Kafka Cluster Management and Operations Auditable Event Methods on Confluent Cloud

An auditable event method is the Kafka API operation, identified by the methodName field, associated with a client request.

The following actions, or operations, for all Apache Kafka® client requests generate auditable event messages for the io.confluent.kafka.server/request event type. This includes cluster management operations and data operations like produce and consume requests. An auditable event triggers the corresponding auditable event method. A message is sent to the audit log and is stored as an audit log record.

Most Kafka cluster auditable event methods have the same method names as the Kafka cluster authorization event methods, except for kafka.Fetch and kafka.Produce, which do not generate corresponding authorization events.

Method name	Action triggering an auditable event message
kafka.AlterConfigs	A Kafka configuration is being altered or updated.
kafka.AlterMirrors	The properties of a mirror topic that exists on a Cluster Link to this cluster are being altered.
kafka.CreateAcls	A Kafka broker access control list (ACL) is being created.
kafka.CreateClusterLinks	A cluster link is being created between this cluster and another cluster.
kafka.CreatePartitions	Partitions are being added to a topic.
kafka.CreateTopics	A topic is being created.
kafka.DeleteAcls	A Kafka broker ACL is being deleted.
kafka.DeleteClusterLinks	A cluster link is being deleted.
kafka.DeleteGroups	A Kafka consumer group is being deleted.
kafka.DeleteTopics	A Kafka topic is being deleted.
kafka.Fetch	A Kafka consumer begins reading a batch of records from a Kafka topic. Only the first fetch per connection (identified by connection ID) generates an auditable event.
kafka.IncrementalAlterConfigs	A dynamic configuration of a Kafka broker is being altered.
kafka.Produce	A Kafka producer begins writing a batch of records to a Kafka topic. Only the first produce per connection (identified by connection ID) generates an auditable event.
kafka.ShareFetch	A request from a Kafka ShareConsumer API and is a member of a share group. Unlike traditional consumers in a consumer group, where each partition is assigned to only one consumer, share consumers cooperatively consume records from the same partition simultaneously. Records are acquired with a time-limited lock and acknowledged individually after processing. This enables a concurrent processing model similar to a message queue.">share consumer to read a batch of records from a Kafka topic within a share group. Only the first share fetch request per connection, as identified by connection ID, generates an auditable event.

kafka.AlterConfigs

The kafka.AlterConfigs event is generated by a request to alter or update a Kafka configuration.

To view example event messages, expand the following dropdowns:

Failure: INVALID_CONFIG

{
  "datacontenttype": "application/json",
  "data": {
    "serviceName": "crn://confluent.cloud/",
    "methodName": "kafka.AlterConfigs",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "env-abc123"
            },
            {
              "type": "CLOUD_CLUSTER",
              "resourceId": "lkc-rjjy79"
            }
          ]
        },
        "resource": {
          "type": "KAFKA_CLUSTER",
          "resourceId": "lkc-rjjy79"
        }
      }
    ],
    "authenticationInfo": {
      "principal": {
        "confluentUser": {
          "resourceId": "u-ok7gjy"
        }
      },
      "result": "SUCCESS"
    },
    "authorizationInfo": {
      "result": "ALLOW"
    },
    "requestMetadata": {
      "connectionId": "166392111226600034",
      "requestId": [
        "166392116845900010"
      ],
      "clientId": "adminclient-25526",
      "clientAddress": [
        {
          "ip": "1.2.3.4"
        }
      ]
    },
    "request": {
      "accessType": "MODIFICATION",
      "data": {
        "resources": [
          {
            "resourceType": "TOPIC",
            "resourceName": "topicAuditLog",
            "configs": [
              {
                "name": "max.message.bytes",
                "value": "-1"
              }
            ]
          }
        ],
        "validateOnly": false
      }
    },
    "result": {
      "status": "FAILURE",
      "data": {
        "responses": [
          {
            "errorCode": 40,
            "errorMessage": "Invalid config value for resource ConfigResource(type=TOPIC, name='topicAuditLog'): Invalid value -1 for configuration max.message.bytes: Value must be at least 0",
            "resourceType": "TOPIC",
            "resourceName": "topicAuditLog"
          }
        ]
      }
    },
    "resourceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-rjjy79/kafka=lkc-rjjy79"
  },
  "subject": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-rjjy79/kafka=lkc-rjjy79",
  "specversion": "1.0",
  "id": "60f8d46b-f4aa-429f-a72b-8189e9305057",
  "source": "crn://confluent.cloud/",
  "time": "2022-09-23T08:19:28.482Z",
  "type": "io.confluent.kafka.server/request"
}

kafka.AlterMirrors

The kafka.AlterMirrors event is generated by a request to alter or update the properties of a mirror topic that exists on a cluster link to this cluster.

