Should i have a dedicated (internal) api endpoint for producing kafka events?

Question

Is this more recommended than having the Kafka producer events done directly by whoever needs to emit it?

Answer 1

I assume by "API", you mean HTTP.

Depends on how easily you can configure Kafka or HTTP Authz & Authn. But if anyone exposes your HTTP endpoints / credentials, you'll end up with a bunch of questionable data in the topic.

With an HTTP interface, you can at least consolidate input validation. But you could also do the same with a TCP proxy, or gRPC endpoint. So, it solves the case where no one should be able to send random binary nonsense into your topics with a direct producer api call, if your producer credentials were to get leaked.

If you need simple HTTP passthough, that can be provided by Confluent REST Proxy, for example, but you still should setup an API gateway + auth / firewall to restrict access to it.