> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/6/configure/environment-variables-properties-reference/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Platform properties and environment variables reference

> Complete reference for configuring Platform with properties or environment variables

Platform 6 configuration supports both platform properties and environment variables in a 1:1 mapping. Each platform property has a corresponding environment variable with the `ITENTIAL_` prefix.

## Property naming convention

Platform properties use lowercase with underscores, while environment variables use uppercase with the `ITENTIAL_` prefix:

* Platform property: `mongo_url`
* Environment variable: `ITENTIAL_MONGO_URL`

## Property reference

This section organizes all properties by functional area. In each table, the **Property Name** column shows the Platform property in lowercase followed by its corresponding environment variable in uppercase with the `ITENTIAL_` prefix. For example, `admin_auth_pages_enabled` is a platform property, and the corresponding environment variable is `ITENTIAL_ADMIN_AUTH_PAGES_ENABLED`.

### Administrative features

Configure Admin Essentials features.

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `admin_auth_pages_enabled`

        \


        `ITENTIAL_ADMIN_AUTH_PAGES_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        Disables the authorization pages in Admin Essentials
      </td>
    </tr>

    <tr>
      <td>
        `admin_status_page_enabled`

        \


        `ITENTIAL_ADMIN_STATUS_PAGE_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        Disables the status page in Admin Essentials
      </td>
    </tr>
  </tbody>
</table>

### Authentication configuration

Configure user authentication and session management.

#### Authorization

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `auth_admin_groups`

        \


        `ITENTIAL_AUTH_ADMIN_GROUPS`
      </td>

      <td>
        json
      </td>

      <td>
        Members of these groups will be implicitly assigned with admin permissions
      </td>
    </tr>

    <tr>
      <td>
        `auth_broker_principal_enabled`

        \


        `ITENTIAL_AUTH_BROKER_PRINCIPAL_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        Enables a AAA adapter to custom build the principal object for a user with a "buildPrincipal" method
      </td>
    </tr>
  </tbody>
</table>

#### Default user

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `default_user_enabled`

        \


        `ITENTIAL_DEFAULT_USER_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        Enables a default user to be used for login when SSO is not configured and no AAA Adapter exists
      </td>
    </tr>

    <tr>
      <td>
        `default_user_password`

        \


        `ITENTIAL_DEFAULT_USER_PASSWORD`
      </td>

      <td>
        string
      </td>

      <td>
        The password of the default user
      </td>
    </tr>

    <tr>
      <td>
        `default_user_username`

        \


        `ITENTIAL_DEFAULT_USER_USERNAME`
      </td>

      <td>
        string
      </td>

      <td>
        The username of the default user
      </td>
    </tr>
  </tbody>
</table>

#### Session settings

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `auth_principal_ttl`

        \


        `ITENTIAL_AUTH_PRINCIPAL_TTL`
      </td>

      <td>
        integer
      </td>

      <td>
        The time in minutes before a user principal expires. If not supplied, falls back to the auth_session_ttl value
      </td>
    </tr>

    <tr>
      <td>
        `auth_relay_state_ttl`

        \


        `ITENTIAL_AUTH_RELAY_STATE_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        The time in seconds before the RelayState from sso expires
      </td>
    </tr>

    <tr>
      <td>
        `auth_session_cookie_name`

        \


        `ITENTIAL_AUTH_SESSION_COOKIE_NAME`
      </td>

      <td>
        string
      </td>

      <td>
        The name of the cookie used for a user session
      </td>
    </tr>

    <tr>
      <td>
        `auth_session_ttl`

        \


        `ITENTIAL_AUTH_SESSION_TTL`
      </td>

      <td>
        integer
      </td>

      <td>
        The time in minutes before a user principal expires. If not supplied, falls back to the auth_session_ttl value
      </td>
    </tr>

    <tr>
      <td>
        `auth_session_ttl`

        \


        `ITENTIAL_AUTH_SESSION_TTL`
      </td>

      <td>
        integer
      </td>

      <td>
        The time in minutes before a user session expires
      </td>
    </tr>

    <tr>
      <td>
        `auth_unique_sessions_enabled`

        \


        `ITENTIAL_AUTH_UNIQUE_SESSIONS_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, logs out existing sessions for a user when they log in with a new session
      </td>
    </tr>
  </tbody>
</table>

### Cache configuration

Configure Redis connection and behavior.

#### Connection management

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `redis_command_timeout`

        \


        `ITENTIAL_REDIS_COMMAND_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        The maximum time in milliseconds to wait for a Redis command to complete before timing out. Critical for detecting hung connections during network partitions — without this, commands may hang indefinitely. Defaults to 5000ms
      </td>
    </tr>

    <tr>
      <td>
        `redis_connect_timeout`

        \


        `ITENTIAL_REDIS_CONNECT_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        The maximum time in milliseconds to wait for initial Redis connection before timing out. If not set, defaults to 30000ms (30 seconds)
      </td>
    </tr>

    <tr>
      <td>
        `redis_keep_alive`

        \


        `ITENTIAL_REDIS_KEEP_ALIVE`
      </td>

      <td>
        integer
      </td>

      <td>
        Enables TCP keepalive on the Redis socket, prompting the OS to detect dead connections at the network level. Value is the keepalive delay in milliseconds. Defaults to 5000ms
      </td>
    </tr>

    <tr>
      <td>
        `redis_max_heartbeat_write_retries`

        \


        `ITENTIAL_REDIS_MAX_HEARTBEAT_WRITE_RETRIES`
      </td>

      <td>
        integer
      </td>

      <td>
        The maximum number of times to retry writing a heartbeat message to Redis from a service
      </td>
    </tr>