To view example event messages, expand the following dropdowns:

Success

{
  "specversion": "1.0",
  "id": "bd1550e6-97a5-4cab-979c-11b0ecc509a2",
  "source": "crn://confluent.cloud/organization=orgId/environment=envId/cloud-cluster=lkc-test1/kafka=lkc-test1",
  "type": "io.confluent.kafka.server/request",
  "datacontenttype": "application/json",
  "subject": "crn://confluent.cloud/organization=orgId/environment=envId/cloud-cluster=lkc-test1/kafka=lkc-test1",
  "time": "2022-04-11T08:51:00Z",
  "data": {
    "serviceName": "crn://confluent.cloud/organization=orgId/environment=envId/cloud-cluster=lkc-test1/kafka=lkc-test1",
    "internalServiceName": "",
    "methodName": "kafka.AlterMirrors",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "orgId"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "envId"
            },
            {
              "type": "CLOUD_CLUSTER",
              "resourceId": "lkc-test1"
            }
          ]
        },
        "resource": {
          "type": "KAFKA_CLUSTER",
          "resourceId": "lkc-test1"
        }
      }
    ],
    "authenticationInfo": {
      "exposure": "CUSTOMER",
      "principal": {
        "email": "",
        "confluentUser": {
          "resourceId": "sa-Alice"
        }
      },
      "result": "SUCCESS",
      "errorMessage": ""
    },
    "authorizationInfo": {
      "result": "ALLOW",
      "dryRun": false,
      "operation": ""
    },
    "requestMetadata": {
      "connectionId": "",
      "requestId": [],
      "clientAddress": [
        {
          "ip": "1.2.3.4"
        }
      ],
      "clientId": "test_client_id",
      "clientTraceId": "",
      "serviceTraceId": "",
      "serviceSpanId": "",
      "requestType": "HTTP",
      "requestPath": ""
    },
    "request": {
      "accessType": "MODIFICATION",
      "schema": "",
      "data": {
        "mirrorOperations": [
          {
            "topic": "test-topic",
            "operationCode": "CLEAR"
          }
        ],
        "validateOnly": false,
        "timeoutMs": 0
      }
    },
    "result": {
      "status": "SUCCESS",
      "schema": "",
      "data": {
        "results": [
          {
            "errorCode": 0,
            "errorMessage": "",
            "topic": "tenant_topic"
          }
        ]
      }
    },
    "platformResources": [],
    "resourceName": "crn://confluent.cloud/organization=orgId/environment=envId/cloud-cluster=lkc-test1/kafka=lkc-test1"
  }
}

