{"openapi":"3.1.0","info":{"title":"Confluent Cloud Admin (BYOK) API","version":"0.1.0","description":"Confluent Cloud Admin (BYOK) lets an AI assistant read your own Confluent Cloud Admin data through the Confluent Cloud Admin API with a key you supply (Cloud API key ID). Read-only: 10 tools (list_costs, list_applied_quotas, list_quota_scopes, list_role_bindings, list_api_keys, list_identity_providers, list_identity_pools, list_sso_group_mappings, list_ip_groups, list_ip_filters). The BYOK key...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-confluent-cloud-admin.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-confluent-cloud-admin/docs"},"termsOfService":"https://connectorbay.com/byok-confluent-cloud-admin/terms"},"servers":[{"url":"https://byok-confluent-cloud-admin.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-confluent-cloud-admin/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_costs":{"post":{"operationId":"list_costs","summary":"List Confluent Cloud billing line items between two dates with product, line type, unit, quantity, price, discount, amou","description":"List Confluent Cloud billing line items between two dates with product, line type, unit, quantity, price, discount, amount and the resource (cluster, environment) each belongs to. Use for \"How much did Confluent Cloud cost us between 2026-10-01 and 2026-10-15\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"start_date":{"description":"First day to include, YYYY-MM-DD.","maxLength":10,"title":"Start Date","type":"string"},"end_date":{"description":"Last day to include, YYYY-MM-DD.","maxLength":10,"title":"End Date","type":"string"},"page_size":{"anyOf":[{"maximum":500,"minimum":1,"type":"integer"},{"type":"null"}],"default":100,"description":"How many line items to return (1 to 500).","title":"Page Size"},"page_token":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque token from metadata.next of the previous answer, to get the next page.","title":"Page Token"}},"required":["start_date","end_date"],"title":"list_costsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_applied_quotas":{"post":{"operationId":"list_applied_quotas","summary":"List applied service quotas for one scope (organization, environment, network, Kafka cluster or user) with default limit","description":"List applied service quotas for one scope (organization, environment, network, Kafka cluster or user) with default limit, applied limit and current usage. Use for \"How close is my Confluent Cloud environment env-abc123 to its quotas\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"scope":{"description":"Quota scope.","enum":["ORGANIZATION","ENVIRONMENT","NETWORK","KAFKA_CLUSTER","USER"],"title":"Scope","type":"string"},"environment":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Only quotas of this environment id.","title":"Environment"},"network":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Only quotas of this network id.","title":"Network"},"kafka_cluster":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Only quotas of this Kafka cluster id.","title":"Kafka Cluster"},"quota_id":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Only this quota code.","title":"Quota Id"},"page_size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":10,"description":"How many results to return (1 to 100, default 10).","title":"Page Size"},"page_token":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque token from metadata.next of the previous answer, to get the next page.","title":"Page Token"}},"required":["scope"],"title":"list_applied_quotasArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_quota_scopes":{"post":{"operationId":"list_quota_scopes","summary":"List the scopes service quotas can be applied to, with descriptions. Use for \"Which quota scopes does Confluent Cloud ha","description":"List the scopes service quotas can be applied to, with descriptions. Use for \"Which quota scopes does Confluent Cloud have\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"page_size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":10,"description":"How many results to return (1 to 100, default 10).","title":"Page Size"},"page_token":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque token from metadata.next of the previous answer, to get the next page.","title":"Page Token"}},"title":"list_quota_scopesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_role_bindings":{"post":{"operationId":"list_role_bindings","summary":"List RBAC role bindings that match a CRN pattern, optionally for one principal or role, with principal, role name and re","description":"List RBAC role bindings that match a CRN pattern, optionally for one principal or role, with principal, role name and resource pattern. Use for \"Who has the CloudClusterAdmin role in my Confluent Cloud organization\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"crn_pattern":{"description":"Partial CRN of the resource, for example the organization CRN 'crn://confluent.cloud/organization=<org-id>'.","maxLength":300,"title":"Crn Pattern","type":"string"},"principal":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only bindings of this principal, for example 'User:u-abc123' or 'User:sa-abc123'.","title":"Principal"},"role_name":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Only bindings of this role, for example OrganizationAdmin.","title":"Role Name"},"page_size":{"anyOf":[{"maximum":1000,"minimum":1,"type":"integer"},{"type":"null"}],"default":100,"description":"How many results to return (1 to 1000).","title":"Page Size"},"page_token":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque token from metadata.next of the previous answer, to get the next page.","title":"Page Token"}},"required":["crn_pattern"],"title":"list_role_bindingsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_api_keys":{"post":{"operationId":"list_api_keys","summary":"List