Auditable Event Methods for Confluent Cloud for Apache Flink
Auditable event methods for Confluent Cloud for Apache Flink® are triggered by operations on Flink and send event messages about the operations to the audit log cluster, where they are stored as event records in a Kafka topic. The resource types for which auditable event methods are triggered include:
The following sections provide details about the auditable event methods for each of these resource types.
Flink region
Auditable event methods for the resource type FLINK_REGION are triggered by operations on Flink compute pool and generate event messages that are sent to the audit log cluster, where they are stored as event records in a Kafka topic.
Method name | Action triggering an auditable event message |
|---|---|
A request to list the Flink regions in the organization. |
ListFlinkRegions
The ListFlinkRegions event method is triggered by a request to get a a list of the Flink regions in the organization and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"specversion": "1.0",
"id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"source": "crn://confluent.cloud/",
"type": "io.confluent.cloud/request",
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"datacontenttype": "application/json",
"dataschema": "https://confluent.io/internal/events/AuditLog.v2",
"data": {
"service_name": "crn://confluent.cloud/service=cc-ksql-api-service",
"internal_service_name": "crn://confluent.cloud/service=cc-ksql-api-service",
"method_name": "ListFlinkRegions",
"cloud_resources": [
{
"resource": {
"type": "ORGANIZATION",
"resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
}
}
],
"authentication_info": {
"exposure": "CUSTOMER",
"principal": {
"confluent_user": {
"resource_id": "u-ab1cd2",
"internal_id": "99"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"request_metadata": {
"request_id": [
"74726163656964303132333435363738"
],
"client_address": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"access_type": "READ_ONLY",
"data": {
"BypassCache": false,
"Cloud": 0,
"PageSize": 10,
"PageToken": "",
"RegionName": ""
}
},
"result": {
"status": "SUCCESS",
"data": {
"elements": [
{
"fcpm_v_2_region": {
"id": "aws.af-south-1",
"metadata": null
}
},
{
"fcpm_v_2_region": {
"id": "aws.ap-east-1",
"metadata": null
}
},
{
"fcpm_v_2_region": {
"id": "aws.ap-northeast-1",
"metadata": null
}
},
{
"fcpm_v_2_region": {
"id": "aws.ap-northeast-2",
"metadata": null
}
},
{
"fcpm_v_2_region": {
"id": "aws.ap-northeast-3",
"metadata": null
}
},
{
"fcpm_v_2_region": {
"id": "aws.ap-south-1",
"metadata": null
}
},
{
"fcpm_v_2_region": {
"id": "aws.ap-south-2",
"metadata": null
}
},
{
"fcpm_v_2_region": {
"id": "aws.ap-southeast-1",
"metadata": null
}
},
{
"fcpm_v_2_region": {
"id": "aws.ap-southeast-2",
"metadata": null
}
},
{
"fcpm_v_2_region": {
"id": "aws.ap-southeast-3",
"metadata": null
}
}
]
}
}
}
}
Flink compute pool
Auditable event methods for the resource type COMPUTE_POOL are triggered by operations on a Flink compute pool and generate event messages that are sent to the audit log cluster, where they are stored as event records in a Kafka topic.