    <tr>
      <td>
        `redis_max_retries_per_request`

        \


        `ITENTIAL_REDIS_MAX_RETRIES_PER_REQUEST`
      </td>

      <td>
        integer
      </td>

      <td>
        The maximum number of times to retry a request to Redis when the connection is lost
      </td>
    </tr>

    <tr>
      <td>
        `redis_persist_queues`

        \


        `ITENTIAL_REDIS_PERSIST_QUEUES`
      </td>

      <td>
        csv
      </td>

      <td>
        The platform will match Bull queue names included to persist in Redis on restarts
      </td>
    </tr>
  </tbody>
</table>

#### Connection settings

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `redis_db`

        \


        `ITENTIAL_REDIS_DB`
      </td>

      <td>
        integer
      </td>

      <td>
        The Redis keyspace (database number) to use for the connection
      </td>
    </tr>

    <tr>
      <td>
        `redis_host`

        \


        `ITENTIAL_REDIS_HOST`
      </td>

      <td>
        string
      </td>

      <td>
        The hostname of the Redis server. Not used when connecting to Redis Sentinels
      </td>
    </tr>

    <tr>
      <td>
        `redis_password`

        \


        `ITENTIAL_REDIS_PASSWORD`
      </td>

      <td>
        string
      </td>

      <td>
        The password to use when connecting to Redis
      </td>
    </tr>

    <tr>
      <td>
        `redis_port`

        \


        `ITENTIAL_REDIS_PORT`
      </td>

      <td>
        integer
      </td>

      <td>
        The port to use when connecting to this Redis instance
      </td>
    </tr>

    <tr>
      <td>
        `redis_username`

        \


        `ITENTIAL_REDIS_USERNAME`
      </td>

      <td>
        string
      </td>

      <td>
        The username to use when connecting to Redis
      </td>
    </tr>
  </tbody>
</table>

#### Sentinel configuration

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `redis_name`

        \


        `ITENTIAL_REDIS_NAME`
      </td>

      <td>
        string
      </td>

      <td>
        The Redis primary name. This only has meaning when Redis is running with replication enabled. The sentinels will monitor this node and consider it down only when the sentinels agree. Note: The primary name should not include special characters other than: .-_ and no whitespaces
      </td>
    </tr>

    <tr>
      <td>
        `redis_sentinel_command_timeout`

        \


        `ITENTIAL_REDIS_SENTINEL_COMMAND_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        The maximum time in milliseconds to wait for a Redis Sentinel command to complete. Prevents the Sentinel discovery process from hanging indefinitely if Sentinel nodes are unreachable. Only applies when connecting via Redis Sentinel. Defaults to 3000ms
      </td>
    </tr>

    <tr>
      <td>
        `redis_sentinel_password`

        \


        `ITENTIAL_REDIS_SENTINEL_PASSWORD`
      </td>

      <td>
        string
      </td>

      <td>
        The password to use when authenticating with a Redis Sentinel cluster
      </td>
    </tr>

    <tr>
      <td>
        `redis_sentinel_username`

        \


        `ITENTIAL_REDIS_SENTINEL_USERNAME`
      </td>

      <td>
        string
      </td>

      <td>
        The username to use when authenticating with a Redis Sentinel cluster
      </td>
    </tr>

    <tr>
      <td>
        `redis_sentinels`

        \


        `ITENTIAL_REDIS_SENTINELS`
      </td>

      <td>
        json
      </td>

      <td>
        The list of Redis Sentinel servers (hostnames and ports) to use for high availability
      </td>
    </tr>
  </tbody>
</table>

#### TLS settings

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `redis_enable_tls_for_sentinel_mode`

        \


        `ITENTIAL_REDIS_ENABLE_TLS_FOR_SENTINEL_MODE`
      </td>

      <td>
        boolean
      </td>

      <td>
        Set to 

        `true`

         if the Redis master requires TLS but the Sentinels do not. When enabled, the Redis client maintains TLS encryption when transitioning from a Sentinel connection to a master connection.
      </td>
    </tr>

    <tr>
      <td>
        `redis_sentinel_tls`

        \


        `ITENTIAL_REDIS_SENTINEL_TLS`
      </td>

      <td>
        json
      </td>

      <td>
        TLS configuration options for the Sentinel discovery connection.
      </td>
    </tr>

    <tr>
      <td>
        `redis_tls`

        \


        `ITENTIAL_REDIS_TLS`
      </td>

      <td>
        json
      </td>

      <td>
        Redis TLS configuration options for secure connections. Refer to NodeJS TLS library for all supported options
      </td>
    </tr>

    <tr>
      <td>
        `redis_tls_ca`

        \


        `ITENTIAL_REDIS_TLS_CA`
      </td>

      <td>
        string
      </td>

      <td>
        CA certificate used to verify the Redis server certificate when using TLS. This should be a string containing the PEM-encoded CA certificate
      </td>
    </tr>

    <tr>
      <td>
        `redis_tls_cert`

        \


        `ITENTIAL_REDIS_TLS_CERT`
      </td>

      <td>
        string
      </td>

      <td>
        Client certificate used to authenticate the client to the Redis server when using TLS. This should be a string containing the PEM-encoded client certificate
      </td>
    </tr>

    <tr>
      <td>
        `redis_tls_key`

        \


        `ITENTIAL_REDIS_TLS_KEY`
      </td>

      <td>
        string
      </td>

      <td>
        Client private key used to authenticate the client to the Redis server when using TLS. This should be a string containing the PEM-encoded client private key
      </td>
    </tr>
  </tbody>
</table>

### Database configuration

Configure MongoDB connection and behavior.

