User Management

Manage service users and credentials via the REST API

Manage users and credentials for your Aiven services. Each service can have multiple users with different credentials and access levels.

List service users

Retrieve all users for a service.

GET /v1/project/{project}/service/{service_name}/user

project · string · required

Project name

service_name · string · required

Service name

Request example

cURL

curl -X GET "https://api.aiven.io/v1/project/my-project/service/pg-demo/user" \
  -H "Authorization: aivenv1 YOUR_TOKEN"

import requests

project = "my-project"
service = "pg-demo"
headers = {"Authorization": "aivenv1 YOUR_TOKEN"}

response = requests.get(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/user",
    headers=headers
)

users = response.json()["users"]
for user in users:
    print(f"User: {user['username']} (Type: {user['type']})")

const project = 'my-project';
const service = 'pg-demo';

const response = await fetch(
  `https://api.aiven.io/v1/project/${project}/service/${service}/user`,
  {
    headers: {
      'Authorization': 'aivenv1 YOUR_TOKEN'
    }
  }
);

const data = await response.json();
console.log(data.users);

Response

users · array

List of service user objects

Show child attributes

username · string

Username

type · string

User type: primary, regular, or admin

password · string

User password (only returned for newly created users)

access_cert · string

Client certificate for certificate-based authentication

access_key · string

Client key for certificate-based authentication

Response example

{
  "users": [
    {
      "username": "avnadmin",
      "type": "primary"
    },
    {
      "username": "app_user",
      "type": "regular"
    }
  ]
}

Create service user

Create a new user for a service.

POST /v1/project/{project}/service/{service_name}/user

project · string · required

Project name

service_name · string · required

Service name

Request body

username · string · required

Username (3-63 characters, alphanumeric and underscores)

authentication · string

Authentication method: caching_sha2_password (MySQL) or scram-sha-256 (PostgreSQL)

Request example

cURL

curl -X POST "https://api.aiven.io/v1/project/my-project/service/pg-demo/user" \
  -H "Authorization: aivenv1 YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "app_user"
  }'

import requests

project = "my-project"
service = "pg-demo"
headers = {
    "Authorization": "aivenv1 YOUR_TOKEN",
    "Content-Type": "application/json"
}

data = {
    "username": "app_user"
}

response = requests.post(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/user",
    headers=headers,
    json=data
)

user = response.json()["user"]
print(f"Created user: {user['username']}")
print(f"Password: {user['password']}")
print("\nStore this password securely - it won't be shown again!")

const project = 'my-project';
const service = 'pg-demo';

const response = await fetch(
  `https://api.aiven.io/v1/project/${project}/service/${service}/user`,
  {
    method: 'POST',
    headers: {
      'Authorization': 'aivenv1 YOUR_TOKEN',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      username: 'app_user'
    })
  }
);

const data = await response.json();
console.log('Created user:', data.user.username);
console.log('Password:', data.user.password);

Response

user · object

The newly created user object with generated password

The password is only returned once during user creation. Store it securely immediately.

Response example

{
  "user": {
    "username": "app_user",
    "type": "regular",
    "password": "GENERATED_PASSWORD_HERE"
  }
}

Reset user password

Reset the password for a service user.

PUT /v1/project/{project}/service/{service_name}/user/{username}

project · string · required

Project name

service_name · string · required

Service name

username · string · required

Username to reset

Request body

operation · string · required

Must be reset-credentials

Request example

cURL

curl -X PUT "https://api.aiven.io/v1/project/my-project/service/pg-demo/user/app_user" \
  -H "Authorization: aivenv1 YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operation": "reset-credentials"
  }'

import requests

project = "my-project"
service = "pg-demo"
username = "app_user"

headers = {
    "Authorization": "aivenv1 YOUR_TOKEN",
    "Content-Type": "application/json"
}

data = {
    "operation": "reset-credentials"
}

response = requests.put(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/user/{username}",
    headers=headers,
    json=data
)

user = response.json()["user"]
print(f"Reset password for: {user['username']}")
print(f"New password: {user['password']}")

Response

user · object

User object with new password

Response example

{
  "user": {
    "username": "app_user",
    "type": "regular",
    "password": "NEW_GENERATED_PASSWORD"
  }
}

Delete service user

Delete a user from a service.

