API Manager Configuration Catalog

The new configuration model based on the toml format is introduced from API Manager 3.0.0 onwards. In older versions of the product, users had to modify different configuration files depending on the components related to the specific feature they were configuring. With this update, all configuration files have been merged to make configurations easier. Therefore, the <API-M_HOME>/repository/conf/deployment.toml file is the single source used to configure and tune the various features in API Manager.

This document describes all the configuration parameters that are used in WSO2 API Manager.

Instructions for use

Select the configuration sections, parameters, and values that are required for your use and add them to the .toml file. See the example .toml file given below.

# This is an example .toml file.

[server]
pattern="value"                         
enable_port_forward=true

[key_mgr_node]
endpoints="value"

[gateway]
gateway_environments=["dev","test"]

[[database]]
pool_options.maxActiv=5

Server

[server]
hostname = "localhost"
#offset=0
mode = "single" #single or ha
base_path = "${carbon.protocol}://${carbon.host}:${carbon.management.port}"
#discard_empty_caches = false
server_role = "default"
disable_shutdown_from_ui = false
disable_restart_from_ui = false

[server] Required

This includes configurations required for configuring the deployment parameters that are used for identifying an API Manager server node.

hostname

string Required

Default: localhost

Possible Values: localhost,127.0.0.1,<any-ip-address>,<any-hostname>

The hostname or IP address of the machine hosting the API Manager instance.

offset

integer

Default: 0

Port offset allows you to run multiple WSO2 products, multiple instances of a WSO2 product, or multiple WSO2 product clusters on the same server or virtual machine (VM). Port offset defines the number by which all ports defined in the runtime such as the HTTP/S ports will be offset. For example, if the default HTTP port is 9443 and the port offset is 1, the effective HTTP port will be 9444. Therefore, for each additional WSO2 product instance, set the port offset to a unique value so that they can all run on the same server without any port conflicts.

server_role

string Required

Default: default

Possible Values: default,api-devportal,api-key-manager,api-publisher,gateway-worker,traffic-manager

The profile name of the API Manager instance.

enableMTOM

boolean

Default: false

Possible Values: true,false

Use this parameter to enable MTOM (Message Transmission Optimization Mechanism) for the product server.

enableSwA

boolean

Default: false

Possible Values: true,false

Use this parameter to enable SwA (SOAP with Attachments) for the product server. When SwA is enabled, the API Manager will process the files attached to SOAP messages.

disable_shutdown_from_ui

boolean

Default: false

Possible Values: true,false

Use this parameter to disable the shutdown server option from carbon management console UI.

disable_restart_from_ui

boolean

Default: false

Possible Values: true,false

Use this parameter to disable the restart server option from carbon management console UI.

Super admin configurations

[super_admin]
username = "admin"
password = "admin"
create_admin_account = true

[super_admin] Required

This includes the configurations related to the super admin user.

username

string

Default: admin

super admin username

password

string

Default: admin

super admin password

create_admin_account

string

Default: TRUE

Set this to true to create a new user with the super admin details given.

Enabling the H2 database console

[database_configuration]
enable_h2_console = true

[database_configuration]

Configurations required to enable browsing the H2 database from a web browser.

enable_h2_console

boolean Required

Default: false

Possible Values: true, false

True when required to browse the H2 database from a browser. False when not.

Database configurations

[database.apim_db]
type = "h2"
url = "jdbc:h2:./repository/database/WSO2AM_DB;DB_CLOSE_ON_EXIT=FALSE"
username = "wso2carbon"
password = "wso2carbon"

[database.apim_db] Required

Database configurations related to API Manager

type

string Required

Default: h2

Possible Values: mysql,h2,mssql,postgre,oracle,db2

Database vendor

hostname

string Required

Default:

You can use either hostname and port or the URL(given below). If you specify the URL the hostname and port will be overridden.

port

string Required

Default:

url

string

Default: jdbc:h2:repository/database/WSO2AM_DB;DB_CLOSE_ON_EXIT=FALSE

The connection URL is required when you use the h2 db. You have to add the URL to use the JDBC properties listed below. Otherwise it is optional.

username

string Required

Default: wso2carbon

The username used to create a connection to the database.

password

string Required

Default: wso2carbon

The password used to create a connection to the database.

validationQuery

string Required

Default: SELECT 1

The value changes according to the Database query

pool_options.maxActive

string

Default: 50

The maximum number of active connections that can be allocated from the connection pool at the same time. Change according to the preferred database.

pool_options.maxWait

string

Default: 60000

The maximum time that requests are expected to wait in the queue for a connection to be released. This property comes into effect when the maximum number of active connections allowed in the connection pool (see maxActive property) is used up.

pool_options.testOnBorrow

string

Default: TRUE

The indication of whether connection objects will be validated before they are borrowed from the pool. If the object validation fails, the connection is dropped from the pool, and there will be an attempt to borrow another connection.

pool_options.validationInterval

string

Default: 30000

This parameter controls how frequently a given validation query is executed (time in milliseconds). That is, if a connection is due for validation, but has been validated previously within this interval, it will not be validated again.

pool_options.defaultAutoCommit

string

Default: TRUE

When auto committing is enabled, each SQL statement will be committed to the database as an individual transaction, as opposed to committing multiple statements as a single transaction.

Shared database configurations

[database.shared_db]
type = "h2"
url = "jdbc:h2:./repository/database/WSO2SHARED_DB;DB_CLOSE_ON_EXIT=FALSE"
username = "wso2carbon"
password = "wso2carbon"

[database.shared_db] Required

Configurations related to the databases shared between nodes

type

string

Default: h2

Possible Values: mysql,h2,mssql,postgre,oracle,db2

Database type

url

string

Default: jdbc:h2:repository/database/WSO2SHARED_DB;DB_CLOSE_ON_EXIT=FALSE

connection url

username

string

Default: wso2carbon

username

password

string

Default: wso2carbon

password

JWT Configurations

[apim.jwt]
enable = true
encoding = "base64"
generator_impl = "org.wso2.carbon.apimgt.keymgt.token.JWTGenerator"
claim_dialect = "http://wso2.org/claims"
header = "X-JWT-Assertion"
signing_algorithm = "SHA256withRSA"
enable_user_claims = true
claims_extractor_impl = "org.wso2.carbon.apimgt.impl.token.DefaultClaimsRetriever"

[apim.jwt] Required

Enable APIM to generate a JWT within itself. JSON Web Token (JWT) is used to represent claims that are transferred between two parties such as the end-user and the backend.

enable

string Required

Default: FALSE

Possible Values: true, false

Enable JWT.

encoding

string

Default: base64

Possible Values: base64,base64url

Use base64 encoding for the default JWT generator. Use the url-safe JWT generator if it is base64url.

header

string

Default: X-JWT-Assertion

The HTTP header name used to send the previously generated JWT.

enable_user_claims

string

Default: FALSE

Possible Values: false true

No user store claims are included in the JWT if false.

claims_extractor_impl

string

Default:

You can define the custom claim retriever implementation by setting apim.jwt.enable_user_claims=true. Make sure that it is the fully-qualified class name.

claim_dialect

string

Default: http://wso2.org/claims

A set of claims are identified as a dialect. Different dialects represent the same piece of information with different claim URIs.

signing_algorithm

string

Default: SHA256withRSA

Possible Values: NONE

Specify NONE to disable the signing.

enable_claim_retrieval

boolean

Default:

Possible Values: true, false

Enable to add user claims to the backend JWT token. This will provide the user claims related to the authorized user to the default Keymanager implementation. For custom keymanager implementations, implement the getUserClaims() in the KeyManager implementation.

gateway_generator.impl

string

Default: org.wso2.carbon.apimgt.gateway.handlers.security.jwt.generator.APIMgtGatewayJWTGeneratorImpl

Fully qualified custom JWT generator to use in JWT (Self Contained) Access Tokens.

gateway_generator.excluded_claims

string

Default:

List of claims that are not supposed to be included in the Backend JWT when using JWT (Self Contained) Access Tokens.

binding_federated_user_claims

boolean

Default: false

Possible Values: true, false

This disables the binding federated user claims to the backend JWT generator.

use_kid_property

boolean

Default: true

Possible Values: true, false

Specifies whether the backend JWT header should include the kid claim.

use_sha256_hash

boolean

Default: false

Possible Values: true, false

Specifies whether the certificate header is signed using the SHA256 algorithm. The default algorithm used to generate the header value is SHA1.

encode_x5t_without_padding

boolean

Default: false

Possible Values: true, false

Determines whether the `x5t` value in the JWT header is Base64 URL-encoded without padding. Set to `true` for compatibility with tools and systems that expect unpadded `x5t` values.

