---
title: "Create Backend Cluster"
method: POST
path: "/v1/event-gateways/{gatewayId}/backend-clusters"
tags: ["Event Gateway Backend Clusters"]
---

# Create Backend Cluster

`POST /v1/event-gateways/{gatewayId}/backend-clusters`

Creates a new backend cluster.

## Request body

- object
  - `name` string, required — The unique name of the backend cluster.
  - `description` string — A human-readable description of the backend cluster.
  - `authentication` union, required
    - BackendClusterAuthenticationAnonymous — Anonymous authentication scheme for the backend cluster.
      - `type` 'anonymous', required — The type of authentication scheme.
    - BackendClusterAuthenticationSaslPlain — SASL/PLAIN authentication scheme for the backend cluster.
      - `type` 'sasl_plain', required
      - `username` string, required — A literal value or a reference to an existing secret as a template string expression. The value is stored and returned by the API as-is, not treated as sensitive information.
      - `password` string, required — A sensitive value containing the secret or a reference to a secret as a template string expression. If the value is provided as plain text, it is encrypted at rest and omitted from API responses. If provided as an expression, the expression itself is stored and returned by the API.
    - BackendClusterAuthenticationSaslScram — SASL/SCRAM authentication scheme for the backend cluster.
      - `type` 'sasl_scram', required
      - `algorithm` 'sha256' | 'sha512', required — The algorithm used for SASL/SCRAM authentication.
      - `username` string, required — A literal value or a reference to an existing secret as a template string expression. The value is stored and returned by the API as-is, not treated as sensitive information.
      - `password` string, required — A sensitive value containing the secret or a reference to a secret as a template string expression. If the value is provided as plain text, it is encrypted at rest and omitted from API responses. If provided as an expression, the expression itself is stored and returned by the API.
  - `insecure_allow_anonymous_virtual_cluster_auth` boolean — If true, virtual clusters can have allow anonymous authentication and use this backend cluster. This setting is not recommended for production use as it may create privilege escalation vulnerabilities.
  - `bootstrap_servers` string[], required — A list of cluster bootstrap servers in the format address:port.
  - `tls` BackendClusterTLS, required
    - `enabled` boolean, required — If true, TLS is enabled for connections to this backend cluster. If false, TLS is explicitly disabled.
    - `insecure_skip_verify` boolean — If true, skip certificate verification. It's not secure to use for production.
    - `ca_bundle` string — A literal value or a reference to an existing secret as a template string expression. The value is stored and returned by the API as-is, not treated as sensitive information.
    - `tls_versions` string[] — List of supported TLS versions.
    - `client_identity` object — Client mTLS configuration. **Requires a minimum runtime version of `1.1`**.
      - `certificate` string, required — A literal value or a reference to an existing secret as a template string expression. The value is stored and returned by the API as-is, not treated as sensitive information.
      - `key` string, required — A sensitive value containing the secret or a reference to a secret as a template string expression. If the value is provided as plain text, it is encrypted at rest and omitted from API responses. If provided as an expression, the expression itself is stored and returned by the API.
  - `metadata_update_interval_seconds` integer — The interval at which metadata is updated in seconds.
  - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".

## Response `201`

Created

- BackendCluster — The Kafka cluster.
  - `id` string, uuid, required — The unique identifier of the backend cluster.
  - `name` string, required — The unique name of the backend cluster.
  - `description` string — A human-readable description of the backend cluster.
  - `authentication` union, required
    - BackendClusterAuthenticationAnonymous — Anonymous authentication scheme for the backend cluster.
      - `type` 'anonymous', required — The type of authentication scheme.
    - BackendClusterAuthenticationSaslPlainSensitiveDataAware — SASL/PLAIN authentication scheme for the backend cluster without requiring sensitive password data.
      - `type` 'sasl_plain', required
      - `username` string, required — A literal value or a reference to an existing secret as a template string expression. The value is stored and returned by the API as-is, not treated as sensitive information.
      - `password` string — A sensitive value containing the secret or a reference to a secret as a template string expression. If the value is provided as plain text, it is encrypted at rest and omitted from API responses. If provided as an expression, the expression itself is stored and returned by the API.
    - BackendClusterAuthenticationSaslScramSensitiveDataAware — SASL/SCRAM authentication scheme for the backend cluster without requiring sensitive password data.
      - `type` 'sasl_scram', required
      - `algorithm` 'sha256' | 'sha512', required — The algorithm used for SASL/SCRAM authentication.
      - `username` string, required — A literal value or a reference to an existing secret as a template string expression. The value is stored and returned by the API as-is, not treated as sensitive information.
      - `password` string — A sensitive value containing the secret or a reference to a secret as a template string expression. If the value is provided as plain text, it is encrypted at rest and omitted from API responses. If provided as an expression, the expression itself is stored and returned by the API.
  - `insecure_allow_anonymous_virtual_cluster_auth` boolean — If true, virtual clusters can have allow anonymous authentication and use this backend cluster. This setting is not recommended for production use as it may create privilege escalation vulnerabilities.
  - `bootstrap_servers` string[], required — A list of cluster bootstrap servers in the format address:port.
  - `tls` BackendClusterTLS, required
    - `enabled` boolean, required — If true, TLS is enabled for connections to this backend cluster. If false, TLS is explicitly disabled.
    - `insecure_skip_verify` boolean — If true, skip certificate verification. It's not secure to use for production.
    - `ca_bundle` string — A literal value or a reference to an existing secret as a template string expression. The value is stored and returned by the API as-is, not treated as sensitive information.
    - `tls_versions` string[] — List of supported TLS versions.
    - `client_identity` object — Client mTLS configuration. **Requires a minimum runtime version of `1.1`**.
      - `certificate` string, required — A literal value or a reference to an existing secret as a template string expression. The value is stored and returned by the API as-is, not treated as sensitive information.
      - `key` string, required — A sensitive value containing the secret or a reference to a secret as a template string expression. If the value is provided as plain text, it is encrypted at rest and omitted from API responses. If provided as an expression, the expression itself is stored and returned by the API.
  - `metadata_update_interval_seconds` integer — The interval at which metadata is updated in seconds.
  - `labels` Labels — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
  - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
  - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden

---

[API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/versions/f920f418f552/schema)