<a id="kafkarest-config"></a>

# Standalone REST Proxy Configuration Options for Confluent Platform

The Confluent REST Proxy accepts the settings for the Java
admin, consumer and producer. Use these to override the default settings of producers and consumers
in the REST Proxy. Use the `client.` prefix to override the default settings of admins, consumers and
producers in Confluent REST Proxy. If you want the configuration to apply only to admins, consumers or
producers, replace the prefix with `admin.`, `consumer.` or `producer.`, respectively.
When configuration options are exposed in the Confluent REST Proxy API, priority is given to settings in the
user request, then to overrides provided as configuration options, and finally falls back to the
default values provided by the Java Kafka clients.

#### IMPORTANT
If you are using Confluent Cloud with REST Proxy, see [Connect Self-managed REST Proxy to Confluent Cloud](/cloud/current/cp-component/kafka-rest-config.html#connect-self-managed-crest-to-ccloud)
for configuration details.

## General

`id`
: Unique ID for the Confluent REST Proxy server instance. This generates unique
  IDs for consumers that do not specify their ID. The ID is empty by default, which
  makes a single server setup easier to get up and running, but is not safe for
  multi-server deployments where automatic consumer IDs are used.
  <br/>
  * Type: string
  * Default: “”
  * Importance: high

`bootstrap.servers`
: A list of Kafka brokers to connect to. For example,
  `PLAINTEXT://hostname:9092,SSL://hostname2:9092`. This configuration is
  particularly important when Kafka security is enabled, because Kafka may expose
  multiple endpoints that will be stored as metadata, but REST Proxy may need to be
  configured with just one of those endpoints. The client will make use of all
  servers irrespective of which servers are specified here for
  bootstrapping—this list only impacts the initial hosts used to discover the
  full set of servers. Because these servers are used only for the initial
  connection to discover the full cluster membership (which may change
  dynamically), this list need not contain the full set of servers (you may want
  more than one, though, in case a server is down).

`listeners`
: Comma-separated list of listeners that listen for API requests over either HTTP
  or HTTPS. If a listener uses HTTPS, you must also set the appropriate TLS configuration parameters.
  <br/>
  * Type: list
  * Default: `http://0.0.0.0:8082`
  * Importance: high

`schema.registry.url`
: The base URL for Schema Registry that should be used by the serializer.
  <br/>
  * Type: string
  * Default: `http://localhost:8081`
  * Importance: high
  <br/>
  #### NOTE
  The configuration property `auto.register.schemas` is not supported for
  Kafka REST Proxy.

`consumer.request.max.bytes`
: Maximum number of bytes in unencoded message keys and values returned by a single
  request. Administrators can use this to limit the memory used by a single
  consumer and to control the memory usage required to decode responses on clients
  that cannot perform a streaming decode. Note that the actual payload is
  larger due to overhead from base64 encoding the response data and from JSON
  encoding the entire response.
  <br/>
  * Type: long
  * Default: 67108864
  * Importance: medium

`consumer.threads`
: The maximum number of threads to run consumer requests on. Note that this must
  be greater than the maximum number of consumers in a single consumer group.
  The sentinel value of -1 allows the number of threads to grow as needed to
  fulfill active consumer requests. Inactive threads will ultimately be stopped
  and cleaned up.
  <br/>
  * Type: int
  * Default: 50
  * Importance: medium

`consumer.request.timeout.ms`
: The maximum time to wait for messages for a request. A request that
  reaches its maximum number of messages returns sooner.
  <br/>
  Configure this setting globally in the REST Proxy configuration file,
  or per consumer at instance creation. A per-consumer value is
  honored in full, whether larger or smaller than the global value. A
  consumer created without a per-consumer value inherits the global
  value. The request `timeout` query parameter can further shorten
  the effective wait below this setting, but can’t extend it beyond
  this setting. The default value is 1,000 milliseconds, so an idle
  fetch returns after about one second by default. Raising the global
  or per-consumer value extends this wait.
  <br/>
  * Type: int
  * Default: 1000
  * Importance: medium