Failure: INVALID_REQUEST

{
  "datacontenttype": "application/json",
  "data": {
    "serviceName": "crn://confluent.cloud/organization=00000000-0000-0000-0000-000000000000/environment=t0/cloud-cluster=lkc-7kyjyo/kafka=lkc-7kyjyo",
    "methodName": "kafka.AlterMirrors",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "00000000-0000-0000-0000-000000000000"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "t0"
            },
            {
              "type": "CLOUD_CLUSTER",
              "resourceId": "lkc-7kyjyo"
            }
          ]
        },
        "resource": {
          "type": "KAFKA_CLUSTER",
          "resourceId": "lkc-7kyjyo"
        }
      }
    ],
    "authenticationInfo": {
      "principal": {
        "confluentUser": {
          "resourceId": "u-000000"
        }
      },
      "result": "SUCCESS"
    },
    "authorizationInfo": {
      "result": "ALLOW"
    },
    "requestMetadata": {
      "connectionId": "166368132996200038",
      "requestId": [
        "166368132997400011"
      ],
      "clientAddress": [
        {
          "ip": "1.2.3.4"
        }
      ],
      "clientId": "caas-link-healthcheck-agent-link-admin-client-310"
    },
    "request": {
      "accessType": "MODIFICATION",
      "data": {
        "mirrorOperations": [
          {
            "topic": "_confluent-healthcheck_0",
            "operationCode": "FAILOVER"
          }
        ],
        "validateOnly": false,
        "timeoutMs": 23987
      }
    },
    "result": {
      "status": "FAILURE",
      "data": {
        "results": [
          {
            "errorCode": 42,
            "errorMessage": "Topic '_confluent-healthcheck_0' has already stopped its mirror from 'healthcheck'",
            "topic": "_confluent-healthcheck_0"
          }
        ]
      }
    },
    "resourceName": "crn://confluent.cloud/organization=00000000-0000-0000-0000-000000000000/environment=t0/cloud-cluster=lkc-7kyjyo/kafka=lkc-7kyjyo"
  },
  "subject": "crn://confluent.cloud/organization=00000000-0000-0000-0000-000000000000/environment=t0/cloud-cluster=lkc-7kyjyo/kafka=lkc-7kyjyo",
  "specversion": "1.0",
  "id": "565c40ea-c47b-4b83-ab05-16befa8d918d",
  "source": "crn://confluent.cloud/organization=00000000-0000-0000-0000-000000000000/environment=t0/cloud-cluster=lkc-7kyjyo/kafka=lkc-7kyjyo",
  "time": "2022-09-20T13:42:09.976Z",
  "type": "io.confluent.kafka.server/request"
}

kafka.CreateAcls

The kafka.CreateAcls event is generated by a request to create a Kafka broker access control list (ACL).

To view example event messages, expand the following dropdowns:

Failure: CLUSTER_AUTHORIZATION_FAILED

{
  "datacontenttype": "application/json",
  "data": {
    "serviceName": "crn://confluent.cloud/",
    "methodName": "kafka.CreateAcls",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "env-abc123"
            },
            {
              "type": "CLOUD_CLUSTER",
              "resourceId": "lkc-rjjy79"
            }
          ]
        },
        "resource": {
          "type": "KAFKA_CLUSTER",
          "resourceId": "lkc-rjjy79"
        }
      }
    ],
    "authenticationInfo": {
      "principal": {
        "confluentUser": {
          "resourceId": "u-v8kwpp"
        }
      },
      "result": "SUCCESS"
    },
    "authorizationInfo": {
      "result": "DENY"
    },
    "requestMetadata": {
      "connectionId": "166392514641100031",
      "requestId": [
        "166392514655100009"
      ],
      "clientId": "adminclient-25564",
      "clientAddress": [
        {
          "ip": "1.2.3.4"
        }
      ]
    },
    "request": {
      "accessType": "MODIFICATION",
      "data": {
        "creations": [
          {
            "resourceType": "TOPIC",
            "resourceName": "testAuditLog",
            "resourcePatternType": "LITERAL",
            "principal": "User:Alilce",
            "host": "*",
            "operation": "READ",
            "permissionType": "ALLOW"
          },
          {
            "resourceType": "TOPIC",
            "resourceName": "testAuditLog",
            "resourcePatternType": "LITERAL",
            "principal": "User:Alice",
            "host": "*",
            "operation": "DESCRIBE",
            "permissionType": "ALLOW"
          }
        ]
     }
    },
    "result": {
      "status": "FAILURE",
      "data": {
        "results": [
          {
            "errorCode": 31,
            "errorMessage": "Error Occurred"
          },
          {
            "errorCode": 31,
            "errorMessage": "Error Occurred"
          }
        ]
      }
    },
    "resourceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-rjjy79/kafka=lkc-rjjy79"
  },
  "subject": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-rjjy79/kafka=lkc-rjjy79",
  "specversion": "1.0",
  "id": "83d52480-b379-4b5f-a56d-fad18b24fc94",
  "source": "crn://confluent.cloud/",
  "time": "2022-09-23T09:25:46.566Z",
  "type": "io.confluent.kafka.server/request"
}

kafka.CreateClusterLinks

The kafka.CreateClusterLinks event is generated by a request to create a cluster link between this cluster and another cluster.