Method name | Action triggering an auditable event message |
|---|---|
A request to create a Flink compute pool. | |
A request to delete a Flink compute pool. | |
A request for a query of a Flink compute pool details. | |
A request for a list of Flink compute pools. | |
A request to update a Flink compute pool. |
CreateComputePool
The CreateComputePool event method is triggered by a request to create a Flink compute pool and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "CreateComputePool",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-west-2"
}
]
},
"resource": {
"type": "COMPUTE_POOL",
"resourceId": "lfcp-a1b2c3"
}
}
],
"authenticationInfo": {
"principal": {
"email": "xyz@confluent.io",
"confluentUser": {
"resourceId": "u-ab1cd2"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"requestMetadata": {
"requestId": [
"b074508552873039d452bf6aea6caa46"
],
"clientAddress": [
{
"ip": "134.238.241.34"
}
]
},
"request": {
"accessType": "MODIFICATION",
"data": {
"spec": {
"config": {
"default_compute_pool": false
},
"display_name": "AWS.us-west-2.env-123abc.4749",
"environment": {
"id": "env-123abc"
},
"max_cfu": 10,
"region": "us-west-2",
"cloud": 1
}
}
},
"result": {
"status": "SUCCESS",
"data": {
"id": "lfcp-a1b2c3",
"metadata": {
"resource_name": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123/flink-region=aws.us-west-2/compute-pool=lfcp-a1b2c3",
"self": "https://devel.cpdev.cloud/fcpm/v2/compute-pools/lfcp-a1b2c3",
"updated_at": "2026-01-07T07:09:29.629925Z",
"created_at": "2026-01-07T07:09:29.629925Z",
"deleted_at": null
},
"spec": {
"display_name": "AWS.us-west-2.env-123abc.4749",
"environment": {
"id": "env-123abc",
"related": "https://devel.cpdev.cloud/fcpm/v2/compute-pools/lfcp-a1b2c3",
"resource_name": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc"
},
"flink_region": "aws.us-west-2",
"max_cfu": 10,
"region": "us-west-2",
"cloud": 1,
"config": {
"default_compute_pool": false
}
},
"status": {
"current_cfu": 0,
"phase": "PROVISIONING"
}
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/compute-pool=lfcp-a1b2c3"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/compute-pool=lfcp-a1b2c3",
"specversion": "1.0",
"id": "d4743d4e-bf35-423d-adf4-6903d8a994a4",
"source": "crn://confluent.cloud/",
"time": "2026-01-07T07:09:29.706595681Z",
"type": "io.confluent.cloud/request"
}
DeleteComputePool
The DeleteComputePool event method is triggered by a request to delete a Flink compute pool and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"specversion": "1.0",
"id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"source": "crn://confluent.cloud/",
"type": "io.confluent.cloud/request",
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=azure.uksouth/compute-pool=lfcp-a1b2c3",
"datacontenttype": "application/json",
"dataschema": "https://confluent.io/internal/events/AuditLog.v2",
"data": {
"service_name": "crn://confluent.cloud/service=cc-ksql-api-service",
"internal_service_name": "crn://confluent.cloud/service=cc-ksql-api-service",
"method_name": "DeleteComputePool",
"cloud_resources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resource_id": "env-123abc"
},
{
"type": "FLINK_REGION",
"resource_id": "azure.uksouth"
}
]
},
"resource": {
"type": "COMPUTE_POOL",
"resource_id": "lfcp-a1b2c3"
}
}
],
"authentication_info": {
"exposure": "CUSTOMER",
"principal": {
"confluent_user": {
"resource_id": "u-ab1cd2",
"internal_id": "99"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"request_metadata": {
"request_id": [
"74726163656964303132333435363738"
],
"client_address": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"access_type": "MODIFICATION",
"data": {
"environment_id": "env-123abc",
"id": "lfcp-a1b2c3"
}
},
"result": {
"status": "SUCCESS"
}
}
}
GetComputePool
The GetComputePool event method is triggered by a request to get the details for a Flink compute pool and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "GetComputePool",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-west-2"
}
]
},
"resource": {
"type": "COMPUTE_POOL",
"resourceId": "lfcp-a1b2c3"
}
}
],
"authenticationInfo": {
"principal": {
"email": "xyz@confluent.io",
