canonical: https://jentic.com/apis/api.aiven.io/aiven # Aiven API The Aiven API gives programmatic control over Aiven's managed open-source data platform, covering provisioning and operation of services such as PostgreSQL, Kafka, ClickHouse, OpenSearch, MySQL, Redis, Cassandra, Flink, and Grafana on AWS, GCP, Azure, DigitalOcean, and UpCloud. Endpoints span organizations, projects, services, integrations, billing, governance, and per-engine operations such as Kafka topics, ClickHouse queries, and PostgreSQL connection pools. Authentication is via a personal token (Authorization: aivenv1 token) or OAuth 2.0. Suited for platform teams that automate database provisioning, GitOps-driven infrastructure, and SRE-grade fleet management. ## For AI agents Provision and operate managed PostgreSQL, Kafka, ClickHouse, OpenSearch, and other open-source data services across major clouds via Aiven. ## Scope Does not handle bare-metal compute, generic VM provisioning, or non-Aiven workloads - use for Aiven-managed open-source data services, projects, and organizations only. ## Capabilities - Provision a managed service (PostgreSQL, Kafka, ClickHouse, OpenSearch, MySQL, Redis) inside a project - Configure service integrations between databases, monitoring, and external sinks via the Service Integrations endpoints - Manage Kafka topics, ACL entries, quotas, and schema registry through the Kafka-specific operations - Run ClickHouse queries and manage databases through the Service: ClickHouse endpoints - Manage organizations, projects, billing groups, payment methods, and invoices - Configure user access, groups, and authentication methods at the organization level - Trigger and monitor service maintenance, upgrades, and backup restorations ## Use cases ### Database provisioning automation Automate per-environment database provisioning by calling /project/{project}/service to create a PostgreSQL or Kafka service from a Terraform-style intent. The API returns the connection URI once the service reaches RUNNING state, which a CI pipeline can write into application secrets. Replaces clickops in the Aiven console for staging and ephemeral environments and gives platform teams a typed contract. Example prompt: POST to /project/myproj/service with service_type=pg, plan=startup-4, cloud=aws-eu-west-1, then poll until state=RUNNING and return service_uri. ### Kafka topic and ACL management Manage the full lifecycle of Kafka topics, ACL entries, and schema registry subjects without granting humans cluster admin. The Service: Kafka endpoints let an automation actor create topics with the right partition count, restrict producer/consumer ACLs to specific principals, and publish schemas to the registry. Underpins data-platform self-service portals. Example prompt: POST to /project/{project}/service/{service_name}/topic with topic_name, partitions=12, replication=3, then POST an ACL granting a service account write access. ### Cross-service observability wiring Stand up a logging and metrics pipeline by creating an Aiven OpenSearch and Grafana service, then using the Service Integrations endpoints to fan logs and metrics from every other service into them. A platform team can offer 'logs to OpenSearch' as a one-click feature for application teams without each team configuring their own sinks. Reduces observability drift across a fleet of services. Example prompt: POST to /project/{project}/integration with integration_type=logs, source_service=my-kafka, dest_service=my-opensearch. ### Agent integration via Jentic Give an SRE agent a typed surface over Aiven's 445 operations through Jentic. The agent can answer 'spin up a Postgres for staging' or 'add this consumer ACL on the prod Kafka cluster' in a single tool call, with the personal token kept inside your Jentic One instance. Avoids hand-rolling a thin client per workflow. Example prompt: Search Jentic for 'create Aiven PostgreSQL service', load the relevant /project/{project}/service POST operation, and execute it with the requested service_type and plan. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | /account | List Aiven accounts | | GET | /account/{account_id} | Retrieve a specific account | | GET | /account/{account_id}/payment_methods | List payment methods on an account | | GET | /account/{account_id}/billing-group | List billing groups on an account | | GET | /account/{account_id}/authentication | List authentication methods on an account | | GET | /account/{account_id}/events | List recent events on an account | ## Key resources - **Account and Organization** — Manage organizations, accounts, billing groups, and payment methods - **Project** — Group services together and manage VPCs, peering, and members - **Service** — Provision and manage managed services across all supported engines and clouds - **Service Integrations** — Wire services together for logs, metrics, replication, and external sinks - **Service: Kafka** — Topic, ACL, quota, schema registry, and connector management - **Service: ClickHouse** — Run queries and manage databases on managed ClickHouse - **User and Authentication Methods** — User access, groups, MFA, and SSO configuration ## Why Jentic - **Setup:** Wiring the Aiven API by hand means choosing between its personal-token and OAuth auth, targeting the v1 host, and finding the right routes among 445 project and organization endpoints yourself. Through Jentic you install once, import Aiven from the API Directory, store the token once, and your agent calls it. - **Permission scoping:** Aiven puts the account id in the URL path (/account/{account_id}/events, /account/{account_id}/billing-group), so a rule can pin your agent to one account: it can read that account's events and settings and nothing else. You choose the operations it may call, so writes such as payment-method changes are only included if you add them. - **Credential handling:** Your Aiven personal token or OAuth token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'create an Aiven PostgreSQL service', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **DigitalOcean API** — Cloud platform with its own managed databases and droplets as an alternative DBaaS - **Linode (Akamai) API** — Cloud compute and managed database alternative for simpler workloads - **Scaleway API** — Underlying European cloud platform that can host applications connecting to Aiven services ## FAQ ### What authentication does the Aiven API use? The Aiven API supports a personal token (Authorization: aivenv1 {token}) and OAuth 2.0. Tokens are created from the Aiven console and scoped to a user; service tokens can be created for automation. When called through Jentic, the token is held in your Jentic One instance and injected on each request. ### Can I provision a managed PostgreSQL or Kafka cluster through the Aiven API? Yes. POST /project/{project}/service with service_type set to pg, kafka, clickhouse, opensearch, mysql, redis, or another supported engine, plus plan and cloud. The service moves through REBUILDING > RUNNING; the response includes the service_uri once it is ready to accept connections. ### How do I manage Kafka topics and ACLs? The Service: Kafka endpoints expose topic creation, partition and retention configuration, ACL entries, quotas, and schema registry operations under /project/{project}/service/{service_name}/topic and /acl paths. They are the programmatic equivalent of the Kafka tab in the Aiven console. ### What are the rate limits for the Aiven API? Aiven applies per-token rate limits in the low hundreds of requests per minute, with separate ceilings for read and write paths. 429 responses include a Retry-After header; agents should back off and retry. Heavy bulk operations should use service-specific batch endpoints where available. ### How do I provision an Aiven service through Jentic? Search Jentic for 'create Aiven PostgreSQL service', load the POST /project/{project}/service operation, and execute it with project, service_type, plan, and cloud. Then poll GET /project/{project}/service/{service_name} until state=RUNNING to retrieve the service_uri. ### Does the Aiven API support service maintenance and upgrades? Yes. Service-level endpoints expose maintenance windows, allow triggering immediate upgrades, and surface upgrade pipeline state for blue/green-style migrations between major versions. Use these endpoints to script controlled major-version upgrades across a fleet of services. ### Can I limit what my agent is allowed to do with the Aiven API? Yes. Because you run Jentic One yourself, your own rules decide which Aiven operations and which stored token the agent may use. Aiven puts the account id in the URL path, so you can pin the agent to a single account and let it read that account's events, billing groups, and authentication methods under /account/{account_id} while it can touch nothing else. Sensitive writes such as changing payment methods are only reachable if you explicitly add those operations to the agent's allowed set.