To view example event messages, expand the following dropdowns:

Success

{
  "datacontenttype": "application/json",
  "data": {
    "serviceName": "crn://confluent.cloud/",
    "methodName": "kafka.CreateClusterLinks",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "env-abc123"
            },
            {
              "type": "CLOUD_CLUSTER",
              "resourceId": "lkc-2jrm1o"
            },
            {
              "type": "KAFKA_CLUSTER",
              "resourceId": "lkc-2jrm1o"
            }
          ]
        },
        "resource": {
          "type": "CLUSTER_LINK",
          "resourceId": "Link_0"
        }
      }
    ],
    "authenticationInfo": {
      "principal": {
        "confluentUser": {
          "resourceId": "u-ok7gjy"
        }
      },
      "result": "SUCCESS"
    },
    "authorizationInfo": {
      "result": "ALLOW"
    },
    "requestMetadata": {
      "connectionId": "166417237945300022",
      "requestId": [
        "166417237946400010"
      ],
      "clientId": "proxy:1856049",
      "clientAddress": [
        {
          "ip": "1.2.3.4"
        }
      ]
    },
    "request": {
      "accessType": "MODIFICATION",
      "data": {
        "linkName": "Link_0",
        "linkId": "AAAAAAAAAAAAAAAAAAAAAA",
        "clusterId": "lkc-rjjy79",
        "configs": [
          {
            "key": "auto.create.mirror.topics.filters",
            "value": "{\"topicFilters\":[{\"name\":\"test-link-\",\"patternType\":\"PREFIXED\",\"filterType\":\"INCLUDE\"}]}"
          },
          {
            "key": "auto.create.mirror.topics.enable",
            "value": "true"
          },
          {
            "key": "bootstrap.servers",
            "value": "pkc-xyz.us-central1.gcp.confluent.cloud:9092"
          },
          {
            "key": "consumer.offset.sync.enable",
            "value": "false"
          },
          {
            "key": "acl.sync.enable",
            "value": "false"
          }
        ],
        "validateOnly": false,
        "validateLink": false
      }
    },
    "result": {
      "status": "SUCCESS",
      "data": {
        "message": "",
        "errorCode": 0,
        "errorType": "NONE",
        "linkName": "Link_0",
        "linkId": "Dr-a1ZgRTdOmQSfrY9UrtA"
      }
    },
    "resourceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-2jrm1o/kafka=lkc-2jrm1o/link=Link_0"
  },
  "subject": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-2jrm1o/kafka=lkc-2jrm1o/link=Link_0",
  "specversion": "1.0",
  "id": "24986793-4afd-437c-baab-b7d30ab6ae07",
  "source": "crn://confluent.cloud/",
  "time": "2022-09-26T06:06:19.652Z",
  "type": "io.confluent.kafka.server/request"
}

Failure: INVALID_CONFIG

{
  "datacontenttype": "application/json",
  "data": {
    "serviceName": "crn://confluent.cloud/",
    "methodName": "kafka.CreateClusterLinks",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "env-abc123"
            },
            {
              "type": "CLOUD_CLUSTER",
              "resourceId": "lkc-rjjy79"
            },
            {
              "type": "KAFKA_CLUSTER",
              "resourceId": "lkc-rjjy79"
            }
          ]
        },
        "resource": {
          "type": "CLUSTER_LINK",
          "resourceId": "from-on-prem-link2"
        }
      }
    ],
    "authenticationInfo": {
      "principal": {
        "confluentUser": {
          "resourceId": "u-ok7gjy"
        }
      },
      "result": "SUCCESS"
    },
    "authorizationInfo": {
      "result": "ALLOW"
    },
    "requestMetadata": {
      "connectionId": "166392952395900034",
      "requestId": [
        "166392952568400010"
      ],
      "clientId": "adminclient-1",
      "clientAddress": [
        {
          "ip": "1.2.3.4"
        }
      ]
    },
    "request": {
      "accessType": "MODIFICATION",
      "data": {
        "linkName": "from-on-prem-link2",
        "linkId": "AAAAAAAAAAAAAAAAAAAAAA",
        "clusterId": "lkc-rjjy79",
        "configs": [
          {
            "key": "abc",
            "value": "[hidden]"
          }
        ],
        "validateOnly": false,
        "validateLink": true
      }
    },
    "result": {
      "status": "FAILURE",
      "data": {
        "message": "Unable to validate cluster link due to error: Unable to create client using provided properties when validating the cluster link: Missing required configuration \"bootstrap.servers\" which has no default value., root cause: org.apache.kafka.common.config.ConfigException: Missing required configuration \"bootstrap.servers\" which has no default value.",
        "errorCode": 40,
        "errorType": "INVALID_CONFIG",
        "linkName": "from-on-prem-link2",
        "linkId": "AAAAAAAAAAAAAAAAAAAAAA"
      }
    },
    "resourceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-rjjy79/kafka=lkc-rjjy79/link=from-on-prem-link2"
  },
  "subject": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-rjjy79/kafka=lkc-rjjy79/link=from-on-prem-link2",
  "specversion": "1.0",
  "id": "f3bc1313-d8ac-4ed0-818e-da9fbe96d507",
  "source": "crn://confluent.cloud/",
  "time": "2022-09-23T10:38:45.696Z",
  "type": "io.confluent.kafka.server/request"
}

