Get security report

View as markdown
GET /v1/security/report

Get a comprehensive security report for the cluster, including information about security configurations such as authentication methods, TLS settings, and security alerts for all interfaces (Kafka, RPC, Admin, Schema Registry, HTTP Proxy).

Responses

  • 200 application/json

    Security report

    Hide response attributes Show response attributes object
    • interfaces object
      Hide interfaces attributes Show interfaces attributes object
      • kafka array[object]

        Security report for Kafka API interface

        Hide kafka attributes Show kafka attributes object
        • name string
        • host string
        • port integer
        • advertised_host string
        • advertised_port integer
        • tls_enabled boolean
        • mutual_tls_enabled boolean
        • authentication_method string

          Values are SASL, mTLS, or None.

        • authorization_enabled boolean
        • supported_sasl_mechanisms array[string]
      • rpc object

        Security report for RPC interface

        Hide rpc attributes Show rpc attributes object
        • host string
        • port integer
        • advertised_host string
        • advertised_port integer
        • tls_enabled boolean
        • mutual_tls_enabled boolean
      • admin array[object]

        Security report for Admin API interface

        Hide admin attributes Show admin attributes object
        • name string
        • host string
        • port integer
        • tls_enabled boolean
        • mutual_tls_enabled boolean
        • authentication_methods array[string]

          Values are BASIC or OIDC.

        • authorization_enabled boolean
      • schema_registry array[object]

        Security report for Schema Registry interface

        Hide schema_registry attributes Show schema_registry attributes object
        • name string
        • host string
        • port integer
        • tls_enabled boolean
        • mutual_tls_enabled boolean
        • authentication_methods array[string]

          Values are BASIC or OIDC.

        • authorization_enabled boolean
      • schema_registry_client object

        Security report for Kafka client interface

        Hide schema_registry_client attributes Show schema_registry_client attributes object
        • kafka_listener_name string
        • brokers array[object]
          Hide brokers attributes Show brokers attributes object
          • host string
          • port integer
        • tls_enabled boolean
        • mutual_tls_enabled boolean
        • configured_authentication_method string

          Values are None, SCRAM_Configured, or SCRAM_Ephemeral.

      • pandaproxy array[object]

        Security report for HTTP Proxy (Pandaproxy) interface

        Hide pandaproxy attributes Show pandaproxy attributes object
        • name string
        • host string
        • port integer
        • advertised_host string
        • advertised_port integer
        • tls_enabled boolean
        • mutual_tls_enabled boolean
        • authentication_methods array[string]

          Values are BASIC or OIDC.

        • authorization_enabled boolean
        • configured_authentication_method string

          Values are None, SCRAM_Configured, or SCRAM_Proxied.

      • audit_log_client object

        Security report for Kafka client interface

        Hide audit_log_client attributes Show audit_log_client attributes object
        • kafka_listener_name string
        • brokers array[object]
          Hide brokers attributes Show brokers attributes object
          • host string
          • port integer
        • tls_enabled boolean
        • mutual_tls_enabled boolean
        • configured_authentication_method string

          Values are None, SCRAM_Configured, or SCRAM_Ephemeral.

    • alerts array[object]
      Hide alerts attributes Show alerts attributes object
      • affected_interface string

        Values are kafka, rpc, admin, schema_registry, schema_registry_client, pandaproxy, or audit_log_client.

      • listener_name string

        The listener name of the affected interface, if provided

      • issue string Required

        Values are NO_TLS, NO_AUTHN, NO_AUTHZ, SASL_PLAIN, PP_CONFIGURED_CLIENT, INSECURE_MIN_TLS_VERSION, or TLS_RENEGOTIATION.

      • description string Required

        Human-readable description of the alert
GET /v1/security/report 
curl \
 --request GET 'http://localhost:9644/v1/security/report'
Response examples (200) 
{
  "interfaces": {
    "kafka": [
      {
        "name": "string",
        "host": "string",
        "port": 42,
        "advertised_host": "string",
        "advertised_port": 42,
        "tls_enabled": true,
        "mutual_tls_enabled": true,
        "authentication_method": "SASL",
        "authorization_enabled": true,
        "supported_sasl_mechanisms": [
          "string"
        ]
      }
    ],
    "rpc": {
      "host": "string",
      "port": 42,
      "advertised_host": "string",
      "advertised_port": 42,
      "tls_enabled": true,
      "mutual_tls_enabled": true
    },
    "admin": [
      {
        "name": "string",
        "host": "string",
        "port": 42,
        "tls_enabled": true,
        "mutual_tls_enabled": true,
        "authentication_methods": [
          "BASIC"
        ],
        "authorization_enabled": true
      }
    ],
    "schema_registry": [
      {
        "name": "string",
        "host": "string",
        "port": 42,
        "tls_enabled": true,
        "mutual_tls_enabled": true,
        "authentication_methods": [
          "BASIC"
        ],
        "authorization_enabled": true
      }
    ],
    "schema_registry_client": {
      "kafka_listener_name": "string",
      "brokers": [
        {
          "host": "string",
          "port": 42
        }
      ],
      "tls_enabled": true,
      "mutual_tls_enabled": true,
      "configured_authentication_method": "None"
    },
    "pandaproxy": [
      {
        "name": "string",
        "host": "string",
        "port": 42,
        "advertised_host": "string",
        "advertised_port": 42,
        "tls_enabled": true,
        "mutual_tls_enabled": true,
        "authentication_methods": [
          "BASIC"
        ],
        "authorization_enabled": true,
        "configured_authentication_method": "None"
      }
    ],
    "audit_log_client": {
      "kafka_listener_name": "string",
      "brokers": [
        {
          "host": "string",
          "port": 42
        }
      ],
      "tls_enabled": true,
      "mutual_tls_enabled": true,
      "configured_authentication_method": "None"
    }
  },
  "alerts": [
    {
      "affected_interface": "kafka",
      "listener_name": "string",
      "issue": "NO_TLS",
      "description": "string"
    }
  ]
}