# Use the Data Plane APIs

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [cloud-data-platform-full.txt](https://docs.redpanda.com/cloud-data-platform-full.txt)

---
title: Use the Data Plane APIs
latest-operator-version: v26.1.4
latest-console-tag: v3.7.3
latest-connect-version: 4.93.0
latest-redpanda-tag: v26.1.9
docname: api/cloud-dataplane-api
page-component-name: cloud-data-platform
page-version: master
page-component-version: master
page-component-title: Cloud
page-relative-src-path: api/cloud-dataplane-api.adoc
page-edit-url: https://github.com/redpanda-data/cloud-docs/edit/main/modules/manage/pages/api/cloud-dataplane-api.adoc
description: Use the Data Plane APIs to manage your Redpanda Cloud clusters.
page-git-created-date: "2024-06-06"
page-git-modified-date: "2025-08-20"
---

<!-- Source: https://docs.redpanda.com/cloud-data-platform/manage/api/cloud-dataplane-api.md -->

The Redpanda Cloud API is a collection of REST APIs that allow you to interact with different parts of Redpanda Cloud. The Data Plane APIs enable you to programmatically manage the resources within your clusters, including topics, users, access control lists (ACLs), and connectors. You can call the API endpoints directly, or use tools like Terraform or Python scripts to automate resource management.

See [Data Plane API](https://docs.redpanda.com/api/doc/cloud-dataplane/) for the full Data Plane API reference documentation.

The [data plane](https://docs.redpanda.com/api/doc/cloud-dataplane/topic/topic-cloud-api-overview#topic-cloud-api-architecture) contains the actual Redpanda clusters. Every cluster is its own data plane, and so it has its own distinct [Data Plane API URL](https://docs.redpanda.com/api/doc/cloud-dataplane/topic/topic-cloud-api-overview#topic-data-plane-apis-url).

## [](#get-data-plane-api-url)Get Data Plane API URL

### BYOC or Dedicated

To retrieve the Data Plane API URL of a cluster, make a request to the [`GET /v1/clusters/{id}`](https://docs.redpanda.com/api/doc/cloud-controlplane/operation/operation-clusterservice_getcluster) endpoint of the Control Plane API.

### Serverless

To retrieve the Data Plane API URL of a cluster, make a request to the [`GET /v1/serverless/clusters/{id}`](https://docs.redpanda.com/api/doc/cloud-controlplane/operation/operation-serverlessclusterservice_getserverlesscluster) endpoint of the Control Plane API.

The response includes a `dataplane_api.url` value:

```bash
  "id": "....",
  "name": "my-cluster",
....
  "dataplane_api": {
    "url": "https://api-xyz.abc.fmc.ppd.cloud.redpanda.com"
  },
...
```

## [](#data-plane-apis)Data Plane APIs

### [](#create-a-user)Create a user

To create a new user in your Redpanda cluster, make a POST request to the [`/v1/users`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-userservice_createuser) endpoint, including the SASL mechanism, username, and password in the request body:

```bash
curl -X POST "https://<dataplane-api-url>/v1/users" \
 -H "Authorization: Bearer <token>" \
 -H "accept: application/json" \
 -H "content-type: application/json" \
 -d '{"mechanism":"SASL_MECHANISM_SCRAM_SHA_256","name":"payment-service","password":"secure-password"}'
```

> 💡 **TIP**
>
> When using a shell substitution variable for the token, use double quotes to wrap the header value.

The success response returns the newly-created username and SASL mechanism:

{
  "user": {
    "name": "payment-service",
    "mechanism": "SASL\_MECHANISM\_SCRAM\_SHA\_256"
  }
}

### [](#create-an-acl)Create an ACL

To create a new ACL in your Redpanda cluster, make a [`POST /v1/acls`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-aclservice_createacl) request. The following example ACL allows all operations on any Redpanda topic for a user with the name `payment-service`.

```bash
curl -X POST "https://<dataplane-api-url>/v1/acls" \
 -H "Authorization: Bearer <token>" \
 -H "accept: application/json" \
 -H "content-type: application/json" \
 -d '{"host":"*","operation":"OPERATION_ALL","permission_type":"PERMISSION_TYPE_ALLOW","principal":"User:payment-service","resource_name":"*","resource_pattern_type":"RESOURCE_PATTERN_TYPE_LITERAL","resource_type":"RESOURCE_TYPE_TOPIC"}'
```

The success response is empty, with a 201 status code.

{}

### [](#create-a-topic)Create a topic

To create a new Redpanda topic without specifying any further parameters, such as the desired topic-level configuration or partition count, make a POST request to [`/v1/topics`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-topicservice_createtopic) endpoint:

```bash
curl -X POST "<dataplane-api-url>/v1/topics" \
 -H "Authorization: Bearer <token>" \
 -H "accept: application/json" \
 -H "content-type: application/json" \
 -d '{"name":"<topic-name>"}'
```

### [](#manage-secrets)Manage secrets

Secrets are stored externally in your cloud provider’s secret management service. Redpanda fetches the secrets when you reference them in cluster properties.

