Cockroachlabs CockroachDB Cloud API
Official vendor OpenAPI document · agent-readyStorageDatabasebearer144 EndpointsREST
For Agents
Provision and manage CockroachDB Cloud clusters, databases, SQL users, backups, and network rules across 144 endpoints from a single Bearer-authenticated API.
Use for: Create a new CockroachDB serverless cluster in us-east1, Scale a CockroachDB dedicated cluster up to 8 vCPUs, List all clusters in my Cockroach Labs organisation, Get the connection string for cluster id abc-123
Not supported: Does not run SQL queries against your data, expose live cluster metrics, or replace the cockroach SQL client - use for CockroachDB Cloud control-plane management only.
The CockroachDB Cloud API manages every resource in a Cockroach Labs Cloud organisation - clusters, databases, SQL users, backups, network allow-lists, private endpoints, CMEK encryption keys, and audit log destinations - through a single Bearer-authenticated REST surface. It also exposes SCIM 2.0 user and group endpoints for identity federation with corporate IdPs. Cockroach Labs publishes this specification at cockroachlabs.cloud, and it backs both the cloud console and the official Terraform provider.
Install Jentic One Beta
Connect the CockroachDB Cloud API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the CockroachDB Cloud API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcockroachlabs.com%2Fcockroachlabs" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcockroachlabs.com%2Fcockroachlabs" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with CockroachDB Cloud API.
Create, scale, upgrade, and delete CockroachDB clusters via /api/v1/clusters and /api/v1/clusters/{cluster_id}
Create, list, update and delete databases inside a cluster via /api/v1/clusters/{cluster_id}/databases endpoints
Configure cluster backup policy and list existing backups via /api/v1/clusters/{cluster_id}/backups and /backups-config
Lock down access with network allow-lists, private endpoints, and Client CA certificates per cluster
Enable customer-managed encryption keys (CMEK) on a cluster through the /cmek endpoints
Federate users and groups via the SCIM 2.0 surface at /api/scim/v2/Users and /api/scim/v2/Groups
Use Cases
Patterns agents use CockroachDB Cloud API for, with concrete tasks.
★ Cluster Provisioning Automation
Provision CockroachDB Cloud clusters from CI/CD or platform self-service portals. POST /api/v1/clusters initialises a new cluster with the chosen plan and region, GET /api/v1/clusters/available-regions returns the region list, and PATCH on the cluster scales it as load grows. The same surface backs the official Terraform provider, so Day 0 setup typically takes under 20 minutes per environment.
Call POST /api/v1/clusters to create a serverless cluster named 'staging' in us-east1, then return the connection string from GET /api/v1/clusters/{cluster_id}/connection-string.
Backup and Disaster Recovery
Configure and audit cluster backups across an organisation. GET /api/v1/clusters/{cluster_id}/backups lists existing backups, PATCH /backups-config updates retention policy, and a separate restore workflow runs from those backups. Useful for meeting RPO and RTO targets in a compliance review without manual ops effort.
Call PATCH /api/v1/clusters/{cluster_id}/backups-config to set retention to 30 days for cluster id abc-123.
Security Posture and Network Lockdown
Enforce network and encryption policy across CockroachDB clusters. The /allowlist, /private-endpoints, /client-ca-cert, and /cmek endpoint groups let an automation add IP CIDRs, attach private connectivity, set client CA certificates, and enable customer-managed encryption keys on a per-cluster basis. This pattern is core to passing SOC 2 and HIPAA reviews.
Add the CIDR 10.0.0.0/16 to the allow-list of cluster id abc-123 by POSTing to the cluster's allowlist endpoint.
Identity Federation via SCIM
Sync users and groups from an enterprise IdP using the SCIM 2.0 endpoints under /api/scim/v2. POST /api/scim/v2/Users provisions an identity, PATCH /api/scim/v2/Users/{id} applies updates, and DELETE deprovisions. The SCIM surface also covers groups, schemas, and a service-provider config endpoint so an IdP can run discovery automatically.
Call POST /api/scim/v2/Users with the new hire's profile and assign them to the 'engineers' group via PATCH /api/scim/v2/Groups/{id}.
AI Agent Database Provisioning via Jentic
An AI platform engineer agent uses Jentic to create on-demand CockroachDB clusters for feature branches and tear them down on PR merge. The agent searches for 'create a CockroachDB cluster', loads the schema, and executes - Jentic supplies the Bearer API key from the vault so the agent never sees the credential.
Use Jentic to search for 'create a CockroachDB cluster', load the POST /api/v1/clusters schema, and create a serverless cluster for branch 'feature-x'.
