": 5, "cloud_managed_count": 3, "grant_option_count": 1},
"settings_profiles": {"customer_count": 2, "cloud_managed_count": 1},
"settings_profile_elements": {"customer_count": 4, "cloud_managed_count": 2},
"quotas": {"customer_count": 1, "cloud_managed_count": 1},
"quota_limits": {"customer_count": 1, "cloud_managed_count": 1},
"row_policies": {"customer_count": 1, "cloud_managed_count": 0}
}
]
}
sso_enabled and mfa_enabled_count are null because ClickHouse Cloud has no API that reports them, and artifacts/clickhouse.collector-result.json records a gap for each.
With a read-only key, members and console_roles are absent too, and the collector result records why:
"gaps": [
{
"path": "artifacts/clickhouse.details.json",
"pointer": "/console_roles",
"status": "not_collected",
"code": "permission_denied",
"owner": "customer",
"vendor_code": "FORBIDDEN",
"operation": "clickhouse.roles.list",
"call": 6,
"missing_permission": "control-plane:organization:manage",
"warning": "Reading console role definitions needs control-plane:organization:manage, which can also change the organization."
},
{
"path": "artifacts/clickhouse.details.json",
"pointer": "/members",
"status": "not_collected",
"code": "permission_denied",
"owner": "customer",
"operation": "clickhouse.members.list",
"call": 2,
"missing_permission": "control-plane:organization:manage",
"warning": "Reading members needs control-plane:organization:manage, which can also change the organization."
},
{"path": "artifacts/clickhouse.details.json", "pointer": "/organization/sso_enabled", "status": "not_collected", "code": "unsupported", "owner": "nobody"}
]
At the trust level, the same organization's artifacts/clickhouse.access-posture.json holds:
{
"schema_version": "1.0.0",
"collected_at": "2026-10-22T12:00:00Z",
"provider": "clickhouse",
"system_type": "database",
"members": {"members_present": true},
"admins": {"admins_present": true, "admin_share_pct": 25},
"credentials": {
"credentials_present": true,
"never_expiring_pct": 60,
"unused_pct": 60,
"unrestricted_pct": 20,
"write_access_pct": 20,
"rotation_overdue_pct": 0
}
}
Five of the six API keys are enabled, and none has expired, so the credentials cover five keys. At audit, the file also holds the count behind each percentage, such as credential_count and never_expiring_credential_count.
At audit, each count has its rows beside it. A database user's row:
{
"name": "ops_admin",
"storage": "replicated",
"auth_methods": [
{"type": "sha256_password", "valid_until": "2030-01-01T00:00:00Z", "second_factor": null}
],
"no_password": false,
"plaintext_password": false,
"host_ip": ["::/0"],
"host_names": [],
"host_names_regexp": [],
"host_names_like": [],
"any_host": true
}
A ClickHouse Cloud organization used only for these checks, with four members, a pending invitation, six API keys, and one service. The service has eight database users and three roles of the customer's, and a settings profile, a quota, and a row policy for its read-only role. ClickHouse Cloud's own users and roles are counted apart from the customer's. The collector reads at the audit level, the console with an API key that can manage the organization, and the service as a read-only database user.
Runs at Audit, which includes Trust. Internal isn't checked.
v0.1.0 · Nov 7, 2026 · 147 of 147 values matched
16 of 16 nights passed, Oct 23 to Nov 7.
The test account is set up only for these checks. Its settings are kept in code, so the value the collector should report for each field is known ahead of time.
Every night at 05:00 UTC, the newest published version runs against the test account. Each value it reports is compared with the known value. New versions go through the same check before they're published.
Values that could identify a test account, such as its domain, IDs, or user logins, aren't shown here. They're still checked.
The same results, with the same values withheld, are published as sandbox-results.json.
Full Changelog: https://github.com/locktivity/epack-collector-clickhouse/compare/v0.1.0...v0.2.0
Nightly checks: 16 passed.
412 fields. The test account checks 94 of them.
Every field this collector can write, each tagged with the lowest level that collects it. Each level includes everything in the level before it.
No fields match these filters.
The values Foundational Controls and other profiles read.
The test account doesn't have a known value for this field.
The system's vendor, such as github, aws, or clickhouse
The test account doesn't have a known value for this field.
The test account doesn't have a known value for this field.
The kind of system
The test account doesn't have a known value for this field.
Admins
The test account doesn't have a known value for this field.
Whether the system has any admins
The test account doesn't have a known value for this field.
Admins who can sign in without SSO. An admin linked to SSO counts when the system still lets them sign in another way
The test account doesn't have a known value for this field.
Percentage of admins who can sign in without SSO and have MFA. Null when no admin can sign in without SSO
The test account doesn't have a known value for this field.
Whether any admins can sign in without SSO. An admin linked to SSO counts too when the system still lets them sign in another way. When false, local_admin_mfa_coverage_pct has no admins to count
The test account doesn't have a known value for this field.
Admins counted in local_admin_count who have MFA
The test account doesn't have a known value for this field.
Admins
The test account doesn't have a known value for this field.
Whether the system has any admins
The test account doesn't have a known value for this field.
Admins who can sign in without SSO. An admin linked to SSO counts when the system still lets them sign in another way
The test account doesn't have a known value for this field.
Percentage of admins who can sign in without SSO and have MFA. Null when no admin can sign in without SSO
The test account doesn't have a known value for this field.
Whether any admins can sign in without SSO. An admin linked to SSO counts too when the system still lets them sign in another way. When false, local_admin_mfa_coverage_pct has no admins to count
The test account doesn't have a known value for this field.
Admins counted in local_admin_count who have MFA
The test account doesn't have a known value for this field.
Third-party apps with access
The test account doesn't have a known value for this field.
Whether any third-party app has access
The test account doesn't have a known value for this field.
Machine credentials
The test account doesn't have a known value for this field.
Whether the system has any machine credentials. When false, the credential percentages have none to count
The test account doesn't have a known value for this field.
Credentials that never expire
The test account doesn't have a known value for this field.
Percentage of credentials that never expire. Null when there are none
The test account doesn't have a known value for this field.
Credentials older than 90 days. When the system does not record when a credential was created, this is left out with a gap
The test account doesn't have a known value for this field.
Percentage of credentials older than 90 days. Left out with a gap when the system does not record when a credential was created. Null when there are none
The test account doesn't have a known value for this field.
Credentials with neither an IP limit nor a scope narrower than full access. A credential limited to chosen permissions or resources has a narrower scope. A credential with either limit is restricted
The test account doesn't have a known value for this field.
Percentage of credentials with neither an IP limit nor a scope narrower than full access. Null when there are none
The test account doesn't have a known value for this field.
Credentials never used, or unused in the last 90 days
The test account doesn't have a known value for this field.
Percentage of credentials never used, or unused in the last 90 days. Null when there are none
The test account doesn't have a known value for this field.