[[apim.jwt.issuer]]
name = "https://test.apim.integration"

[apim.jwt.issuer]

To specify the issuers of the JWT tokens if third-party Key Managers are used.

name

string

Default:

The issuer name of the JWT.

[apim.jwt.issuer.jwks]
url = "https://localhost:8743/jwks/1.0"

[apim.jwt.issuer.jwks]

To specify the JSON Web Key Set (JWKS) endpoint of the issuer.

url

string

Default:

The JWKS endpoint URL of the issuer.

[[apim.jwt.issuer.claim_mapping]]
remote_claim = "http://idp1.org/claims/givenname"
local_claim = "http://wso2.org/claims/givenname"

[apim.jwt.issuer.claim_mapping]

remote_claim

string

Default:

The name of the remote claim.

local_claim

string

Default:

The local claim name that the remote claim needs to be mapped to.

API-M gateway type configurations

[apim]
gateway_type = "Regular,APK,AWS"

[apim] Required

Configuring the gateway types used by API Manager.

gateway_type

string Required

Default: Regular,APK,AWS

Users can configure supported gateway types through the configuration. These pre-configured options will be available under gateway environment types when creating new gateway environments via the Admin Portal.

API-M gateway environment configurations

[[apim.gateway.environment]]
name = "Default"
type = "hybrid"
display_in_api_console = true
description = "This is a hybrid gateway that handles both production and sandbox token traffic."
show_as_token_endpoint_url = true
service_url = "https://localhost:${mgt.transport.https.port}/services/"
username = "admin"
password = "admin"
ws_endpoint = "ws://localhost:9099"
http_endpoint = "http://localhost:${http.nio.port}"
https_endpoint = "https://localhost:${https.nio.port}"

[apim.gateway.environment] Required

Configuring the gateways used by API Manager.

name

string Required

Default: Default

User can add preferred values as the name.

type

string Required

Default: hybrid

Possible Values: production, sandbox, hybrid

display_in_api_console

string Required

Default: TRUE

Displays the environment under 'Try it' in the API Developer Portal, in the API console.

description

string Required

Default: This is a hybrid gateway that handles both production and sandbox token traffic.

Describe the function of the gateway here.

show_as_token_endpoint_url

string Required

Default: TRUE

Use to construct the sample curl request in the API Developer Portal.

service_url

string Required

Default: https://localhost:9443/services/

APIs will be published using this URL

username

string Required

Default: $conf{super_admin.username}

Credentials used to publish APIs

password

string Required

Default: $conf{super_admin.password}

Credentials used to publish APIs

ws_endpoint

string Required

Default: no default value

E.g., ws://localhost:9099

https_endpoint

string Required

Default: no default value

https://localhost:8243/

http_endpoint

string

Default: no default value

http://localhost:8280/

[apim.sync_runtime_artifacts]
enable = "true"
tenants = "*"

[apim.sync_runtime_artifacts.tenant_loading] Required

Define information on tenants synchronization on gateway node

enable

string

Default: FALSE

Set TRUE to enable.

tenants

string

Default: *

Comma separated list of tenants to be loaded on the gateway. Use * to load all tenants

[apim.sync_runtime_artifacts.gateway]
gateway_labels = ["Default"]
deployment_retry_duration = 15000
max_retry_count = 5
retry_progression_factor = 2.0

[apim.sync_runtime_artifacts.gateway] Required

Define information on labels that the gateway is going to subscribe to. Only the APIs with these labels will be pulled from the extension point and deployed

gateway_labels

string array Required

Default: Default

Possible Values: TestGWLabel,Default

Array of the labels that the gateway is going to subscribe to

deployment_retry_duration

int

Default: 15000

The initial duration in milliseconds to wait before retrying a failed deployment

max_retry_count

int

Default: 5

The maximum number of retry attempts for deploying artifacts in case of failures.

retry_progression_factor

float

Default: 2.0

The factor by which the retry duration increases after each failed deployment attempt.

Virtual host of API-M gateway environment configurations

[[apim.gateway.environment]]
name = "Default"
type = "hybrid"
display_in_api_console = true
description = "This is a hybrid gateway that handles both production and sandbox token traffic."
show_as_token_endpoint_url = true
service_url = "https://localhost:${mgt.transport.https.port}/services/"
username = "admin"
password = "admin"
ws_endpoint = "ws://localhost:9099"
http_endpoint = "http://localhost:${http.nio.port}"
https_endpoint = "https://localhost:${https.nio.port}"

[apim.gateway.environment.virtual_host]

Configuring virtual host for the gateways environment.

http_endpoint

string

Default: http://<host of https endpoint>:80

Possible Values: http://<host>:<port>/<optional context>

HTTP endpoint e.g. http://dev.wso2.com:8280

https_endpoint

string Required

Default:

Possible Values: https://<host>:<port>/<optional context>

HTTPS endpoint e.g. https://dev.wso2.com:8243

ws_endpoint

string

Default: ws://<host of https endpoint>:9099

Possible Values: ws://<host>:<port>

WS endpoint e.g. ws://dev.wso2.com:9099

wss_endpoint

string

Default: wss://<host of https endpoint>:8099

Possible Values: wss://<host>:<port>

WSS endpoint e.g. wss://dev.wso2.com:8099

Gateway token cache

[apim.cache.gateway_token]
enable = true
expiry_time = "900s"

[apim.cache.gateway_token] Required

enable

string

Default: TRUE

Enable the gateway token cache. WSO2 recommends to enable this feature by default. The token validation request checks with the cached value.

expiry_time

string

Default: 15 m

Set the cache expiry time in minutes. Recommended value is 15 minutes.

Cache resource

[apim.cache.resource]
enable = true
expiry_time = "900s"

[apim.cache.resource] Required

enable

string

Default: TRUE

Enable the gateway resource cache. Caches the API resources at the gateway. Expires in 15 minutes.

Keymanager token cache

[apim.cache.km_token]
enable = false
expiry_time = "15m"

[apim.cache.km_token] Required

enable

string

Default: FALSE

Enable the Key Manager token cache. The token validation request checks with the value cached at the Key Manager. At any given time you should only have one cache enabled, which is either the Key Manager cache or the API Gateway cache. WSO2 does not recommend using both caches at the same time.

expiry_time

string

Default: 15 m

Set the cache expiry time.

Cache recent APIs

[apim.cache.recent_apis]
enable = false

[apim.cache.recent_apis] Required

enable

string

Default: FALSE

Enable cache for recently added apis in the API Developer Portal. This expires in 15 minutes by default.

Cache scopes

[apim.cache.scopes]
enable = true

[apim.cache.scopes] Required

enable

string

Default: TRUE

Enable cache for scopes. This expires in 15 minutes by default.

Cache publisher roles

[apim.cache.publisher_roles]
enable = true

[apim.cache.publisher_roles] Required

enable

string

Default: TRUE

Enable cache for publisher roles. Expires in 15 minutes by default

Cache JWT claims

[apim.cache.jwt_claim]
enable = true
expiry_time = "15m"

[apim.cache.jwt_claim] Required

enable

string

Default: TRUE

Enable JWT claim cache. The user's claims used to create the JWT are cached.

expiry_time

string

Default: Not defined

Set the cache expiry time. Would be same as the JWT expiry time.

Cache tags

[apim.cache.tags]
expiry_time = "2m"

[apim.cache.tags] Required

expiry_time

string

Default: 2m

Set when the tag cache expires. This option is disabled when not defined.