#### Advanced options

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `mongo_bypass_version_check`

        \


        `ITENTIAL_MONGO_BYPASS_VERSION_CHECK`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, the server will not check if it is connecting to a compatible MongoDB version
      </td>
    </tr>
  </tbody>
</table>

#### Connection pool

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `mongo_max_idle_time_ms`

        \


        `ITENTIAL_MONGO_MAX_IDLE_TIME_MS`
      </td>

      <td>
        integer
      </td>

      <td>
        The maximum number of milliseconds that a connection can remain idle in the pool. Set to 0 for no limit
      </td>
    </tr>

    <tr>
      <td>
        `mongo_max_pool_size`

        \


        `ITENTIAL_MONGO_MAX_POOL_SIZE`
      </td>

      <td>
        integer
      </td>

      <td>
        The maximum number of connections in a connection pool. Each application/adapter has its own connection pool
      </td>
    </tr>
  </tbody>
</table>

#### Connection settings

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `mongo_auth_db`

        \


        `ITENTIAL_MONGO_AUTH_DB`
      </td>

      <td>
        string
      </td>

      <td>
        The name of the database that the MongoDB user must authenticate against
      </td>
    </tr>

    <tr>
      <td>
        `mongo_auth_enabled`

        \


        `ITENTIAL_MONGO_AUTH_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        Instructs the MongoDB driver to use the configured username/password when connecting to MongoDB
      </td>
    </tr>

    <tr>
      <td>
        `mongo_db_name`

        \


        `ITENTIAL_MONGO_DB_NAME`
      </td>

      <td>
        string
      </td>

      <td>
        The name of the MongoDB logical database to connect to
      </td>
    </tr>

    <tr>
      <td>
        `mongo_password`

        \


        `ITENTIAL_MONGO_PASSWORD`
      </td>

      <td>
        string
      </td>

      <td>
        The password to use when connecting to MongoDB
      </td>
    </tr>

    <tr>
      <td>
        `mongo_url`

        \


        `ITENTIAL_MONGO_URL`
      </td>

      <td>
        string
      </td>

      <td>
        The MongoDB connection string. For a replica set this will include all members of the replica set. For Mongo Atlas this will be the SRV connection format
      </td>
    </tr>

    <tr>
      <td>
        `mongo_user`

        \


        `ITENTIAL_MONGO_USER`
      </td>

      <td>
        string
      </td>

      <td>
        The username to use when connecting to MongoDB
      </td>
    </tr>
  </tbody>
</table>

#### TLS settings

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `mongo_ssl_accept_invalid_certs`

        \


        `ITENTIAL_MONGO_SSL_ACCEPT_INVALID_CERTS`
      </td>

      <td>
        boolean
      </td>

      <td>
        Deprecated in favor of the 

        `mongo_tls_allow_invalid_certificates`

         property
      </td>
    </tr>

    <tr>
      <td>
        `mongo_ssl_ca_file`

        \


        `ITENTIAL_MONGO_SSL_CA_FILE`
      </td>

      <td>
        string
      </td>

      <td>
        Deprecated in favor of the 

        `mongo_tls_ca_file`

         property
      </td>
    </tr>

    <tr>
      <td>
        `mongo_ssl_enabled`

        \


        `ITENTIAL_MONGO_SSL_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        Deprecated in favor of the 

        `mongo_tls_enabled`

         property
      </td>
    </tr>

    <tr>
      <td>
        `mongo_tls_allow_invalid_certificates`

        \


        `ITENTIAL_MONGO_TLS_ALLOW_INVALID_CERTIFICATES`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, disables the validation checks for TLS certificates on other servers in the cluster and allows the use of invalid or self-signed certificates to connect
      </td>
    </tr>

    <tr>
      <td>
        `mongo_tls_ca_contents`

        \


        `ITENTIAL_MONGO_TLS_CA_CONTENTS`
      </td>

      <td>
        string
      </td>

      <td>
        Root certificate chain from the Certificate Authority. This should be a string containing the PEM-encoded certificate
      </td>
    </tr>

    <tr>
      <td>
        `mongo_tls_ca_file`

        \


        `ITENTIAL_MONGO_TLS_CA_FILE`
      </td>

      <td>
        string
      </td>

      <td>
        The .pem file that contains the root certificate chain from the Certificate Authority. Specify the file name of the .pem file using absolute paths
      </td>
    </tr>

    <tr>
      <td>
        `mongo_tls_enabled`

        \


        `ITENTIAL_MONGO_TLS_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        Instruct the MongoDB driver to use TLS protocols when connecting to the database
      </td>
    </tr>
  </tbody>
</table>

### Device management

Configure device broker behavior.

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `device_broker_default_adapter_priority`

        \


        `ITENTIAL_DEVICE_BROKER_DEFAULT_ADAPTER_PRIORITY`
      </td>

      <td>
        csv
      </td>

      <td>
        A list of adapter types that manages the devices
      </td>
    </tr>

    <tr>
      <td>
        `device_broker_run_command_adapter_preference`

        \


        `ITENTIAL_DEVICE_BROKER_RUN_COMMAND_ADAPTER_PREFERENCE`
      </td>

      <td>
        string
      </td>

      <td>
        Runs a command on a device
      </td>
    </tr>

    <tr>
      <td>
        `device_count_polling_interval`

        \


        `ITENTIAL_DEVICE_COUNT_POLLING_INTERVAL`
      </td>

      <td>
        integer
      </td>

      <td>
        The interval for how often Platform polls for the number of devices, in hours
      </td>
    </tr>
  </tbody>
</table>

### Integration configuration

Configure external API behavior.