Credentials that can write or administer
The test account doesn't have a known value for this field.
Percentage of credentials that can write or administer. Null when there are none
The test account doesn't have a known value for this field.
Machine credentials
The test account doesn't have a known value for this field.
Whether the system has any machine credentials. When false, the credential percentages have none to count
The test account doesn't have a known value for this field.
Credentials that never expire
The test account doesn't have a known value for this field.
Percentage of credentials that never expire. Null when there are none
The test account doesn't have a known value for this field.
Credentials older than 90 days. When the system does not record when a credential was created, this is left out with a gap
The test account doesn't have a known value for this field.
Percentage of credentials older than 90 days. Left out with a gap when the system does not record when a credential was created. Null when there are none
The test account doesn't have a known value for this field.
Credentials with neither an IP limit nor a scope narrower than full access. A credential limited to chosen permissions or resources has a narrower scope. A credential with either limit is restricted
The test account doesn't have a known value for this field.
Percentage of credentials with neither an IP limit nor a scope narrower than full access. Null when there are none
The test account doesn't have a known value for this field.
Credentials never used, or unused in the last 90 days
The test account doesn't have a known value for this field.
Percentage of credentials never used, or unused in the last 90 days. Null when there are none
The test account doesn't have a known value for this field.
Credentials that can write or administer
The test account doesn't have a known value for this field.
Percentage of credentials that can write or administer. Null when there are none
The test account doesn't have a known value for this field.
Members from outside the organization
The test account doesn't have a known value for this field.
Whether any members come from outside the organization, such as outside collaborators or guests
The test account doesn't have a known value for this field.
Members with no sign-in or other recorded activity in the last 90 days
The test account doesn't have a known value for this field.
Percentage of members with no sign-in or other recorded activity in the last 90 days. Null when there are no members
The test account doesn't have a known value for this field.
Members who can sign in without SSO. A member linked to SSO counts when the system still lets them sign in another way
The test account doesn't have a known value for this field.
Whether any members can sign in without SSO, with a password or a social login. A member linked to SSO counts too when the system still lets them sign in another way, so local and SSO members can overlap. When false, local_mfa_coverage_pct has no members to count
The test account doesn't have a known value for this field.
Percentage of members who can sign in without SSO and have MFA. Null when no member can sign in without SSO
The test account doesn't have a known value for this field.
Members counted in local_member_count who have MFA
The test account doesn't have a known value for this field.
Members
The test account doesn't have a known value for this field.
Whether the system has any members. When false, the member percentages have no members to count
The test account doesn't have a known value for this field.
Percentage of members whose account is linked to SSO. Null when there are no members
The test account doesn't have a known value for this field.
Members whose account is linked to SSO
The test account doesn't have a known value for this field.
Members from outside the organization
The test account doesn't have a known value for this field.
Whether any members come from outside the organization, such as outside collaborators or guests
The test account doesn't have a known value for this field.
Members with no sign-in or other recorded activity in the last 90 days
The test account doesn't have a known value for this field.
Percentage of members with no sign-in or other recorded activity in the last 90 days. Null when there are no members
The test account doesn't have a known value for this field.
Members who can sign in without SSO. A member linked to SSO counts when the system still lets them sign in another way
The test account doesn't have a known value for this field.
Whether any members can sign in without SSO, with a password or a social login. A member linked to SSO counts too when the system still lets them sign in another way, so local and SSO members can overlap. When false, local_mfa_coverage_pct has no members to count
The test account doesn't have a known value for this field.
Percentage of members who can sign in without SSO and have MFA. Null when no member can sign in without SSO
The test account doesn't have a known value for this field.
Members counted in local_member_count who have MFA
The test account doesn't have a known value for this field.
Members
The test account doesn't have a known value for this field.
Whether the system has any members. When false, the member percentages have no members to count
The test account doesn't have a known value for this field.
Percentage of members whose account is linked to SSO. Null when there are no members
The test account doesn't have a known value for this field.
Members whose account is linked to SSO
The test account doesn't have a known value for this field.
Whether any root account has access keys
The test account doesn't have a known value for this field.
Root accounts. A system with scopes has one per scope
The test account doesn't have a known value for this field.
Whether the system has a built-in root account. When false, root_mfa_coverage_pct has no accounts to count
The test account doesn't have a known value for this field.
Root accounts with MFA
The test account doesn't have a known value for this field.
Percentage of root accounts with MFA. Null when there are none
The test account doesn't have a known value for this field.
Whether any root account has access keys
The test account doesn't have a known value for this field.
Root accounts. A system with scopes has one per scope
The test account doesn't have a known value for this field.
Whether the system has a built-in root account. When false, root_mfa_coverage_pct has no accounts to count
The test account doesn't have a known value for this field.
Root accounts with MFA
The test account doesn't have a known value for this field.
Percentage of root accounts with MFA. Null when there are none
The test account doesn't have a known value for this field.
The account or subscription ID
The test account doesn't have a known value for this field.
The test account doesn't have a known value for this field.
The account or subscription name
The test account doesn't have a known value for this field.
Whether the system requires MFA from anyone who signs in without SSO
The test account doesn't have a known value for this field.
Whether accounts are created and removed through SCIM
The test account doesn't have a known value for this field.
Whether SSO is set up for the system
The test account doesn't have a known value for this field.
Whether everyone must sign in through SSO
The test account doesn't have a known value for this field.
Whether the system requires MFA from anyone who signs in without SSO
The test account doesn't have a known value for this field.
Whether accounts are created and removed through SCIM
The test account doesn't have a known value for this field.
Whether SSO is set up for the system
The test account doesn't have a known value for this field.
Whether everyone must sign in through SSO
The test account doesn't have a known value for this field.
Everything this collector reads, grouped by area. Each field lists the lowest level that collects it. Its schema isn't published yet, so only the checked fields are listed.
Not in the published schema yet. The checks below name the paths as the collector writes them.
| Path | Expected | Reported | Result |
|---|---|---|---|
| collector.name | "clickhouse" | "clickhouse" | Matches |
Not in the published schema yet. The checks below name the paths as the collector writes them.
| Path | Expected | Reported | Result |
|---|---|---|---|
| collector.version | the same as artifacts/clickhouse.collector-result.json /collector/version, which is "0.1.0" | withheld | Matches |
Not in the published schema yet. The checks below name the paths as the collector writes them.
| Path | Expected | Reported | Result |
|---|---|---|---|
| schemas.artifacts/clickhouse.json | any value | any value | Matches |
Not in the published schema yet. The checks below name the paths as the collector writes them.
| Path | Expected | Reported | Result |
|---|---|---|---|
| trace_map.artifacts.artifacts/clickhouse.json./members/total_count.operations | ["clickhouse.members.list"] | ["clickhouse.members.list"] | Matches |
Everything this collector reads, grouped by area. Each field lists the lowest level that collects it.