API Manager Analytics Configuration

[apim.analytics]
enable = true
type = "moesif"

[apim.analytics.properties]
moesifKey = "estY2FtcGxlLW1vZXNpZi1rZXk="
moesif_base_url = "https://api.moesif.net"
send_headers = false
build_response_message = false
send_payloads = false
payload_size_limit = 100000
capture_payloads_without_content_length = false

[apim.analytics] Required

Top-level Analytics configuration.

enable

boolean Required

Default: false

Possible Values: TRUE | FALSE

Enable or disable Analytics in API Manager.

type

string Required

Default:

Possible Values: moesif, log

Analytics provider type. There is no default; set it explicitly. For API-M 4.6.0+, use 'moesif' or 'log'.

[apim.analytics.properties] Required

Provider-specific properties for the selected analytics type.

moesifKey

string Required

Default:

Moesif API key used to authenticate ingestion. (Only when type is 'moesif')

moesif_base_url

string

Default: https://api.moesif.net

Base URL of the Moesif ingestion endpoint. (Only when type is 'moesif')

send_headers

boolean

Default: false

Possible Values: TRUE | FALSE

If TRUE, include request/response headers in events sent to analytics.

build_response_message

boolean

Default: false

Possible Values: TRUE | FALSE

If TRUE, the response will be built and the responseSize will be calculated, which will be included in the response analytics event.

send_payloads

boolean

Default: false

Possible Values: TRUE | FALSE

If TRUE, include request/response bodies in events sent to analytics. Captured bodies are published in full and are not masked.

payload_size_limit

integer

Default: 100000

Maximum size in bytes of a single request or response body captured for analytics. A larger body is dropped, not truncated. Applies only when send_payloads is TRUE.

capture_payloads_without_content_length

boolean

Default: false

Possible Values: TRUE | FALSE

If TRUE, capture bodies that do not declare a Content-Length header, such as chunked payloads. Such a body is read into memory in full before its size is checked. Applies only when send_payloads is TRUE.

API-M Analytics - URL group configurations

#LOADBALANCER CONFIGS
[[apim.analytics.url_group]]
analytics_url =["tcp://analytics1:7611","tcp://analytics2:7611"]
analytics_auth_url =["ssl://analytics1:7711","ssl://analytics2:7711"]
type = "loadbalance"

#FAILOVER CONFIGS
[[apim.analytics.url_group]]
analytics_url =["tcp://analytics1:7612","tcp://analytics2:7612"]
analytics_auth_url =["ssl://analytics1:7712","ssl://analytics2:7712"]
type = "failover"

[apim.analytics.url_group] Required

string

Default:

Define each analytics node that the API Manager will connect to, as an array. If there are multiple nodes, you need to define this configuration for each node.

analytics_url

string Required

Default: tcp://localhost:7612

The list of server URLs e.g.,: analytics_url = ["tcp: //localhost:7611, tcp://localhost:7611"]"

analytics_auth_url

string Required

Default: ssl://localhost:7712

The list of auth server URLs e.g.,: analytics_auth_url = ["ssl: //localhost:7711,ssl://localhost:7711"]

type

string

Default: no default value

Possible Values: loadbalance failover

Loadbalance or Failover

API-M Key Manager related configurations

[apim.key_manager]
service_url = "https://localhost:${mgt.transport.https.port}/services/"
username = "$ref{super_admin.username}"
password = "$ref{super_admin.password}"
pool.init_idle_capacity = 50
pool.max_idle = 100
key_validation_handler_type = "custom"
key_validation_handler_impl = "org.wso2.carbon.apimgt.keymgt.handlers.DefaultKeyValidationHandler"
enable_application_scopes_for_resident_km = false

[apim.key_manager] Required

service_url

string Required

Default: https://localhost:9443/services/

URL that offers services of the KM

username

string

Default: Credentials of the super admin user.

Credentials of the super admin user, in the Key Manager node.

password

string

Default: Credentials of the super admin user.

Credentials of the super admin user, in the Key Manager node.

pool.init_idle_capacity

string

Default: 50

Minimum no. of clients created, to connect to the key manager.

pool.max_idle

string

Default: 100

Maximum no. of clients created, to connect to the key manager.

key_validation_handler_type

string

Default: default

Possible Values: default or custom

If custom, then provide the "key_validation_handler_impl" value

key_validation_handler_impl

string

Default:

You can provide a custom key validation handler implementation. To do this, set the "key_validation_handler_type" to custom

enable_application_scopes_for_resident_km

boolean

Default: false

Possible Values: true,false

Enable the application scopes for the Resident Key Manager.

disable_retrieve_key_mapping

boolean

Default: false

Possible Values: true,false

Disables the retrieval of key mapping from the internal API when subscription validation is disabled.

[apim.http_client] Required

Configuration related to the http client used for key validation calls made from gateway to key manager component. For the default JWT tokens (from APIM 3.2.0 onwards, the default token type is JWT), the key validation takes place within GW node itself, as the JWT token is self-contained. So no key validation call is made for JWT tokens. But if the token used is a reference token (if the deployment is migrated from older version which used reference tokens), the key validation http calls will be made to the Key manager component for token introspection. This dedicated http client is used for this purpose.

max_total

int Required

Default: 100

The maximum number of connections that will be created for the key validation calls. If there is a considerable latency, the connections in use at a given time will take a long time to be released and added back to the connection pool. As a result, connections may not be available for some requests. In such situations, it is recommended to increase the value for this parameter.

default_max_per_route

int Required

Default: 50

The maximum number of connections that will be created per host server by the client. Will have to increase this too, when required as similarly for the config max_total.

API-M AI configurations

[apim.ai]
enable = true
token = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
endpoint = "https://e95488c8-8511-4882-967f-ec3ae2a0f86f-prod.e1-us-east-azure.choreoapis.dev/lgpt/interceptor-service/interceptor-service-be2/v1.0"
default_request_timeout = 30

[apim.ai.failover_configurations]
failover_endpoints_limit = 10
default_request_timeout = 30

[apim.ai] Required

Collection of AI feature related configs

enable

boolean Required

Default: true

Possible Values: true,false

Enable the AI features.

token

string Required

Default:

The access token to authenticate AI feature related requests

endpoint

string

Default:

The endpoint that exposes the AI capabilities for API Manager

default_request_timeout

integer

Default: 30

The default timeout (in seconds) for AI API requests

[apim.ai.failover_configurations]

Configurations for AI feature failover handling

failover_endpoints_limit

integer

Default: 10

Maximum number of failover endpoints

default_request_timeout

integer

Default: 30

The default timeout (in seconds) for failover requests

MCP Configurations

[apim.mcp]
enable = true
enforce_auth_for_all_mcp_methods = false

[apim.mcp]

Collection of MCP related configs

enable

boolean Required

Default: true

Possible Values: true,false

Enable the MCP features.

enforce_auth_for_all_mcp_methods

boolean

Default: false

Possible Values: true,false

By default, all MCP requests sent over POST except tools/call requests are unauthenticated. If this option is set to true, authentication will be required for all such MCP requests sent over POST. This option does not apply to the GET request made to the MCP endpoint (used to check for SSE transport support), which is never authenticated regardless of this setting. For improved security, it is recommended to enable this option.

API-M OAuth configurations

[apim.oauth_config]
enable_outbound_auth_header = false
auth_header = "Authorization"
revoke_endpoint = "https://localhost:${mgt.transport.https.port}/oauth2/revoke"
enable_token_encryption = false
enable_token_hashing = false

[apim.oauth_config] Required

Collection of OAuth related configs

enable_outbound_auth_header

string

Default: FALSE

If TRUE, sends Auth header to the backend as received from the client.

auth_header

string

Default: Authorization

Possible Values: Any custom value

Valid authorization header for OAuth configurations.

revoke_endpoint

string

Default: https://localhost:9443/oauth2/revoke

Possible Values: Valid URL for revocation endpoint.