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `external_request_timeout`

        \


        `ITENTIAL_EXTERNAL_REQUEST_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        The timeout for external API requests, in seconds
      </td>
    </tr>

    <tr>
      <td>
        `integration_thread_count`

        \


        `ITENTIAL_INTEGRATION_THREAD_COUNT`
      </td>

      <td>
        integer
      </td>

      <td>
        The number of threads available for API requests
      </td>
    </tr>

    <tr>
      <td>
        `integration_timeout`

        \


        `ITENTIAL_INTEGRATION_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        The number of milliseconds until an integration request times out
      </td>
    </tr>
  </tbody>
</table>

### Logging configuration

Configure application logging behavior.

#### File logging

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `log_directory`

        \


        `ITENTIAL_LOG_DIRECTORY`
      </td>

      <td>
        string
      </td>

      <td>
        The absolute directory path where log files are written
      </td>
    </tr>

    <tr>
      <td>
        `log_filename`

        \


        `ITENTIAL_LOG_FILENAME`
      </td>

      <td>
        string
      </td>

      <td>
        The name of the primary platform log file
      </td>
    </tr>

    <tr>
      <td>
        `log_max_file_size`

        \


        `ITENTIAL_LOG_MAX_FILE_SIZE`
      </td>

      <td>
        integer
      </td>

      <td>
        The maximum file size in bytes of each log file before rotation occurs
      </td>
    </tr>

    <tr>
      <td>
        `log_max_files`

        \


        `ITENTIAL_LOG_MAX_FILES`
      </td>

      <td>
        integer
      </td>

      <td>
        The maximum number of each log file to keep as rotation occurs
      </td>
    </tr>
  </tbody>
</table>

#### Log formats

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `console_format_json`

        \


        `ITENTIAL_CONSOLE_FORMAT_JSON`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, console logs will be written in JSON format. Otherwise, log entries will be written in plaintext
      </td>
    </tr>

    <tr>
      <td>
        `log_format_json`

        \


        `ITENTIAL_LOG_FORMAT_JSON`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, log entries will be written in JSON format. Otherwise, log entries will be written in plaintext
      </td>
    </tr>
  </tbody>
</table>

#### Log levels

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `log_level`

        \


        `ITENTIAL_LOG_LEVEL`
      </td>

      <td>
        string
      </td>

      <td>
        The minimum log level to display in the log file
      </td>
    </tr>

    <tr>
      <td>
        `log_level_console`

        \


        `ITENTIAL_LOG_LEVEL_CONSOLE`
      </td>

      <td>
        string
      </td>

      <td>
        The minimum log level to display in the console (stdout)
      </td>
    </tr>

    <tr>
      <td>
        `log_level_syslog`

        \


        `ITENTIAL_LOG_LEVEL_SYSLOG`
      </td>

      <td>
        string
      </td>

      <td>
        The minimum log level to send to the syslog server
      </td>
    </tr>
  </tbody>
</table>

#### Syslog settings

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `syslog_app_name`

        \


        `ITENTIAL_SYSLOG_APP_NAME`
      </td>

      <td>
        string
      </td>

      <td>
        The process property to include as the application name in the syslog message
      </td>
    </tr>

    <tr>
      <td>
        `syslog_eol`

        \


        `ITENTIAL_SYSLOG_EOL`
      </td>

      <td>
        string
      </td>

      <td>
        The end of line character to include in the syslog message
      </td>
    </tr>

    <tr>
      <td>
        `syslog_facility`

        \


        `ITENTIAL_SYSLOG_FACILITY`
      </td>

      <td>
        string
      </td>

      <td>
        The syslog facility to use when sending logs to the syslog server
      </td>
    </tr>

    <tr>
      <td>
        `syslog_format_json`

        \


        `ITENTIAL_SYSLOG_FORMAT_JSON`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, syslog logs will be written in JSON format. Otherwise, log entries will be written in plaintext
      </td>
    </tr>

    <tr>
      <td>
        `syslog_host`

        \


        `ITENTIAL_SYSLOG_HOST`
      </td>

      <td>
        string
      </td>

      <td>
        The hostname or IP address of the syslog server
      </td>
    </tr>

    <tr>
      <td>
        `syslog_localhost`

        \


        `ITENTIAL_SYSLOG_LOCALHOST`
      </td>

      <td>
        string
      </td>

      <td>
        The hostname to include in the syslog message
      </td>
    </tr>

    <tr>
      <td>
        `syslog_path`

        \


        `ITENTIAL_SYSLOG_PATH`
      </td>

      <td>
        string
      </td>

      <td>
        The path to the syslog server file
      </td>
    </tr>

    <tr>
      <td>
        `syslog_pid`

        \


        `ITENTIAL_SYSLOG_PID`
      </td>

      <td>
        string
      </td>

      <td>
        The process property to include as the process id in the syslog message
      </td>
    </tr>

    <tr>
      <td>
        `syslog_port`

        \


        `ITENTIAL_SYSLOG_PORT`
      </td>

      <td>
        integer
      </td>

      <td>
        The port number of the syslog server
      </td>
    </tr>

    <tr>
      <td>
        `syslog_protocol`

        \


        `ITENTIAL_SYSLOG_PROTOCOL`
      </td>

      <td>
        string
      </td>

      <td>
        The protocol to use when sending logs to the syslog server
      </td>
    </tr>

    <tr>
      <td>
        `syslog_type`

        \


        `ITENTIAL_SYSLOG_TYPE`
      </td>

      <td>
        string
      </td>

      <td>
        The syslog message format to use when sending logs to the syslog server
      </td>
    </tr>
  </tbody>
</table>

### Monitoring configuration

Configure SNMP alarm notifications.