When the collector ran.
The test account doesn't have a known value for this field.
The collection level the artifact was made at. audit adds the inventories to trust's counts, and internal adds nothing more.
| Path | Expected | Reported | Result |
|---|---|---|---|
| collected_at_level | "audit" | "audit" | Matches |
The version of this schema.
| Path | Expected | Reported | Result |
|---|---|---|---|
| schema_version | "1.0.0" | "1.0.0" | Matches |
API keys that hold the Admin role, enabled or not.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.admin_count | 1 | 1 | Matches |
API keys whose IP access list admits any address, enabled or not.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.any_address_count | 5 | 5 | Matches |
In the test account: Five of the six keys can be used from any address.
Enabled API keys.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.enabled_count | 5 | 5 | Matches |
Every API key, sorted by name.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.inventory[6] | left out | left out | Matches |
Whether the key holds the Admin role.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.inventory[1].admin | true | true | Matches |
Whether the key's IP access list holds 0.0.0.0/0.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.inventory[5].any_address | false | false | Matches |
When the key was created. Null when the API does not say.
The test account doesn't have a known value for this field.
When the key expires. Null when it never expires.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.inventory[0].expires_at | null | null | Matches |
| api_keys.inventory[1].expires_at | null | null | Matches |
| api_keys.inventory[4].expires_at | "2030-01-01T00:00:00Z" | "2030-01-01T00:00:00Z" | Matches |
The addresses and ranges the key may be used from. 0.0.0.0/0 admits any address.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.inventory[0].ip_access_list | ["0.0.0.0/0"] | ["0.0.0.0/0"] | Matches |
| api_keys.inventory[5].ip_access_list | ["203.0.113.0/24"] | ["203.0.113.0/24"] | Matches |
When the key was last used, to the minute. Null when it has never been used.
The test account doesn't have a known value for this field.
The key's name.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.inventory[0].name | "epack-collector" | "epack-collector" | Matches |
| api_keys.inventory[1].name | "sandbox-admin" | "sandbox-admin" | Matches |
| api_keys.inventory[2].name | "sandbox-auditor" | "sandbox-auditor" | Matches |
| api_keys.inventory[3].name | "sandbox-disabled" | "sandbox-disabled" | Matches |
| api_keys.inventory[4].name | "sandbox-expiring" | "sandbox-expiring" | Matches |
| api_keys.inventory[5].name | "sandbox-ip-limited" | "sandbox-ip-limited" | Matches |
Whether the key has no expiry date.
The test account doesn't have a known value for this field.
Whether the key has never been used.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.inventory[0].never_used | false | false | Matches |
| api_keys.inventory[1].never_used | false | false | Matches |
| api_keys.inventory[2].never_used | true | true | Matches |
The console roles assigned to the key.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.inventory[0].roles | [{"name":"epack-collector","type":"custom"}] | [{"name":"epack-collector","type":"custom"}] | Matches |
| api_keys.inventory[2].roles | [{"name":"sandbox-auditor","type":"custom"}] | [{"name":"sandbox-auditor","type":"custom"}] | Matches |
| api_keys.inventory[3].roles | [] | [] | Matches |
| api_keys.inventory[4].roles | [] | [] | Matches |
The role's name, such as Admin or a custom role's name.
The test account doesn't have a known value for this field.
system for a role ClickHouse Cloud defines, custom for one the organization made.
The test account doesn't have a known value for this field.
Whether the key is enabled.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.inventory[3].state | "disabled" | "disabled" | Matches |
API keys with no expiry date, enabled or not.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.never_expires_count | 5 | 5 | Matches |
In the test account: Five of the six keys never expire.
API keys that have never been used, enabled or not.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.never_used_count | 4 | 4 | Matches |
In the test account: Only the admin key and the collector's key are used, every night.
API keys, enabled or not.
| Path | Expected | Reported | Result |
|---|---|---|---|
| api_keys.total_count | 6 | 6 | Matches |
Custom console roles.
| Path | Expected | Reported | Result |
|---|---|---|---|
| console_roles.custom_count | 2 | 2 | Matches |
API keys that hold the role.
The test account doesn't have a known value for this field.
Members who hold the role.
The test account doesn't have a known value for this field.
The role's name.
The test account doesn't have a known value for this field.
ALLOW or DENY.
The test account doesn't have a known value for this field.
The permissions the policy allows or denies, such as control-plane:organization:view.
The test account doesn't have a known value for this field.
What the permissions apply to, such as organization/<id> or instance/*.
The test account doesn't have a known value for this field.
The policy's tags.grants, a list of database grants such as database names. Null when the policy has no such tag.
The test account doesn't have a known value for this field.
The policy's tags.roleV2. sql-console-readonly means read-only SQL console access to the service's databases, and sql-console-admin means admin access. Null when the policy has no such tag.
The test account doesn't have a known value for this field.
system or custom.
The test account doesn't have a known value for this field.
Console roles, system and custom.
| Path | Expected | Reported | Result |
|---|---|---|---|
| console_roles.total_count | at least 12 | 12 | Matches |
The source of a READ or WRITE grant, such as S3, or the user of a SET DEFINER grant. It is an empty string for every source or user, and for any other privilege. Null when the server runs a ClickHouse version older than 25.8, which has no access_object column.
The test account doesn't have a known value for this field.
The privilege, such as SELECT or CREATE USER.
The test account doesn't have a known value for this field.
The column it applies to. Null for every column.
The test account doesn't have a known value for this field.
The database it applies to. Null for every database.
The test account doesn't have a known value for this field.
Whether the grantee may grant the privilege to others.
The test account doesn't have a known value for this field.
Whether the row revokes part of a broader grant.
The test account doesn't have a known value for this field.
Whether the grant names a prefix, as in sales*.* or sales.order*. The prefix is in table, or in database when table is null, and the grant covers every name that starts with it. Null when the server runs a ClickHouse version older than 26.7, which has no is_wildcard column.
The test account doesn't have a known value for this field.
The role the privilege is granted to. Null when it is granted to a user.
The test account doesn't have a known value for this field.
The table it applies to. Null for every table.
The test account doesn't have a known value for this field.
The user the privilege is granted to. Null when it is granted to a role.
The test account doesn't have a known value for this field.
ClickHouse Cloud's own grants.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].grants.cloud_managed_count | at least 1 | 168 | Matches |
The customer's grants.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].grants.customer_count | at least 11 | 14 | Matches |
Grants to the customer's users and roles that let the grantee grant the privilege to others.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].grants.grant_option_count | 1 | 1 | Matches |
In the test account: One grant, SELECT on one table, lets its user pass it on.
