---
title: "POST /v1/{+acl}:addAclEntry"
method: POST
path: "/v1/{+acl}:addAclEntry"
tags: ["projects"]
---

# POST /v1/{+acl}:addAclEntry

`POST /v1/{+acl}:addAclEntry`

Incremental update: Adds an acl entry to an acl. Creates the acl if it does not exist yet.

## Path parameters

- `acl` string, required

## Request body

- AclEntry — Represents the access granted for a given Resource Pattern in an ACL.
  - `operation` string — Required. The operation type. Allowed values are (case insensitive): ALL, READ, WRITE, CREATE, DELETE, ALTER, DESCRIBE, CLUSTER_ACTION, DESCRIBE_CONFIGS, ALTER_CONFIGS, and IDEMPOTENT_WRITE. See https://kafka.apache.org/documentation/#operations_resources_and_protocols for valid combinations of resource_type and operation for different Kafka API requests.
  - `host` string — Required. The host. Must be set to "*" for Managed Service for Apache Kafka.
  - `permissionType` string — Required. The permission type. Accepted values are (case insensitive): ALLOW, DENY.
  - `principal` string — Required. The principal. Specified as Google Cloud account, with the Kafka StandardAuthorizer prefix "User:". For example: "User:test-kafka-client@test-project.iam.gserviceaccount.com". Can be the wildcard "User:*" to refer to all users.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/managedkafka.md) · [All operations](https://skmtc.net/google/apis/managedkafka/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/managedkafka/versions/ebfb70483869/schema)