<a id="sr-authentication-authorization-auditable-events"></a>

# Schema Registry Authentication and Authorization Auditable Event Methods on Confluent Cloud

An auditable event is an authentication or authorization action on Confluent Cloud
Schema Registry, Stream Catalog, or exporters for Schema Linking that generates a
message that Confluent Cloud stores as a record in the audit log.

For management and operations events for Schema Registry, see
[Schema Registry Management and Operations Auditable Event Methods on Confluent Cloud](sr-management.md#sr-management-auditable-events).

## Schema Registry authentication

The following authentication actions or operations on
[Confluent Cloud Schema Registry](../../../sr/schemas-manage.md#sr-prv),
[Confluent Cloud Stream Catalog](../../../stream-governance/stream-catalog.md#cloud-stream-catalog), and exporters
for [Schema Linking on Confluent Cloud](../../../sr/schema-linking.md#schema-linking) generate auditable event messages for the
`io.confluent.sg.server/authentication` event.

| Method name                                                                | Action triggering an auditable event message                            |
|----------------------------------------------------------------------------|-------------------------------------------------------------------------|
| [schema-registry.Authentication](#schema-registry-authentication-examples) | A request to authenticate to Schema Registry using an API key or token. |

<a id="schema-registry-authentication-examples"></a>

### schema-registry.Authentication

The `schema-registry.Authentication` event is generated by a request
for authentication to Schema Registry using an API key or token.

To view an example event message, expand the following dropdown:

### Success

```json
{
  "datacontenttype": "application/json",
  "data": {
    "serviceName": "crn://confluent.cloud/",
    "methodName": "schema-registry.Authentication",
    "cloudResources": [
      {
        "scope": {
          "resources": [
            {
              "type": "ORGANIZATION",
              "resourceId": "bc64d0fb-84b7-4467-a36b-3ad3cd8c188d"
            },
            {
              "type": "ENVIRONMENT",
              "resourceId": "env-qjygy6"
            }
          ]
        },
        "resource": {
          "type": "SCHEMA_REGISTRY",
          "resourceId": "lsrc-gx9kdv"
        }
      }
    ],
    "authenticationInfo": {
      "principal": {
        "confluentUser": {
          "resourceId": "u-y35x87"
        }
      },
      "result": "SUCCESS",
      "credentials": {
        "idSecretCredentials": {
          "credentialId": "7TBXED2PT5CAKIGK"
        },
        "mechanism": "HTTP_BASIC"
      }
    },
    "requestMetadata": {
      "requestId": [
        "8406167c-8c05-11ed-8f14-5f38e5250914"
      ]
    },
    "resourceName": "crn://confluent.cloud/organization=bc64d0fb-84b7-4467-a36b-3ad3cd8c188d/environment=env-qjygy6/schema-registry=lsrc-gx9kdv"
  },
  "subject": "crn://confluent.cloud/organization=bc64d0fb-84b7-4467-a36b-3ad3cd8c188d/environment=env-qjygy6/schema-registry=lsrc-gx9kdv",
  "specversion": "1.0",
  "id": "7fced40b-f893-429e-aa08-be584268379a",
  "source": "crn://confluent.cloud/",
  "time": "2023-01-04T07:58:03.708Z",
  "type": "io.confluent.sg.server/authentication"
}
```

<a id="authorization-auditable-events-sr"></a>

## Schema Registry authorization

The following authorization actions, or operations, on Schema Registry generate auditable
event messages for the `io.confluent.sg.server/authorization` event type.

Each of the following auditable event methods is generated by a request to the
Schema Registry API. Each method listed includes the action triggering an auditable event
message and the associated Schema Registry API request.