kafka.CreatePartitions

The kafka.CreatePartitions event is generated by a request to add partitions to a Kafka topic.

To view example event messages, expand the following dropdowns:

kafka.CreateTopics

The kafka.CreateTopics event is generated by a request to create Kafka topics.

To view example event messages, expand the following dropdowns:

kafka.DeleteAcls

The kafka.DeleteAcls event is generated by a request to delete a Kafka broker access control list (ACL).

To view example event messages, expand the following dropdowns:

Success

{
  "datacontenttype": "application/json",
  "data": {
    "serviceName": "crn://confluent.cloud/",
    "methodName": "kafka.DeleteAcls",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "env-abc123"
            },
            {
              "type": "CLOUD_CLUSTER",
              "resourceId": "lkc-rjjy79"
            }
          ]
        },
        "resource": {
          "type": "KAFKA_CLUSTER",
          "resourceId": "lkc-rjjy79"
        }
      }
    ],
    "authenticationInfo": {
      "principal": {
        "confluentUser": {
          "resourceId": "u-ok7gjy"
        }
      },
      "result": "SUCCESS"
    },
    "authorizationInfo": {
      "result": "ALLOW"
    },
    "requestMetadata": {
      "connectionId": "166299794190500034",
      "requestId": [
        "166299794354400008"
      ],
      "clientId": "adminclient-1",
      "clientAddress": [
        {
          "ip": "1.2.3.4"
        }
      ]
    },
    "request": {
      "accessType": "MODIFICATION",
      "data": {
        "filters": [
          {
            "resourceTypeFilter": "TOPIC",
            "resourceNameFilter": "topicAuditLog",
            "patternTypeFilter": "LITERAL",
            "principalFilter": "User:Alice",
            "hostFilter": "*",
            "operation": "WRITE",
            "permissionType": "ALLOW"
          }
        ]
      }
    },
    "result": {
      "status": "SUCCESS",
      "data": {
        "filterResults": [
          {
            "errorCode": 0,
            "errorMessage": null,
            "matchingAcls": [
              {
                "errorCode": 0,
                "errorMessage": null,
                "resourceType": "TOPIC",
                "resourceName": "topicAuditLog",
                "patternType": "LITERAL",
                "principal": "User:Alice",
                "host": "*",
                "operation": "WRITE",
                "permissionType": "ALLOW"
              }
            ]
          }
        ]
      }
    },
    "resourceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-rjjy79/kafka=lkc-rjjy79"
  },
  "subject": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-rjjy79/kafka=lkc-rjjy79",
  "specversion": "1.0",
  "id": "7bae9e4c-549d-4325-a573-f18d4fff7cdf",
  "source": "crn://confluent.cloud/",
  "time": "2022-09-12T15:52:23.553Z",
  "type": "io.confluent.kafka.server/request"
}

kafka.DeleteClusterLinks

The kafka.DeleteClusterLinks event is generated by a request to delete cluster links.