"confluentUser": {
"resourceId": "u-ab1cd2"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"requestMetadata": {
"requestId": [
"d7f428f0a481f99067d50ae13b7a500c"
],
"clientAddress": [
{
"ip": "134.238.241.34"
}
]
},
"request": {
"accessType": "READ_ONLY",
"data": {
"OrgResourceId": "",
"Id": "lfcp-a1b2c3",
"EnvironmentId": "env-123abc",
"FlinkRegion": "aws.us-west-2",
"IncludeDeactivated": false
}
},
"result": {
"status": "SUCCESS",
"data": {
"status": {
"current_cfu": 0,
"phase": "PROVISIONING"
},
"id": "lfcp-a1b2c3",
"metadata": {
"self": "https://devel.cpdev.cloud/fcpm/v2/compute-pools/lfcp-a1b2c3",
"updated_at": "2026-01-07T07:09:29.915339Z",
"created_at": "2026-01-07T07:09:29.629925Z",
"deleted_at": null,
"resource_name": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/compute-pool=lfcp-a1b2c3"
},
"spec": {
"environment": {
"id": "env-123abc",
"related": "https://devel.cpdev.cloud/fcpm/v2/compute-pools/lfcp-a1b2c3",
"resource_name": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc"
},
"flink_region": "aws.us-west-2",
"max_cfu": 10,
"region": "us-west-2",
"cloud": 1,
"display_name": "AWS.us-west-2.env-123abc.4749"
}
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/compute-pool=lfcp-a1b2c3"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/compute-pool=lfcp-a1b2c3",
"specversion": "1.0",
"id": "20034b46-dc67-4fa8-a0b3-d2383ef2731e",
"source": "crn://confluent.cloud/",
"time": "2026-01-07T07:09:31.439558633Z",
"type": "io.confluent.cloud/request"
}
ListComputePools
The ListComputePools event method is triggered by a request for a list of Flink compute pools and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "ListComputePools",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
}
]
},
"resource": {
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
}
}
],
"authenticationInfo": {
"principal": {
"email": "xyz@confluent.io",
"confluentUser": {
"resourceId": "u-ab1cd2"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"requestMetadata": {
"requestId": [
"99eb046866e6852ce8b0521eaf73c7b6"
],
"clientAddress": [
{
"ip": "134.238.241.34"
}
]
},
"request": {
"accessType": "READ_ONLY",
"data": {
"EnvironmentId": "env-123abc",
"Region": "",
"NetworkId": "",
"PageToken": "",
"PageSize": 3,
"OrgResourceId": ""
}
},
"result": {
"status": "SUCCESS",
"data": {
"elements": null
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc",
"specversion": "1.0",
"id": "3c873186-7a17-4ddb-8f1f-9cb8072f6e5f",
"source": "crn://confluent.cloud/",
"time": "2026-01-07T07:09:07.109105510Z",
"type": "io.confluent.cloud/request"
}
UpdateComputePool
The UpdateComputePool event method is triggered by a request to update a Flink compute pool and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "UpdateComputePool",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-west-2"
}
]
},
"resource": {
"type": "COMPUTE_POOL",
"resourceId": "lfcp-a1b2c3"
}
}
],
"authenticationInfo": {
"principal": {
"email": "xyz@confluent.io",
"confluentUser": {
"resourceId": "u-ab1cd2"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"requestMetadata": {
"requestId": [
"858b0457b658b1dcb6bdeb4ec1c383c4"
],
"clientAddress": [
{
"ip": "134.238.241.34"
}
]
},
"request": {
"accessType": "MODIFICATION",
"data": {
"spec": {
"cloud": 0,
"display_name": "",
"environment": {
"id": "env-123abc"
},
"max_cfu": 5,
"region": ""
}
}
},
"result": {
"status": "FAILURE",
"data": {
"errors": [
{
"status": "400",
"detail": "Reducing the max_cfu of a compute pool is currently unsupported.",
"source": {},
"id": "858b0457b658b1dcb6bdeb4ec1c383c4"
}
]
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/compute-pool=lfcp-a1b2c3"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/compute-pool=lfcp-a1b2c3",
"specversion": "1.0",
"id": "9f42c5f7-a791-4f24-b4b6-9950f81674e5",
"source": "crn://confluent.cloud/",
"time": "2026-01-07T07:10:53.102443832Z",
"type": "io.confluent.cloud/request"
}
Flink workspace
Auditable event methods for the resource type FLINK_WORKSPACE are triggered by operations on a Flink workspace and generate event messages that are sent to the audit log cluster, where they are stored as event records in a Kafka topic.