Token revocation endpoint used in the API Developer Portal

enable_token_encryption

string

Default: FALSE

If set to TRUE, the token stored in the database will be encrypted/decrypted when reading and storing. RSA/ECB/OAEPwithSHA1andMGF1PaddingIf FALSE - Setting Up OAuth Token Encryption | Extension Points for OAuth - IS Docs

enable_token_hashing

string

Default: FALSE

Similar to prev. Get desc from IS docs

allowed_scopes

string

Default: ["^device_.*,openid"]

List of allowlisted scopes. Take desc from Key Concepts page.

API-M gateway notification configurations

[apim.gateway_notification]
enabled = true
gateway_id = "gateway_00"

[apim.gateway_notification]

Gateway notification configurations for API revision deployment monitoring

enabled

boolean

Default: true

Possible Values: true,false

Enable or disable gateway notification feature.

gateway_id

string

Default: Randomly generated UUID

Unique identifier for the gateway instance.

API-M gateway notification heartbeat configurations

[apim.gateway_notification.heartbeat]
notify_interval = "1m"

[apim.gateway_notification.heartbeat]

Gateway heartbeat notification configurations

notify_interval

string

Default: 1m

Interval for sending heartbeat notifications from the gateway.

API-M deployment acknowledgment configurations

[apim.gateway_notification.deployment_ack]
batch_size = 100
batch_interval = "2s"
max_retry_count = 5
retry_duration = "10s"
retry_progression_factor = 2
batch_processor_min_thread = 2
batch_processor_max_thread = 8
batch_processor_keep_alive = "1m"
batch_processor_queue_size = 50

[apim.gateway_notification.deployment_ack]

Gateway deployment acknowledgment configurations

batch_size

integer

Default: 100

Number of deployment acknowledgments to process in a batch.

batch_interval

string

Default: 2s

Interval between batch processing operations.

max_retry_count

integer

Default: 5

Maximum number of retry attempts for failed acknowledgments.

retry_duration

string

Default: 10s

Initial retry duration for failed acknowledgments.

retry_progression_factor

integer

Default: 2

Factor by which retry duration increases after each failed attempt.

batch_processor_min_thread

integer

Default: 2

Minimum number of threads for batch processing.

batch_processor_max_thread

integer

Default: 8

Maximum number of threads for batch processing.

batch_processor_keep_alive

string

Default: 1m

Keep-alive time for idle threads in the batch processor.

batch_processor_queue_size

integer

Default: 50

Queue size for the batch processor.

API-M gateway notification registration configurations

[apim.gateway_notification.registration]
max_retry_count = 5
retry_duration = "10s"
retry_progression_factor = 2

[apim.gateway_notification.registration]

Gateway registration configurations

max_retry_count

integer

Default: 5

Maximum number of retry attempts for gateway registration.

retry_duration

string

Default: 10s

Initial retry duration for failed registration attempts.

retry_progression_factor

integer

Default: 2

Factor by which retry duration increases after each failed attempt.

API-M gateway notification cleanup configurations

[apim.gateway_notification.cleanup]
expiry_time = "2m"
data_retention_period = "30d"

[apim.gateway_notification.cleanup]

Gateway notification cleanup configurations for ACP or All In One deployments

expiry_time

string

Default: 2m

Time period after which a gateway is considered expired if no heartbeat is received.

data_retention_period

string

Default: 30d

Period for which notification data is retained before cleanup.

API-M platform gateway configurations

[apim.platform_gateway]
versions = ["1.0.0", "1.1.0"]

[apim.platform_gateway]

Configuration for Platform Gateway, a lightweight gateway distribution used for hybrid API Platform deployments.

versions

array

Default: []

List of Platform Gateway package version strings. These values are listed in the Gateway version drop-down when adding or editing a platform gateway from the Admin Portal.

API-M platform gateway connect configurations

[[apim.platform_gateway.connect]]
registration_token = "$env{PLATFORM_GW_1_REGISTRATION_TOKEN}"
name = "platform-gw-1"
display_name = "Production Platform Gateway"
description = "Platform Gateway for production traffic"
url = "https://<gateway-host>:<gateway-port>"
organization = "carbon.super"

[[apim.platform_gateway.connect]]

Declares a Platform Gateway that is registered through deployment.toml instead of the Admin Portal. Repeat this array-of-tables block once per gateway. The gateway record is created the first time the gateway connects to the Control Plane, not at startup. Note that this configuration is available in wso2am-4.7.0 starting from update level 7.

registration_token

string Required

Default:

The gateway's registration token, in <token-id>.<plain-token> format. Choose any value for <token-id> (for example a UUID) and <plain-token> (for example a random string) - this token is defined here, not copied from the Admin Portal. Configure the same value as GATEWAY_REGISTRATION_TOKEN on the gateway. Reference it with WSO2's $env{...} syntax (as shown above) rather than a literal value in deployment.toml, especially when deployment.toml is checked into version control.

url

string Required

Default:

The URL where the gateway will be accessible, for example https://<gateway-host>:<gateway-port>. Must be a valid http or https URL with a host.

name

string

Default: ID derived from registration_token

Environment name shown in the Control Plane. Use lowercase letters, numbers, and hyphens only. Defaults to an ID derived from registration_token when not set.

display_name

string

Default: name

Display name shown in the Admin Portal and Publisher Portal. Defaults to name when not set.

description

string

Default:

Optional description of the gateway.

organization

string

Default: carbon.super

Tenant organization that owns the gateway. A Platform Gateway is always scoped to a single tenant; WSO2-ALL-TENANTS is not supported here.

API-M Mutual SSL Configuration

[apimgt.mutual_ssl]
certificate_header = "SSL-CLIENT-CERT"
enable_client_validation = false
client_certificate_encode = false
enable_certificate_chain_validation = false

[apimgt.mutual_ssl] Required

Collection of Mutual SSL related configs

certificate_header

string

Default: X-WSO2-CLIENT-CERTIFICATE

Specifies the header name for the client certificate.

enable_client_validation

boolean

Default: false

Possible Values: true, false

This property needs to be true if the MutualSSL connection is established between the load balancer and the Gateway.

client_certificate_encode

boolean

Default: false

Possible Values: true, false

This property needs to be true if the certificate should be decoded when it is passed from the load balancer to the Gateway.

enable_certificate_chain_validation

boolean

Default: false

Possible Values: true, false

Specifies if certificate chain validation is enabled.

API Definitions Security Audit Configurations

[security_audit]
api_token="c21404ea-p13x-1swq-013a-pur90605uiwl"
collection_id="a5213vyo-6tre-560u-p04h-p0inb98i0gt1"
global=true
base_url="https://platform.42crunch.com/api/v1/apis"

[security_audit] Required

Configures API definitions security audit settings.

api_token

string Required

Default:

Specifies the API token for security audit.

collection_id

string Required

Default:

Specifies the collection ID for security audit.

global

boolean

Default: true

Possible Values: true, false

Specifies if security audit is globally enabled.

base_url

string

Default: https://platform.42crunch.com/api/v1/apis

Specifies the base URL for the 42Crunch platform.

API-M Developer Portal configurations

[apim.devportal]
url = "https://localhost:${mgt.transport.https.port}/devportal"
enable_application_sharing = false
if application_sharing_type, application_sharing_impl both defined priority goes to application_sharing_impl
application_sharing_type = "default" changed type, saml, default todo: check the new config for rest api
application_sharing_impl = "org.wso2.carbon.apimgt.impl.SAMLGroupIDExtractorImpl"
display_multiple_versions = false
display_deprecated_apis = false
enable_comments = true
enable_ratings = true
enable_forum = true
enable_legacy_api_keys = true
mode = "HYBRID"

[apim.devportal] Required

Configures the API Developer Portal

url

string Required

Default: https://localhost:9443/devportal

Public API Developer Portal URL

enable_application_sharing

string

Default: FALSE

Enable application sharing according to the claims.

application_sharing_type

string

Default: If the config is not mentioned, then undefined.default

Possible Values: default, saml

Use the application_sharing_impl as the default implementation. If it is saml, the group extractor extracts the claims to group the applications from the saml response.

application_sharing_impl

string

Default: Based on the application sharing type.

