User Management

Manage users and credentials for your Aiven services. Each service can have multiple users with different credentials and access levels.

List service users

Retrieve all users for a service.

GET /v1/project/{project}/service/{service_name}/user

string

required

Project name

string

required

Service name

Request example

curl -X GET "https://api.aiven.io/v1/project/my-project/service/pg-demo/user" \
  -H "Authorization: aivenv1 YOUR_TOKEN"

import requests

project = "my-project"
service = "pg-demo"
headers = {"Authorization": "aivenv1 YOUR_TOKEN"}

response = requests.get(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/user",
    headers=headers
)

users = response.json()["users"]
for user in users:
    print(f"User: {user['username']} (Type: {user['type']})")

const project = 'my-project';
const service = 'pg-demo';

const response = await fetch(
  `https://api.aiven.io/v1/project/${project}/service/${service}/user`,
  {
    headers: {
      'Authorization': 'aivenv1 YOUR_TOKEN'
    }
  }
);

const data = await response.json();
console.log(data.users);

Response

array

List of service user objects

Show child attributes

string

Username

string

User type: primary, regular, or admin

string

User password (only returned for newly created users)

string

Client certificate for certificate-based authentication

string

Client key for certificate-based authentication

Response example

{
  "users": [
    {
      "username": "avnadmin",
      "type": "primary"
    },
    {
      "username": "app_user",
      "type": "regular"
    }
  ]
}

Create service user

Create a new user for a service.

POST /v1/project/{project}/service/{service_name}/user

string

required

Project name

string

required

Service name

Request body

string

required

Username (3-63 characters, alphanumeric and underscores)

string

Authentication method: caching_sha2_password (MySQL) or scram-sha-256 (PostgreSQL)

Request example

curl -X POST "https://api.aiven.io/v1/project/my-project/service/pg-demo/user" \
  -H "Authorization: aivenv1 YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "app_user"
  }'

import requests

project = "my-project"
service = "pg-demo"
headers = {
    "Authorization": "aivenv1 YOUR_TOKEN",
    "Content-Type": "application/json"
}

data = {
    "username": "app_user"
}

response = requests.post(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/user",
    headers=headers,
    json=data
)

user = response.json()["user"]
print(f"Created user: {user['username']}")
print(f"Password: {user['password']}")
print("\nStore this password securely - it won't be shown again!")

const project = 'my-project';
const service = 'pg-demo';

const response = await fetch(
  `https://api.aiven.io/v1/project/${project}/service/${service}/user`,
  {
    method: 'POST',
    headers: {
      'Authorization': 'aivenv1 YOUR_TOKEN',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      username: 'app_user'
    })
  }
);

const data = await response.json();
console.log('Created user:', data.user.username);
console.log('Password:', data.user.password);

Response

object

The newly created user object with generated password

The password is only returned once during user creation. Store it securely immediately.

Response example

{
  "user": {
    "username": "app_user",
    "type": "regular",
    "password": "GENERATED_PASSWORD_HERE"
  }
}

Reset user password

Reset the password for a service user.

PUT /v1/project/{project}/service/{service_name}/user/{username}

string

required

Project name

string

required

Service name

string

required

Username to reset

Request body

string

required

Must be reset-credentials

Request example

curl -X PUT "https://api.aiven.io/v1/project/my-project/service/pg-demo/user/app_user" \
  -H "Authorization: aivenv1 YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operation": "reset-credentials"
  }'

import requests

project = "my-project"
service = "pg-demo"
username = "app_user"

headers = {
    "Authorization": "aivenv1 YOUR_TOKEN",
    "Content-Type": "application/json"
}

data = {
    "operation": "reset-credentials"
}

response = requests.put(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/user/{username}",
    headers=headers,
    json=data
)

user = response.json()["user"]
print(f"Reset password for: {user['username']}")
print(f"New password: {user['password']}")

Response

object

User object with new password

Response example

{
  "user": {
    "username": "app_user",
    "type": "regular",
    "password": "NEW_GENERATED_PASSWORD"
  }
}

Delete service user

Delete a user from a service.

DELETE /v1/project/{project}/service/{service_name}/user/{username}

string

required

Project name

string

required

Service name

string

required

Username to delete

You cannot delete the primary service user (typically avnadmin). Ensure no applications are using this user before deletion.