Method name | Action triggering an auditable event message |
|---|---|
A request to create a Flink workspace. | |
A request to delete a Flink workspace. | |
A request for a query of a Flink workspace details. | |
A request for a list of Flink workspaces. | |
A request to update a Flink workspace. |
CreateWorkspace
The CreateWorkspace event method is triggered by a request to create a Flink workspace and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "CreateWorkspace",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-east-1"
}
]
},
"resource": {
"type": "FLINK_WORKSPACE",
"resourceId": "workspace-2026-01-22-162414"
}
}
],
"authenticationInfo": {
"principal": {
"confluentUser": {
"resourceId": "u-ab1cd2"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"requestMetadata": {
"requestId": [
"8b4f7ec5693a01fb4a1ae0a24240f944"
],
"clientAddress": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"accessType": "MODIFICATION",
"data": {
"workspace_name": "workspace-2026-01-22-162414",
"environment_id": "env-123abc",
"org_resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"spec": {
"compute_pool": {
"id": "lfcp-a1b2c3"
},
"service_account": null
}
}
},
"result": {
"status": "SUCCESS",
"data": {
"environment_id": "env-123abc",
"name": "workspace-2026-01-22-162414",
"org_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"spec": {
"compute_pool": {
"id": "lfcp-a1b2c3"
},
"service_account": null
}
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-east-1/flink-workspace=workspace-2026-01-22-162414"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-east-1/flink-workspace=workspace-2026-01-22-162414",
"specversion": "1.0",
"id": "b76bee22-7678-49ea-8902-67519b0d4133",
"source": "crn://confluent.cloud/",
"time": "2026-01-22T16:24:15.007233032Z",
"type": "io.confluent.cloud/request"
}
DeleteWorkspace
The DeleteWorkspace event method is triggered by a request to delete a Flink workspace and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "DeleteWorkspace",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-east-1"
}
]
},
"resource": {
"type": "FLINK_WORKSPACE",
"resourceId": "workspace-2026-01-22-162414"
}
}
],
"authenticationInfo": {
"principal": {
"confluentUser": {
"resourceId": "u-ab1cd2"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"requestMetadata": {
"requestId": [
"6a4dd657fe6fc5241360983cbf8dc8ce"
],
"clientAddress": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"accessType": "MODIFICATION",
"data": {
"workspace_name": "workspace-2026-01-22-162414",
"environment_id": "env-123abc",
"org_resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
}
},
"result": {
"status": "SUCCESS"
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-east-1/flink-workspace=workspace-2026-01-22-162414"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-east-1/flink-workspace=workspace-2026-01-22-162414",
"specversion": "1.0",
"id": "36791901-6bd6-4057-8820-9d6860d56d0c",
"source": "crn://confluent.cloud/",
"time": "2026-01-22T16:24:41.773914645Z",
"type": "io.confluent.cloud/request"
}
GetWorkspace
The GetWorkspace event method is triggered by a request to get the details for a Flink workspace and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "GetWorkspace",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-east-1"
}
]
},
"resource": {
"type": "FLINK_WORKSPACE",
"resourceId": "workspace-2026-01-22-162414"
}
}
],
"authenticationInfo": {
"principal": {
"confluentUser": {
"resourceId": "u-ab1cd2"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"requestMetadata": {
"requestId": [
"ae0fe8164a496916ba2494a4f5cef447"
],
"clientAddress": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"accessType": "READ_ONLY",
"data": {
"environment_id": "env-123abc",
"org_resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"workspace_name": "workspace-2026-01-22-162414"
}
},
"result": {
"status": "SUCCESS",
"data": {
"environment_id": "env-123abc",
"name": "workspace-2026-01-22-162414",
"org_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"spec": {
"service_account": null,
"compute_pool": {
"id": "lfcp-stgcc30xr80"
}
}