#### [](#create-a-secret)Create a secret

Make a request to [`POST /v1/secrets`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-secretservice_createsecret). You must use a Base64-encoded secret.

```bash
curl -X POST "https://<dataplane-api-url>/v1/secrets" \
 -H "accept: application/json" \
 -H "authorization: Bearer <token>" \
 -H "content-type: application/json" \
 -d '{"id":"<secret-name>","scopes":["SCOPE_REDPANDA_CLUSTER"],"secret_data":"<secret-value>"}'
```

You must include the following values:

-   `<dataplane-api-url>`: The base URL for the Data Plane API.

-   `<token>`: The API key you generated during authentication.

-   `<secret-name>`: The name of the secret you want to add. Use only the following characters: `^[A-Z][A-Z0-9_]*$`.

-   `<secret-value>`: The Base64-encoded secret.

-   This scope: `"SCOPE_REDPANDA_CLUSTER"`.


The response returns the name and scope of the secret.

You can then use the Control Plane API or `rpk` to [set a cluster property value](https://docs.redpanda.com/cloud-data-platform/manage/cluster-maintenance/config-cluster/) to reference a secret, using the secret name.

For the Control Plane API, you must use the following notation with the secret name in the request body to correctly reference the secret:

```bash
"iceberg_rest_catalog_client_secret": "${secrets.<secret-name>}"
```

#### [](#update-a-secret)Update a secret

Make a request to [`PUT /v1/secrets/{id}`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-secretservice_updatesecret). You can only update the secret value, not its name. You must use a Base64-encoded secret.

```bash
curl -X PUT "https://<dataplane-api-url>/v1/secrets/<secret-name>" \
 -H "accept: application/json" \
 -H "authorization: Bearer <token>" \
 -H "content-type: application/json" \
 -d '{"scopes":["SCOPE_REDPANDA_CLUSTER"],"secret_data":"<new-secret-value>"}'
```

You must include the following values:

-   `<dataplane-api-url>`: The base URL for the Data Plane API.

-   `<secret-name>`: The name of the secret you want to update. The secret’s name is also its ID.

-   `<token>`: The API key you generated during authentication.

-   This scope: `"SCOPE_REDPANDA_CLUSTER"`.

-   `<new-secret-value>`: Your new Base64-encoded secret.


The response returns the name and scope of the secret. It might take several minutes for the new secret value to propagate to any cluster properties that reference it.

#### [](#delete-a-secret)Delete a secret

Before you delete a secret, make sure that you remove references to it from your cluster configuration.

Make a request to [`DELETE /v1/secrets/{id}`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-secretservice_deletesecret).

```bash
curl -X DELETE "https://<dataplane-api-url>/v1/secrets/<secret-name>" \
 -H "accept: application/json" \
 -H "authorization: Bearer <token>" \
```

You must include the following values:

-   `<dataplane-api-url>`: The base URL for the Data Plane API.

-   `<secret-name>`: The name of the secret you want to delete.

-   `<token>`: The API key you generated during authentication.


### [](#use-redpanda-connect)Use Redpanda Connect

Use the API to manage [Redpanda Connect pipelines](https://docs.redpanda.com/cloud-data-platform/develop/connect/about/) in Redpanda Cloud.

> 📝 **NOTE**
>
> The Pipeline APIs for Redpanda Connect are supported in BYOC and Serverless clusters only.

#### [](#get-redpanda-connect-pipeline)Get Redpanda Connect pipeline

To get details of a specific pipeline, make a [`GET /v1/redpanda-connect/pipelines/{id}`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-redpandaconnectservice_getpipeline) request.

```bash
curl "https://<dataplane-url>/v1/redpanda-connect/pipelines/<pipeline-id>"
```

#### [](#stop-a-redpanda-connect-pipeline)Stop a Redpanda Connect pipeline

To stop a running pipeline, make a [`PUT /v1/redpanda-connect/pipelines/{id}/stop`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-redpandaconnectservice_stoppipeline) request.

```bash
curl -X PUT "https://<dataplane-url>/v1/redpanda-connect/pipelines/<pipeline-id>/stop"
```

#### [](#start-a-redpanda-connect-pipeline)Start a Redpanda Connect pipeline

To start a previously stopped pipeline, make a [`PUT /v1/redpanda-connect/pipelines/{id}/start`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-redpandaconnectservice_startpipeline) request.

```bash
curl -X PUT "https://<dataplane-url>/v1/redpanda-connect/pipelines/<pipeline-id>/start"
```

#### [](#update-a-redpanda-connect-pipeline)Update a Redpanda Connect pipeline

To update a pipeline, make a [`PUT /v1/redpanda-connect/pipelines/{id}`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-redpandaconnectservice_updatepipeline) request. You update a pipeline configuration to scale resources, for example the number of CPU cores and amount of memory allocated.

```bash
curl -X PUT "https://api.redpanda.com/v1/redpanda-connect/pipelines/" \
 -H 'accept: application/json'\
 -H 'content-type: application/json' \
 -d '{"resources":{"cpu_shares":"8","memory_shares":"8G"}}'
```

### [](#manage-kafka-connect)Manage Kafka Connect

Use the API to configure your [Kafka Connect](https://docs.redpanda.com/cloud-data-platform/develop/managed-connectors/) clusters.