The privileges of the customer's users and roles, and each part of one revoked again.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].grants.inventory[0] | {"access_type":"SELECT","column":null,"database":"app","grant_option":true,"is_partial_revoke":false,"role_name":null,"t... | {"access_type":"SELECT","column":null,"database":"app","grant_option":true,"is_partial_revoke":false,"role_name":null,"t... | Matches |
The source of a READ or WRITE grant, such as S3, or the user of a SET DEFINER grant. It is an empty string for every source or user, and for any other privilege. Null when the server runs a ClickHouse version older than 25.8, which has no access_object column.
The test account doesn't have a known value for this field.
The privilege, such as SELECT or CREATE USER.
The test account doesn't have a known value for this field.
The column it applies to. Null for every column.
The test account doesn't have a known value for this field.
The database it applies to. Null for every database.
The test account doesn't have a known value for this field.
Whether the grantee may grant the privilege to others.
The test account doesn't have a known value for this field.
Whether the row revokes part of a broader grant.
The test account doesn't have a known value for this field.
Whether the grant names a prefix, as in sales*.* or sales.order*. The prefix is in table, or in database when table is null, and the grant covers every name that starts with it. Null when the server runs a ClickHouse version older than 26.7, which has no is_wildcard column.
The test account doesn't have a known value for this field.
The role the privilege is granted to. Null when it is granted to a user.
The test account doesn't have a known value for this field.
The table it applies to. Null for every table.
The test account doesn't have a known value for this field.
The user the privilege is granted to. Null when it is granted to a role.
The test account doesn't have a known value for this field.
Invitations that expired before anyone accepted them.
| Path | Expected | Reported | Result |
|---|---|---|---|
| invitations.expired_count | 0 | 0 | Matches |
When the invitation was sent. Null when the API does not say.
The test account doesn't have a known value for this field.
The address the invitation was sent to.
The test account doesn't have a known value for this field.
Whether the invitation had expired when the collector ran.
The test account doesn't have a known value for this field.
When the invitation expires.
The test account doesn't have a known value for this field.
The console roles the invitation assigns.
| Path | Expected | Reported | Result |
|---|---|---|---|
| invitations.inventory[0].roles | [{"name":"Member","type":"system"}] | [{"name":"Member","type":"system"}] | Matches |
The role's name, such as Admin or a custom role's name.
The test account doesn't have a known value for this field.
system for a role ClickHouse Cloud defines, custom for one the organization made.
The test account doesn't have a known value for this field.
Invitations that have not been accepted and have not expired.
| Path | Expected | Reported | Result |
|---|---|---|---|
| invitations.pending_count | 1 | 1 | Matches |
In the test account: One invitation is kept pending.
Invitations that have not been accepted.
| Path | Expected | Reported | Result |
|---|---|---|---|
| invitations.total_count | 1 | 1 | Matches |
Members who hold the Admin role.
| Path | Expected | Reported | Result |
|---|---|---|---|
| members.admin_count | 1 | 1 | Matches |
In the test account: One member holds the Admin role.
Every member, sorted by email.
| Path | Expected | Reported | Result |
|---|---|---|---|
| members.inventory[4] | left out | left out | Matches |
Whether the member holds the Admin role.
| Path | Expected | Reported | Result |
|---|---|---|---|
| members.inventory[0].admin | false | false | Matches |
| members.inventory[2].admin | true | true | Matches |
The member's email address.
The test account doesn't have a known value for this field.
When the member joined the organization. Null when the API does not say.
The test account doesn't have a known value for this field.
The console roles assigned to the member.
| Path | Expected | Reported | Result |
|---|---|---|---|
| members.inventory[0].roles | [{"name":"Member","type":"system"},{"name":"sandbox-auditor","type":"custom"}] | [{"name":"Member","type":"system"},{"name":"sandbox-auditor","type":"custom"}] | Matches |
| members.inventory[1].roles | [{"name":"Billing","type":"system"}] | [{"name":"Billing","type":"system"}] | Matches |
| members.inventory[2].roles | [{"name":"Admin","type":"system"}] | [{"name":"Admin","type":"system"}] | Matches |
| members.inventory[3].roles | [{"name":"Member","type":"system"},{"name":"Service Reader","type":"system"}] | [{"name":"Member","type":"system"},{"name":"Service Reader","type":"system"}] | Matches |
The role's name, such as Admin or a custom role's name.
The test account doesn't have a known value for this field.
system for a role ClickHouse Cloud defines, custom for one the organization made.
The test account doesn't have a known value for this field.
Members who sign in with MFA. Always null, with a gap: ClickHouse Cloud has no API that reports it.
| Path | Expected | Reported | Result |
|---|---|---|---|
| members.mfa_enabled_count | left out: not licensed | left out: not licensed | Matches |
In the test account: ClickHouse Cloud has no API that reports a member's MFA.
Members of the organization.
| Path | Expected | Reported | Result |
|---|---|---|---|
| members.total_count | 4 | 4 | Matches |
In the test account: Four members with different console roles.
When the organization was created. Null when the API does not say.
The test account doesn't have a known value for this field.
The organization's ID.
| Path | Expected | Reported | Result |
|---|---|---|---|
| organization.id | withheld | withheld | Matches |
The organization's name.
The test account doesn't have a known value for this field.
Whether members sign in with SAML SSO. Always null, with a gap: ClickHouse Cloud has no API that reports it.
| Path | Expected | Reported | Result |
|---|---|---|---|
| organization.sso_enabled | left out: not licensed | left out: not licensed | Matches |
In the test account: ClickHouse Cloud has no API that reports SAML SSO.
The interval's length, in seconds.
The test account doesn't have a known value for this field.
Whether the interval starts at a random offset.
The test account doesn't have a known value for this field.
The limits that are set, keyed by their name in system.quota_limits without max_, such as queries or failed_sequential_authentications.
The test account doesn't have a known value for this field.
The quota.
The test account doesn't have a known value for this field.
ClickHouse Cloud's own quota limits.
The test account doesn't have a known value for this field.
The customer's quota limits.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].quota_limits.customer_count | 1 | 1 | Matches |
The interval's length, in seconds.
The test account doesn't have a known value for this field.
Whether the interval starts at a random offset.
The test account doesn't have a known value for this field.
The limits that are set, keyed by their name in system.quota_limits without max_, such as queries or failed_sequential_authentications.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].quota_limits.inventory[0].limits | {"failed_sequential_authentications":5,"queries":1000} | {"failed_sequential_authentications":5,"queries":1000} | Matches |
The quota.
The test account doesn't have a known value for this field.
Whether it applies to every user and role, apart from those in apply_to_except.
The test account doesn't have a known value for this field.
The users and roles it does not apply to, when apply_to_all is true.
The test account doesn't have a known value for this field.
The users and roles it applies to, when apply_to_all is false.
The test account doesn't have a known value for this field.
The length of each interval, in seconds.
The test account doesn't have a known value for this field.
What usage is counted by, such as user_name. Empty when it is counted for everyone together.
The test account doesn't have a known value for this field.
The quota's name.
The test account doesn't have a known value for this field.