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-east-1/flink-workspace=workspace-2026-01-22-162414"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-east-1/flink-workspace=workspace-2026-01-22-162414",
"specversion": "1.0",
"id": "ae935a4b-bcc6-4359-9149-3c31e728877a",
"source": "crn://confluent.cloud/",
"time": "2026-01-22T16:24:15.666686762Z",
"type": "io.confluent.cloud/request"
}
ListWorkspaces
The ListWorkspaces event method is triggered by a request for a list of Flink workspaces and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "ListWorkspace",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-east-1"
}
]
},
"resource": {
"type": "FLINK_WORKSPACE",
"resourceId": "workspace-2026-01-22-162414"
}
}
],
"authenticationInfo": {
"principal": {
"confluentUser": {
"resourceId": "u-ab1cd2"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"requestMetadata": {
"requestId": [
"5e926b0c56f3131f8fb350f228ad9b11"
],
"clientAddress": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"accessType": "READ_ONLY",
"data": {
"environment_id": "env-123abc",
"org_resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"page_size": 100
}
},
"result": {
"status": "SUCCESS",
"data": {
"data": [
{
"name": "workspace-2026-01-22-162414",
"org_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"spec": {
"compute_pool": {
"id": "lfcp-a1b2c3"
},
"service_account": null
},
"environment_id": "env-123abc"
}
]
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-east-1/flink-workspace=workspace-2026-01-22-162414"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-east-1/flink-workspace=workspace-2026-01-22-162414",
"specversion": "1.0",
"id": "f1f9c92e-f3b8-425e-971f-c0206b0eadc0",
"source": "crn://confluent.cloud/",
"time": "2026-01-22T16:24:29.707277883Z",
"type": "io.confluent.cloud/request"
}
UpdateWorkspace
The UpdateWorkspace event method is triggered by a request to update a Flink workspace and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "UpdateWorkspace",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-east-1"
}
]
},
"resource": {
"type": "FLINK_WORKSPACE",
"resourceId": "workspace-2026-01-22-162803"
}
}
],
"authenticationInfo": {
"principal": {
"confluentUser": {
"resourceId": "u-ab1cd2"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-ab1cd2"
},
"requestMetadata": {
"requestId": [
"8dd4507a31c9fa9f7ca08fdad18020c5"
],
"clientAddress": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"accessType": "MODIFICATION",
"data": {
"spec": {
"compute_pool": null,
"service_account": null
},
"workspace_name": "workspace-2026-01-22-162803",
"environment_id": "env-123abc",
"org_resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
}
},
"result": {
"status": "SUCCESS",
"data": {
"environment_id": "env-123abc",
"name": "workspace-2026-01-22-162803",
"org_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"spec": {
"compute_pool": null,
"service_account": null
}
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-east-1/flink-workspace=workspace-2026-01-22-162803"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-east-1/flink-workspace=workspace-2026-01-22-162803",
"specversion": "1.0",
"id": "b59d471f-3da3-41e2-847a-8363ab4f9077",
"source": "crn://confluent.cloud/",
"time": "2026-01-22T16:29:09.323947120Z",
"type": "io.confluent.cloud/request"
}
Flink statement
Auditable event methods for the resource type STATEMENT are triggered by operations on a Flink statement and generate event messages that are sent to the audit log cluster, where they are stored as event records in a Kafka topic.
Method name | Action triggering an auditable event message |
|---|---|
A request to create a Flink statement. | |
A request to delete a Flink statement. | |
A request for a query of a Flink statement details. | |
A request for a list of Flink statements. | |
A request to update a Flink statement. | |
A request to patch a Flink statement. |
CreateStatement
The CreateStatement event method is triggered by a request to create a Flink statement and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "CreateStatement",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-west-2"
}
]
},
"resource": {
"type": "STATEMENT",
"resourceId": "d730eb03-d3b5-412d"
}
}
],
"authenticationInfo": {
"principal": {
"confluentUser": {