> ❗ **IMPORTANT**
>
> -   To enable this feature, contact [Redpanda Support](https://support.redpanda.com/hc/en-us/requests/new). To disable this feature, see [Disable Kafka Connect](https://docs.redpanda.com/cloud-data-platform/develop/managed-connectors/disable-kc/).
>
> -   Redpanda Support does not manage or monitor Kafka Connect. For fully-supported connectors, consider [Redpanda Connect](https://docs.redpanda.com/cloud-data-platform/develop/connect/about/).
>
> -   When Kafka Connect is enabled, there is a dedicated node running even when no connectors are deployed.

> 📝 **NOTE**
>
> Kafka Connect is supported in BYOC and Dedicated clusters only.

#### [](#create-a-kafka-connect-cluster-secret)Create a Kafka Connect cluster secret

Kafka Connect cluster secret data must first be in JSON format, and then Base64-encoded.

1.  Prepare the secret data in JSON format:

    ```none
    {"secret.access.key": "<secret-access-key-value>"}
    ```

2.  Encode the secret data in Base64:

    ```none
    echo '{"secret.access.key": "<secret-access-key-value>"}' | base64
    ```

3.  Use the [Secrets API](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-kafkaconnectservice_createsecret) to create a secret that stores the Base64-encoded secret data:

    ```bash
    curl -X POST "https://<dataplane-api-url>/v1/kafka-connect/clusters/redpanda/secrets" \
     -H 'accept: application/json'\
     -H 'content-type: application/json' \
     -d '{"name":"<connector-name>","secret_data":"<secret-data-base64-encoded>"}'
    ```


The response returns an `id` that you can use to [create the Kafka Connect connector](#create-a-kafka-connect-connector).

#### [](#create-a-kafka-connect-connector)Create a Kafka Connect connector

To create a connector, make a POST request to [`/v1/kafka-connect/clusters/{cluster_name}/connectors`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-kafkaconnectservice_createconnector).

The following example shows how to create an S3 sink connector with the name `my-connector`:

```bash
curl -X POST "<dataplane-api-url>/v1/kafka-connect/clusters/redpanda/connectors" \
 -H "Authorization: Bearer <token>" \
 -H "accept: application/json" \
 -H "content-type: application/json" \
 -d '{"config":{"connector.class":"com.redpanda.kafka.connect.s3.S3SinkConnector","topics":"test-topic","aws.secret.access.key":"${secretsManager:<secret-id>:secret.access.key}","aws.s3.bucket.name":"bucket-name","aws.access.key.id":"access-key","aws.s3.bucket.check":"false","region":"us-east-1"},"name":"my-connector"}'
```

> ⚠️ **CAUTION**
>
> The field `aws.secret.access.key` in this example contains sensitive information that usually shouldn’t be added to a configuration directly. Redpanda recommends that you first create a secret and then use the secret ID to inject the secret in your Create Connector request.
>
> If you had created a secret following the example from the previous section [Create a Kafka Connect cluster secret](#create-a-kafka-connect-cluster-secret), use the `id` returned in the Create Secret response to replace the placeholder `<secret-id>` in this Create Connector example. The syntax `${secretsManager:<secret-id>:secret.access.key}` tells the Kafka Connect cluster to load `<secret-id>`, specifying the key `secret.access.key` from the secret JSON.

Example success response:

{
  "name": "my-connector",
  "config": {
    "aws.access.key.id": "access-key",
    "aws.s3.bucket.check": "false",
    "aws.s3.bucket.name": "bucket-name",
    "aws.secret.access.key": "secret-key",
    "connector.class": "com.redpanda.kafka.connect.s3.S3SinkConnector",
    "name": "my-connector",
    "region": "us-east-1",
    "topics": "test-topic"
  },
  "tasks": \[\],
  "type": "sink"
}

#### [](#restart-a-kafka-connect-connector)Restart a Kafka Connect connector

To restart a connector, make a POST request to the [`/v1/kafka-connect/clusters/{cluster_name}/connectors/{name}/restart`](https://docs.redpanda.com/api/doc/cloud-dataplane/operation/operation-kafkaconnectservice_restartconnector) endpoint:

```bash
curl -X POST "<dataplane-api-url>/v1/kafka-connect/clusters/redpanda/connectors/my-connector/restart" \
 -H "Authorization: Bearer <token>" \
 -H "accept: application/json"\
 -H "content-type: application/json" \
 -d '{"include_tasks":false,"only_failed":false}'
```

## [](#limitations)Limitations

-   Client SDKs are not available.