Where the server keeps the quota.
The test account doesn't have a known value for this field.
ClickHouse Cloud's own quotas.
The test account doesn't have a known value for this field.
The customer's quotas.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].quotas.customer_count | 1 | 1 | Matches |
Whether it applies to every user and role, apart from those in apply_to_except.
The test account doesn't have a known value for this field.
The users and roles it does not apply to, when apply_to_all is true.
The test account doesn't have a known value for this field.
The users and roles it applies to, when apply_to_all is false.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].quotas.inventory[0].apply_to_list | ["app_reader"] | ["app_reader"] | Matches |
The length of each interval, in seconds.
The test account doesn't have a known value for this field.
What usage is counted by, such as user_name. Empty when it is counted for everyone together.
The test account doesn't have a known value for this field.
The quota's name.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].quotas.inventory[0].name | "reader_quota" | "reader_quota" | Matches |
Where the server keeps the quota.
The test account doesn't have a known value for this field.
Whether the role is active when the grantee signs in.
The test account doesn't have a known value for this field.
The role granted.
The test account doesn't have a known value for this field.
The role the role is granted to. Null when it is granted to a user.
The test account doesn't have a known value for this field.
The user the role is granted to. Null when it is granted to a role.
The test account doesn't have a known value for this field.
Whether the grantee may grant the role to others.
The test account doesn't have a known value for this field.
ClickHouse Cloud's own role grants.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].role_grants.cloud_managed_count | at least 1 | 1 | Matches |
The customer's role grants.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].role_grants.customer_count | 7 | 7 | Matches |
The roles granted to the customer's users and roles.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].role_grants.inventory[0] | {"granted_role_is_default":true,"granted_role_name":"app_reader","role_name":null,"user_name":"analyst","with_admin_opti... | {"granted_role_is_default":true,"granted_role_name":"app_reader","role_name":null,"user_name":"analyst","with_admin_opti... | Matches |
| services[0].role_grants.inventory[2] | {"granted_role_is_default":true,"granted_role_name":"access_reader","role_name":null,"user_name":"epack_collector","with... | {"granted_role_is_default":true,"granted_role_name":"access_reader","role_name":null,"user_name":"epack_collector","with... | Matches |
| services[0].role_grants.inventory[3] | {"granted_role_is_default":true,"granted_role_name":"app_reader","role_name":null,"user_name":"office_only","with_admin_... | {"granted_role_is_default":true,"granted_role_name":"app_reader","role_name":null,"user_name":"office_only","with_admin_... | Matches |
| services[0].role_grants.inventory[4] | {"granted_role_is_default":true,"granted_role_name":"user_admin","role_name":null,"user_name":"ops_admin","with_admin_op... | {"granted_role_is_default":true,"granted_role_name":"user_admin","role_name":null,"user_name":"ops_admin","with_admin_op... | Matches |
Whether the role is active when the grantee signs in.
The test account doesn't have a known value for this field.
The role granted.
The test account doesn't have a known value for this field.
The role the role is granted to. Null when it is granted to a user.
The test account doesn't have a known value for this field.
The user the role is granted to. Null when it is granted to a role.
The test account doesn't have a known value for this field.
Whether the grantee may grant the role to others.
The test account doesn't have a known value for this field.
Role grants to the customer's users and roles that let the grantee grant the role to others.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].role_grants.with_admin_option_count | 4 | 4 | Matches |
In the test account: Four role grants let their holders grant the role to others.
The role's name.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].roles.cloud_managed[0].name | "clickpipes_system" | "clickpipes_system" | Matches |
| services[0].roles.cloud_managed[1].name | "default_role" | "default_role" | Matches |
| services[0].roles.cloud_managed[2].name | "sql_console_admin" | "sql_console_admin" | Matches |
| services[0].roles.cloud_managed[3].name | "sql_console_read_only" | "sql_console_read_only" | Matches |
Where the server keeps the role.
The test account doesn't have a known value for this field.
The roles ClickHouse Cloud creates in every service: clickpipes_system, default_role, sql_console_admin, and sql_console_read_only.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].roles.cloud_managed_count | 4 | 4 | Matches |
The customer's database roles.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].roles.customer_count | 3 | 3 | Matches |
The role's name.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].roles.inventory[0].name | "access_reader" | "access_reader" | Matches |
| services[0].roles.inventory[1].name | "app_reader" | "app_reader" | Matches |
| services[0].roles.inventory[2].name | "user_admin" | "user_admin" | Matches |
Where the server keeps the role.
The test account doesn't have a known value for this field.
Whether it applies to every user and role, apart from those in apply_to_except.
The test account doesn't have a known value for this field.
The users and roles it does not apply to, when apply_to_all is true.
The test account doesn't have a known value for this field.
The users and roles it applies to, when apply_to_all is false.
The test account doesn't have a known value for this field.
The database the policy applies to.
The test account doesn't have a known value for this field.
Whether the policy is restrictive rather than permissive.
The test account doesn't have a known value for this field.
The policy's full name, such as tenant_a ON app.events.
The test account doesn't have a known value for this field.
The policy's name.
The test account doesn't have a known value for this field.
Where the server keeps the policy.
The test account doesn't have a known value for this field.
The table the policy applies to, or empty for the whole database.
The test account doesn't have a known value for this field.
ClickHouse Cloud's own row policies.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].row_policies.cloud_managed_count | 0 | 0 | Matches |
The customer's row policies.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].row_policies.customer_count | 1 | 1 | Matches |
Whether it applies to every user and role, apart from those in apply_to_except.
The test account doesn't have a known value for this field.
The users and roles it does not apply to, when apply_to_all is true.
The test account doesn't have a known value for this field.
The users and roles it applies to, when apply_to_all is false.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].row_policies.inventory[0].apply_to_list | ["app_reader"] | ["app_reader"] | Matches |
The database the policy applies to.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].row_policies.inventory[0].database | "app" | "app" | Matches |
Whether the policy is restrictive rather than permissive.
The test account doesn't have a known value for this field.
The policy's full name, such as tenant_a ON app.events.
The test account doesn't have a known value for this field.
The policy's name.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].row_policies.inventory[0].short_name | "tenant_a" | "tenant_a" | Matches |
Where the server keeps the policy.
The test account doesn't have a known value for this field.
The table the policy applies to, or empty for the whole database.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].row_policies.inventory[0].table | "events" | "events" | Matches |
One entry for each service the configuration lists, in its order. An empty list means the configuration lists no services, not that the organization has none.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[1] | left out | left out | Matches |
The service's host, as the configuration names it.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].host | withheld | withheld | Matches |
The database user the collector read the service as.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].user | "epack_collector" | "epack_collector" | Matches |
The server's ClickHouse version.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].version | any value | any value | Matches |
The profile the element inherits, or null.
The test account doesn't have a known value for this field.
The highest value the setting may be changed to, or null.