`host.name`
: The host name used to generate absolute URLs in responses. If empty, the default
  canonical hostname is used.
  <br/>
  * Type: string
  * Default: “”
  * Importance: medium

`access.control.allow.methods`
: Set value to Jetty Access-Control-Allow-Origin header for specified methods.
  <br/>
  * Type: string
  * Default: “”
  * Importance: low

`access.control.allow.origin`
: Set value for Jetty Access-Control-Allow-Origin header.
  You may use `*` for any origin, or you can specify multiple origins separated by commas.
  <br/>
  * Type: string
  * Default: “”
  * Importance: low

`response.http.headers.config`
: Use to select which HTTP headers are returned in the HTTP response for Confluent Platform
  components. Specify multiple values in a comma-separated string using the
  format `[action][header name]:[header value]` where `[action]` is one of
  the following: `set`, `add`, `setDate`, or `addDate`. You must use
  quotation marks around the header value when the header value contains commas.
  For example:
  <br/>
  ```none
  response.http.headers.config="add Cache-Control: no-cache, no-store, must-revalidate", add X-XSS-Protection: 1; mode=block, add Strict-Transport-Security: max-age=31536000; includeSubDomains, add X-Content-Type-Options: nosniff
  ```
  <br/>
  * Type: string
  * Default: “”
  * Importance: low

`reject.options.request`
: Indicates whether to reject the OPTIONS method request to REST
  services. By default, sending a request with the OPTIONS method to all REST
  services from Confluent Platform REST Proxy, Confluent Control Center REST endpoint, and so on, returns the list
  of available methods on the specified endpoint. For example: `curl -X OPTIONS
  http://localhost:8083`. When `reject.options.request` is set to `true`,
  requests with `-X OPTIONS` are rejected and available methods are not
  returned. Setting `reject.options.request` to `true` protects API
  endpoints that are not specifically used by applications, which reduces the
  attack surface.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: low

`consumer.instance.timeout.ms`
: Amount of idle time before a consumer instance is automatically destroyed.
  <br/>
  * Type: int
  * Default: 300000
  * Importance: low

`consumer.iterator.backoff.ms`
: Amount of time to backoff when an iterator runs out of data. If a consumer has
  a dedicated worker thread, this is effectively the maximum error value for the entire
  request timeout. It should be small enough to closely target the timeout, but
  large enough to avoid busy waiting.
  <br/>
  * Type: int
  * Default: 50
  * Importance: low

`fetch.min.bytes`
: Minimum number of bytes in message keys and values returned by a single request
  before the timeout of `consumer.request.timeout.ms` passes. The special sentinel
  value of -1 disables this functionality.
  <br/>
  * Type: int
  * Default: -1
  * Importance: medium

`consumer.iterator.timeout.ms`
: Timeout for blocking consumer iterator operations. This should be set to a small
  enough value that it is possible to effectively peek() on the iterator.
  <br/>
  * Type: int
  * Default: 1
  * Importance: low

`debug`
: Indicates whether to generate extra debugging information in some
  error response entities.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: low

`idle.timeout.ms`
: The number of milliseconds before an idle connection times out.
  <br/>
  * Type: long
  * Default: 30000
  * Importance: low

`metric.reporters`
: List of classes to use as metrics reporters. Implementing the
  `MetricReporter` interface allows plugging in classes that are
  notified of new metric creation. The JmxReporter is always included to register
  JMX statistics.
  <br/>
  * Type: list
  * Default: []
  * Importance: low

`metrics.jmx.prefix`
: Prefix to apply to metric names for the default JMX reporter.
  <br/>
  * Type: string
  * Default: `kafka.rest`
  * Importance: low

`metrics.num.samples`
: The number of samples maintained to compute metrics.
  <br/>
  * Type: int
  * Default: 2
  * Importance: low