"resourceId": "u-5q0mkq"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-5q0mkq"
},
"requestMetadata": {
"requestId": [
"38cf3bb10d833c36d7b022c633522153"
],
"clientAddress": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"accessType": "MODIFICATION",
"data": {
"environment_id": "env-123abc",
"org_resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"spec": {
"compute_pool_id": "lfcp-a1b2c3",
"name": "d730eb03-d3b5-412d",
"principal": "u-5q0mkq"
}
}
},
"result": {
"status": "SUCCESS",
"data": {
"metadata": {
"environment_id": "env-123abc"
},
"spec": {
"compute_pool_id": "lfcp-a1b2c3",
"name": "d730eb03-d3b5-412d",
"principal": "u-5q0mkq"
}
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/statement=d730eb03-d3b5-412d"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/statement=d730eb03-d3b5-412d",
"specversion": "1.0",
"id": "d1fbc567-e5bb-4728-bf54-de88a1aba84e",
"source": "crn://confluent.cloud/",
"time": "2026-01-22T16:45:13.689395512Z",
"type": "io.confluent.cloud/request"
}
DeleteStatement
The DeleteStatement event method is triggered by a request to delete a Flink statement and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "DeleteStatement",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-west-2"
}
]
},
"resource": {
"type": "STATEMENT",
"resourceId": "workspace-2023-09-19-024944-b9c724de-c284-486e-a45f-e7dc1100e181"
}
}
],
"authenticationInfo": {
"principal": {
"confluentUser": {
"resourceId": "u-devccq71mwp"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-devccq71mwp"
},
"requestMetadata": {
"requestId": [
"7e9362e01607ffacb08fa80dd2241db2"
],
"clientAddress": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"accessType": "MODIFICATION",
"data": {
"StatementName": "workspace-2023-09-19-024944-b9c724de-c284-486e-a45f-e7dc1100e181",
"OrgResourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"EnvironmentId": "env-123abc"
}
},
"result": {
"status": "SUCCESS"
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/statement=workspace-2023-09-19-024944-b9c724de-c284-486e-a45f-e7dc1100e181"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/statement=workspace-2023-09-19-024944-b9c724de-c284-486e-a45f-e7dc1100e181",
"specversion": "1.0",
"id": "de07cd1b-ec0f-4d0e-abce-050a993e7532",
"source": "crn://confluent.cloud/",
"time": "2026-01-22T16:48:05.106656163Z",
"type": "io.confluent.cloud/request"
}
GetStatement
The GetStatement event method is triggered by a request to get the details for a Flink statement and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "GetStatement",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.us-west-2"
}
]
},
"resource": {
"type": "STATEMENT",
"resourceId": "928c8647-582b-4d3b"
}
}
],
"authenticationInfo": {
"principal": {
"confluentUser": {
"resourceId": "u-21r8oo"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-21r8oo"
},
"requestMetadata": {
"requestId": [
"a688f8810ba426f39511c04f7b511a0a"
],
"clientAddress": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"accessType": "READ_ONLY",
"data": {
"statement_name": "928c8647-582b-4d3b",
"environment_id": "env-123abc"
}
},
"result": {
"status": "SUCCESS",
"data": {
"metadata": {
"environment_id": "env-123abc"
},
"spec": {
"compute_pool_id": "lfcp-a1b2c3",
"name": "928c8647-582b-4d3b",
"principal": "u-21r8oo"
}
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/statement=928c8647-582b-4d3b"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.us-west-2/statement=928c8647-582b-4d3b",
"specversion": "1.0",
"id": "f6f45075-3d85-4e41-8677-c06a80ef903e",
"source": "crn://confluent.cloud/",
"time": "2026-01-22T16:35:20.968310060Z",
"type": "io.confluent.cloud/request"
}
ListStatements
The ListStatements event method is triggered by a request for a list of Flink statements and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"serviceName": "crn://confluent.cloud/",
"methodName": "ListStatements",
"cloudResources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.eu-west-1"
}
]
},
"resource": {
"type": "STATEMENT",
"resourceId": "3ab9a756-4bcf-475b"
}
},
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resourceId": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resourceId": "env-123abc"
