---
title: "Database users and databases"
slug: "dbaas-user-db-management"
source: "https://app.cloudpe.com/help/dbaas-user-db-management"
updated: "2026-08-30T19:03:44.196Z"
---

# Database users and databases

## Overview

Every managed database cluster on CloudPe hosts two things you manage separately: **Databases** (the logical databases inside the cluster) and **Database Users** (the accounts that connect to them). This article covers creating and removing both from the cluster detail page, and the equivalent API calls.

Managed Databases is in beta. The **Users** and **Databases** tabs appear on the detail page of any running cluster, whichever engine it runs.

## Before you start

- You need a running cluster. If you have not created one yet, start with [PostgreSQL clusters](/help/dbaas-postgresql-clusters).
- Viewing users and databases requires the `databases:read` permission. Creating a user or a database requires `databases:update`. Deleting either requires `databases:delete`.
- Your account must belong to an organization — DBaaS endpoints authorise against the cluster's organization, so a user with no organization cannot list or manage cluster contents.
- Decide the username, password and, for MongoDB, the roles you want to grant before you open the dialog: passwords are set at creation time.

## Steps

### Create a database user

1. Open **Databases** in the sidebar and select your cluster to reach **Cluster Details**.
2. Open the **Users** tab.
3. Click **Add User**.
4. Enter a username. Usernames must start with a letter or underscore and may contain only letters, digits and underscores.
5. Enter a password.
6. Grant access: either mark the user as an admin, or scope it to specific databases and privileges. For MongoDB clusters, supply the MongoDB roles instead — they are required for that engine.
7. Save. The new account appears in the **Database Users** list.

![](/kb/databases/dbaas-user-db-management-01-users-tab.png)

To remove an account, find it in the **Database Users** list and delete it. The account is dropped in the engine, so any application still using those credentials will fail to authenticate.

### Create a logical database

1. On the same cluster, open the **Databases** tab.
2. Click **Create Database**.
3. Enter a name. Names must start with a letter or underscore and may contain only letters, digits and underscores.
4. Optionally set a character set and a collation. Leave them blank to use the engine defaults.
5. Save. The database appears under the **Databases** heading.

![](/kb/databases/dbaas-user-db-management-02-databases-tab.png)

Deleting a database from this tab drops it in the engine along with its contents. Take a backup from the **Backups** tab first if you may need the data again.

### Connect with the new credentials

Use the **Connection** tab for the cluster's host, port and connection string, then substitute the username, password and database name you just created.

## API

All calls below are org-scoped and use a Bearer API key.

List the databases in a cluster:

```bash
curl -X GET https://app.cloudpe.com/api/v1/databases/<cluster_id>/dbs \
  -H "Authorization: Bearer <API_KEY>"
```

Create a logical database (`GET /api/v1/databases/{cluster_id}/dbs` for the result):

```bash
curl -X POST https://app.cloudpe.com/api/v1/databases/<cluster_id>/dbs \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "app_data",
    "charset": "utf8mb4",
    "collation": "utf8mb4_general_ci"
  }'
```

Delete a logical database:

```bash
curl -X DELETE https://app.cloudpe.com/api/v1/databases/<cluster_id>/dbs/<db_id> \
  -H "Authorization: Bearer <API_KEY>"
```

List database users:

```bash
curl -X GET https://app.cloudpe.com/api/v1/databases/<cluster_id>/users \
  -H "Authorization: Bearer <API_KEY>"
```

Create a database user. Use `allowed_databases` and `privileges` for MySQL, MariaDB and PostgreSQL clusters; use `roles` for MongoDB, where it is required:

```bash
curl -X POST https://app.cloudpe.com/api/v1/databases/<cluster_id>/users \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "app_user",
    "password": "<PASSWORD>",
    "is_admin": false,
    "allowed_databases": ["app_data"],
    "privileges": ["SELECT", "INSERT"]
  }'
```

Delete a database user:

```bash
curl -X DELETE https://app.cloudpe.com/api/v1/databases/<cluster_id>/users/<user_id> \
  -H "Authorization: Bearer <API_KEY>"
```

Related endpoints on the same cluster: `GET /api/v1/databases/{cluster_id}` for cluster details, `GET /api/v1/databases/{cluster_id}/events` for the audit trail of these operations, and `GET /api/v1/databases/{cluster_id}/firewall` / `PUT /api/v1/databases/{cluster_id}/firewall` to control which sources may connect with the credentials you create.

## Limits & billing

Creating users and logical databases does not change what you are billed — a cluster is priced by its plan, node count and extra storage, not by the number of accounts or schemas inside it. Consult the **Overview** tab for the cluster's plan.

Usernames are limited to the length allowed by the create-user request schema, and database names to the length allowed by the create-database schema; the console rejects anything longer before it reaches the engine. Passwords must meet the minimum length enforced by the API.

Cluster-level quotas (number of clusters, nodes per cluster, storage) apply to the cluster itself and are described in [PostgreSQL clusters](/help/dbaas-postgresql-clusters).

## Troubleshooting

| Error | What it means | What to do |
|---|---|---|
| `Cluster not found` | The cluster id in the request does not resolve, or it belongs to an organization you are not a member of. | Re-open the cluster from **Databases** and copy the id from the URL. Confirm you are working in the right organization. |
| `User has no organization` | Your account is not attached to an organization, so no DBaaS resource can be scoped to you. | Ask an administrator to add you to the organization that owns the cluster, then retry. |
| `{…} {…} already exists` | A user or database with that name already exists on the cluster. | Pick a different name, or delete the existing object first from the **Users** or **Databases** tab. |

If a create call returns a server error with no detail, check the **Events** tab for the cluster — the operation is recorded there — and open a support ticket with the cluster id.

## FAQ

**Can I change a user's password later?**
Recreate the account: delete the user, then create it again with the new password and the same grants. There is no separate password-change endpoint on the public API.

**Do users I create apply to every node?**
Yes. Users and databases are created through the cluster's primary and propagate to replicas through replication, so read replicas accept the same credentials.

**Why is my new user unable to connect?**
Credentials are only half the story: the cluster's firewall rules decide which source addresses may reach it. Check the **Firewall** tab, and confirm you are connecting to the endpoint shown on the **Connection** tab.

**Which fields do MongoDB clusters need?**
MongoDB users are role-based, so supply `roles` when creating a user on a MongoDB cluster. `privileges` and `allowed_databases` are for the SQL engines.

**Does deleting a database delete its backups?**
No. Backups are taken at cluster level and are listed on the **Backups** tab; dropping a logical database does not remove existing backups of the cluster.

## Related

- [PostgreSQL clusters](/help/dbaas-postgresql-clusters)