Need to define if the application_sharing_type is custom. If both application_sharing_type and application_sharing_impl are defined, take value from application_sharing_impl.

login_username_case_insensitive

string

Default: TRUE

Check with new UI

display_multiple_versions

string

Default: FALSE

If TRUE displays all the versions of the API under the API listing (and search depending on the new UI)

display_deprecated_apis

string

Default: FALSE

If TRUE displays all the deprecated APIs under the API listing (and search depending on the new UI)

enable_comments

string

Default: TRUE

Can comment on the API

enable_ratings

string

Default: TRUE

Enable rating the API with a star-based rating

enable_forum

string

Default: TRUE

^

enable_legacy_api_keys

string

Default: FALSE

The config to enable application bound legacy API key option.

application_sharing_claim

string

Default: http://wso2.org/claims/organization

The user claim used to group the applications.

mode

string

Default: HYBRID

Possible Values: HYBRID, API_ONLY, MCP_ONLY

The Developer Portal can operate in three modes. In HYBRID mode, both APIs and MCP servers are available. In API_ONLY mode, only APIs are shown. In MCP_ONLY mode, only MCP servers are shown.

API-M CORS configurations

[apim.cors]
allow_origins = "*"
allow_methods = ["GET","PUT","POST","DELETE","PATCH","OPTIONS"]
allow_headers = ["authorization","Access-Control-Allow-Origin","Content-Type","SOAPAction"]
allow_credentials = false

[apim.cors] Required

Configures CORS headers on the Publisher and the Gateway.

enable

string

Default: TRUE

CORS configurations are enabled by default.

allow_origins

string

Default: *

Denotes "Access-Control-Allow-Origin" response header. Specify an origin to share the response with.

allow_methods

string

Default: GET,PUT,POST,DELETE,PATCH,OPTIONS

Configures the methods allowed by the access control.

allow_headers

string

Default: authorization,Access-Control-Allow-Origin,Content-Type,SOAPAction

Configures the type of headers allowed by the access control.

allow_credentials

string

Default: FALSE

Specifying this header to true means that the server allows cookies (or other user credentials) to be included on cross-origin requests. It is false by default and if you set it to true then make sure that the Access-Control-Allow-Origin header does not contain the wildcard (*)

API-M Throttling configurations

[apim.throttling]
enable_data_publishing = true
enable_policy_deploy = true
enable_blacklist_condition = true
enable_persistence = true
enable_header_based_throttling = true
enable_jwt_claim_based_throttling = true
enable_query_param_based_throttling = true
enable_unlimited_tier = true
throttle_decision_endpoints = ["tcp://localhost:5672","tcp://localhost:5672"]
skip_redeploying_policies = ["carbon.super_app_unitApp","carbon.super_app_20PerMin"]

[apim.throttling] Required

Configures API-M traffic control.

event_type

string

Default: Binary

Possible Values: Thrift

Binary - Uses the binary transport. Recommended. Thrift - Uses thrift transport

receiver_url

string

Default: tcp://${carbon.local.ip}:${receiver.url.port}

Define traffic manager connection url inline. If none of this is defined consider it as "tcp://${carbon.local.ip}:${receiver.url.port}".

enable_header_based_throttling

string

Default: false

Specifying this header to true will enable a user to define header condition throttling policies in the Admin Portal.

enable_unlimited_tier

string

Default: true

Specifying this config to false will disable the unlimited throttling tier of basic throttling configurations.

enable_jwt_claim_based_throttling

string

Default: false

Specifying this config to true will enable a user to define JWT claim based throttling policies in the Admin Portal.

enable_query_param_based_throttling

string

Default: false

Specifying this config to true will enable a user to define Query parameter condition throttling policies in the Admin Portal.

skip_redeploying_policies

string

Default:

Define an array of throttle policies which don't need to redeploy on startup

enable_decision_connection

boolean

Default: true

Possible Values: true, false

This will enable/disable the JMS Message retrieval connection based on the provided value(true/false).

jms.ssl

boolean

Default: false

Possible Values: true, false

This will configure SSL in the JMS connection.

jms.start_delay

string

Default: not defined

Connection delay to read the Traffic Manager at startup.

jms.conn_jndi_name

string

Default: TopicConnectionFactory

Possible Values: custom value

The JNDI name of the connection factory.

jms.destination_type

string

Default: topic

Type of the destination.

jms.java_naming_factory_initial

string

Default: org.wso2.andes.jndi.PropertiesFileInitialContextFactory

Define JMS factory initials. If decision_connection_type is andes, this is "org.wso2.andes.jndi.PropertiesFileInitialContextFactory"

jms.topic_connection_factory

string

Default: not defined

Possible Values: custom value

Type of the connection factory.

jms.username

string

Default: super username

If the credentials of the user is different, use the credentials of the user configured for the JMS connection.

jms.password

string

Default: super user password

If the credentials of the user is different, use the credentials of the user configured for the JMS connection.

enable_data_publishing

boolean

Default: true

Possible Values: true, false

Enable publishing of request and throttling data.

enable_policy_deploy

boolean

Default: true

Possible Values: true, false

Enable deploying of throttling policies.

enable_blacklist_condition

boolean

Default: true

Possible Values: true, false

Enable blocking conditions from the admin portal.

enable_persistence

boolean

Default: false

Possible Values: true, false

Enable persisting current counter state of the TM.

API-M Throttling URL group configs

[apim.throttling.blacklist_condition]
start_delay = "5m"
period = "1h"

[apim.throttling.jms]
start_delay = "5m"

[apim.throttling.event_sync]
hostName = "0.0.0.0"
port = 11224

[apim.throttling.event_management]
hostName = "0.0.0.0"
port = 10005

LOADBALANCE CONFIGS
[[apim.throttling.url_group]]
traffic_manager_urls = ["tcp://localhost:9611","tcp://localhost:9611"]
traffic_manager_auth_urls = ["ssl://localhost:9711","ssl://localhost:9711"]
type = "loadbalance"

FAILOVER CONFIGS
[[apim.throttling.url_group]]
traffic_manager_urls = ["tcp://localhost:9611","tcp://localhost:9611"]
traffic_manager_auth_urls = ["ssl://localhost:9711","ssl://localhost:9711"]
type = "failover"

[apim.throttling.policy_deploy.tenant_loading]
tenants = "*"

[apim.throttling.url_group] Required

username

string

Default: super username

Credentials of the Traffic Manager user.

password

string

Default: super user password

Credentials of the Traffic Manager user.

receiver_username

string

Default: super username

If the username of the receiver is different, use the username of the receiver configured on the Traffic Manager.

receiver_password

string

Default: super user password

If the credentials of the receiver is different, use the password of the receiver configured on the Traffic Manager.

policy_deploy.username

string

Default: super username

If the credentials of the user is different, use the credentials of the user configured for deploying policies.

policy_deploy.password

string

Default: super user password

If the credentials of the user is different, use the credentials of the user configured for deploying policies.

policy_deploy.tenant_loading.tenants

string

Default: *

Define the tenants to load policies at startup. Use * to load all the tenants.

jms.username

string

Default: super username

If the credentials of the user is different, use the credentials of the user configured for the JMS connection.

jms.password

string

Default: super user password

If the credentials of the user is different, use the credentials of the user configured for the JMS connection.

publisher.max_idle

string

Default: 1000

Ideal values for the maximum no. of connections to the data publisher pool.

publisher.init_idle_size

string

Default: 200

Ideal values for the minimum no. of connections to the data publisher pool.

publisher.pool_size

string

Default: 200

The size of the thread pool in the API Publisher.

publisher.max_pool_size

string

Default: 1000

The maximum size of the thread pool in the API Publisher.

publisher.keep_alive_time

string

Default: 200s

The timeframe after which the publisher thread pool is terminated.

service_url

string Required

Default: https://localhost:${mgt.transport.https.port}${carbon.context}services/

Service URL of the Traffic Manager.

blacklist_condition.start_delay

string

Default: not defined

Define the delay time to get the blacklist conditions from the Keymanager.

jms.destination

string

Default: throttleData

JMS topic name

jms.start_delay

string

Default: not defined

Connection delay to read the Traffic Manager at startup.

jms.conn_jndi_name

string

Default: TopicConnectionFactory

Possible Values: custom value

jms.destination_type

string

Default: topic

decision_connection_type

string

Default: andes

Define the JMS type e.g.,: andes

jms.java_naming_factory_initial

string

Default:

Define JMS factory initials. If decision_connection_type is andes, this is "org.wso2.andes.jndi.PropertiesFileInitialContextFactory"

throttle_decision_endpoints

string Required

Default:

Define array of JMS connection as an array.