| Method name                                | Action triggering an auditable event message                                                                                                                                                                                                          |
|--------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `schema-registry.RegisterSchema`           | A request to register a new schema under the specified subject.<br/><br/><br/>[POST /subjects/(string: subject)/versions](https://docs.confluent.io/cloud/current/ccloud/register/)<br/><br/>                                                         |
| `schema-registry.LookUpSchemaUnderSubject` | A request to check if a schema has already been registered under the specified subject.<br/><br/><br/>[POST /subjects/(string: subject)](https://docs.confluent.io/cloud/current/ccloud/look-up-schema-under-subject/)<br/><br/>                      |
| `schema-registry.DeleteSchemaVersion`      | A request to delete a specific version of the schema registered under this subject.<br/><br/><br/>[DELETE /subjects/(string: subject)/versions/(versionId: version)](https://docs.confluent.io/cloud/current/ccloud/delete-schema-version/)<br/><br/> |
| `schema-registry.DeleteSubject`            | A request to delete the specified subject and its associated compatibility level if registered.<br/><br/><br/>[DELETE /subjects/(string: subject)](https://docs.confluent.io/cloud/current/ccloud/delete-subject/)<br/><br/>                          |
| `schema-registry.UpdateSubjectConfig`      | A request to update the subject compatibility level.<br/><br/><br/>[PUT /config/(string: subject)](https://docs.confluent.io/cloud/current/ccloud/update-subject-level-config/)<br/><br/>                                                             |
| `schema-registry.DeleteSubjectConfig`      | A request to delete the specified subject-level compatibility level configuration and revert to the global default.<br/><br/><br/>[DELETE /config/(string: subject)](https://docs.confluent.io/cloud/current/ccloud/delete-subject-config/)<br/><br/> |
| `schema-registry.UpdateGlobalConfig`       | A request to update the global compatibility level.<br/><br/><br/>[PUT /config](https://docs.confluent.io/cloud/current/ccloud/update-top-level-config/)<br/><br/>                                                                                    |
| `schema-registry.DeleteGlobalConfig`       | A request to delete the global compatibility level configuration and revert to the default.<br/><br/><br/>[DELETE /config](https://docs.confluent.io/cloud/current/ccloud/delete-top-level-config/)<br/><br/>                                         |
| `schema-registry.UpdateSubjectMode`        | A request to update the mode for the specified subject.<br/><br/><br/>[PUT /mode/(string: subject)](https://docs.confluent.io/cloud/current/ccloud/update-mode/)<br/><br/>                                                                            |
| `schema-registry.DeleteSubjectMode`        | A request to delete the specified subject-level compatibility level configuration and revert to the global default.<br/><br/><br/>[DELETE /mode/(string: subject)](https://docs.confluent.io/cloud/current/ccloud/delete-subject-mode/)<br/><br/>     |
| `schema-registry.UpdateGlobalMode`         | A request to update global mode.<br/><br/><br/>[PUT /mode](https://docs.confluent.io/cloud/current/ccloud/update-top-level-mode/)<br/><br/>                                                                                                           |

<a id="authorization-auditable-events-sc"></a>

## Stream Catalog authorization

The following authorization actions, or operations, on Confluent Cloud Stream Catalog
generate auditable event messages for the
`io.confluent.sg.server/authorization` event type.

Each of the following auditable event methods is generated by a request to the
Stream Catalog API. Each method listed includes the action triggering an auditable
event message and the associated Stream Catalog API request.

| Method name                                    | Action triggering an auditable event message                                                                                                                                                                                                                              |
|------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `schema-registry.PartialEntityUpdate`          | A request to partially update an entity.<br/><br/><br/>[PUT catalog/v1/entity](https://docs.confluent.io/cloud/current/ccloud/partial-entity-update/)<br/><br/>                                                                                                           |
| `schema-registry.CreateTags`                   | A request to create tags.<br/><br/><br/>[POST catalog/v1/entity/tags](https://docs.confluent.io/cloud/current/ccloud/create-tags/)<br/><br/>                                                                                                                              |
| `schema-registry.UpdateTags`                   | A request to update tags.<br/><br/><br/>[PUT catalog/v1/entity/tags](https://docs.confluent.io/cloud/current/ccloud/update-tags/)<br/><br/>                                                                                                                               |
| `schema-registry.DeleteTag`                    | A request to delete a tag on an entity.<br/><br/><br/>[DELETE catalog/v1/entity/type/(string: typeName)/name/(string: qualifiedName)/tags/(string: tagName)](https://docs.confluent.io/cloud/current/ccloud/delete-tag/)<br/><br/>                                        |
| `schema-registry.CreateBusinessMetadata`       | A request to create business metadata.<br/><br/><br/>[POST catalog/v1/entity/businessmetadata](https://docs.confluent.io/cloud/current/ccloud/create-business-metadata/)<br/><br/>                                                                                        |
| `schema-registry.UpdateBusinessMetadata`       | A request to update business metadata.<br/><br/><br/>[PUT catalog/v1/entity/businessmetadata](https://docs.confluent.io/cloud/current/ccloud/update-business-metadata/)<br/><br/>                                                                                         |
| `schema-registry.DeleteBusinessMetadata`       | A request to delete a business metadata on an entity.<br/><br/><br/>[DELETE catalog/v1/entity/type/(string: typeName)/name/(string: qualifiedName)/businessmetadata/(string: bmName)](https://docs.confluent.io/cloud/current/ccloud/delete-business-metadata/)<br/><br/> |
| `schema-registry.SearchCatalogUsingBasicQuery` | A request to retrieve data for the specified full text query.<br/><br/><br/>[GET catalog/v1/search/basic](https://docs.confluent.io/cloud/current/ccloud/search-using-basic/)<br/><br/>                                                                                   |
| `schema-registry.SearchCatalogUsingAttributes` | A request to retrieve data for the specified attribute search query.<br/><br/><br/>[GET catalog/v1/search/attribute](https://docs.confluent.io/cloud/current/ccloud/search-using-attribute/)<br/><br/>                                                                    |
| `schema-registry.CreateTagDefs`                | A request to create tag definitions.<br/><br/><br/>[POST catalog/v1/types/tagdefs](https://docs.confluent.io/cloud/current/ccloud/create-tag-defs/)<br/><br/>                                                                                                             |
| `schema-registry.UpdateTagDefs`                | A request to update tag definitions.<br/><br/><br/>[PUT catalog/v1/types/tagdefs](https://docs.confluent.io/cloud/current/ccloud/update-tag-defs/)<br/><br/>                                                                                                              |
| `schema-registry.DeleteTagDef`                 | A request to delete tag definitions identified by their names.<br/><br/><br/>[DELETE catalog/v1/types/tagdefs/(string: tagName)](https://docs.confluent.io/cloud/current/ccloud/delete-tag-def/)<br/><br/>                                                                |
| `schema-registry.CreateBusinessMetadataDefs`   | A request to create business metadata definitions.<br/><br/><br/>[POST catalog/v1/types/businessmetadatadefs](https://docs.confluent.io/cloud/current/ccloud/create-business-metadata-defs/)<br/><br/>                                                                    |
| `schema-registry.UpdateBusinessMetadataDefs`   | A request to update business metadata definitions.<br/><br/><br/>[PUT catalog/v1/types/businessmetadatadefs](https://docs.confluent.io/cloud/current/ccloud/update-business-metadata-defs/)<br/><br/>                                                                     |
| `schema-registry.DeleteBusinessMetadataDef`    | A request to delete a business metadata definition identified by its name.<br/><br/><br/>[DELETE catalog/v1/types/businessmetadatadefs/(string: bmName)](https://docs.confluent.io/cloud/current/ccloud/delete-business-metadata-def/)<br/><br/>                          |
| `schema-registry.UpdateSchemaTags`             | A request to bulk-update multiple tags.<br/><br/><br/>[PUT catalog/v1/entity/tags](https://docs.confluent.io/cloud/current/ccloud/update-tags/)<br/><br/>                                                                                                                 |