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `snmp_alarm_configs`

        \


        `ITENTIAL_SNMP_ALARM_CONFIGS`
      </td>

      <td>
        json
      </td>

      <td>
        Remote SNMP destination configuration objects
      </td>
    </tr>
  </tbody>
</table>

### Security configuration

Configure encryption and secrets management.

#### CyberArk integration

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `cyberark_allow_invalid_certificates`

        \


        `ITENTIAL_CYBERARK_ALLOW_INVALID_CERTIFICATES`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, disables the validation checks for TLS certificates and allows the use of invalid or self-signed certificates to connect. Used by CyberArk CCP only
      </td>
    </tr>

    <tr>
      <td>
        `cyberark_app_id`

        \


        `ITENTIAL_CYBERARK_APP_ID`
      </td>

      <td>
        string
      </td>

      <td>
        Specifies the unique ID of the application issuing the password request to CyberArk CCP. Used by CyberArk CCP only
      </td>
    </tr>

    <tr>
      <td>
        `cyberark_ca`

        \


        `ITENTIAL_CYBERARK_CA`
      </td>

      <td>
        string
      </td>

      <td>
        The .pem file that contains the root certificate chain from the Certificate Authority. Specify the file name of the .pem file using absolute paths. Used by CyberArk CCP only
      </td>
    </tr>

    <tr>
      <td>
        `cyberark_ca_contents`

        \


        `ITENTIAL_CYBERARK_CA_CONTENTS`
      </td>

      <td>
        string
      </td>

      <td>
        String represenation of the PEM-encoded root certificate chain from the Certificate Authority. Used by CyberArk CCP only
      </td>
    </tr>

    <tr>
      <td>
        `cyberark_certificate`

        \


        `ITENTIAL_CYBERARK_CERTIFICATE`
      </td>

      <td>
        string
      </td>

      <td>
        The .pem file that contains the client certificate. Specify the file name of the .pem file using absolute paths. Used by CyberArk CCP only
      </td>
    </tr>

    <tr>
      <td>
        `cyberark_certificate_contents`

        \


        `ITENTIAL_CYBERARK_CERTIFICATE_CONTENTS`
      </td>

      <td>
        string
      </td>

      <td>
        String representation of the PEM-encoded client certificate. Used by CyberArk CCP only
      </td>
    </tr>

    <tr>
      <td>
        `cyberark_connection_timeout`

        \


        `ITENTIAL_CYBERARK_CONNECTION_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        The number of seconds that the Central Credential Provider will try to retrieve the secret value. Used by CyberArk CCP only
      </td>
    </tr>

    <tr>
      <td>
        `cyberark_key`

        \


        `ITENTIAL_CYBERARK_KEY`
      </td>

      <td>
        string
      </td>

      <td>
        The certificate key file location. Specify the location of the key file using absolute paths. Used by CyberArk CCP only
      </td>
    </tr>

    <tr>
      <td>
        `cyberark_key_contents`

        \


        `ITENTIAL_CYBERARK_KEY_CONTENTS`
      </td>

      <td>
        string
      </td>

      <td>
        String represenation of the PEM-encoded certificate key. Used by CyberArk CCP only
      </td>
    </tr>

    <tr>
      <td>
        `cyberark_reason_text`

        \


        `ITENTIAL_CYBERARK_REASON_TEXT`
      </td>

      <td>
        string
      </td>

      <td>
        Set this property to the reason for retrieving the password to have the reason text appear in CyberArk Credential Provider's audit log. Used by CyberArk CCP only
      </td>
    </tr>

    <tr>
      <td>
        `cyberark_url`

        \


        `ITENTIAL_CYBERARK_URL`
      </td>

      <td>
        string
      </td>

      <td>
        The URL to the CyberArk Central Credential Provider
      </td>
    </tr>
  </tbody>
</table>

#### Encryption

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `encryption_key`

        \


        `ITENTIAL_ENCRYPTION_KEY`
      </td>

      <td>
        string
      </td>

      <td>
        64-length hex string describing a 256 bit encryption key
      </td>
    </tr>

    <tr>
      <td>
        `platform_encrypted`

        \


        `ITENTIAL_PLATFORM_ENCRYPTED`
      </td>

      <td>
        boolean
      </td>

      <td>
        Indicates whether Platform is using encrypted code files
      </td>
    </tr>
  </tbody>
</table>

#### Secrets providers

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `secret_provider_name`

        \


        `ITENTIAL_SECRET_PROVIDER_NAME`
      </td>

      <td>
        string
      </td>

      <td>
        Name of the secrets provider. Required for CyberArk CCP. Not required for Hashicorp Vault
      </td>
    </tr>
  </tbody>
</table>

#### Vault integration

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `vault_approle_path`

        \


        `ITENTIAL_VAULT_APPROLE_PATH`
      </td>

      <td>
        string
      </td>

      <td>
        The path where the AppRole was enabled
      </td>
    </tr>

    <tr>
      <td>
        `vault_auth_method`

        \


        `ITENTIAL_VAULT_AUTH_METHOD`
      </td>

      <td>
        string
      </td>

      <td>
        The authorization method to connect to Hashicorp Vault. Either token or approle
      </td>
    </tr>

    <tr>
      <td>
        `vault_connection_timeout`

        \


        `ITENTIAL_VAULT_CONNECTION_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        The number of milliseconds to wait before timing out requests to the Hashicorp Vault server. Used by Hashicorp Vault only
      </td>
    </tr>

