Deep Dive

Access guide

Map SQIP tasks to tenant permissions

The console displays a navigation area when you have at least one relevant permission, then hides individual actions you cannot perform. The API enforces the same tenant-scoped permissions even if a request is sent without using the console.

Open Access and RBAC → Access guide to view the same role and permission reference in SQIP.

Tenant and cluster access

PermissionAllows
dashboard:readOpen the tenant dashboard and view summary statistics. Included for every tenant member.
tenants:readDiscover tenants the identity belongs to. Included for every tenant member.
clusters:readView cluster configuration, topology, capacity, and status.
clusters:createProvision a shared or dedicated cluster for the tenant.
clusters:upgradeRequest a managed Pulsar version upgrade.
provisioning:readView provisioning and upgrade job status.
build-logs:readRead control-plane and Kubernetes build logs.
runtime-logs:readRead bounded broker, proxy, BookKeeper, and ZooKeeper logs.

Data resources and operations

PermissionAllows
namespaces:readView namespace quota, storage, retention, reconciliation, and topics.
namespaces:createCreate a managed namespace with a storage allocation.
namespaces:updateChange namespace storage and retention settings.
namespaces:reconcileReapply desired namespace configuration to Pulsar.
namespaces:deletePermanently delete a namespace and its contained resources.
topics:readList and inspect managed topics.
topics:createCreate a topic in a managed namespace.
topics:deletePermanently delete a topic and its broker data.
schemas:readView schemas, compatibility settings, and version history.
schemas:writeUpload schemas, change policy, and roll back versions.
schemas:deleteDelete a topic's active schema.
usage:readView production, consumption, ingestion, and delivery measurements.
monitoring:readView cluster health and operational monitoring status.

Credentials, users, and governance

PermissionAllows
api-keys:readList active key metadata, scopes, endpoints, and expiries. Never reveals the secret again.
api-keys:createIssue a credential for one managed namespace.
api-keys:revokeRevoke a credential and remove its namespace grant.
users:readView tenant members, roles, and effective permissions.
users:manage-accessAdd or assign users, change roles and grants, and configure tenant OIDC.
users:deleteRemove a membership and, when it is the last membership, the underlying identity.
audit-events:readSearch tenant security and operational audit events.
audit-events:exportExport the tenant audit history as CSV.
notifications:readView channel state without revealing saved destinations.
notifications:updateEnable channels and replace or clear their destinations.
notification-deliveries:readRead destination-free attempt, retry, failure, and delivery history through the API.

Connector access

PermissionAllows
connectors:readView connector installations and status.
connectors:operatePause, resume, restart, and test an existing connector.
connector-logs:readRead the tenant-isolated connector monitoring topic.
connector-metrics:readView connector health and reconciliation metrics.
connectors:createInstall connectors; reserved for tenant and platform administrators.
connectors:updateReconfigure connectors; reserved for tenant and platform administrators.
connectors:deleteRemove connector runtimes; reserved for tenant and platform administrators.
connector-secrets:updateRotate connector credentials; reserved for tenant and platform administrators.

If a menu or action is missing

  1. Confirm that your identity belongs to the intended tenant.
  2. Confirm that the resource belongs to that same tenant.
  3. Compare the task with the permission tables above.
  4. Ask a tenant administrator for the narrowest missing permission or a suitable standard role.
  5. Sign in again if your identity-provider role changed and the current token is stale.

Note

An explicit SQIP tenant membership takes precedence over an SSO-derived default role for that tenant. Platform administrators retain global access through their separate platform role.