Deep Dive
Access guide
Map SQIP tasks to tenant permissions
The console displays a navigation area when you have at least one relevant permission, then hides individual actions you cannot perform. The API enforces the same tenant-scoped permissions even if a request is sent without using the console.
Open Access and RBAC → Access guide to view the same role and permission reference in SQIP.
Tenant and cluster access
| Permission | Allows |
|---|---|
dashboard:read | Open the tenant dashboard and view summary statistics. Included for every tenant member. |
tenants:read | Discover tenants the identity belongs to. Included for every tenant member. |
clusters:read | View cluster configuration, topology, capacity, and status. |
clusters:create | Provision a shared or dedicated cluster for the tenant. |
clusters:upgrade | Request a managed Pulsar version upgrade. |
provisioning:read | View provisioning and upgrade job status. |
build-logs:read | Read control-plane and Kubernetes build logs. |
runtime-logs:read | Read bounded broker, proxy, BookKeeper, and ZooKeeper logs. |
Data resources and operations
| Permission | Allows |
|---|---|
namespaces:read | View namespace quota, storage, retention, reconciliation, and topics. |
namespaces:create | Create a managed namespace with a storage allocation. |
namespaces:update | Change namespace storage and retention settings. |
namespaces:reconcile | Reapply desired namespace configuration to Pulsar. |
namespaces:delete | Permanently delete a namespace and its contained resources. |
topics:read | List and inspect managed topics. |
topics:create | Create a topic in a managed namespace. |
topics:delete | Permanently delete a topic and its broker data. |
schemas:read | View schemas, compatibility settings, and version history. |
schemas:write | Upload schemas, change policy, and roll back versions. |
schemas:delete | Delete a topic's active schema. |
usage:read | View production, consumption, ingestion, and delivery measurements. |
monitoring:read | View cluster health and operational monitoring status. |
Credentials, users, and governance
| Permission | Allows |
|---|---|
api-keys:read | List active key metadata, scopes, endpoints, and expiries. Never reveals the secret again. |
api-keys:create | Issue a credential for one managed namespace. |
api-keys:revoke | Revoke a credential and remove its namespace grant. |
users:read | View tenant members, roles, and effective permissions. |
users:manage-access | Add or assign users, change roles and grants, and configure tenant OIDC. |
users:delete | Remove a membership and, when it is the last membership, the underlying identity. |
audit-events:read | Search tenant security and operational audit events. |
audit-events:export | Export the tenant audit history as CSV. |
notifications:read | View channel state without revealing saved destinations. |
notifications:update | Enable channels and replace or clear their destinations. |
notification-deliveries:read | Read destination-free attempt, retry, failure, and delivery history through the API. |
Connector access
| Permission | Allows |
|---|---|
connectors:read | View connector installations and status. |
connectors:operate | Pause, resume, restart, and test an existing connector. |
connector-logs:read | Read the tenant-isolated connector monitoring topic. |
connector-metrics:read | View connector health and reconciliation metrics. |
connectors:create | Install connectors; reserved for tenant and platform administrators. |
connectors:update | Reconfigure connectors; reserved for tenant and platform administrators. |
connectors:delete | Remove connector runtimes; reserved for tenant and platform administrators. |
connector-secrets:update | Rotate connector credentials; reserved for tenant and platform administrators. |
If a menu or action is missing
- Confirm that your identity belongs to the intended tenant.
- Confirm that the resource belongs to that same tenant.
- Compare the task with the permission tables above.
- Ask a tenant administrator for the narrowest missing permission or a suitable standard role.
- Sign in again if your identity-provider role changed and the current token is stale.
Note
An explicit SQIP tenant membership takes precedence over an SSO-derived default role for that tenant. Platform administrators retain global access through their separate platform role.