Schema Registry Authentication and Authorization Auditable Event Methods on Confluent Cloud

Confluent Cloud audit logs contain records of auditable events for authentication and authorization actions on Confluent Cloud Schema Registry, Stream Catalog, and Exporters for Schema Linking. When an auditable event occurs, a message is sent to the audit log and is stored as an audit log record Included here are the authentication actions, or operations, on Confluent Cloud Schema Registry, Confluent Cloud Stream Catalog, and exporters for Schema Linking on Confluent Cloud that generate auditable event messages for the io.confluent.sg.server/authentication event.

Auditable event methods

schema-registry.Authentication

A request to authenticate to Schema Registry using an API key or token.

Examples of authentication auditable event messages

schema-registry.Authentication

The schema-registry.Authentication event method is triggered by a request for authentication to Schema Registry using an API key or token.

SUCCESS 
{
  "datacontenttype": "application/json",
  "data": {
    "serviceName": "crn://confluent.cloud/",
    "methodName": "schema-registry.Authentication",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "bc64d0fb-84b7-4467-a36b-3ad3cd8c188d"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "env-qjygy6"
            }
          ]
        },
        "resource": {
          "type": "SCHEMA_REGISTRY",
          "resourceId": "lsrc-gx9kdv"
        }
      }
    ],
    "authenticationInfo": {
      "principal": {
        "confluentUser": {
          "resourceId": "u-y35x87"
        }
      },
      "result": "SUCCESS",
      "credentials": {
        "idSecretCredentials": {
          "credentialId": "7TBXED2PT5CAKIGK"
        },
        "mechanism": "HTTP_BASIC"
      }
    },
    "requestMetadata": {
      "requestId": [
        "8406167c-8c05-11ed-8f14-5f38e5250914"
      ]
    },
    "resourceName": "crn://confluent.cloud/organization=bc64d0fb-84b7-4467-a36b-3ad3cd8c188d/environment=env-qjygy6/schema-registry=lsrc-gx9kdv"
  },
  "subject": "crn://confluent.cloud/organization=bc64d0fb-84b7-4467-a36b-3ad3cd8c188d/environment=env-qjygy6/schema-registry=lsrc-gx9kdv",
  "specversion": "1.0",
  "id": "7fced40b-f893-429e-aa08-be584268379a",
  "source": "crn://confluent.cloud/",
  "time": "2023-01-04T07:58:03.708Z",
  "type": "io.confluent.sg.server/authentication"
}

The sections below include the auditable event methods for Confluent Cloud Schema Registry, Confluent Cloud Stream Catalog, and Schema Linking on Confluent Cloud that generate auditable event messages for the io.confluent.sg.server/authorization event.

Schema Registry authorization auditable event methods

Included here are the authorization actions, or operations, on Schema Registry that generate auditable event messages for the io.confluent.sg.server/authorization event type.

Auditable event methods

Each of the following auditable event methods is triggered by a request to the Schema Registry API. Each method listed includes the action triggering an auditable event message and the associated Schema Registry API request.

schema-registry.RegisterSchema

Triggered by a request to register a new schema under the specified subject. Essentially, create a new schema (POST /subjects/(string: subject)/versions).

schema-registry.LookUpSchemaUnderSubject

Triggered by a request to check if a schema has already been registered under the specified subject (POST /subjects/(string: subject))

schema-registry.DeleteSchemaVersion

Triggered by a request to delete a specific version of the schema registered under this subject (DELETE /subjects/(string: subject)/versions/(versionId: version))

schema-registry.DeleteSubject

Triggered by a request to delete the specified subject and its associated compatibility level if registered (DELETE /subjects/(string: subject))

schema-registry.UpdateSubjectConfig

Triggered by a request to update the subject compatibility level (PUT /config/(string: subject))

schema-registry.DeleteSubjectConfig

Triggered by a request to delete the specified subject-level compatibility level configuration and revert to the global default (DELETE /config/(string: subject))

schema-registry.UpdateGlobalConfig

Triggered by a request to update the global compatibility level (PUT /config)

schema-registry.DeleteGlobalConfig

Triggered by a request to delete the global compatibility level configuration and revert to the default (DELETE /config)

schema-registry.UpdateSubjectMode

Triggered by a request to update the mode for the specified subject (PUT /mode/(string: subject))

schema-registry.DeleteSubjectMode

Triggered by a request to delete the specified subject-level compatibility level configuration and revert to the global default (DELETE /mode/(string: subject))

schema-registry.UpdateGlobalMode

Triggered by a request to update global mode (PUT /mode)

Stream Catalog authorization auditable event methods

Included here are the authorization actions, or operations, on Confluent Cloud Stream Catalog that generate auditable event messages for the io.confluent.sg.server/authorization event type.