DELETE /v1/project/{project}/service/{service_name}/user/{username}

project · string · required

Project name

service_name · string · required

Service name

username · string · required

Username to delete

You cannot delete the primary service user (typically avnadmin). Ensure no applications are using this user before deletion.

Request example

cURL

curl -X DELETE "https://api.aiven.io/v1/project/my-project/service/pg-demo/user/app_user" \
  -H "Authorization: aivenv1 YOUR_TOKEN"

import requests

project = "my-project"
service = "pg-demo"
username = "app_user"

headers = {"Authorization": "aivenv1 YOUR_TOKEN"}

response = requests.delete(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/user/{username}",
    headers=headers
)

if response.status_code == 200:
    print(f"User {username} deleted successfully")

Response

Returns 200 OK with an empty response body on success.

Get service connection info

Retrieve connection information for a service including host, port, and credentials.

GET /v1/project/{project}/service/{service_name}/connection_info

project · string · required

Project name

service_name · string · required

Service name

Request example

cURL

curl -X GET "https://api.aiven.io/v1/project/my-project/service/pg-demo/connection_info" \
  -H "Authorization: aivenv1 YOUR_TOKEN"

import requests

project = "my-project"
service = "pg-demo"
headers = {"Authorization": "aivenv1 YOUR_TOKEN"}

response = requests.get(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/connection_info",
    headers=headers
)

info = response.json()
print(f"Host: {info['host']}")
print(f"Port: {info['port']}")
print(f"Database: {info['database']}")
print(f"User: {info['user']}")
print(f"Password: {info['password']}")
print(f"\nConnection URI: {info['uri']}")

Response

host · string

Service hostname

port · integer

Service port

user · string

Default username

password · string

Default user password

database · string

Default database name (for database services)

uri · string

Complete connection URI

ca_cert · string

CA certificate for TLS connections

Response example

{
  "host": "pg-demo-project.aivencloud.com",
  "port": 12345,
  "user": "avnadmin",
  "password": "REDACTED",
  "database": "defaultdb",
  "uri": "postgres://avnadmin:[e-mail]:12345/defaultdb?sslmode=require",
  "ca_cert": "-----BEGIN CERTIFICATE-----\n..."
}

Kafka user ACL management

For Apache Kafka services, you can manage user ACLs (Access Control Lists) to control topic access.

Create Kafka ACL

POST /v1/project/{project}/service/{service_name}/acl

project · string · required

Project name

service_name · string · required

Kafka service name

Request body

username · string · required

Username to grant access

topic · string · required

Topic name or pattern (use * for all topics)

permission · string · required

Permission level: read, write, readwrite, or admin

Request example

cURL

curl -X POST "https://api.aiven.io/v1/project/my-project/service/kafka-prod/acl" \
  -H "Authorization: aivenv1 YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "app_user",
    "topic": "events.*",
    "permission": "readwrite"
  }'

import requests

project = "my-project"
service = "kafka-prod"
headers = {
    "Authorization": "aivenv1 YOUR_TOKEN",
    "Content-Type": "application/json"
}

data = {
    "username": "app_user",
    "topic": "events.*",
    "permission": "readwrite"
}

response = requests.post(
    f"https://api.aiven.io/v1/project/{project}/service/{service}/acl",
    headers=headers,
    json=data
)

print(f"Created ACL for user {data['username']} on topic {data['topic']}")

List Kafka ACLs

GET /v1/project/{project}/service/{service_name}/acl

cURL

curl -X GET "https://api.aiven.io/v1/project/my-project/service/kafka-prod/acl" \
  -H "Authorization: aivenv1 YOUR_TOKEN"

Related resources

• Create service users in Console
• Service management API
• User management CLI commands
• Full API reference