---
title: "Add a Kafka-native ACL entry"
method: POST
path: "/project/{project}/service/{service_name}/kafka/acl"
tags: ["Service:_Kafka"]
---

# Add a Kafka-native ACL entry

`POST /project/{project}/service/{service_name}/kafka/acl`

## Path parameters

- `project` string, required
- `service_name` string, required

## Request body

- ServiceKafkaNativeAclAddRequestBody — ServiceKafkaNativeAclAddRequestBody
  - `host` string — the host or * for all hosts
  - `operation` 'All' | 'Alter' | 'AlterConfigs' | 'ClusterAction' | 'Create' | 'CreateTokens' | 'Delete' | 'Describe' | 'DescribeConfigs' | 'DescribeTokens' | 'IdempotentWrite' | 'Read' | 'Write', required — Operation a Kafka-native ACL grants or denies permission to perform.
  - `pattern_type` 'LITERAL' | 'PREFIXED', required — How a Kafka-native ACL matches its resource name.
  - `permission_type` 'ALLOW' | 'DENY', required — Whether a Kafka-native ACL allows or denies its operation.
  - `principal` string, required — principal is in 'PrincipalType:name' format
  - `resource_name` string, required — Resource pattern used to match specified resources
  - `resource_type` 'Topic' | 'Group' | 'Cluster' | 'TransactionalId' | 'DelegationToken' | 'User', required — Type of resource a Kafka-native ACL can be applied to.

## Response `200`

Response

- ServiceKafkaNativeAclAddResponse — ServiceKafkaNativeAclAddResponse
  - `acl` object, required — Kafka-native ACL entry for Kafka service.
    - `host` string, required — the host or * for all hosts
    - `id` string, required — ID
    - `operation` 'All' | 'Alter' | 'AlterConfigs' | 'ClusterAction' | 'Create' | 'CreateTokens' | 'Delete' | 'Describe' | 'DescribeConfigs' | 'DescribeTokens' | 'IdempotentWrite' | 'Read' | 'Write', required — Operation a Kafka-native ACL grants or denies permission to perform.
    - `pattern_type` 'LITERAL' | 'PREFIXED', required — How a Kafka-native ACL matches its resource name.
    - `permission_type` 'ALLOW' | 'DENY', required — Whether a Kafka-native ACL allows or denies its operation.
    - `principal` string, required — principal is in 'principalType:name' format
    - `resource_name` string, required — Resource pattern used to match specified resources
    - `resource_type` 'Topic' | 'Group' | 'Cluster' | 'TransactionalId' | 'DelegationToken' | 'User', required — Type of resource a Kafka-native ACL can be applied to.
  - `message` string, required — Printable result of the request

## Other responses

- `400` — Invalid request parameters
- `409` — Request conflict

## Changes

- **2026-08-28** `c949573465e3` — 1 warning, 4 info
  - removed the optional property `errors` from the response with the `200` status
  - the `host` request property default value `*` was added
  - the `pattern_type` request property default value `LITERAL` was removed
  - the `permission_type` request property default value `ALLOW` was removed
  - …1 more

[Change history](https://skmtc.dev/aiven/apis/aiven-api-documentation/changes/project/:project/service/:service_name/kafka/acl/post.md)

---

[API](https://skmtc.dev/aiven/apis/aiven-api-documentation.md) · [All operations](https://skmtc.dev/aiven/apis/aiven-api-documentation/llms.txt) · [OpenAPI document](https://skmtc.dev/aiven/apis/aiven-api-documentation/revisions/90f50802482d?raw)