API-M Throttling URL group

[apim.throttling.blacklist_condition]
start_delay = "5m"
period = "1h"

[apim.throttling.jms]
start_delay = "5m"

[apim.throttling.event_sync]
hostName = "0.0.0.0"
port = 11224

[apim.throttling.event_management]
hostName = "0.0.0.0"
port = 10005

LOADBALANCE CONFIGS
[[apim.throttling.url_group]]
traffic_manager_urls = ["tcp://localhost:9611","tcp://localhost:9611"]
traffic_manager_auth_urls = ["ssl://localhost:9711","ssl://localhost:9711"]
type = "loadbalance"

FAILOVER CONFIGS
[[apim.throttling.url_group]]
traffic_manager_urls = ["tcp://localhost:9611","tcp://localhost:9611"]
traffic_manager_auth_urls = ["ssl://localhost:9711","ssl://localhost:9711"]
type = "failover"

[apim.throttling.policy_deploy.tenant_loading]
tenants = "*"

[apim.throttling.url_group] Required

traffic_manager_urls

string Required

Default:

Possible Values: TM binary server url

[[apim.throttling.url_group]]traffic_manager_urls = ["tcp://localhost:9611","tcp://localhost:9611"]traffic_manager_auth_urls = ["ssl://localhost:9711","ssl://localhost:9711"]type = "loadbalance"

traffic_manager_auth_urls

string Required

Default:

Possible Values: TM binary auth server url

type

string

Default: failover

Possible Values: failover,loadbalance

API-M Workflow configurations

[apim.workflow]
enable = false
service_url = "https://localhost:9445/bpmn"
username = "$ref{super_admin.username}"
password = "$ref{super_admin.password}"
callback_endpoint = "https://localhost:${mgt.transport.https.port}/api/am/publisher/v0.15/workflows/update-workflow-status"
token_endpoint = "https://localhost:${https.nio.port}/token"
client_registration_endpoint = "https://localhost:${mgt.transport.https.port}/client-registration/v0.15/register"
client_registration_username = "$ref{super_admin.username}"
client_registration_password = "$ref{super_admin.password}"

[apim.workflow] Required

Configures the workflows in API Manager

enable

string

Default: FALSE

Enable API State Change workflow.

service_url

string

Default: https://localhost:9445/bpmn

The service URL of the workflow engine.

wf_engine_user

string

Default: super username

Workflow username.

wf_engine_pass

string

Default: super user password

Workflow password.

callback_endpoint

string

Default: https://localhost:${mgt.transport.https.port}/api/am/publisher/v0.14/workflows/update-workflow-status

Callback URL for the workflow engine.

token_endpoint

string

Default: https://localhost:${https.nio.port}/token

Token endpoint used for the workflow.

client_registration_endpoint

string

Default: https://localhost:${mgt.transport.https.port}/client-registration/v0.14/register

DCR endpoint

client_registration_username

string

Default: super username

DCR username

API-M SDK configurations

[apim.sdk]
group_id = "org.wso2"
artifact_id = "org.wso2.client"
model_package = "org.wso2.client.model"
api_package = "org.wso2.client.api"
supported_languages = ["android", "java", "csharp", "dart", "groovy", "javascript", "jmeter", "perl", "php", "python", "ruby", "swift5", "clojure"]
                    

[apim.sdk] Required

group_id

string

Default: org.wso2

Group ID of the of the generated project.

artifact_id

string

Default: org.wso2.client.

Artifact ID of the generated project.

model_package

string

Default: org.wso2.client.model.

Model package of the generated project.

api_package

string

Default: org.wso2.client.api.

API package of the generated project.

supported_languages

string

Default: android, java, javascript, jmeter

Possible Values: android, java, csharp, dart, groovy, javascript, jmeter, perl, php, python, ruby, swift5, clojure

Supported programming languages.

API-M Open tracer configurations

[apim.open_tracer]
remote_tracer.enable = true
remote_tracer.name = "zipkin"
remote_tracer.properties.hostname = "localhost"
remote_tracer.properties.port = 9411
log_tracer.enable = true
                    

[apim.open_tracer] Required

Configurations related to tracing.

remote_tracer.enable

string

Default: FALSE

Enable tracing in API Manager. Traces the execution time upto message level.

remote_tracer.name

string

Default: zipkin

Tracer name.

remote_tracer.properties.hostname

string

Default: localhost

Hostname of the zipkin tool (tracer)

remote_tracer.properties.port

string

Default: 9411

Port allocated for the tool.

log_tracer.enable

string

Default: FALSE

Define whether to log the tracer values.

API-M token revocation

[apim.token.revocation]
notifier_impl = "org.wso2.carbon.apimgt.notification.TokenRevocationNotifierImpl"
enable_realtime_notifier = true
realtime_notifier.ttl = 5000
enable_persistent_notifier = true
persistent_notifier.hostname = "https://localhost:2379/v2/keys/jti/"
persistent_notifier.ttl = 5000
persistent_notifier.username = "root"
persistent_notifier.password = "root"

[apim.token.revocation] Required

Configures the token revocation on KM

notifier_impl

string

Default: org.wso2.carbon.apimgt.notification.TokenRevocationNotifierImpl

This config is required only during a custom implementation. If a token is revoked, the notification will be sent to the JMS topic. Write a custom implementation to change this behaviour.

realtime_notifier.ttl

string

Default: 5000

persistent_notifier.hostname

string

Default: https://localhost:2379/v2/keys/jti/

etcd hostname

persistent_notifier.ttl

string

Default: 5000

persistent_notifier.username

string

Default: root

persistent_notifier.password

string

Default: root

API-M Event Hub configurations

[apim.event_hub]
enabled = true
username = "username"
password = "password"
service_url = "https://control-plane-host/services/"
event_listening_endpoints = ["tcp://control-plane-host:5672"]
event_duplicate_url = ["tcp://control-plane-2-host:5672"]

[apim.event_hub]

Configures the event hub in API Manager

enable

boolean

Default: true

Possible Values: true,false

Enable the event hub.

username

string

Default: Username of the super tenant admin

Username of the super tenant admin.

password

string

Default: Password of the super tenant admin

Password of the super tenant admin.

service_url

string

Default:

Internal service URL of the event hub. This configuration is used to pull artifacts from the control plane.

event_listening_endpoints

string array

Default:

Array of event listening endpoints which are used to create a JMS connection with the control plane.

event_duplicate_url

string array

Default:

Array of endpoints which is used in control plane to communicate with the other in a HA setup (If multiple URLs are added, other URLs will be taken as failover endpoints).

event_waiting_time

integer

Default:

The waiting time before the gateway/traffic manager waits before processing JMS events received from the event hub (in Milliseconds).

API-M Event Hub Publish URL group configurations

[[apim.event_hub.publish.url_group]]
urls = ["tcp://control-plane-1-host:9611"]
auth_urls = ["ssl://control-plane-1-host:9711"]

[[apim.event_hub.publish.url_group]]
urls = ["tcp://control-plane-2-host:9611"]
auth_urls = ["ssl://control-plane-2-host:9711"]

[apim.event_hub.publish.url_group]

Configures event hub publish URL groups

urls

string array Required

Default:

Array of URLs used to publish event streams to the control plane in a HA setup (If multiple URLs are added, other URLs will be taken as failover endpoints).

auth_urls

string array Required

Default:

Array of URLs used to create a secure connection for binary data streaming to the control plane in a HA setup (If multiple URLs are added, other URLs will be taken as failover endpoints).

