Schema registry

Schema registries are resources that you can use in Schema Validation policies to validate messages against the Confluent schema registry.

Event Gateway supports the following registry types:

• Avro
• JSON Schema

You can also set schema_type to any v1.3+ to accept records in any supported format, rather than a single fixed format. With any, Event Gateway resolves the format of each record individually. Values that carry a schema reference, in the Confluent wire format or in a record header, are decoded using the registry. Any other value is parsed as JSON without a schema.

curl -X POST https://{region}.api.konghq.com/v1/event-gateways/{eventGatewayId}/schema-registries \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "my-schema-registry",
      "type": "confluent",
      "config": {
        "schema_type": "avro",
        "endpoint": "endpoint",
        "timeout_seconds": 10,
        "authentication": {
          "type": "basic",
          "username": "username",
          "password": "'$MY_PASSWORD'"
        }
      }
    }
    '

terraform {
  required_providers {
    konnect-beta = {
      source  = "kong/konnect-beta"
    }
  }
}

provider "konnect-beta" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

resource "konnect_event_gateway_schema_registry" "my_schema_registry" {
  provider = konnect-beta
  type = "confluent"
  config = {
    schema_type = "avro"
    endpoint = "endpoint"
    timeout_seconds = 10

    authentication = {
      type = "basic"
      username = "username"
      password = "$MY_PASSWORD"
    }
  }



  gateway_id = konnect_event_gateway.my_event_gateway.id
}

event_gateways:
  - ref: eventGatewayName
    name: eventGatewayName
    schema_registries:
    - ref: my-schema-registry
      name: my-schema-registry
      type: confluent
      config:
        schema_type: avro
        endpoint: endpoint
        timeout_seconds: 10
        authentication:
          type: basic
          username: username
          password: !env MY_PASSWORD

Note: Event Gateway only requires read-only access to the schema registry to fetch schemas for validation.

A policy can compute its behavior straight from schema metadata, for example a Mask Fields or Encrypt Fields selector built from record.value.schema.metadata.tags, or a condition that checks record.value.schema.metadata.properties. For those policies, the registry is a trusted input.

That means anyone with write access to the registry can change what a policy does without touching the policy itself. For example, removing a PII tag stops a field from being masked or encrypted. The change takes effect for every record validated against that schema version, on every virtual cluster that uses it.

Restrict write access to the registry to the same degree you’d restrict the policies it drives. Review metadata changes before they go live, and keep a registry-side audit log so changes stay traceable after the fact.