The test account doesn't have a known value for this field.
The lowest value the setting may be changed to, or null.
The test account doesn't have a known value for this field.
The profile the element belongs to, or null.
The test account doesn't have a known value for this field.
The role the element is set on, or null.
The test account doesn't have a known value for this field.
The setting, such as readonly. Null when the element only inherits a profile.
The test account doesn't have a known value for this field.
The user the element is set on, or null.
The test account doesn't have a known value for this field.
The setting's value, or null when the element sets none.
The test account doesn't have a known value for this field.
WRITABLE, CONST, or CHANGEABLE_IN_READONLY, or null when the element sets no constraint.
The test account doesn't have a known value for this field.
ClickHouse Cloud's own settings profile elements.
The test account doesn't have a known value for this field.
The customer's settings profile elements.
The test account doesn't have a known value for this field.
The profile the element inherits, or null.
The test account doesn't have a known value for this field.
The highest value the setting may be changed to, or null.
The test account doesn't have a known value for this field.
The lowest value the setting may be changed to, or null.
The test account doesn't have a known value for this field.
The profile the element belongs to, or null.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].settings_profile_elements.inventory[0].profile_name | "ro_profile" | "ro_profile" | Matches |
The role the element is set on, or null.
The test account doesn't have a known value for this field.
The setting, such as readonly. Null when the element only inherits a profile.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].settings_profile_elements.inventory[0].setting_name | "readonly" | "readonly" | Matches |
| services[0].settings_profile_elements.inventory[1].setting_name | "readonly" | "readonly" | Matches |
The user the element is set on, or null.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].settings_profile_elements.inventory[1].user_name | "epack_collector" | "epack_collector" | Matches |
The setting's value, or null when the element sets none.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].settings_profile_elements.inventory[0].value | "1" | "1" | Matches |
| services[0].settings_profile_elements.inventory[1].value | "1" | "1" | Matches |
WRITABLE, CONST, or CHANGEABLE_IN_READONLY, or null when the element sets no constraint.
The test account doesn't have a known value for this field.
Whether it applies to every user and role, apart from those in apply_to_except.
The test account doesn't have a known value for this field.
The users and roles it does not apply to, when apply_to_all is true.
The test account doesn't have a known value for this field.
The users and roles it applies to, when apply_to_all is false.
The test account doesn't have a known value for this field.
The profile's name.
The test account doesn't have a known value for this field.
Where the server keeps the profile.
The test account doesn't have a known value for this field.
ClickHouse Cloud's own settings profiles.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].settings_profiles.cloud_managed_count | at least 1 | 15 | Matches |
The customer's settings profiles.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].settings_profiles.customer_count | 1 | 1 | Matches |
Whether it applies to every user and role, apart from those in apply_to_except.
The test account doesn't have a known value for this field.
The users and roles it does not apply to, when apply_to_all is true.
The test account doesn't have a known value for this field.
The users and roles it applies to, when apply_to_all is false.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].settings_profiles.inventory[0].apply_to_list | ["app_reader"] | ["app_reader"] | Matches |
The profile's name.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].settings_profiles.inventory[0].name | "ro_profile" | "ro_profile" | Matches |
Where the server keeps the profile.
The test account doesn't have a known value for this field.
The customer's users who may connect from any address.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.any_host_count | 7 | 7 | Matches |
In the test account: Seven of the eight can connect from any address. One connects only from 10.0.0.0/8.
Whether the user may connect from any address.
The test account doesn't have a known value for this field.
The second factor the method also asks for, such as one_time_password. Null when it asks for none.
The test account doesn't have a known value for this field.
The sign-in method, as system.users names it, such as sha256_password, ssh_key, or no_password.
The test account doesn't have a known value for this field.
When the method stops working, in UTC. Null when it never expires.
The test account doesn't have a known value for this field.
The addresses and ranges the user may connect from. ::/0 means any address.
The test account doesn't have a known value for this field.
The host names the user may connect from.
The test account doesn't have a known value for this field.
LIKE patterns for the host names the user may connect from.
The test account doesn't have a known value for this field.
Regular expressions for the host names the user may connect from.
The test account doesn't have a known value for this field.
The user's name.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.cloud_managed[0].name | "availability-monitoring-internal" | "availability-monitoring-internal" | Matches |
| services[0].users.cloud_managed[1].name | "backups-internal" | "backups-internal" | Matches |
| services[0].users.cloud_managed[2].name | "hyperdx-alert-internal" | "hyperdx-alert-internal" | Matches |
| services[0].users.cloud_managed[3].name | "management-internal" | "management-internal" | Matches |
| services[0].users.cloud_managed[4].name | "monitoring-internal" | "monitoring-internal" | Matches |
| services[0].users.cloud_managed[5].name | "observability-internal" | "observability-internal" | Matches |
| services[0].users.cloud_managed[6].name | "operator-cert-internal" | "operator-cert-internal" | Matches |
| services[0].users.cloud_managed[7].name | "operator-internal" | "operator-internal" | Matches |
| services[0].users.cloud_managed[8].name | "prometheus-certauth-internal" | "prometheus-certauth-internal" | Matches |
| services[0].users.cloud_managed[9].name | "prometheus-exporter" | "prometheus-exporter" | Matches |
| services[0].users.cloud_managed[10].name | "prometheus-internal" | "prometheus-internal" | Matches |
Whether one of the user's sign-in methods is no_password and has no valid_until or one later than collected_at, so anyone who reaches the service can sign in as the user.
The test account doesn't have a known value for this field.
Whether one of the user's sign-in methods keeps its password in plain text.
The test account doesn't have a known value for this field.
Where the server keeps the user, such as replicated or users_xml.
The test account doesn't have a known value for this field.
ClickHouse Cloud's own database users, the ones stored in users_xml.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.cloud_managed_count | 11 | 11 | Matches |
The customer's database users: every user apart from ClickHouse Cloud's own.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.customer_count | 8 | 8 | Matches |
In the test account: Six users made for these checks, and the default and sql-console users ClickHouse Cloud creates.
The customer's database users, sorted by name, with the default and sql-console users ClickHouse Cloud creates.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.inventory[8] | left out | left out | Matches |
Whether the user may connect from any address.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.inventory[5].any_host | false | false | Matches |
Each way the user can sign in. Any one of them is enough.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.inventory[0].auth_methods | [{"second_factor":null,"type":"sha256_password","valid_until":null}] | [{"second_factor":null,"type":"sha256_password","valid_until":null}] | Matches |
| services[0].users.inventory[2].auth_methods | [{"second_factor":null,"type":"ssh_key","valid_until":null}] | [{"second_factor":null,"type":"ssh_key","valid_until":null}] | Matches |
The second factor the method also asks for, such as one_time_password. Null when it asks for none.
The test account doesn't have a known value for this field.
