Supported Operations and Schema Registry Resources

The Schema Registry security plugin provides authorization for operations on schemas for subjects, which correspond to Kafka topics.

The supported operations and corresponding Schema Registry URIs are listed here. These apply to both role-based access control (RBAC) and ACL authorization.


You can use both RBAC and ACLs together or independently. Both methods of access control have their strengths and use cases. To learn more, see RBAC and ACLs in the RBAC overview.

Supported Operations

GET /subjects/(string: subject)/versions
POST /subjects/(string: subject)
GET /subjects/(string: subject)/versions/(versionId: version)
POST /subjects/(string: subject)/versions
POST /compatibility/subjects/(string: subject)/versions/(versionId: version)
DELETE /subjects/(string: subject)/versions/(versionId: version)
DELETE /subjects/(string: subject)
GET /schemas/ids/{int: id}
GET /config/(string: subject)
GET /mode/(string: subject)
PUT /config/(string: subject)
PUT /mode/(string: subject)
GET /config and .. http:get:: /mode
PUT /config and .. http:put:: /mode
GET /subjects

For more information on these operations, see the Schema Registry API.

Example ACL Setups

Any “one size fits all” recommendation for Schema Registry ACL configurations will not make sense, but here are a few prosaic examples that may provide a starting point as you plan your deployment.

  • One permissive setup might be to provide all READ-ACLs to all clients, including ANONYMOUS. If you adhere to the need-to-know principle more closely, you may want to limit READ operations.
  • An autonomous team would need all the SUBJECT ACLs: READ, WRITE, DELETE, COMPATIBILTY_WRITE and COMPATIBILTY_READ. The exact configuration depends on the autonomy of the team and the desired level of control over the Schema Registry. A CD/CI system would get the same ACLs for all relevant subjects.
  • An admin team may additionally set up the GLOBAL_ ACLs.

To learn more about defining ACLs, see Schema Registry ACL Authorizer.

Configure the Authorizer

Incoming requests are mapped to a Schema Registry Operation as outlined in above table, after which the request is authorized using the configured authorizer.


The implementation used to authorize Schema Registry requests. This needs to be an implementation of the SchemaRegistryAuthorizer interface.

  • Type: string
  • Default: “”
  • Importance: high

These Schema Registry authorizers are provided natively.