    <tr>
      <td>
        `vault_namespace`

        \


        `ITENTIAL_VAULT_NAMESPACE`
      </td>

      <td>
        string
      </td>

      <td>
        The Vault Enterprise namespace to scope all secret operations to. Required for multi-tenant Vault Enterprise configurations. Not required for open-source Vault
      </td>
    </tr>

    <tr>
      <td>
        `vault_read_only`

        \


        `ITENTIAL_VAULT_READ_ONLY`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, only reads secrets from Hashicorp Vault. Otherwise, Platform can write secrets to Vault for storage
      </td>
    </tr>

    <tr>
      <td>
        `vault_role_id`

        \


        `ITENTIAL_VAULT_ROLE_ID`
      </td>

      <td>
        string
      </td>

      <td>
        Hashicorp Vault Role ID used for AppRole authentication
      </td>
    </tr>

    <tr>
      <td>
        `vault_secret_id`

        \


        `ITENTIAL_VAULT_SECRET_ID`
      </td>

      <td>
        string
      </td>

      <td>
        Hashicorp Vault Secret ID used for AppRole login
      </td>
    </tr>

    <tr>
      <td>
        `vault_secrets_endpoint`

        \


        `ITENTIAL_VAULT_SECRETS_ENDPOINT`
      </td>

      <td>
        string
      </td>

      <td>
        The endpoint for the Secrets Engine that is used
      </td>
    </tr>

    <tr>
      <td>
        `vault_token`

        \


        `ITENTIAL_VAULT_TOKEN`
      </td>

      <td>
        string
      </td>

      <td>
        The file path to a token file. The token is used for authentication to access Vault secrets
      </td>
    </tr>

    <tr>
      <td>
        `vault_url`

        \


        `ITENTIAL_VAULT_URL`
      </td>

      <td>
        string
      </td>

      <td>
        The URL to the Hashicorp Vault server
      </td>
    </tr>
  </tbody>
</table>

### Service configuration

Configure service behavior and management.

#### Health monitoring

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `dead_process_check_enabled`

        \


        `ITENTIAL_DEAD_PROCESS_CHECK_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, Platform will periodically check for dead processes
      </td>
    </tr>

    <tr>
      <td>
        `dead_process_check_interval`

        \


        `ITENTIAL_DEAD_PROCESS_CHECK_INTERVAL`
      </td>

      <td>
        integer
      </td>

      <td>
        How often to check if an application/adapter stopped sending healthcheck pings (dead process), in seconds
      </td>
    </tr>

    <tr>
      <td>
        `dead_process_max_period`

        \


        `ITENTIAL_DEAD_PROCESS_MAX_PERIOD`
      </td>

      <td>
        integer
      </td>

      <td>
        Maximum time period for application/adapter without sending healthcheck ping, in seconds
      </td>
    </tr>

    <tr>
      <td>
        `service_health_check_interval`

        \


        `ITENTIAL_SERVICE_HEALTH_CHECK_INTERVAL`
      </td>

      <td>
        integer
      </td>

      <td>
        How often to update service health, measured in seconds
      </td>
    </tr>

    <tr>
      <td>
        `service_health_check_unhealthy_threshold`

        \


        `ITENTIAL_SERVICE_HEALTH_CHECK_UNHEALTHY_THRESHOLD`
      </td>

      <td>
        integer
      </td>

      <td>
        The number of failed health checks in a row before a service is considered to be "unhealthy"
      </td>
    </tr>
  </tbody>
</table>

#### Service lifecycle

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `service_crash_recovery_max_retries`

        \


        `ITENTIAL_SERVICE_CRASH_RECOVERY_MAX_RETRIES`
      </td>

      <td>
        integer
      </td>

      <td>
        Specifies the amount of times services will retry on crash before stopping
      </td>
    </tr>

    <tr>
      <td>
        `service_crash_recovery_reset_retries_after_ms`

        \


        `ITENTIAL_SERVICE_CRASH_RECOVERY_RESET_RETRIES_AFTER_MS`
      </td>

      <td>
        integer
      </td>

      <td>
        Specifies the amount of times between each retry before the count will reset in milliseconds
      </td>
    </tr>

    <tr>
      <td>
        `service_launch_delay`

        \


        `ITENTIAL_SERVICE_LAUNCH_DELAY`
      </td>

      <td>
        integer
      </td>

      <td>
        The application/adapter launch delay, in seconds
      </td>
    </tr>

    <tr>
      <td>
        `service_launch_timeout`

        \


        `ITENTIAL_SERVICE_LAUNCH_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        The application/adapter launch timeout, in seconds
      </td>
    </tr>
  </tbody>
</table>

#### Service management

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `service_blacklist`

        \


        `ITENTIAL_SERVICE_BLACKLIST`
      </td>

      <td>
        csv
      </td>

      <td>
        The service type that will be denied CRUD operation access
      </td>
    </tr>

    <tr>
      <td>
        `service_directory`

        \


        `ITENTIAL_SERVICE_DIRECTORY`
      </td>

      <td>
        string
      </td>

      <td>
        The file path to the directory containing additional services (applications and adapters)
      </td>
    </tr>

    <tr>
      <td>
        `services`

        \


        `ITENTIAL_SERVICES`
      </td>

      <td>
        csv
      </td>

      <td>
        A whitelist of services (applications/adapters) to initialize on startup of Platform. If no value is given, all services will be initialized
      </td>
    </tr>
  </tbody>
</table>

### System configuration

Configure system-level behavior.

