[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for Apache Kafka®](../index.md) > [Concepts](index.md) > APIs in Managed Service for Apache Kafka®

# APIs in Managed Service for Apache Kafka®

A cluster features multiple API types for different operations.

## Cloud APIs {#cloud-api}

Provided by Yandex Cloud, these APIs include the REST API and gRPC API. You can use any of these APIs to manage the following objects:

* [Managed Service for Apache Kafka® clusters](../operations/index.md#clusters) and [cluster logs](../operations/cluster-logs.md).
* Some Apache Kafka® entities: [topics](../operations/cluster-topics.md), [accounts](../operations/cluster-accounts.md), and [connectors](../operations/cluster-connector.md).

### Usage {#cloud-api-usage}

You do not need to take any preliminary steps to access these APIs as they are always available. To use these APIs, you need to [authenticate](../api-ref/authentication.md) when sending API requests.

The scope of available operations depends on the [roles of the account](../security/index.md) used to send API requests.

For descriptions of the [REST API methods](../api-ref/index.md) and [gRPC API calls](../api-ref/grpc/index.md), see the API reference. For examples of queries, se these [step-by-step guides](../operations/index.md).

### Limitations {#cloud-api-limits}

You can use these APIs to manage only some of Apache Kafka® entities. For advanced Apache Kafka® entity management, use the [Managed Service for Apache Kafka® REST API](#managed-kafka-api) or [Client API](#client-api).

## Managed Service for Apache Kafka® REST API {#managed-kafka-api}

Provided by Yandex Cloud, these REST APIs include the following:

* REST API for Managed Schema Registry compatible with Confluent Schema Registry API version 6.1 (with [some limitations](#managed-kafka-api-limits)).

    You can use this API to work with the [managed schema registry](managed-schema-registry.md).

* REST API for Apache Kafka® compatible with Confluent REST Proxy API version 6.1 (with [some limitations](#managed-kafka-api-limits)).

    This API enables you to manage producers and consumers using format schemas from the registry as well as view information about brokers, topics, and partitions.

Managed Service for Apache Kafka® clusters use [Karapace](https://www.karapace.io/), an open-source tool which provides access to these REST APIs as well as the basis for the managed schema registry.

### Usage {#managed-kafka-api-usage}

To use any one of these APIs:

1. Get access to the API.

    By default, Managed Schema Registry and both of the REST APIs are disabled and not available. To use them, specify the relevant settings when [creating](../operations/cluster-create.md) or [updating](../operations/cluster-update.md) a cluster:

    * **Schema registry**. Managed Schema Registry and the respective REST API will become available in the cluster.
    * **Kafka Rest API**. The REST API for Apache Kafka® will become available in the cluster.

    While both of the REST APIs are provided by Karapace, you can access them independently of each other, e.g., only use Managed Schema Registry and its REST API, only use the Apache Kafka® REST API, or all of them at once.

1. [Complete all the steps to pre-configure a connection to the cluster](../operations/connect/index.md).

1. Authenticate when sending API requests.

    The APIs use the [HTTP Basic Authentication]https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#basic_authentication_scheme scheme, where each request must contain an [Authorization](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization) HTTP header with credentials for the [Apache Kafka® user](../operations/cluster-accounts.md) sending the request.

The scope of available operations depends on the roles assigned to the [Apache Kafka® user](../operations/cluster-accounts.md) sending API requests.

* REST API for Managed Schema Registry:

    * `ACCESS_ROLE_SCHEMA_READER` role: User can perform read operations with [subjects](managed-schema-registry.md#subjects) the role was assigned for.
    * `ACCESS_ROLE_SCHEMA_WRITER` role: User can perform read and write operations with subjects the role was assigned for.
    * `ACCESS_ROLE_CONSUMER` role: User can perform read operations with subjects associated with the topic the role was assigned for.
    * `ACCESS_ROLE_PRODUCER` role: User can perform any operations with subjects associated with the topic the role was assigned for.
    * `ACCESS_ROLE_ADMIN` role: User can perform any operations with subjects associated with any topic (this role applies to all topics).
    * `ACCESS_ROLE_TOPIC_ADMIN` role: User can perform any operations with subjects associated with the topic the role was assigned for.

