Skip to main content
C1.ai provides identity governance and just-in-time provisioning for Confluent Cloud. Integrate your Confluent Cloud organization with C1.ai to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

​
Capabilities

The connector reads one Confluent Cloud organization, the organization the API key belongs to. It syncs that organization’s users, service accounts, environments, and Kafka clusters, along with the RBAC role bindings that grant those identities access at the organization, environment, and cluster scopes. The connector grants and revokes RBAC role bindings for a user across those scopes. Provisioning principals are users only.

​
Limitations

Individual Kafka topics are not synced. Per-topic access requires the per-cluster Kafka REST API, which this connector does not use. Cluster-wide topic roles that apply across all topics in a cluster are still synced. Cluster-scoped and all-topics role bindings only apply when the organization already has a Kafka cluster.
  • Role bindings apply only at the scope they name. A binding at the organization or environment scope appears on that resource alone. Confluent also grants cluster access to the OrganizationAdmin and EnvironmentAdmin roles, so review those organization- and environment-scope grants alongside a cluster’s own when you assess who can reach a cluster.
  • Only user and service account principals are synced. The connector reads role bindings whose principal is a user or a service account. A binding held by any other principal, including an SSO group mapping or an identity pool, does not appear in C1.ai — so access held through SSO group membership or a workload identity is not visible here.
  • API keys are not synced. Confluent API keys, including those owned by service accounts, are outside the connector’s resource model.
  • Confluent Cloud only. The connector reads the Confluent Cloud control-plane API. Self-managed Confluent Platform uses a different API and is not supported.
  • API key authentication only. The connector authenticates with a Cloud API key. OAuth through Confluent STS is not supported.
  • No last-login data. Confluent’s user API does not expose a last-login timestamp, so C1.ai cannot report dormant Confluent accounts.
  • No account creation. The connector does not create users, service accounts, or organization invitations.

​
Prerequisites

You need a Confluent Cloud Cloud API key (an organization-scoped key) whose service account holds the OrganizationAdmin role. That role grants the full read access and role-binding writes the connector needs across the organization.

​
Gather Confluent Cloud credentials

1
Sign in to the Confluent Cloud console as an administrator.
2
Confirm the account you will use holds the OrganizationAdmin role at the organization level.
3
Open Settings > API keys and add a new Cloud API key with organization (global) scope.
4
Copy and save both the key ID and the secret. The secret is shown only once at creation time.

​
Configure the Confluent Cloud connector

Follow these instructions to use a built-in, no-code connector hosted by C1.ai.
1
In C1.ai, navigate to Apps > Connectors and click Add connector.
2
Search for Confluent Cloud and click Add.
3
Choose how to set up the new Confluent Cloud connector.
4
Set the owner for this connector.
5
Click Next.
6
Find the Settings area of the page and click Edit.
7
Enter the Confluent Cloud credentials:
  • Confluent Cloud API key ID: the key ID you created.
  • Confluent Cloud API secret: the secret paired with the key ID.
  • Confluent Cloud API base URL (optional): the control-plane API root, with no trailing slash. Defaults to https://api.confluent.cloud; leave it unless a test harness targets another host.
8
Click Save.
9
The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.
Done. Your Confluent Cloud connector is now pulling access data into C1.ai.