Request example

curl -X DELETE "https://api.aiven.io/v1/project/my-project/service/pg-demo/user/app_user" \
  -H "Authorization: aivenv1 YOUR_TOKEN"

import requests

project = "my-project"
service = "pg-demo"
username = "app_user"

headers = {"Authorization": "aivenv1 YOUR_TOKEN"}

response = requests.delete(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/user/{username}",
    headers=headers
)

if response.status_code == 200:
    print(f"User {username} deleted successfully")

Response

Returns 200 OK with an empty response body on success.

Get service connection info

Retrieve connection information for a service including host, port, and credentials.

GET /v1/project/{project}/service/{service_name}/connection_info

string

required

Project name

string

required

Service name

Request example

curl -X GET "https://api.aiven.io/v1/project/my-project/service/pg-demo/connection_info" \
  -H "Authorization: aivenv1 YOUR_TOKEN"

import requests

project = "my-project"
service = "pg-demo"
headers = {"Authorization": "aivenv1 YOUR_TOKEN"}

response = requests.get(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/connection_info",
    headers=headers
)

info = response.json()
print(f"Host: {info['host']}")
print(f"Port: {info['port']}")
print(f"Database: {info['database']}")
print(f"User: {info['user']}")
print(f"Password: {info['password']}")
print(f"\nConnection URI: {info['uri']}")

Response

string

Service hostname

integer

Service port

string

Default username

string

Default user password

string

Default database name (for database services)

string

Complete connection URI

string

CA certificate for TLS connections

Response example

{
  "host": "pg-demo-project.aivencloud.com",
  "port": 12345,
  "user": "avnadmin",
  "password": "REDACTED",
  "database": "defaultdb",
  "uri": "postgres://avnadmin:REDACTED@pg-demo-project.aivencloud.com:12345/defaultdb?sslmode=require",
  "ca_cert": "-----BEGIN CERTIFICATE-----\n..."
}

Kafka user ACL management

For Apache Kafka services, you can manage user ACLs (Access Control Lists) to control topic access.

Create Kafka ACL

POST /v1/project/{project}/service/{service_name}/acl

string

required

Project name

string

required

Kafka service name

Request body

string

required

Username to grant access

string

required

Topic name or pattern (use * for all topics)

string

required

Permission level: read, write, readwrite, or admin

Request example

curl -X POST "https://api.aiven.io/v1/project/my-project/service/kafka-prod/acl" \
  -H "Authorization: aivenv1 YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "app_user",
    "topic": "events.*",
    "permission": "readwrite"
  }'

import requests

project = "my-project"
service = "kafka-prod"
headers = {
    "Authorization": "aivenv1 YOUR_TOKEN",
    "Content-Type": "application/json"
}

data = {
    "username": "app_user",
    "topic": "events.*",
    "permission": "readwrite"
}

response = requests.post(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/acl",
    headers=headers,
    json=data
)

print(f"Created ACL for user {data['username']} on topic {data['topic']}")

List Kafka ACLs

GET /v1/project/{project}/service/{service_name}/acl

curl -X GET "https://api.aiven.io/v1/project/my-project/service/kafka-prod/acl" \
  -H "Authorization: aivenv1 YOUR_TOKEN"

Getting Started

Endpoints

User Management

List service users

Request example

Response

Response example

Create service user

Request body

Request example

Response

Response example

Reset user password

Request body

Request example

Response

Response example

Delete service user

Request example

Response

Get service connection info

Request example

Response

Response example

Kafka user ACL management

Create Kafka ACL

Request body

Request example

List Kafka ACLs

​List service users

​Request example

​Response

​Response example

​Create service user

​Request body

​Request example

​Response

​Response example

​Reset user password

​Request body

​Request example

​Response

​Response example

​Delete service user

​Request example

​Response

​Get service connection info

​Request example

​Response

​Response example

​Kafka user ACL management

​Create Kafka ACL

​Request body

​Request example

​List Kafka ACLs

​Related resources

List service users

Request example

Response

Response example

Create service user

Request body

Request example

Response

Response example

Reset user password

Request body

Request example

Response

Response example

Delete service user

Request example

Response

Get service connection info

Request example

Response

Response example

Kafka user ACL management

Create Kafka ACL

Request body

Request example

List Kafka ACLs

Related resources