`metrics.sample.window.ms`
: The metrics system maintains a configurable number of samples over a fixed window
  size. This configuration controls the size of the window. For example, you might
  maintain two samples each measured over a 30 second period. When a window expires,
  you erase and overwrite the oldest window.
  <br/>
  * Type: long
  * Default: 30000
  * Importance: low

`port`
: DEPRECATED: port to listen on for new connections. Use `listeners` instead.
  <br/>
  * Type: int
  * Default: 8082
  * Importance: low

`request.logger.name`
: Name of the SLF4J logger to write the NCSA Common Log Format request log.
  <br/>
  * Type: string
  * Default: `io.confluent.rest-utils.request`
  * Importance: low

`response.mediatype.default`
: The default response media type to use if no specific types are
  requested in an Accept header.
  <br/>
  * Type: string
  * Default: `application/json`
  * Importance: low

`response.mediatype.preferred`
: An ordered list of the server’s preferred media types used for responses, from
  most preferred to least.
  <br/>
  * Type: list
  * Default: [application/json, application/vnd.kafka.v2+json]
  * Importance: low

`shutdown.graceful.ms`
: Amount of time to wait after a shutdown request for outstanding requests to complete.
  <br/>
  * Type: int
  * Default: 1000
  * Importance: low

`kafka.rest.resource.extension.class`
: List of classes to use as extensions to the REST Proxy.
  Set this property to `io.confluent.kafkarest.security.KafkaRestSecurityResourceExtension` when you have a Confluent Enterprise license.
  You can also implement the
  `RestResourceExtension`  interface to inject your own user-defined resources
  like filters to REST Proxy for custom capabilities like logging and security.
  <br/>
  * Type: list
  * Default: “”
  * Importance: low

`advertised.listeners`
: List of advertised listeners. This configuration is used to generate absolute URLs in V3
  responses. The HTTP and HTTPS protocols are supported. Each listener must include the protocol,
  hostname, and port. For example: `http://myhost:8080` and `https://0.0.0.0:8081`.
  <br/>
  * Type: list
  * Default: “”
  * Importance: low

`confluent.resource.name.authority`
: The authority where the governance of the name space is delegated to. This value
  is defined by the remainder of the CRN. This is used when generating Confluent resource
  names. Examples: `confluent.cloud` and `mds-01.example.com`.
  <br/>
  * Type: string
  * Default: “”
  * Importance: low

`api.v3.produce.batch.maximum.entries`
: The maximum number of entries in a v3 API batch produce request.
  <br/>
  * Type: int
  * Default: 10
  * Valid Values: [1,…,50]
  * Importance: low

<a id="kafka-rest-http-ssl-config"></a>

## Configuration Options for HTTPS

`ssl.keystore.location`
: Used for HTTPS. Location of the keystore file to use for TLS.
  <br/>
  #### IMPORTANT
  Jetty requires that the key’s CN, stored in the keystore, must match the FQDN.
  <br/>
  * Type: string
  * Default: “”
  * Importance: high

`ssl.keystore.password`
: Used for HTTPS. The store password for the keystore file.
  <br/>
  * Type: password
  * Default: “”
  * Importance: high

`ssl.key.password`
: Used for HTTPS. The password of the private key in the keystore file.
  <br/>
  * Type: password
  * Default: “”
  * Importance: high

`ssl.keystore.type`
: Used for HTTPS. The type of keystore file.
  <br/>
  * Type: string
  * Default: JKS
  * Importance: medium

`ssl.protocol`
: Used for HTTPS.
  The TLS protocol used to generate the SSLContext. The default is `TLSv1.3`
  when running with Java 11 or newer, `TLSv1.2` otherwise. This value works
  for most use cases. Allowed values in recent JVMs are `TLSv1.2` and
  `TLSv1.3`. `TLS`, `TLSv1.1`, `SSL`, `SSLv2` and `SSLv3` might be
  supported in older JVMs, but their usage is discouraged due to known security
  vulnerabilities. With the default value for this configuration and `ssl.enabled.protocols`,
  clients downgrade to `TLSv1.2` if the server does not support `TLSv1.3`.
  If this configuration is set to `TLSv1.2`, clients do not use `TLSv1.3`,
  even if it is one of the values in `ssl.enabled.protocols` and the server
  only supports `TLSv1.3`.
  <br/>
  * Type: string
  * Default: `TLSv1.3`
  * Importance: medium

