Streaming Hub in the Lerian platform
The platform’s event backbone is a shared, CloudEvents-based stream carried on Kafka/Redpanda. Delivery on that stream is at-least-once, and every tenant’s events ride the same topics. To consume it directly, you must run your own Kafka consumer. That consumer tracks offsets, filters event types, deduplicates, retries failed deliveries, and signs outbound requests. Streaming Hub does that work once, as a managed edge. It consumes the internal stream and never produces onto it. It turns a raw event feed into per-destination delivery you configure through a single API. You register a subscription, the hub tracks the stream, and matched events arrive at your endpoint already signed and correlated. Because the hub is the delivery edge, the guarantees you build against are the hub’s delivery contract, not the raw stream. Your webhook endpoint verifies a signature, deduplicates on a stable event id, and returns quickly. See How Streaming Hub works for the full path an event takes.
Sink kinds
A subscription delivers to exactly one destination, called a sink. Streaming Hub supports five sink kinds:
Push sinks (
webhook, sqs, rabbitmq, eventbridge) deliver events to you as they match. The pull sink inverts that: the hub holds events on a cursor and your consumer fetches them on its own schedule.
A webhook subscription becomes deliverable after one signed probe confirms your endpoint answers. RabbitMQ subscriptions require a broker credential that the hub probes before activation. SQS and EventBridge can activate with an outbound credential that the hub probes, or with a delegated AWS grant that stores no credential. See Managing subscriptions.
Deployment model
Streaming Hub runs BYOC by default: you deploy it into your own infrastructure as a single-tenant service, with one configured control-plane tenant and no dependency on Lerian-hosted tenant management. On Lerian Cloud, subscriptions, events, and cursors stay isolated by tenant. See Operating Streaming Hub for the deployment details.
The control-plane API
You manage subscriptions through the
/v1 control-plane API. Every route requires an Access Manager token (Authorization: Bearer <token>). The hub never takes the tenant from a request body, path, or query. Through it you:
- create, list, read, and delete subscriptions.
- verify a destination (
ping/verify) and supply queue credentials. - rotate a webhook signing secret.
- read a subscription’s delivery health.
- read the operational dashboard of your subscriptions.
- pull events (
GET /v1/events) forpullsinks. - browse the event catalog the hub sees.
Next steps
How Streaming Hub works
The path an event takes: ingest, match, dispatch, retry, and auto-disable.
Managing subscriptions
Create webhook and queue subscriptions, wire AWS grants, and rotate secrets.
Consuming events
Verify webhook signatures, deduplicate deliveries, and pull events.
Event streaming overview
The shared CloudEvents contract every Lerian event follows.