},
{
"type": "FLINK_REGION",
"resourceId": "aws.eu-west-1"
}
]
},
"resource": {
"type": "STATEMENT",
"resourceId": "e264b999-269c-46d6"
}
}
],
"authenticationInfo": {
"principal": {
"confluentUser": {
"resourceId": "u-devccq71mwp"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-devccq71mwp"
},
"requestMetadata": {
"requestId": [
"7cec6a84ab0b05ccb38ecf14981da31b"
],
"clientAddress": [
{
"ip": "1.2.3.4"
}
]
},
"request": {
"accessType": "READ_ONLY",
"data": {
"compute_pool_id": "",
"environment_id": "env-123abc",
"page_size": 100
}
},
"result": {
"status": "SUCCESS",
"data": {
"data": [
{
"metadata": {
"environment_id": "env-123abc"
},
"spec": {
"compute_pool_id": "lfcp-a1b2c3",
"name": "3ab9a756-4bcf-475b",
"principal": "u-rk1gy7"
}
},
{
"metadata": {
"environment_id": "env-123abc"
},
"spec": {
"principal": "u-rk1gy7",
"compute_pool_id": "lfcp-a1b2c3",
"name": "e264b999-269c-46d6"
}
}
]
}
},
"resourceName": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.eu-west-1"
},
"subject": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/environment=env-123abc/flink-region=aws.eu-west-1",
"specversion": "1.0",
"id": "5e6bc2d3-9881-442b-af0c-a0a6aa127867",
"source": "crn://confluent.cloud/",
"time": "2026-01-22T16:47:00.894461118Z",
"type": "io.confluent.cloud/request"
}
UpdateStatement
The UpdateStatement event method is triggered by a request to update a Flink statement and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"service_name": "crn://confluent.cloud/",
"method_name": "UpdateStatement",
"cloud_resources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resource_id": "env-123abc"
},
{
"type": "FLINK_REGION",
"resource_id": "aws.us-east-2"
}
]
},
"resource": {
"type": "STATEMENT",
"resource_id": "statement-123"
}
},
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resource_id": "env-123abc"
},
{
"type": "FLINK_REGION",
"resource_id": "aws.us-east-2"
}
]
},
"resource": {
"type": "STATEMENT",
"resource_id": "statement-123"
}
}
],
"authentication_info": {
"exposure": "CUSTOMER",
"principal": {
"confluent_user": {
"resource_id": "u-123"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-123"
},
"request_metadata": {
"request_id": [
"74726163656964303132333435363738"
],
"client_address": [
{
"ip": "127.0.0.1"
}
]
},
"request": {
"access_type": "MODIFICATION",
"data": {
"environment_id": "env-123abc",
"org_resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"spec": {
"compute_pool_id": "lfcp-a1b2c3",
"name": "statement-123",
"principal": "sa-123"
}
}
},
"result": {
"status": "SUCCESS",
"data": {
"metadata": {
"environment_id": "env-123"
},
"spec": {
"compute_pool_id": "lfcp-a1b2c3",
"name": "statement-123",
"principal": "sa-123"
}
}
}
}
}
PatchStatement
The PatchStatement event method is triggered by a request to patch a Flink statement and sends an event message that is saved in the audit log as an event record.
Examples
SUCCESS
{
"datacontenttype": "application/json",
"data": {
"service_name": "crn://confluent.cloud/",
"method_name": "PatchStatement",
"cloud_resources": [
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resource_id": "env-123"
},
{
"type": "FLINK_REGION",
"resource_id": "aws.us-east-2"
}
]
},
"resource": {
"type": "STATEMENT",
"resource_id": "statement-123"
}
},
{
"scope": {
"resources": [
{
"type": "ORGANIZATION",
"resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"
},
{
"type": "ENVIRONMENT",
"resource_id": "env-123"
},
{
"type": "FLINK_REGION",
"resource_id": "aws.us-east-2"
}
]
},
"resource": {
"type": "STATEMENT",
"resource_id": "statement-123"
}
}
],
"authentication_info": {
"exposure": "CUSTOMER",
"principal": {
"confluent_user": {
"resource_id": "u-123"
}
},
"result": "SUCCESS",
"identity": "crn://confluent.cloud/organization=ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj/identity-provider=Confluent/identity=u-123"
},
"request_metadata": {
"request_id": [
"74726163656964303132333435363738"
],
"client_address": [
{
"ip": "127.0.0.1"
}
]
},
"request": {
"access_type": "MODIFICATION",
"data": {
"environment_id": "env-123",
"org_resource_id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj",
"statement_name": "statement-123"
}
},
"result": {
"status": "SUCCESS"
}
}
}