Enable Notifications

[apim.notification]
from_address = "abcd@gmail.com"
username = "abcd@gmail.com"
password = "xxxxxx"
hostname = "smtp.gmail.com"
port = "587"
enable_start_tls = true
enable_authentication = true

[apim.notifications]

from_address

string

Default:

The email address you use to send emails.

username

string

Default:

The email address used to authenticate the mail server. This can be the same email address as the from_address.

password

string

Default:

Password used to authenticate the mail server.

hostname

string

Default:

The SMTP server to connect to.

signature

string

Default:

Signature of the sender account.

port

string

Default: 25

The SMTP server port to connect to, if the connect() method does not explicitly specify one. Defaults to 25.

enable_start_tls

string

Default: false

If true, enables the use of the `STARTTLS` command (if supported by the server, before issuing any login commands). Note that an appropriate trust store must be configured so that the client will trust the certificate of the server. Defaults to false.

enable_authentication

string

Default: false

If true, it attempts to authenticate the user using the AUTH command. Defaults to false.

Tenant Management

[tenant_mgt]
enable_email_domain = true

[tenant_mgt]

enable_email_domain

string

Default: FALSE

Enable email login for tenant users.

Enable Password Recovery

[output_adapter.email]
from_address = "wso2am@gmail.com"
username = "wso2amtest"
password = "Wso2@am70"
signature = "do not reply"
hostname = "smtp.gmail.com"
port = "587"
enable_start_tls = true
enable_authentication = true

[output_adapter.email]

from_address

string

Default:

The email address you use to send emails.

username

string

Default:

The email address used to authenticate the mail server. This can be the same email address as the from_address.

password

string

Default:

Password used to authenticate the mail server.

hostname

string

Default:

The SMTP server to connect to.

signature

string

Default:

Signature of the sender account.

port

string

Default: 25

The SMTP server port to connect to, if the connect() method does not explicitly specify one. Defaults to 25.

enable_start_tls

string

Default: false

If true, enables the use of the `STARTTLS` command (if supported by the server, before issuing any login commands). Note that an appropriate trust store must be configured so that the client will trust the certificate of the server. Defaults to false.

enable_authentication

string

Default: false

If true, it attempts to authenticate the user using the AUTH command. Defaults to false.

Multi-tenancy Configurations

[multi_tenancy.stratos]
disable_tenant_management_emails = true
email_validation_mandatory_for_login = false
tenant_activation_moderated = false
super_admin_email = "super-admin-email"
skip_summary_generator = false
notification_email = "notification-email"
finance_notification_email = "finance-notification-email"
charge_on_registration = false
public_cloud_setup = true
google_analytics_url = "http://google-analytics.js"
sso_loading_message = "Loading..."

[multi_tenancy.stratos]

Configures the multi-tenant Stratos properties.

disable_tenant_management_emails

boolean

Default: TRUE

Disable tenant management emails for tenant users.

email_validation_mandatory_for_login

boolean

Default: FALSE

Enable or disable mandatory email validation when logging in.

tenant_activation_moderated

boolean

Default: FALSE

Enable or disable activation of moderated tenants.

super_admin_email

string

Default:

Email of the super admin user.

skip_summary_generator

boolean

Default: FALSE

Skip summary generator for tenants.

notification_email

string

Default:

The email address that is used to send event related notifications.

finance_notification_email

string

Default:

The email address that is used to send financial information related notifications.

charge_on_registration

boolean

Default: FALSE

The charge applicable for tenant registration.

public_cloud_setup

boolean

Default: TRUE

Enable or disable public cloud setup for tenants.

google_analytics_url

string

Default:

URL address of Google Analytics.

sso_loading_message

string

Default:

The message that is displayed when SSO is loaded.

[multi_tenancy.stratos.paypal]
url = "Paypal URL"
username = "username"
password = "password"
signature = "signature"
environment = "live"

[multi_tenancy.stratos.paypal]

url

string

Default:

The URL address of the attached PayPal account.

username

string

Default:

The username of the attached PayPal account.

password

string

Default:

The password of the attached PayPal account.

signature

string

Default:

The signature of the attached PayPal account.

environment

string

Default:

The environment of the attached PayPal account.

[multi_tenancy.stratos.manager_service]
url = "https://am.cloud.wso2.com/services/"
admin_username = "admin"
admin_password = "admin"

[multi_tenancy.stratos.manager_service]

Configures the Stratos manager service.

url

string

Default:

The URL of the Stratos manager service.

admin_username

string

Default:

The admin username of the Stratos manager service.

admin_password

string

Default:

The admin password of the Stratos manager service.

[multi_tenancy.usage_agent.data_persistence_task]
startup_delay_in_ms = "60000"
records_per_execution = "100"
execution_interval_in_ms = "-1"

[multi_tenancy.usage_agent.data_persistence_task]

Configures the data persistence for user agents in multi-tenant mode.

startup_delay_in_ms

string

Default:

Connection delay to start data persistence at startup.

records_per_execution

string

Default:

Number of records to be persisted per execution.

execution_interval_in_ms

string

Default: -1

Time between execution cycles in milliseconds.

Multi-tenancy throttling manager configurations

[multi_tenancy.throttling_manager_tasks]
data_providers = [
    "org.wso2.carbon.throttling.manager.dataproviders.BillingDataProvider",
    "org.wso2.carbon.throttling.manager.dataproviders.UsageDataProvider"
]

[multi_tenancy.throttling_manager_tasks]

Configures the multi-tenant throttling manager tasks.

data_providers

string array

Default:

Data providers for throttling management tasks.

[multi_tenancy.throttling_manager_tasks.parameters]
interval = "10"
delay = "60"

[multi_tenancy.throttling_manager_tasks.parameters]

Configures the parameters of multi-tenant throttling manager tasks.

interval

string

Default:

Time interval between throttling manager tasks.

delay

string

Default:

Time delay to start throttling manager tasks.

Multi-tenancy cloud services configurations

[multi_tenancy.cloud_services]
name = "WSO2 API Manager"
default = true
key = "AM"
label = "API Manager"
link = "https://am.cloud.wso2.com"
description = "API Manager in the cloud"

[multi_tenancy.cloud_services]

Configures the multi tenant cloud services.

name

string

Default:

Name of the cloud service.

default

boolean

Default: TRUE

Use as the default cloud service or not.

key

string

Default:

Key-value that represents the cloud service.

label

string

Default:

Label value that represents the cloud service.

link

string

Default:

URL link to the cloud service.

description

string

Default:

Description of the cloud service.

Multi-tenancy monetization configurations

[multi_tenancy.billing.package.demo]
name = "Demo"
subscription_charge = 0

[multi_tenancy.billing.package.demo]

This includes multi-tenancy monetization configurations related to the "Demo" package.

name

string

Default: Demo

Provides the name of the billing package that is being used.

subscription_charge

int

Default: 0

The value of the subscription charge for the billing package.

[multi_tenancy.billing.package.demo.users]
limit= "1"
charge= "0"

[multi_tenancy.billing.package.demo.users]

This includes the users' configurations related to the "Demo" billing package.

limit

string

Default: 1

Provides the number of users that can be attached to the "Demo" billing package.

charge

string

Default: 0

The value of the subscription charge for the "Demo" billing package per user.

[multi_tenancy.billing.package.demo.resource_volume]
limit= "20"
overuse_charge= "0"

[multi_tenancy.billing.package.demo.resource_volume]

This includes the resource volume configurations related to the "Demo" billing package.

limit

string

Default:

The maximum number of resources that can be charged with the given billing package.

overuse_charge

string

Default: 0

The charge for over usage based on the billing package.

[multi_tenancy.billing.package.demo.bandwidth]
limit= "50"
overuse_charge= "0"

[multi_tenancy.billing.package.demo.bandwidth]

This includes the bandwidth configurations related to the "Demo" billing package.

limit

string

Default:

The highest bandwidth value that can be allocated for the "Demo" billing package.

overuse_charge

string

Default: 0

The charge for over usage based on the billing package.

