Version ranges are intersected with the upstream broker’s advertised
capabilities at connection time. APIs not listed here are rejected by the proxy.
Data plane
| API | Versions |
|---|
| Produce | v3–v12 |
| Fetch | v4–v18 |
| ListOffsets | v1–v9 |
| OffsetForLeaderEpoch | v3–v4 |
| API | Versions |
|---|
| Metadata | v0–v13 |
| DescribeCluster | v0–v2 |
| DescribeTopicPartitions | v0 |
| ListConfigResources | v1 |
| FindCoordinator | v0–v6 |
Consumer groups
| API | Versions |
|---|
| OffsetCommit | v2–v9 |
| OffsetFetch | v1–v9 |
| JoinGroup | v0–v9 |
| SyncGroup | v0–v5 |
| Heartbeat | v0–v4 |
| LeaveGroup | v0–v5 |
| ListGroups | v0–v5 |
| DeleteGroups | v0–v2 |
| DescribeGroups | v0–v6 |
| ConsumerGroupHeartbeat | v0–v1 |
| ConsumerGroupDescribe | v0–v1 |
| OffsetDelete | v0 |
Transactions
| API | Versions |
|---|
| InitProducerId | v0–v5 |
| AddPartitionsToTxn | v0–v5 |
| AddOffsetsToTxn | v0–v4 |
| EndTxn | v0–v5 |
| TxnOffsetCommit | v0–v5 |
| DescribeProducers | v0 |
| ListTransactions | v0–v1 |
| DescribeTransactions | v0 |
Topic and configuration admin
| API | Versions |
|---|
| CreateTopics | v2–v7 |
| DeleteTopics | v1–v6 |
| CreatePartitions | v0–v3 |
| DeleteRecords | v0–v2 |
| DescribeConfigs | v1–v4 |
| AlterConfigs | v0–v2 |
| IncrementalAlterConfigs | v0–v1 |
ACL admin (opt-in)
Available only when acl_admin.mode: broker-delegated is set in configuration.
Without it, the proxy does not advertise these APIs and rejects requests that
invoke them.
| API | Versions |
|---|
| DescribeAcls | v1–v3 |
| CreateAcls | v1–v3 |
| DeleteAcls | v1–v3 |
Quotas and credentials
| API | Versions |
|---|
| DescribeClientQuotas | v0–v1 |
| AlterClientQuotas | v0–v1 |
| DescribeUserScramCredentials | v0 |
| AlterUserScramCredentials | v0 |
Cluster topology (cross-cutting)
| API | Versions |
|---|
| AlterPartitionReassignments | v0–v1 |
| ListPartitionReassignments | v0 |
| ElectLeaders | v0–v2 |
| AlterReplicaLogDirs | v1–v2 (stubbed) |
| DescribeLogDirs | v1–v4 (stubbed) |
Authentication and negotiation
| API | Versions |
|---|
| ApiVersions | v0–v4 |
| SaslHandshake | v0–v1 |
| SaslAuthenticate | v0–v2 |
Stubbed APIs
AlterReplicaLogDirs and DescribeLogDirs are answered locally and never
forwarded to the broker. A genuine response from the broker would expose
physical topic names under the __vt_{tenant}_* prefix and broker filesystem
paths, both of which would leak cross-tenant state. Disk relocations also have
no tenant semantics.
DescribeLogDirs returns an empty results: [] response and sets
CLUSTER_AUTHORIZATION_FAILED in protocol versions that carry a top-level
error code.AlterReplicaLogDirs echoes the requested topic-partitions with per-partition
CLUSTER_AUTHORIZATION_FAILED.
Tenants that rely on JBOD disk inspection or disk management will therefore
see those calls fail rather than observe physical broker topology.
ListConfigResources scope
ListConfigResources is v1-only. Klamm filters and rewrites topic and group
resources to the tenant namespace, keeps broker and broker-logger resources,
and drops client-metrics resources until client telemetry / config-resource
namespacing is designed.