`ssl.provider`
: Used for HTTPS. The TLS security provider name. Leave blank to use Jetty’s default.
  <br/>
  * Type: string
  * Default: “” (Jetty’s default)
  * Importance: medium

`ssl.enabled.protocols`
: Used for HTTPS. Comma-separated list of protocols enabled for TLS connections.
  Leave blank to use Jetty’s defaults.
  <br/>
  * Type: list
  * Default: “” (Jetty’s default)
  * Importance: medium

`ssl.keymanager.algorithm`
: Used for HTTPS. The algorithm used by the key manager factory for TLS connections.
  Leave blank to use Jetty’s default.
  <br/>
  * Type: string
  * Default: “” (Jetty’s default)
  * Importance: low

`ssl.trustmanager.algorithm`
: Used for HTTPS. The algorithm used by the trust manager factory for TLS connections.
  Leave blank to use Jetty’s default.
  <br/>
  * Type: string
  * Default: “” (Jetty’s default)
  * Importance: low

`ssl.cipher.suites`
: Used for HTTPS. Comma-separated list of TLS cipher suites. Leave blank
  to use Jetty’s defaults.
  <br/>
  * Type: list
  * Default: “” (Jetty’s default)
  * Importance: low

`ssl.endpoint.identification.algorithm`
: Used for HTTPS. The endpoint identification algorithm to validate the server
  hostname using the server certificate. Leave blank to use Jetty’s default.
  <br/>
  * Type: string
  * Default: https
  * Importance: low

<a id="kafka-rest-broker-ssl-config"></a>

## Configuration Options for TLS Encryption between REST Proxy and Apache Kafka Brokers

Note that all the TLS configurations (for REST Proxy to Broker communication) are prefixed with
`client.`. If you want the configuration to apply just to admins, consumers or producers, you can
replace the prefix with `admin.`, `consumer.` or `producer.` respectively.

In addition to these configurations, make sure `bootstrap.servers` configuration
is set with SSL://host:port endpoints, or you could accidentally open a TLS connection
to a non-TLS port.

Keep in mind that authenticated and encrypted connection to Kafka Brokers will only work when Kafka is
running with appropriate security configuration. For details, see [Kafka Security](../../../security/overview.md#security).

`client.security.protocol`
: Protocol used to communicate with brokers. Valid values are: PLAINTEXT, SSL,
  SASL_PLAINTEXT, SASL_SSL.
  <br/>
  * Type: string
  * Default: PLAINTEXT
  * Importance: high

`client.ssl.key.password`
: The password of the private key in the key store file. This is optional for
  client.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`client.ssl.keystore.location`
: The location of the key store file. This is optional for client and can be used
  for two-way client authentication.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`client.ssl.keystore.password`
: The store password for the key store file. This is optional for client and only
  needed if ssl.keystore.location is configured.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`client.ssl.truststore.location`
: The location of the trust store file.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`client.ssl.truststore.password`
: The password for the trust store file.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`client.ssl.enabled.protocols`
: Comma-separated list of protocols enabled for TLS connections. The default
  value is `TLSv1.2,TLSv1.3` when running with Java 11 or later, `TLSv1.2`
  otherwise. With the default value for Java 11 (`TLSv1.2,TLSv1.3`), Kafka
  clients and brokers prefer TLSv1.3 if both support it, and fall back to
  TLSv1.2 otherwise (assuming both support at least TLSv1.2).
  <br/>
  * Type: list
  * Default: `TLSv1.2,TLSv1.3`
  * Importance: medium

`client.ssl.keystore.type`
: The file format of the key store file. This is optional for client.
  <br/>
  * Type: string
  * Default: JKS
  * Importance: medium