The sign-in method, as system.users names it, such as sha256_password, ssh_key, or no_password.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.inventory[1].auth_methods[0].type | "sha256_password" | "sha256_password" | Matches |
| services[0].users.inventory[3].auth_methods[0].type | "sha256_password" | "sha256_password" | Matches |
| services[0].users.inventory[4].auth_methods[0].type | "sha256_password" | "sha256_password" | Matches |
| services[0].users.inventory[4].auth_methods[1].type | "ssh_key" | "ssh_key" | Matches |
When the method stops working, in UTC. Null when it never expires.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.inventory[6].auth_methods[0].valid_until | "2030-01-01T00:00:00Z" | "2030-01-01T00:00:00Z" | Matches |
The addresses and ranges the user may connect from. ::/0 means any address.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.inventory[5].host_ip | ["10.0.0.0/8"] | ["10.0.0.0/8"] | Matches |
The host names the user may connect from.
The test account doesn't have a known value for this field.
LIKE patterns for the host names the user may connect from.
The test account doesn't have a known value for this field.
Regular expressions for the host names the user may connect from.
The test account doesn't have a known value for this field.
The user's name.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.inventory[0].name | "analyst" | "analyst" | Matches |
| services[0].users.inventory[1].name | "default" | "default" | Matches |
| services[0].users.inventory[2].name | "deploy_bot" | "deploy_bot" | Matches |
| services[0].users.inventory[3].name | "epack_collector" | "epack_collector" | Matches |
| services[0].users.inventory[4].name | "legacy_app" | "legacy_app" | Matches |
| services[0].users.inventory[5].name | "office_only" | "office_only" | Matches |
| services[0].users.inventory[6].name | "ops_admin" | "ops_admin" | Matches |
| services[0].users.inventory[7].name | "sql-console" | "sql-console" | Matches |
Whether one of the user's sign-in methods is no_password and has no valid_until or one later than collected_at, so anyone who reaches the service can sign in as the user.
The test account doesn't have a known value for this field.
Whether one of the user's sign-in methods keeps its password in plain text.
The test account doesn't have a known value for this field.
Where the server keeps the user, such as replicated or users_xml.
The test account doesn't have a known value for this field.
The customer's users who can sign in with no password.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.no_password_count | 0 | 0 | Matches |
The customer's users with a password kept in plain text.
| Path | Expected | Reported | Result |
|---|---|---|---|
| services[0].users.plaintext_password_count | 0 | 0 | Matches |
The status of each run, and any value it couldn't read and why.
Number of findings left out after the first 100.
The test account doesn't have a known value for this field.
Number of requests sent, including retries. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
Number of times the collector made the call, not counting retries. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The Deprecation header from the vendor's most recent response that carried one.
The test account doesn't have a known value for this field.
The codes of the operation's failed attempts, without their counts.
The test account doesn't have a known value for this field.
Number of failed attempts per code. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The operation's name, such as okta.users.list.
The test account doesn't have a known value for this field.
The permission the call needs, in the vendor's terms. The collector declares it with Operation.Permission. A permission_denied gap from the call records it as its missing_permission.
The test account doesn't have a known value for this field.
True when a request for the operation was a retry.
The test account doesn't have a known value for this field.
Number of requests that were retries. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The HTTP status codes, or DNS response codes for a lookup, that the operation's responses had, without their counts.
The test account doesn't have a known value for this field.
Number of responses per HTTP status code, or per DNS response code for a lookup. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The Sunset header from the vendor's most recent response that carried one.
The test account doesn't have a known value for this field.
Number of the rows left out whose attempt failed or was a retry. Present wherever the rows are; 0 means every failed or retried request has a row.
The test account doesn't have a known value for this field.
One row per request, at the audit and internal levels: the first 1000, then up to 1000 more whose attempt failed or was a retry.
Its rows aren't described in the schema yet. The checks below name the paths as the collector writes them.
| Path | Expected | Reported | Result |
|---|---|---|---|
| calls.requests.*.start_ms | any value | any value | Matches |
Which attempt the request was: 1 for the first, higher for a retry.
The test account doesn't have a known value for this field.
The call's number in the run, counting from 1 in the order calls start. Every attempt of one call has the same number.
The test account doesn't have a known value for this field.
How long the request took, in milliseconds.
The test account doesn't have a known value for this field.
The code for a request that failed. Absent when it succeeded.
The test account doesn't have a known value for this field.
The request's host, the name a DNS lookup queried, or the host dialed.
The test account doesn't have a known value for this field.
The HTTP method, DNS and the record type looked up, such as DNS TXT, or DIAL.
The test account doesn't have a known value for this field.
The operation the request belongs to.
The test account doesn't have a known value for this field.
Names of the request's query parameters. Their values are not recorded.
The test account doesn't have a known value for this field.
DNS lookups only: the response code. A lookup that got no response has none.
The test account doesn't have a known value for this field.
The vendor's request ID from the response headers, when it sent one.
The test account doesn't have a known value for this field.
HTTP requests only.
The test account doesn't have a known value for this field.
When the attempt was sent, in milliseconds after the run's started_at.
The test account doesn't have a known value for this field.
The response's HTTP status code. Absent when no response arrived.
The test account doesn't have a known value for this field.
The step the call was made in. Absent for a call made outside every step.
The test account doesn't have a known value for this field.
The vendor's own error code from a failed response, such as E0000047. Never the vendor's message. Absent for collectors that do not read one.
The test account doesn't have a known value for this field.
On a retry, how long the SDK waited before sending it: the Retry-After value, the rate limit reset, or its own backoff. Absent on a first attempt and on a retry sent at once.
The test account doesn't have a known value for this field.
Number of request rows left out.
The test account doesn't have a known value for this field.
The first 100 findings of the output checks the SDK runs on each artifact it writes. Absent when there are none.
| Path | Expected | Reported | Result |
|---|---|---|---|
| checks | left out | left out | Matches |
schema, schema_unusable, population, nulls, rollups, ratios, guidance, or levels.
The test account doesn't have a known value for this field.
What the check found.
The test account doesn't have a known value for this field.
The artifact the finding is about. A schema_unusable finding has none.
The test account doesn't have a known value for this field.
JSON pointer to the value the finding is about.
The test account doesn't have a known value for this field.
What happens if the customer picks the option, including its cost and what stays Not collected.
The test account doesn't have a known value for this field.
The test account doesn't have a known value for this field.
The test account doesn't have a known value for this field.
What happens if the customer picks the option, including its cost and what stays Not collected.
The test account doesn't have a known value for this field.
The test account doesn't have a known value for this field.
The test account doesn't have a known value for this field.
Each kind the collector could write that the key left out. Each has a not_shared gap.
The test account doesn't have a known value for this field.
The kinds of evidence the collect config key listed, such as cloud-posture.
The test account doesn't have a known value for this field.
Each kind the key listed that the run never wrote, such as a misspelled one.
The test account doesn't have a known value for this field.