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `audit_enabled`

        \


        `ITENTIAL_AUDIT_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, Platform will track detailed audit events
      </td>
    </tr>

    <tr>
      <td>
        `broker_validation_enabled`

        \


        `ITENTIAL_BROKER_VALIDATION_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, Platform will perform strict JSON Schema validation on messages into the brokers and coming back to the broker layer from adapters
      </td>
    </tr>

    <tr>
      <td>
        `platform_shutdown_timeout`

        \


        `ITENTIAL_PLATFORM_SHUTDOWN_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        The amount of time a service should wait before shutting down, in seconds
      </td>
    </tr>

    <tr>
      <td>
        `profile_id`

        \


        `ITENTIAL_PROFILE_ID`
      </td>

      <td>
        string
      </td>

      <td>
        The name of the profile document to load from the MongoDB where legacy configuration properties are stored. Not required for installations that are using environment variables or a properties file
      </td>
    </tr>

    <tr>
      <td>
        `server_id`

        \


        `ITENTIAL_SERVER_ID`
      </td>

      <td>
        string
      </td>

      <td>
        An identifier for the server instance. This is used to uniquely identify the server in a multi-server environment. If not provided, the server will generate one on startup
      </td>
    </tr>

    <tr>
      <td>
        `server_id_strategy`

        \


        `ITENTIAL_SERVER_ID_STRATEGY`
      </td>

      <td>
        string
      </td>

      <td>
        Strategy used to generate server ID, if one is not set using the server_id property. Selecting mac:port will generate a server_id using a combination of MAC address and port, while random will generate a random ID on each startup
      </td>
    </tr>
  </tbody>
</table>

### UI configuration

Configure user interface customization.

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `ui_apple_touch_icon_file`

        \


        `ITENTIAL_UI_APPLE_TOUCH_ICON_FILE`
      </td>

      <td>
        string
      </td>

      <td>
        Path to the apple touch icon file that will be displayed on iOS devices
      </td>
    </tr>

    <tr>
      <td>
        `ui_favicon_file`

        \


        `ITENTIAL_UI_FAVICON_FILE`
      </td>

      <td>
        string
      </td>

      <td>
        Path to the favicon file that will be displayed in the browser tab
      </td>
    </tr>

    <tr>
      <td>
        `ui_home_file`

        \


        `ITENTIAL_UI_HOME_FILE`
      </td>

      <td>
        string
      </td>

      <td>
        Path to the HTML file that will be displayed as the home page for the UI
      </td>
    </tr>

    <tr>
      <td>
        `ui_layout_file`

        \


        `ITENTIAL_UI_LAYOUT_FILE`
      </td>

      <td>
        string
      </td>

      <td>
        Path to the layout file extended in pug templates
      </td>
    </tr>

    <tr>
      <td>
        `ui_login_file`

        \


        `ITENTIAL_UI_LOGIN_FILE`
      </td>

      <td>
        string
      </td>

      <td>
        Path to the HTML file that will be displayed as the login page for the UI
      </td>
    </tr>

    <tr>
      <td>
        `ui_profile_file`

        \


        `ITENTIAL_UI_PROFILE_FILE`
      </td>

      <td>
        string
      </td>

      <td>
        Path to the HTML file that will be displayed as the profile page for the UI
      </td>
    </tr>
  </tbody>
</table>

### Web server configuration

Configure HTTP/HTTPS server settings.

#### HTTP settings

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `webserver_http_allowed_optional_verbs`

        \


        `ITENTIAL_WEBSERVER_HTTP_ALLOWED_OPTIONAL_VERBS`
      </td>

      <td>
        csv
      </td>

      <td>
        The set of allowed HTTP verbs in addition to those defined in the standard HTTP/1.1 protocol
      </td>
    </tr>

    <tr>
      <td>
        `webserver_http_enabled`

        \


        `ITENTIAL_WEBSERVER_HTTP_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, allows the webserver to respond to insecure HTTP requests
      </td>
    </tr>

    <tr>
      <td>
        `webserver_http_port`

        \


        `ITENTIAL_WEBSERVER_HTTP_PORT`
      </td>

      <td>
        integer
      </td>

      <td>
        The port on which the webserver listens for HTTP requests
      </td>
    </tr>
  </tbody>
</table>

#### HTTPS settings

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `webserver_https_cert`

        \


        `ITENTIAL_WEBSERVER_HTTPS_CERT`
      </td>

      <td>
        string
      </td>

      <td>
        The path to the certificate file used for HTTPS connections
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_cert_contents`

        \


        `ITENTIAL_WEBSERVER_HTTPS_CERT_CONTENTS`
      </td>

      <td>
        string
      </td>

      <td>
        Certificate used for HTTPS connections. This should be a string containing the PEM-encoded certificate
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_enabled`

        \


        `ITENTIAL_WEBSERVER_HTTPS_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, allows the webserver to respond to secure HTTPS requests
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_key`

        \


        `ITENTIAL_WEBSERVER_HTTPS_KEY`
      </td>

      <td>
        string
      </td>

      <td>
        The path to the public key file used for HTTPS connections
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_key_contents`

        \


        `ITENTIAL_WEBSERVER_HTTPS_KEY_CONTENTS`
      </td>

      <td>
        string
      </td>

      <td>
        Public key used for HTTPS connections. This should be a string containing the PEM-encoded key
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_passphrase`

        \


        `ITENTIAL_WEBSERVER_HTTPS_PASSPHRASE`
      </td>

      <td>
        string
      </td>

      <td>
        The passphrase for the private key used to enable TLS sessions
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_port`

        \


        `ITENTIAL_WEBSERVER_HTTPS_PORT`
      </td>

      <td>
        integer
      </td>

      <td>
        The port on which the webserver listens for HTTPS requests
      </td>
    </tr>
  </tbody>
</table>