<a id="authorization-auditable-events-schema-linking-exporters"></a>

## Schema Linking exporters authorization

The following authorization actions, or operations, on Confluent Cloud exporters
generate auditable event messages for the
`io.confluent.sg.server/authorization` event type.

Each of the following auditable event methods is generated by a request to the
exporters API. Each method listed includes the action triggering an auditable
event message and the associated exporters API request.

| Method name                            | Action triggering an auditable event message                                                                                                                                                              |
|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `schema-registry.CreateExporter`       | A request to create a schema exporter.<br/><br/><br/>[POST /exporters](https://docs.confluent.io/cloud/current/ccloud/register-exporter/)<br/><br/>                                                       |
| `schema-registry.UpdateExporter`       | A request to update schema exporter by name.<br/><br/><br/>[PUT /exporters/(string: name)](https://docs.confluent.io/cloud/current/ccloud/update-exporter-info/)<br/><br/>                                |
| `schema-registry.UpdateExporterConfig` | A request to update schema exporter configuration by name.<br/><br/><br/>[PUT /exporters/(string: name)/config](https://docs.confluent.io/cloud/current/ccloud/update-exporter-config-by-name/)<br/><br/> |
| `schema-registry.PauseExporter`        | A request to pause schema exporter by name.<br/><br/><br/>[PUT /exporters/(string: name)/pause](https://docs.confluent.io/cloud/current/ccloud/pause-exporter-by-name/)<br/><br/>                         |
| `schema-registry.ResetExporter`        | A request to reset schema exporter by name.<br/><br/><br/>[PUT /exporters/(string: name)/reset](https://docs.confluent.io/cloud/current/ccloud/reset-exporter-by-name/)<br/><br/>                         |
| `schema-registry.ResumeExporter`       | A request to resume schema exporter by name.<br/><br/><br/>[PUT /exporters/(string: name)/resume](https://docs.confluent.io/cloud/current/ccloud/resume-exporter-by-name/)<br/><br/>                      |
| `schema-registry.DeleteExporter`       | A request to delete schema exporter by name.<br/><br/><br/>[DELETE /exporters/(string: name)](https://docs.confluent.io/cloud/current/ccloud/delete-exporter/)<br/><br/>                                  |

<a id="authorization-auditable-events-dek"></a>

## Data encryption key authorization

The following authorization actions, or operations, on data encryption keys
(DEK) and key encryption keys (KEK) generate auditable event messages for the
`io.confluent.sg.server/authorization` event type.

Each of the following auditable event methods is generated by a request to the
Confluent Cloud Schema Registry DEK API. Each method listed includes the action triggering an
auditable event message for the `io.confluent.sg.server/authorization` event
type.

| Method name                     | Action triggering an auditable event message   |
|---------------------------------|------------------------------------------------|
| `schema-registry.RegisterKek`   | A request to register a key encryption key.    |
| `schema-registry.UpdateKek`     | A request to update a key encryption key.      |
| `schema-registry.DeregisterKek` | A request to deregister a key encryption key.  |
| `schema-registry.RegisterDek`   | A request to register a data encryption key.   |
| `schema-registry.GetDek`        | A request to retrieve a data encryption key.   |
| `schema-registry.DeregisterDek` | A request to deregister a data encryption key. |