The source commit the collector was built from. Absent when the build set none.
The test account doesn't have a known value for this field.
The collector's name, as its spec declares it.
| Path | Expected | Reported | Result |
|---|---|---|---|
| collector.name | "clickhouse" | "clickhouse" | Matches |
The collector's version, such as v0.3.0. Absent when the build set none.
The test account doesn't have a known value for this field.
One entry per value the collector left out of an artifact, and why.
| Path | Expected | Reported | Result |
|---|---|---|---|
| gaps[2] | left out | left out | Matches |
The number of that call, matching the call on its request rows. A partial gap names the first failed call among those it counts. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
Why the value was left out: auth_failed, permission_denied, config_invalid, not_licensed, unsupported, not_read, rate_limited, vendor_error, timeout, invalid_response, too_large, internal, or not_shared. unsupported means the vendor does not report the value. too_large means the vendor holds more than the collector reads. not_shared means the customer left it out of this pack with the collect config key.
The test account doesn't have a known value for this field.
Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The one instruction that fixes collection. It uses fixed wording plus permission, plan, and region names. A gap has at most one of fix, no_action, and choice.
The test account doesn't have a known value for this field.
For a permission_denied gap, the permission to grant, in the vendor's own terms, such as okta.logs.read.
The test account doesn't have a known value for this field.
True when nothing needs changing now. It does not clear the gap.
The test account doesn't have a known value for this field.
The operation whose failed call left the value out. Absent when no call's error caused the gap, such as for a feature the plan lacks.
The test account doesn't have a known value for this field.
Who can act on the code: customer, nobody for an expected gap such as a feature the plan lacks, vendor, vendor_or_runner, or publisher.
The test account doesn't have a known value for this field.
The artifact the value belongs in. Absent when the run wrote no such artifact, in which case schema names it.
The test account doesn't have a known value for this field.
JSON pointer to the value within the artifact. Items are addressed by array index.
| Path | Expected | Reported | Result |
|---|---|---|---|
| gaps[0].pointer | "/members/mfa_enabled_count" | "/members/mfa_enabled_count" | Matches |
| gaps[1].pointer | "/organization/sso_enabled" | "/organization/sso_enabled" | Matches |
The schema of the artifact the value belongs in, when the run wrote no such artifact.
The test account doesn't have a known value for this field.
The account, tenant, or region affected. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The file and line in the collector's own source that recorded the gap, relative to its module root, such as internal/collector/system_log.go:155.
The test account doesn't have a known value for this field.
not_collected when the collector could not read the value. partial when a rollup was left out because some of the items it covers could not be read, or when a list or object holds only the items that could be.
The test account doesn't have a known value for this field.
For a partial gap, the number of items that could not be read. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The vendor's own error code, when its response included one.
The test account doesn't have a known value for this field.
The collector's message to the operator about the gap, redacted. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
Its calls in the step. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The operation.
The test account doesn't have a known value for this field.
For a partial run, the code of the first gap other than a not_shared, unsupported, or not_read one, saying why its value was left out.
The test account doesn't have a known value for this field.
For a partial run, who can act on that code.
The test account doesn't have a known value for this field.
collected when the run read every value its level collects, or partial when it left values out. gaps lists each one. A not_shared or unsupported gap does not make a run partial.
The test account doesn't have a known value for this field.
True when SSL_CERT_FILE or SSL_CERT_DIR was set for the run.
The test account doesn't have a known value for this field.
When the run finished, in RFC 3339 UTC.
The test account doesn't have a known value for this field.
The level the run collected at, at every level. A reader uses it to tell a value the level left out from one the collector could not read. Absent from results of older SDKs.
The test account doesn't have a known value for this field.
True when a proxy variable such as HTTPS_PROXY was set for the run.
The test account doesn't have a known value for this field.
The run ID the runner passed in EPACK_RUN_ID. Absent when it passed none.
The test account doesn't have a known value for this field.
When the run started, in RFC 3339 UTC.
The test account doesn't have a known value for this field.
How the collector proved its identity, such as private_key_jwt for OAuth 2.0 client credentials with a signed key assertion or api_token for an API token.
| Path | Expected | Reported | Result |
|---|---|---|---|
| signed_in_as.auth_method | "api_token" | "api_token" | Matches |
Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The kind of principal, such as service_app, service_principal, or user.
| Path | Expected | Reported | Result |
|---|---|---|---|
| signed_in_as.kind | "api_key" | "api_key" | Matches |
The identity system, such as okta or microsoft-entra.
| Path | Expected | Reported | Result |
|---|---|---|---|
| signed_in_as.provider | "clickhouse" | "clickhouse" | Matches |
Present when the collector can show that its credential could only read.
The test account doesn't have a known value for this field.
The scopes the collector asked for. A scope here and missing from scopes was not granted.
The test account doesn't have a known value for this field.
The permissions the sign-in carried.
The test account doesn't have a known value for this field.
The tenant, account, or organization signed in to. Present at the audit and internal levels only.
| Path | Expected | Reported | Result |
|---|---|---|---|
| signed_in_as.tenant_id | withheld | withheld | Matches |
The named parts of the run, in the order they started, at every level. Absent when the collector opens none.
| Path | Expected | Reported | Result |
|---|---|---|---|
| steps[5] | left out | left out | Matches |
True when an attempt in the step failed: one with an error code or a status of 400 or more.
The test account doesn't have a known value for this field.
The calls those requests belong to. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
When the step ended, in milliseconds after the run's started_at. A step still open when the collector emitted ended then. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The attempts that failed: those with an error code or a status of 400 or more. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The step's name, such as people. Step names are part of the collector's contract, like operation names.
| Path | Expected | Reported | Result |
|---|---|---|---|
| steps[0].name | "sign_in" | "sign_in" | Matches |
| steps[1].name | "members" | "members" | Matches |
| steps[2].name | "api_keys" | "api_keys" | Matches |
| steps[3].name | "console_roles" | "console_roles" | Matches |
| steps[4].name | "databases" | "databases" | Matches |
The requests sent in the step, including rows left out of calls.requests. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The requests that were retries. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
When the step started, in milliseconds after the run's started_at. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The step's title, such as People and sign-in methods.
The test account doesn't have a known value for this field.
How many distinct values the run read that the vocabulary lacks.
The test account doesn't have a known value for this field.
The first 50 of those values, sorted. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The vocabulary's name, such as okta.event_types.
The test account doesn't have a known value for this field.
The one instruction that fixes collection. A warning has at most one of fix, no_action, and choice.
The test account doesn't have a known value for this field.
The collector's message about what happened. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The permission to grant, in the vendor's own terms.
The test account doesn't have a known value for this field.
True when nothing needs changing now.
The test account doesn't have a known value for this field.
The account, tenant, or region affected. Present at the audit and internal levels only.
The test account doesn't have a known value for this field.
The controls that read this collector's evidence.