To view example event messages, expand the following dropdowns:

Success

{
   "specversion":"1.0",
   "id":"bd1550e6-97a5-4cab-979c-11b0ecc509a2",
   "source":"crn://confluent.cloud/organization=orgId/environment=envId/cloud-cluster=lkc-test1/kafka=lkc-test1",
   "type":"io.confluent.kafka.server/request",
   "datacontenttype":"application/json",
   "subject":"crn://confluent.cloud/organization=orgId/environment=envId/cloud-cluster=lkc-test1/kafka=lkc-test1/link=foo",
   "time":"2022-04-11T08:51:00Z",
   "data":{
      "serviceName":"crn://confluent.cloud/organization=orgId/environment=envId/cloud-cluster=lkc-test1/kafka=lkc-test1",
      "internalServiceName":"",
      "methodName":"kafka.DeleteClusterLinks",
      "cloudResources":[
         {
            "scope":{
               "resources":[
                  {
                     "type":"ORGANIZATION",
                     "resourceId":"orgId",
                     "internalId":""
                  },
                  {
                     "type":"ENVIRONMENT",
                     "resourceId":"envId",
                     "internalId":""
                  },
                  {
                     "type":"CLOUD_CLUSTER",
                     "resourceId":"lkc-test1",
                     "internalId":""
                  },
                  {
                     "type":"KAFKA_CLUSTER",
                     "resourceId":"lkc-test1",
                     "internalId":""
                  }
               ]
            },
            "resource":{
               "type":"CLUSTER_LINK",
               "resourceId":"foo",
               "internalId":""
            }
         }
      ],
      "authenticationInfo":{
         "exposure":"INTERNAL",
         "principal":{
            "email":"",
            "confluentUser":{
               "resourceId":"sa-Alice",
               "internalId":""
            }
         },
         "result":"SUCCESS",
         "errorMessage":""
      },
      "authorizationInfo":{
         "result":"ALLOW",
         "dryRun":false,
         "operation":""
      },
      "requestMetadata":{
         "connectionId":"",
         "requestId":[

         ],
         "clientAddress": [
            {
               "ip": "1.2.3.4"
            }
         ],
         "clientId":"test_client_id",
         "clientTraceId":"",
         "serviceTraceId":"",
         "serviceSpanId":"",
         "requestType":"HTTP",
         "requestPath":""
      },
      "request":{
         "accessType":"MODIFICATION",
         "schema":"",
         "data":{
            "linkName":"foo",
            "validateOnly":false,
            "force":false
         }
      },
      "result":{
         "status":"SUCCESS",
         "schema":"",
         "data":{
            "message":"",
            "errorCode":0.0,
            "errorType":"NONE"
         }
      },
      "platformResources":[

      ],
      "resourceName":"crn://confluent.cloud/organization=orgId/environment=envId/cloud-cluster=lkc-test1/kafka=lkc-test1/link=foo"
   }
}

kafka.DeleteGroups

The kafka.DeleteGroups event is generated by a request to delete Kafka consumer groups.

To view example event messages, expand the following dropdowns:

kafka.DeleteTopics

The kafka.DeleteTopics event is generated by a request to delete Kafka topics.

To view example event messages, expand the following dropdowns:

kafka.Fetch

The kafka.Fetch event is generated by a request from a Kafka consumer to read a batch of records from a Kafka topic. Only the first fetch request per connection (identified by connection ID) generates an auditable event.

To view example event messages, expand the following dropdowns:

kafka.IncrementalAlterConfigs

The kafka.IncrementalAlterConfigs event is generated by a request to update or alter the dynamic configuration of a Kafka broker.

To view example event messages, expand the following dropdowns:

Failure: INVALID_CONFIG

{
  "datacontenttype": "application/json",
  "data": {
    "serviceName": "crn://confluent.cloud/",
    "methodName": "kafka.IncrementalAlterConfigs",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "env-abc123"
            },
            {
              "type": "CLOUD_CLUSTER",
              "resourceId": "lkc-rjjy79"
            }
          ]
        },
        "resource": {
          "type": "KAFKA_CLUSTER",
          "resourceId": "lkc-rjjy79"
        }
      }
    ],
    "authenticationInfo": {
      "principal": {
        "confluentUser": {
          "resourceId": "u-ok7gjy"
        }
      },
      "result": "SUCCESS"
    },
    "authorizationInfo": {
      "result": "ALLOW"
    },
    "requestMetadata": {
      "connectionId": "166392198382100034",
      "requestId": [
        "166392198588800009"
      ],
      "clientId": "adminclient-1",
      "clientAddress": [
        {
          "ip": "1.2.3.4"
        }
      ]
    },
    "request": {
      "accessType": "MODIFICATION",
      "data": {
        "resources": [
          {
            "resourceType": "TOPIC",
            "resourceName": "topicAuditLog",
            "configs": [
              {
                "name": "retention.ms",
                "configOperation": "SET",
                "value": ""
              }
            ]
          }
        ],
        "validateOnly": false
      }
    },
    "result": {
      "status": "FAILURE",
      "data": {
        "responses": [
          {
            "errorCode": 40,
            "errorMessage": "Invalid config value for resource ConfigResource(type=TOPIC, name='topicAuditLog'): Invalid value  for configuration retention.ms: Not a number of type LONG",
            "resourceType": "TOPIC",
            "resourceName": "topicAuditLog"
          }
        ]
      }
    },
    "resourceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-rjjy79/kafka=lkc-rjjy79"
  },
  "subject": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-abc123/cloud-cluster=lkc-rjjy79/kafka=lkc-rjjy79",
  "specversion": "1.0",
  "id": "19312ac5-e5a4-47b9-9667-351e9e4b7f58",
  "source": "crn://confluent.cloud/",
  "time": "2022-09-23T08:33:05.896Z",
  "type": "io.confluent.kafka.server/request"
}