    Also, a user’s role determines which subjects this user can manage. Learn more about the Managed Schema Registry role model [here](managed-schema-registry.md).

* REST API for Apache Kafka®:

    * `ACCESS_ROLE_CONSUMER` role: User can get information about Apache Kafka® objects and work with consumers.
    * `ACCESS_ROLE_TOPIC_ADMIN`, `ACCESS_ROLE_PRODUCER`, or `ACCESS_ROLE_ADMIN` role: User can perform the full range of operations with Apache Kafka® objects.

For descriptions of the [REST API methods for Managed Schema Registry](https://docs.confluent.io/platform/6.1/schema-registry/develop/api.html) and [REST API methods for Apache Kafka®](https://docs.confluent.io/platform/6.1/kafka-rest/api.html), see the Confluent documentation. For examples of working with these APIs, see [Working with the managed schema registry via the REST API](../tutorials/managed-schema-registry-rest.md).

### Limitations {#managed-kafka-api-limits}

* REST API for Managed Schema Registry:

    The following limitations apply to [registry operation mode management methods](https://docs.confluent.io/platform/6.1/schema-registry/develop/api.html#mode):

    * To view information on registry operation modes, the user must have the `ACCESS_ROLE_ADMIN` permissions.
    * You cannot change the registry operation mode.

* REST API for Apache Kafka®:

    * You cannot manage clusters or other Apache Kafka® objects except producers and consumers.
    * Only the [Confluent REST Proxy API](https://docs.confluent.io/platform/6.1/kafka-rest/api.html) [v2](https://docs.confluent.io/platform/6.1/kafka-rest/api.html#crest-api-v2) methods are available.

## Apache Kafka® client APIs {#client-api}

Client APIs is an umbrella name for the following native Apache Kafka® APIs:

* [Producer API](https://kafka.apache.org/42/apis/#producer-api): For operations with producers.
* [Consumer API](https://kafka.apache.org/42/apis/#consumer-api): For operations with consumers.
* [Streams API](https://kafka.apache.org/42/apis/#streams-api): For operations with data streams.
* [Connect API](https://kafka.apache.org/42/apis/#connect-api): For operations with connectors.
* [Admin API](https://kafka.apache.org/42/apis/#admin-api): For operations with Apache Kafka® objects.

You can use these APIs to manage Apache Kafka® objects (with [some limitations](#client-api-limits)).

### Usage {#client-api-usage}

To use any one of these APIs:

1. [Pre-configure your connection to the cluster](../operations/connect/index.md).

1. Embed the API into your [Apache Kafka® client application](../operations/connect/code-examples.md) code.

    To use the client APIs, you need to invoke the relevant functions from the code of your client apps, as these are not REST APIs.

1. To access the APIs, set up the appropriate authentication method in your client app code. Authentication requires the [Apache Kafka® user](../operations/cluster-accounts.md) credentials.

    For the descriptions of authentication methods, see the [Confluent documentation for client applications](https://docs.confluent.io/kafka-client/overview.html). For configuration examples, see [Code examples for connecting to an Apache Kafka® cluster](../operations/connect/code-examples.md).

The scope of available operations depends on the roles assigned to the [Apache Kafka® user](../operations/cluster-accounts.md) sending requests to the client APIs.

For descriptions of the client APIs, see the [Apache Kafka® documentation](https://kafka.apache.org/42/apis/) For examples of working with the Producer API and Consumer API, see [Working with the managed schema registry](../tutorials/managed-schema-registry.md).

### Limitations {#client-api-limits}

* You cannot manage Apache Kafka® clusters or accounts.
* You can manage topics via the Admin API with the following limitations:

    * Topics are managed by:
       * Admin user with the `ACCESS_ROLE_ADMIN` role for all cluster topics. If there is no such user in the cluster, [create](../operations/cluster-accounts.md) one.
       * User with the `ACCESS_ROLE_TOPIC_ADMIN` role for specific topics.
    
       Learn more about the permissions you get with each role [here](account-roles.md).
    
    * You need to configure user access permissions for [producers and consumers](producers-consumers.md) using native Yandex Cloud interfaces rather than the Apache Kafka® Admin API.


## Use cases {#examples}

* [Working with the managed schema registry via the REST API](../tutorials/managed-schema-registry-rest.md)