Key Endpoints
144 endpoints — the cockroachdb cloud api manages every resource in a cockroach labs cloud organisation - clusters, databases, sql users, backups, network allow-lists, private endpoints, cmek encryption keys, and audit log destinations - through a single bearer-authenticated rest surface.
METHOD
PATH
DESCRIPTION
POST
/api/v1/clusters
Create and initialise a new cluster
GET
/api/v1/clusters
List clusters in the organisation
PATCH
/api/v1/clusters/{cluster_id}
Scale, edit, or upgrade a cluster
GET
/api/v1/clusters/{cluster_id}/connection-string
Get the connection string for a cluster
GET
/api/v1/clusters/{cluster_id}/backups
List cluster backups
POST
/api/v1/clusters/{cluster_id}/cmek
Enable CMEK on a cluster
GET
/api/v1/auditlogevents
List audit log events
POST
/api/scim/v2/Users
Create a SCIM user
POST
/api/v1/clusters
Create and initialise a new cluster
GET
/api/v1/clusters
List clusters in the organisation
PATCH
/api/v1/clusters/{cluster_id}
Scale, edit, or upgrade a cluster
GET
/api/v1/clusters/{cluster_id}/connection-string
Get the connection string for a cluster
GET
/api/v1/clusters/{cluster_id}/backups
List cluster backups
POST
/api/v1/clusters/{cluster_id}/cmek
Enable CMEK on a cluster
GET
/api/v1/auditlogevents
List audit log events
POST
/api/scim/v2/Users
Create a SCIM user
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the CockroachDB Cloud API by hand means learning its bearer auth, targeting cockroachlabs.cloud, and handling paging and retries across a large control-plane surface yourself. Through Jentic you install once, import the CockroachDB Cloud API from the API Directory, store the API key once, and your agent calls it.
Permission scoping
CockroachDB Cloud puts the cluster id in the URL path (/api/v1/clusters/{cluster_id}/...), so a rule can pin your agent to one cluster for reads like its connection string and backups. You choose the operations it may call, so ones that change state like editing a cluster or provisioning CMEK are not included unless you add them.
Credential isolation
Your CockroachDB Cloud API key is stored once, encrypted, by your own Jentic One instance and added to the Authorization header at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'create a CockroachDB cluster' or 'add an IP allow-list entry', and Jentic returns the matching CockroachDB Cloud operation with its parameter schema so the agent calls the right endpoint without scanning the full reference.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using CockroachDB Cloud API through Jentic.
What authentication does the CockroachDB Cloud API use?
The API uses HTTP Bearer authentication. Generate an API key in the Cockroach Labs Cloud console at https://cockroachlabs.cloud and pass it in the Authorization header on every request. Through Jentic the API key is stored encrypted in the vault and injected at execution time.
Can I create and scale CockroachDB clusters with this API?
Yes. POST /api/v1/clusters creates a cluster with the chosen plan and region, PATCH /api/v1/clusters/{cluster_id} scales or edits it (including version upgrades), and DELETE on the same path tears it down. The same operations back the official Terraform provider.
What are the rate limits for the CockroachDB Cloud API?
The OpenAPI spec does not declare numeric rate limits. Cockroach Labs applies tenant-level throttling, particularly on cluster creation, so platform automations should serialise create/delete loops and back off on 429 responses.
How do I retrieve a connection string for a cluster through Jentic?
Search Jentic for 'CockroachDB connection string', load the GET /api/v1/clusters/{cluster_id}/connection-string schema, and execute with the cluster id. Install the SDK with pip install jentic and call it via the async client. The endpoint returns a generic, region-agnostic connection string.
Does the API support SCIM provisioning?
Yes. The /api/scim/v2 surface implements SCIM 2.0 - Users, Groups, ResourceTypes, Schemas, and ServiceProviderConfig - so an enterprise IdP such as Okta or Entra ID can provision and deprovision Cockroach Cloud users and groups automatically.
Can I manage backups and CMEK encryption through the API?
Yes. /api/v1/clusters/{cluster_id}/backups lists backups, /backups-config configures retention, and the /cmek endpoint group enables and rotates customer-managed encryption keys on a per-cluster basis. These cover the typical SOC 2 and HIPAA control points for managed databases.
Can I limit what my agent is allowed to do with the CockroachDB Cloud API?
Yes. Jentic One is self-hosted by you, so your own rules decide which CockroachDB Cloud operations and credentials the agent may use. Because the cluster id sits in the URL path (/api/v1/clusters/{cluster_id}/...), you can pin the agent to a single cluster and to read-only calls such as fetching its connection string or listing its backups. State-changing operations like editing a cluster or provisioning CMEK are only available to the agent if you explicitly add them.
GET STARTED