kafka.Produce

The kafka.Produce event is generated by a request from a Kafka producer to write a batch of records to a Kafka topic. Only the first produce request per connection (identified by connection ID) generates an auditable event.

To view example event messages, expand the following dropdowns:

kafka.ShareFetch

The kafka.ShareFetch event is generated by a request from a Kafka ShareConsumer API and is a member of a share group. Unlike traditional consumers in a consumer group, where each partition is assigned to only one consumer, share consumers cooperatively consume records from the same partition simultaneously. Records are acquired with a time-limited lock and acknowledged individually after processing. This enables a concurrent processing model similar to a message queue.">share consumer to read a batch of records from a Kafka topic within a share group. Only the first share fetch request per connection (identified by connection ID) generates an auditable event.

To view example event messages, expand the following dropdowns:

Success

{
 "datacontenttype": "application/json",
 "data": {
   "serviceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq",
   "methodName": "kafka.ShareFetch",
   "cloudResources": [
     {
       "scope": {
         "resources": [
           {
             "type": "ORGANIZATION",
             "resourceId": "91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
           },
           {
             "type": "ENVIRONMENT",
             "resourceId": "env-devcpo3m3k"
           },
           {
             "type": "CLOUD_CLUSTER",
             "resourceId": "lkc-devc59k8dq"
           },
           {
             "type": "KAFKA_CLUSTER",
             "resourceId": "lkc-devc59k8dq"
           }
         ]
       },
       "resource": {
         "type": "TOPIC",
         "resourceId": "crUkp3DnQM-917GypWnW5Q"
       }
     }
   ],
   "authenticationInfo": {
     "exposure": "CUSTOMER",
     "principal": {
       "confluentUser": {
         "resourceId": "u-yynj67"
       }
     },
     "result": "SUCCESS",
     "identity": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-yynj67"
   },
   "authorizationInfo": {
     "result": "ALLOW"
   },
   "requestMetadata": {
     "connectionId": "176777661747700072",
     "requestId": [
       "176777661906500003"
     ],
     "clientAddress": [
       {
         "ip": "134.238.241.34"
       }
     ],
     "clientId": "console-share-consumer",
     "requestListenerName": "EXTERNAL"
   },
   "request": {
     "accessType": "MODIFICATION",
     "data": {
       "partition": null,
       "offset": null,
       "shareSessionEpoch": 0.0,
       "groupId": "gs1"
     }
   },
   "result": {
     "status": "SUCCESS",
     "data": {
       "message": "NONE",
       "errorCode": 0.0,
       "errorType": "NONE"
     }
   },
   "resourceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq/topic=crUkp3DnQM-917GypWnW5Q"
 },
 "subject": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq/topic=crUkp3DnQM-917GypWnW5Q",
 "specversion": "1.0",
 "id": "ab3ddcdb-b557-4cc3-98f1-a2627c86d64f",
 "source": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq",
 "time": "2026-01-07T09:03:39.567587772Z",
 "type": "io.confluent.kafka.server/request"
}