Auditable event methods

Each of the following auditable event methods is triggered by a request to the Stream Catalog API. Each method listed includes the action triggering an auditable event message and the associated Stream Catalog API request.

schema-registry.PartialEntityUpdate

Triggered by a request to partially update an entity. PUT catalog/v1/entity

schema-registry.CreateTags

Triggered by a request to create tags (POST catalog/v1/entity/tags)

schema-registry.UpdateTags

Triggered by a request to update tags (PUT catalog/v1/entity/tags)

schema-registry.DeleteTag

Triggered by a request to delete a tag on an entity (DELETE catalog/v1/entity/type/(string: typeName)/name/(string: qualifiedName)/tags/(string: tagName))

schema-registry.CreateBusinessMetadata

Triggered by a request to create business metadata (POST catalog/v1/entity/businessmetadata)

schema-registry.UpdateBusinessMetadata

Triggered by a request to update business metadata (PUT catalog/v1/entity/businessmetadata)

schema-registry.DeleteBusinessMetadata

Triggered by a request to delete a business metadata on an entity (DELETE catalog/v1/entity/type/(string: typeName)/name/(string: qualifiedName)/businessmetadata/(string: bmName))

schema-registry.SearchCatalogUsingBasicQuery

Triggered by a request to retrieve data for the specified full text query (GET catalog/v1/search/basic)

schema-registry.SearchCatalogUsingAttributes

Triggered by a request to retrieve data for the specified attribute search query (GET catalog/v1/search/attribute)

schema-registry.CreateTagDefs

Triggered by a request to create tag definitions (POST catalog/v1/types/tagdefs)

schema-registry.UpdateTagDefs

Triggered by a request to update tag definitions (PUT catalog/v1/types/tagdefs)

schema-registry.DeleteTagDef

Triggered by a request to delete tag definitions identified by their names (DELETE catalog/v1/types/tagdefs/(string: tagName))

schema-registry.CreateBusinessMetadataDefs

Triggered by a request to create business metadata definitions (POST catalog/v1/types/businessmetadatadefs)

schema-registry.UpdateBusinessMetadataDefs

Triggered by a request to update business metadata definitions (PUT catalog/v1/types/businessmetadatadefs)

schema-registry.DeleteBusinessMetadataDef

Triggered by a request to delete a business metadata definition identified by its name (DELETE catalog/v1/types/businessmetadatadefs/(string: bmName))

schema-registry.UpdateSchemaTags

Triggered by a request to bulk-update multiple tags (PUT catalog/v1/entity/tags)

Schema Linking Exporters authorization auditable event methods

Included here are the authorization actions, or operations, on Confluent Cloud Exporters that generate auditable event messages for the io.confluent.sg.server/authorization event type.

Auditable event methods

Each of the following auditable event methods is triggered by a request to the Exporters API. Each method listed includes the action triggering an auditable event message and the associated Exporters API request.

schema-registry.CreateExporter

Triggered by a request to retrieve a list of existing schema exporters (POST /exporters)

schema-registry.UpdateExporter

Triggered by a request to update schema exporter by name (PUT /exporters/(string: name))

schema-registry.UpdateExporterConfig

Triggered by a request to update schema exporter configuration by name (PUT /exporters/(string: name)/config)

schema-registry.PauseExporter

Triggered by a request to pause schema exporter by name (PUT /exporters/(string: name)/pause)

schema-registry.ResetExporter

Triggered by a request to reset schema exporter by name (PUT /exporters/(string: name)/reset)

schema-registry.ResumeExporter

Triggered by a request to resume schema exporter by name (PUT /exporters/(string: name)/resume)

schema-registry.DeleteExporter

Triggered by a request to delete schema exporter by name (DELETE /exporters/(string: name))

Data Encryption Key (DEK) authorization auditable event methods

Included here are the authorization actions, or operations, on Data Encryption Keys (DEK) and Key Encryption Keys (KEK) that generate auditable event messages for the io.confluent.sg.server/authorization event type.

Auditable event methods

Each of the following auditable event methods is triggered by a request to the Confluent Cloud Schema Registry DEK API. Each method listed includes the action triggering an auditable event message for the io.confluent.sg.server/authorization event type.

schema-registry.RegisterKek

Triggered by a request to register a key encryption key.

schema-registry.UpdateKek

Triggered by a request to update a key encryption key.

schema-registry.DeregisterKek

Triggered by a request to deregister a key encryption key.

schema-registry.RegisterDek

Triggered by a request to register a data encryption key.

schema-registry.GetDek

Triggered by a request to retrieve a data encryption key.

schema-registry.DeregisterDek

Triggered by a request to deregister a data encryption key.

Related content