# ACLs

This API allows you to manage Kafka ACLs (Access Control Lists) for your WarpStream virtual clusters.

ACL rules are only *enforced* on Kafka traffic once ACLs are [enabled on the virtual cluster](/warpstream/kafka/manage-security/configure-acls#enabling-and-disabling-acls). This lets you set up your ACL rules before turning on enforcement. You can enable ACLs via the [UpdateConfiguration](/warpstream/reference/api-reference/virtual-clusters/updateconfiguration) endpoint by setting `are_acls_enabled` to `true`.

For general information about ACLs in WarpStream, including principals, super users, and caching behavior, see the [ACLs guide](/warpstream/kafka/manage-security/configure-acls).

## ACL Fields

Each ACL rule consists of the following fields:

| Field | Description |
|---|---|
| `resource_type` | The type of Kafka resource. One of: `TOPIC`, `GROUP`, `CLUSTER`, `TRANSACTIONAL_ID`, `DELEGATION_TOKEN`, `ANY`. |
| `resource_name` | The name of the resource (e.g., topic name, consumer group name). For `CLUSTER` resources, use `kafka-cluster`. |
| `pattern_type` | How the resource name is matched. One of: `LITERAL` (exact match), `PREFIXED` (prefix match). |
| `principal` | The user principal in the format `User:<name>`. See [ACL Principals](/warpstream/kafka/manage-security/configure-acls#acl-principal) for details. |
| `host` | The client host. Use `*` to allow all hosts. |
| `operation` | The Kafka operation. One of: `ALL`, `READ`, `WRITE`, `CREATE`, `DELETE`, `ALTER`, `DESCRIBE`, `CLUSTER_ACTION`, `DESCRIBE_CONFIGS`, `ALTER_CONFIGS`, `IDEMPOTENT_WRITE`. |
| `permission_type` | Whether to allow or deny the operation. One of: `ALLOW`, `DENY`. |
| `created_at` | Read-only. When the ACL was created, as an RFC 3339 UTC timestamp. Only returned by [List ACLs](/warpstream/reference/api-reference/acls/list-acls). |