Failure: TOPIC_AUTHORIZATION_FAILED

{
 "datacontenttype": "application/json",
 "data": {
   "serviceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq",
   "methodName": "kafka.ShareFetch",
   "cloudResources": [
     {
       "scope": {
         "resources": [
           {
             "type": "ORGANIZATION",
             "resourceId": "91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
           },
           {
             "type": "ENVIRONMENT",
             "resourceId": "env-devcpo3m3k"
           },
           {
             "type": "CLOUD_CLUSTER",
             "resourceId": "lkc-devc59k8dq"
           },
           {
             "type": "KAFKA_CLUSTER",
             "resourceId": "lkc-devc59k8dq"
           }
         ]
       },
       "resource": {
         "type": "TOPIC",
         "resourceId": "crUkp3DnQM-917GypWnW5Q"
       }
     }
   ],
   "authenticationInfo": {
     "exposure": "CUSTOMER",
     "principal": {
       "confluentUser": {
         "resourceId": "u-yynj67"
       }
     },
     "result": "SUCCESS",
     "identity": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-yynj67"
   },
   "authorizationInfo": {
     "result": "DENY"
   },
   "requestMetadata": {
     "connectionId": "176778501053300060",
     "requestId": [
       "176778501216900002"
     ],
     "clientAddress": [
       {
         "ip": "134.238.241.34"
       }
     ],
     "clientId": "consumer-app",
     "requestListenerName": "EXTERNAL"
   },
   "request": {
     "accessType": "MODIFICATION",
     "data": {
       "partition": null,
       "offset": null,
       "shareSessionEpoch": 0.0,
       "groupId": "gs2"
     }
   },
   "result": {
     "status": "FAILURE",
     "data": {
       "message": "Topic authorization failed.",
       "errorCode": 29.0,
       "errorType": "TOPIC_AUTHORIZATION_FAILED"
     }
   },
   "resourceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq/topic=crUkp3DnQM-917GypWnW5Q"
 },
 "subject": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq/topic=crUkp3DnQM-917GypWnW5Q",
 "specversion": "1.0",
 "id": "654e2c0f-24ce-4046-9eb6-21d606455c51",
 "source": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq",
 "time": "2026-01-07T11:23:32.171397477Z",
 "type": "io.confluent.kafka.server/request"
}

Failure: GROUP_AUTHORIZATION_FAILED

{
  "datacontenttype": "application/json",
  "data": {
    "serviceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq",
    "methodName": "kafka.ShareFetch",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "91a07ac9-9a13-491e-a2cf-46a9a5cf339c"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "env-devcpo3m3k"
            },
            {
              "type": "CLOUD_CLUSTER",
              "resourceId": "lkc-devc59k8dq"
            },
            {
              "type": "KAFKA_CLUSTER",
              "resourceId": "lkc-devc59k8dq"
            }
          ]
        },
        "resource": {
          "type": "GROUP",
          "resourceId": "gs2"
        }
      }
    ],
    "authenticationInfo": {
      "exposure": "CUSTOMER",
      "principal": {
        "confluentUser": {
          "resourceId": "u-yynj67"
        }
      },
      "result": "SUCCESS",
      "identity": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/identity-provider=Confluent/identity=u-yynj67"
    },
    "authorizationInfo": {
      "result": "DENY"
    },
    "requestMetadata": {
      "connectionId": "176823698327700064",
      "requestId": [
        "176823698480300101"
      ],
      "clientAddress": [
        {
          "ip": "134.238.241.34"
        }
      ],
      "clientId": "consumer-app",
      "requestListenerName": "EXTERNAL"
    },
    "request": {
      "accessType": "MODIFICATION",
      "data": {
        "partition": null,
        "offset": null,
        "shareSessionEpoch": 0.0,
        "groupId": "gs2"
      }
    },
    "result": {
      "status": "FAILURE",
      "data": {
        "message": "Group authorization failed.",
        "errorCode": 30.0,
        "errorType": "GROUP_AUTHORIZATION_FAILED"
      }
    },
    "resourceName": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq/group=gs2"
  },
  "subject": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq/group=gs2",
  "specversion": "1.0",
  "id": "ec249e9f-75e3-492f-a888-20e142fe3dc5",
  "source": "crn://confluent.cloud/organization=91a07ac9-9a13-491e-a2cf-46a9a5cf339c/environment=env-devcpo3m3k/cloud-cluster=lkc-devc59k8dq/kafka=lkc-devc59k8dq",
  "time": "2026-01-12T16:56:24.804611609Z",
  "type": "io.confluent.kafka.server/request"
}