--- title: "Create Cluster Policy for Virtual Cluster" method: POST path: "/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies#RequestRuleValidator" tags: ["Event Gateway Virtual Cluster Policies"] --- # Create Cluster Policy for Virtual Cluster `POST /v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies#RequestRuleValidator` ## Request - Base URL: `https://global.api.konghq.com` - URL: `https://global.api.konghq.com/v1/event-gateways/{gatewayId}/virtual-clusters/{virtualClusterId}/cluster-policies#RequestRuleValidator` - Auth: one of: - HTTP bearer - HTTP bearer - HTTP bearer - HTTP bearer - TypeScript: (a function with typed inputs; its response is checked against the schema) Creates a new cluster-level policy associated with the specified Event Gateway virtual cluster. ## Query parameters - `before` string, uuid - `after` string, uuid ## Request body - EventGatewayRequestRuleValidatorPolicy: Validates the content of Kafka requests against a list of rules. Use this policy to enforce conventions that Kafka ACLs cannot express, because ACLs cannot read the content of a request. For example, a maximum number of partitions, a topic naming convention, or a minimum number of acknowledgements on produce. Each rule describes the valid state of the request. The action of the rule runs when the rule evaluates to `false`. **Requires a minimum runtime version of `1.3`**. - `type` 'request_rule_validator', required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `config` EventGatewayRequestRuleValidatorConfig, required: The configuration of the request rule validator policy. - `requests` EventGatewayRequestRules[], required: The rules to apply, grouped by Kafka request type. A request type can occur more than once in this list. Every entry for the type applies, in list order. Requests of a type that is not in this list are not validated. A maximum of 100 entries are allowed. - union: The rules to apply to one Kafka request type. - EventGatewayCreateTopicsRequestRules: The rules to apply to Kafka `CreateTopics` requests. When at least one `create_topics` rule is configured, Event Gateway turns auto topic creation off on `Metadata` requests, because clients could use it to bypass the rules. - `type` 'create_topics', required - `rules` EventGatewayCreateTopicsRule[], required: Every rule in this list is evaluated independently against each topic in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayCreatePartitionsRequestRules: The rules to apply to Kafka `CreatePartitions` requests. - `type` 'create_partitions', required - `rules` EventGatewayCreatePartitionsRule[], required: Every rule in this list is evaluated independently against each topic in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayAlterConfigsRequestRules: The rules to apply to Kafka `AlterConfigs` requests. - `type` 'alter_configs', required - `rules` EventGatewayAlterConfigsRule[], required: Every rule in this list is evaluated independently against each resource in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayIncrementalAlterConfigsRequestRules: The rules to apply to Kafka `IncrementalAlterConfigs` requests. - `type` 'incremental_alter_configs', required - `rules` EventGatewayIncrementalAlterConfigsRule[], required: Every rule in this list is evaluated independently against each configuration entry in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayAlterClientQuotasRequestRules: The rules to apply to Kafka `AlterClientQuotas` requests. - `type` 'alter_client_quotas', required - `rules` EventGatewayAlterClientQuotasRule[], required: Every rule in this list is evaluated independently against each quota operation in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayAlterUserScramCredentialsRequestRules: The rules to apply to Kafka `AlterUserScramCredentials` requests. - `type` 'alter_user_scram_credentials', required - `rules` EventGatewayAlterUserScramCredentialsRule[], required: Every rule in this list is evaluated independently against each credential in the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayProduceRequestRules: The rules to apply to Kafka `Produce` requests. - `type` 'produce', required - `rules` EventGatewayProduceRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayFetchRequestRules: The rules to apply to Kafka `Fetch` requests. - `type` 'fetch', required - `rules` EventGatewayFetchRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayJoinGroupRequestRules: The rules to apply to Kafka `JoinGroup` requests. - `type` 'join_group', required - `rules` EventGatewayJoinGroupRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayConsumerGroupHeartbeatRequestRules: The rules to apply to Kafka `ConsumerGroupHeartbeat` requests. - `type` 'consumer_group_heartbeat', required - `rules` EventGatewayConsumerGroupHeartbeatRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayOffsetCommitRequestRules: The rules to apply to Kafka `OffsetCommit` requests. - `type` 'offset_commit', required - `rules` EventGatewayOffsetCommitRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayOffsetFetchRequestRules: The rules to apply to Kafka `OffsetFetch` requests. - `type` 'offset_fetch', required - `rules` EventGatewayOffsetFetchRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - EventGatewayTxnOffsetCommitRequestRules: The rules to apply to Kafka `TxnOffsetCommit` requests. - `type` 'txn_offset_commit', required - `rules` EventGatewayTxnOffsetCommitRule[], required: Every rule in this list is evaluated independently against the request. A rule that evaluates to `false` runs its action. A maximum of 10 rules are allowed. - `description` string, required: An explanation of the rule. Event Gateway writes this text to the logs when the request violates the rule, because the rule expression alone does not show the intent. - `rule` string, required: A boolean expression that describes the valid state of the request. The action runs when the expression evaluates to `false`. An expression that cannot be evaluated, for example because a value has an unexpected format, also counts as `false`. - `action` 'reject' | 'passthrough', required: What to do when a rule evaluates to `false`. `reject` fails the request with the `POLICY_VIOLATION` error code. `passthrough` lets the request continue, but logs the violation in the same way as `reject`. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. ## Response `201` Created - EventGatewayPolicy: A policy associated with an Event Gateway. - `type` string, required: The type name of the policy. - `name` string: A unique user-defined name of the policy. - `description` string: A human-readable description of the policy. - `enabled` boolean: Whether the policy is enabled. - `labels` Labels: Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_". - `id` string, uuid, required: The unique identifier of the policy. - `config` object, nullable: The configuration of the policy. - `created_at` string, date-time, required: An ISO-8601 timestamp representation of entity creation date. - `parent_policy_id` string, uuid, nullable: The unique identifier of the parent policy, if any. - `updated_at` string, date-time, required: An ISO-8601 timestamp representation of entity update date. - `condition` string: A string containing the boolean expression that determines whether the policy is applied. ## Other responses - `400`: Bad Request - `401`: Unauthorized - `403`: Forbidden ## Changes - **2026-11-05** `f018071a4515`: 1 info - endpoint added [Operation history](https://skmtc.dev/kong/apis/konnect-api/changes/v1/event-gateways/:gatewayId/virtual-clusters/:virtualClusterId/cluster-policies%23RequestRuleValidator/post.md) --- [API](https://skmtc.dev/kong/apis/konnect-api.md) - [All operations](https://skmtc.dev/kong/apis/konnect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kong/apis/konnect-api/revisions/f018071a4515?raw)