#### Logging

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `webserver_log_directory`

        \


        `ITENTIAL_WEBSERVER_LOG_DIRECTORY`
      </td>

      <td>
        string
      </td>

      <td>
        The absolute directory path where webserver log files are written
      </td>
    </tr>

    <tr>
      <td>
        `webserver_log_filename`

        \


        `ITENTIAL_WEBSERVER_LOG_FILENAME`
      </td>

      <td>
        string
      </td>

      <td>
        The name of the webserver log file
      </td>
    </tr>
  </tbody>
</table>

#### Server behavior

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `webserver_cache_control_enabled`

        \


        `ITENTIAL_WEBSERVER_CACHE_CONTROL_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        A toggle to instruct the webserver to include HTTP cache control headers on the response
      </td>
    </tr>

    <tr>
      <td>
        `webserver_response_header_access_control_allow_origin`

        \


        `ITENTIAL_WEBSERVER_RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN`
      </td>

      <td>
        string
      </td>

      <td>
        The value of the HTTP Access-Control-Allow-Origin header returned to clients
      </td>
    </tr>

    <tr>
      <td>
        `webserver_timeout`

        \


        `ITENTIAL_WEBSERVER_TIMEOUT`
      </td>

      <td>
        integer
      </td>

      <td>
        Timeout to use for incoming HTTP requests to Platform API, in milliseconds
      </td>
    </tr>
  </tbody>
</table>

#### TLS configuration

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `webserver_https_ciphers`

        \


        `ITENTIAL_WEBSERVER_HTTPS_CIPHERS`
      </td>

      <td>
        string
      </td>

      <td>
        The allowed SSL/TLS cipher suite
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_client_reneg_limit`

        \


        `ITENTIAL_WEBSERVER_HTTPS_CLIENT_RENEG_LIMIT`
      </td>

      <td>
        integer
      </td>

      <td>
        Specifies the number of renegotiations that are allowed in a single HTTPS connection
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_client_reneg_window`

        \


        `ITENTIAL_WEBSERVER_HTTPS_CLIENT_RENEG_WINDOW`
      </td>

      <td>
        integer
      </td>

      <td>
        Specifies the time renegotiation window in seconds for a single HTTPS connection
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_secure_protocol`

        \


        `ITENTIAL_WEBSERVER_HTTPS_SECURE_PROTOCOL`
      </td>

      <td>
        string
      </td>

      <td>
        The set of allowed SSL/TLS protocol versions. Ignored when either tlsMinVersion or tlsMaxVersion is given
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_tls_max_version`

        \


        `ITENTIAL_WEBSERVER_HTTPS_TLS_MAX_VERSION`
      </td>

      <td>
        string
      </td>

      <td>
        Maximum permitted TLS version. Overrides webserver_https_secure_protocol
      </td>
    </tr>

    <tr>
      <td>
        `webserver_https_tls_min_version`

        \


        `ITENTIAL_WEBSERVER_HTTPS_TLS_MIN_VERSION`
      </td>

      <td>
        string
      </td>

      <td>
        Minimum permitted TLS version. Overrides webserver_https_secure_protocol
      </td>
    </tr>
  </tbody>
</table>

### Worker configuration

Configure workers for task processing.

<table sticky>
  <thead>
    <tr>
      <th>
        Property Name
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `event_worker_thread_count`

        \


        `ITENTIAL_EVENT_WORKER_THREAD_COUNT`
      </td>

      <td>
        integer
      </td>

      <td>
        The number of worker threads available for event processing. 

        Platform 6.5.1+

        .
      </td>
    </tr>

    <tr>
      <td>
        `job_worker_enabled`

        \


        `ITENTIAL_JOB_WORKER_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, will allow jobs to be started after the server startup process is complete. If false, API calls to start Jobs will return an error until enabled manually via the UI/API
      </td>
    </tr>

    <tr>
      <td>
        `task_worker_enabled`

        \


        `ITENTIAL_TASK_WORKER_ENABLED`
      </td>

      <td>
        boolean
      </td>

      <td>
        If true, will start working tasks immediately after the server startup process is complete. If false, the task worker must be enabled manually via the UI/API
      </td>
    </tr>

    <tr>
      <td>
        `task_worker_rate_limit`

        \


        `ITENTIAL_TASK_WORKER_RATE_LIMIT`
      </td>

      <td>
        integer
      </td>

      <td>
        The maximum number of tasks to run per period. The value 0 disables the rate limiter
      </td>
    </tr>

    <tr>
      <td>
        `task_worker_rate_limit_period`

        \


        `ITENTIAL_TASK_WORKER_RATE_LIMIT_PERIOD`
      </td>

      <td>
        integer
      </td>

      <td>
        The time period in seconds for the task worker rate limit
      </td>
    </tr>

    <tr>
      <td>
        `task_worker_thread_count`

        \


        `ITENTIAL_TASK_WORKER_THREAD_COUNT`
      </td>

      <td>
        integer
      </td>

      <td>
        The number of worker threads available for task processing. All threads share the configured task worker rate limit. Default 1, maximum 4
      </td>
    </tr>

    <tr>
      <td>
        `transformation_worker_thread_count`

        \


        `ITENTIAL_TRANSFORMATION_WORKER_THREAD_COUNT`
      </td>

      <td>
        integer
      </td>

      <td>
        The number of worker threads available for transformation processing
      </td>
    </tr>
  </tbody>
</table>

## Related reading

* [Configuration overview](/itential-platform/configure/platform)
* [Installation](/itential-platform/install/platform)
* [Upgrading](/maintain/upgrade)
* [Adapters & Custom Apps](/itential-platform/install/apps-adapters)

> Complete reference for configuring Platform with properties or environment variables