`client.ssl.protocol`
: The TLS protocol used to generate the SSLContext. The default is `TLSv1.3`
  when running with Java 11 or newer, `TLSv1.2` otherwise. This value works
  for most use cases. Allowed values in recent JVMs are `TLSv1.2` and
  `TLSv1.3`. `TLS`, `TLSv1.1`, `SSL`, `SSLv2` and `SSLv3` might be
  supported in older JVMs, but their usage is discouraged due to known security
  vulnerabilities. With the default value for this configuration and `ssl.enabled.protocols`,
  clients downgrade to `TLSv1.2` if the server does not support `TLSv1.3`.
  If this configuration is set to `TLSv1.2`, clients do not use `TLSv1.3`,
  even if it is one of the values in `ssl.enabled.protocols` and the server
  only supports `TLSv1.3`.
  <br/>
  * Type: string
  * Default: `TLSv1.3`
  * Importance: medium

`client.ssl.provider`
: The name of the security provider used for TLS connections. Default value is
  the default security provider of the JVM.
  <br/>
  * Type: string
  * Default: null
  * Importance: medium

`client.ssl.truststore.type`
: The file format of the trust store file.
  <br/>
  * Type: string
  * Default: JKS
  * Importance: medium

`client.ssl.cipher.suites`
: List of cipher suites. This is a named combination of authentication, encryption,
  MAC, and key exchange algorithms used to negotiate the security settings for a
  network connection using the TLS network protocol. By default, all available
  cipher suites are supported.
  <br/>
  * Type: list
  * Default: null
  * Importance: low

`client.ssl.endpoint.identification.algorithm`
: The endpoint identification algorithm to validate server hostname using server
  certificate.
  <br/>
  * Type: string
  * Default: null
  * Importance: low

`client.ssl.keymanager.algorithm`
: The algorithm used by key manager factory for TLS connections. Default value
  is the key manager factory algorithm configured for the Java Virtual Machine.
  <br/>
  * Type: string
  * Default: SunX509
  * Importance: low

`client.ssl.secure.random.implementation`
: The SecureRandom PRNG implementation to use for TLS cryptography operations.
  <br/>
  * Type: string
  * Default: null
  * Importance: low

`client.ssl.trustmanager.algorithm`
: The algorithm used by trust manager factory for TLS connections. Default value
  is the trust manager factory algorithm configured for the Java Virtual Machine.
  <br/>
  * Type: string
  * Default: PKIX
  * Importance: low

## Configuration Options for TLS Encryption between REST Proxy and Schema Registry

Keep in mind that authenticated and encrypted connection to Schema Registry will only work when Schema Registry is running
with appropriate security configuration. For details, see
[Schema Registry](../../../schema-registry/security/index.md#schemaregistry-security).

`schema.registry.ssl.key.password`
: The password of the private key in the key store file. This is optional.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`schema.registry.ssl.keystore.location`
: The location of the key store file. This is optional and can be used for mutual TLS
  authentication.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`schema.registry.ssl.keystore.password`
: The store password for the key store file. This is optional and only needed if
  ssl.keystore.location is configured.
  <br/>
  * Type: password
  * Default: null
  * Importance: high

`schema.registry.ssl.truststore.location`
: The location of the trust store file.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

`schema.registry.ssl.truststore.password`
: The password for the trust store file.
  <br/>
  * Type: string
  * Default: null
  * Importance: high

## License configuration options

#### IMPORTANT
License configurations are only required if you are using principal propagation. For
more information, see [REST Proxy Authentication](security.md#kafka-rest-security-http-auth).

`confluent.license`
: Confluent issues a license key to each subscriber. The license key is a short snippet of
  text that you can copy and paste. Without the license key, you can use Confluent security plugins
  for a 30-day trial period. If you are a subscriber and don’t have a license key, contact
  [Confluent Support](https://support.confluent.io/).
  <br/>
  * Type: string
  * Default: “”
  * Importance: high