API keys of the organization with name, description, owner and the resource they are scoped to. Key secrets are nev","description":"List API keys of the organization with name, description, owner and the resource they are scoped to. Key secrets are never returned. Use for \"Which API keys exist for Confluent Cloud cluster lkc-abc12\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"owner":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Only keys owned by this user or service account id.","title":"Owner"},"resource":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Only keys scoped to this resource id, for example a cluster id.","title":"Resource"},"page_size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":10,"description":"How many results to return (1 to 100, default 10).","title":"Page Size"},"page_token":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque token from metadata.next of the previous answer, to get the next page.","title":"Page Token"}},"title":"list_api_keysArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_identity_providers":{"post":{"operationId":"list_identity_providers","summary":"List OAuth identity providers with name, description, identity claim, issuer, state and JWKS URI. Signing keys are not r","description":"List OAuth identity providers with name, description, identity claim, issuer, state and JWKS URI. Signing keys are not requested. Use for \"Which identity providers does Confluent Cloud trust\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"page_size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":10,"description":"How many results to return (1 to 100, default 10).","title":"Page Size"},"page_token":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque token from metadata.next of the previous answer, to get the next page.","title":"Page Token"}},"title":"list_identity_providersArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_identity_pools":{"post":{"operationId":"list_identity_pools","summary":"List the identity pools of one identity provider with name, claim, filter, mapped principal and state. Use for \"Which id","description":"List the identity pools of one identity provider with name, claim, filter, mapped principal and state. Use for \"Which identity pools does identity provider op-abc123 have\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"provider_id":{"description":"Identity provider id, for example 'op-abc123'.","maxLength":200,"title":"Provider Id","type":"string"},"page_size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":10,"description":"How many results to return (1 to 100, default 10).","title":"Page Size"},"page_token":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque token from metadata.next of the previous answer, to get the next page.","title":"Page Token"}},"required":["provider_id"],"title":"list_identity_poolsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_sso_group_mappings":{"post":{"operationId":"list_sso_group_mappings","summary":"List SSO group mappings (identity provider groups mapped to Confluent principals) with name, filter, principal and state","description":"List SSO group mappings (identity provider groups mapped to Confluent principals) with name, filter, principal and state. Use for \"Which SSO group mappings are configured in Confluent Cloud\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"page_size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":10,"description":"How many results to return (1 to 100, default 10).","title":"Page Size"},"page_token":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque token from metadata.next of the previous answer, to get the next page.","title":"Page Token"}},"title":"list_sso_group_mappingsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_ip_groups":{"post":{"operationId":"list_ip_groups","summary":"List IP groups (named sets of CIDR blocks used by IP filters). Use for \"Which IP groups are defined in Confluent Cloud\".","description":"List IP groups (named sets of CIDR blocks used by IP filters). Use for \"Which IP groups are defined in Confluent Cloud\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"page_size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results to return (1 to 100, default 25).","title":"Page Size"},"page_token":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque token from metadata.next of the previous answer, to get the next page.","title":"Page Token"}},"title":"list_ip_groupsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_ip_filters":{"post":{"operationId":"list_ip_filters","summary":"List IP filters (which IP groups may use which operation groups on a resource scope) with name, resource group, scope an","description":"List IP filters (which IP groups may use which operation groups on a resource scope) with name, resource group, scope and linked IP groups. Use for \"Which IP filters restrict access to my Confluent Cloud organization\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"resource_scope":{"anyOf":[{"maxLength":300,"type":"string"},{"type":"null"}],"default":null,"description":"Only filters of this resource scope, for example an organization CRN.","title":"Resource Scope"},"include_parent_scopes":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":false,"description":"True to include filters defined at the organization level; needs resource_scope.","title":"Include Parent Scopes"},"page_size":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results to return (1 to 100, default 25).","title":"Page Size"},"page_token":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Opaque token from metadata.next of the previous answer, to get the next page.","title":"Page Token"}},"title":"list_ip_filtersArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}