[multi_tenancy.billing.package.smb]
name = "SMB"
subscription_charge = "100"

[multi_tenancy.billing.package.smb]

This includes multi-tenancy monetization configurations related to the "SMB" package.

name

string

Default: SMB

Provides the name of the billing package that is being used.

subscription_charge

int

Default: 0

The value of the subscription charge for the billing package.

[multi_tenancy.billing.package.smb.users]
limit= "unlimited"
charge= "0"

[multi_tenancy.billing.package.smb.users]

This includes the users' configurations related to the "SMB" billing package.

limit

string

Default: 1

Provides the number of users that can be attached to the "SMB" billing package.

charge

string

Default: 0

Value of the subscription charge for the "SMB" billing package per user.

[multi_tenancy.billing.package.smb.resource_volume]
limit= "50"
overuse_charge= "0"

[multi_tenancy.billing.package.smb.resource_volume]

This includes the resource volume configurations related to the "SMB" billing package.

limit

string

Default:

The maximum number of resources that can be charged with the given billing package.

overuse_charge

string

Default: 0

The charge for over usage based on the billing package.

[multi_tenancy.billing.package.smb.bandwidth]
limit= "150"
overuse_charge= "0"

[multi_tenancy.billing.package.smb.bandwidth]

This includes the bandwidth configurations related to the "SMB" billing package.

limit

string

Default:

The highest bandwidth value that can be allocated for the "SMB" billing package.

overuse_charge

string

Default: 0

The charge for over usage based on the billing package.

[multi_tenancy.billing.package.custom]
name = "Professional"
subscription_charge = "500"

[multi_tenancy.billing.package.custom]

This includes multi-tenancy monetization configurations related to the custom package.

name

string

Default: SMB

The name of the custom billing package.

subscription_charge

int

Default: 0

The value of the subscription charge for the billing package.

[multi_tenancy.billing.package.custom.users]
limit= "unlimited"
charge= "0"

[multi_tenancy.billing.package.custom.users]

This includes the users' configurations related to the custom billing package.

limit

string

Default: 1

Provides the number of users that can be attached to the custom billing package.

charge

string

Default: 0

Value of the subscription charge for the custom billing package per user.

[multi_tenancy.billing.package.custom.resource_volume]
limit = "1536"
overuse_charge = "0.03"

[multi_tenancy.billing.package.custom.resource_volume]

This includes the resource volume configurations related to the custom billing package.

limit

string

Default:

The maximum number of resources that can be charged with the given billing package.

overuse_charge

string

Default: 0

The charge for over usage based on the billing package.

[multi_tenancy.billing.package.custom.bandwidth]
limit= "50"
overuse_charge= "0"

[multi_tenancy.billing.package.custom.bandwidth]

This includes the bandwidth configurations related to the custom billing package.

limit

string

Default:

The highest bandwidth value that can be allocated for the custom billing package.

overuse_charge

string

Default: 0

The charge for over usage based on the billing package.

Registry indexing configurations

[indexing]
enable = true
starting_delay = 35
frequency = 3
bach_size = 40
pool_size = 40
re_indexing = 1

[indexing]

Index configurations related to metadata search in registry.

enable

boolean

Default: true

Possible Values: true,false

Enable registry indexing, which indexes the APIs in the registry. Required only to be true on the API Publisher and Developer Portal nodes. WSO2 recommends disabling this on other nodes (Gateways, Traffic Managers, and Key Managers).

starting_delay

string

Default: 35

Initial startup delay for indexing (when the server is starting) in seconds.

frequency

string

Default: 3

Indexing frequency in seconds.

bach_size

string

Default: 40

Number of resources submitted for a given indexing thread.

pool_size

string

Default: 40

Number of worker threads for indexing.

re_indexing

string

Default: Not defined

Provide a number starting from 1. Increase the value by one during each time you need to reindex. Make sure to backup and delete the <API-M_HOME>/solr directory after changing the configuration and before restarting the server. After a server restart, reindexing might take a considerable amount of time depending on the number of APIs you have in the registry.

HTTP Servlet Transport

[transport.http.properties]
port = "9763"
redirectPort = "9443"
bindOnInit = "false"
maxHttpHeaderSize = "8192"
acceptorThreadCount = "2"
maxThreads = "250"
minSpareThreads = "50"
disableUploadTimeout = "false"
connectionUploadTimeout = "120000"
maxKeepAliveRequests = "200"
acceptCount = "200"
server = "WSO2 Carbon Server"
compression = "on"
compressionMinSize = "2048"
noCompressionUserAgents = "gozilla, traviata"
compressibleMimeType = "text/html,text/javascript,application/x-javascript,application/javascript,application/xml,text/css,application/xslt+xml,text/xsl,image/gif,image/jpg,image/jpeg"
URIEncoding = "UTF-8"

[transport.http.properties]

This configuration header is required for configuring the parameters that are used for tuning the default HTTP catalina server transport of the API Manager.

port

integer Required

Default: 9443

Possible Values: -

bindOnInit

boolean Required

Default: false

Possible Values: "true" or "false"

maxHttpHeaderSize

integer Required

Default: 8192

Possible Values: -

acceptorThreadCount

integer Required

Default: 2

Possible Values: -

maxThreads

integer Required

Default: 250

Possible Values: -

minSpareThreads

integer Required

Default: 50

Possible Values: -

disableUploadTimeout

boolean Required

Default: false

Possible Values: "true" or "false"

connectionUploadTimeout

integer Required

Default: 120000

Possible Values: -

maxKeepAliveRequests

integer Required

Default: 120000

Possible Values: -

keepAliveTimeout

integer Required

Default: 60000

Possible Values: 3000

acceptCount

integer Required

Default: 200

Possible Values: -

server

string Required

Default: WSO2 Carbon Server

Possible Values: -

compression

string Required

Default: on

Possible Values: -

compressionMinSize

integer Required

Default: 2048

Possible Values: -

noCompressionUserAgents

string Required

Default: gozilla, traviata

Possible Values: -

compressibleMimeType

string Required

Default: text/html,text/javascript,application/x-javascript,application/javascript,application/xml,text/css,application/xslt+xml,text/xsl,image/gif,image/jpg,image/jpeg

Possible Values: -

URIEncoding

string Required

Default: UTF-8

Possible Values: -

HTTPS Servlet Transport

[transport.https.properties]
port = "9763"
redirectPort = "9443"
bindOnInit = "false"
maxHttpHeaderSize = "8192"
acceptorThreadCount = "2"
maxThreads = "250"
minSpareThreads = "50"
disableUploadTimeout = "false"
connectionUploadTimeout = "120000"
maxKeepAliveRequests = "200"
acceptCount = "200"
server = "WSO2 Carbon Server"
compression = "on"
compressionMinSize = "2048"
noCompressionUserAgents = "gozilla, traviata"
compressibleMimeType = "text/html,text/javascript,application/x-javascript,application/javascript,application/xml,text/css,application/xslt+xml,text/xsl,image/gif,image/jpg,image/jpeg"
URIEncoding = "UTF-8"
enableLookups = "false"
scheme = "https"
secure = "true"
SSLEnabled = "true"

[transport.https.properties]

This configuration header is required for configuring the parameters that are used for tuning the default HTTPS catalina server transport of the API Manager.

port

integer Required

Default: 9443

Possible Values: -

bindOnInit

boolean Required

Default: false

Possible Values: "true" or "false"

maxHttpHeaderSize

integer Required

Default: 8192

Possible Values: -

acceptorThreadCount

integer Required

Default: 2

Possible Values: -

maxThreads

integer Required

Default: 250

Possible Values: -

minSpareThreads

integer Required

Default: 50

Possible Values: -

disableUploadTimeout

boolean Required

Default: false

Possible Values: "true" or "false"

connectionUploadTimeout

integer Required

Default: 120000

Possible Values: -

maxKeepAliveRequests

integer Required

Default: 120000

Possible Values: -

keepAliveTimeout

integer Required

Default: 60000

Possible Values: 3000

acceptCount

integer Required

Default: 200

Possible Values: -

server

string Required

Default: WSO2 Carbon Server

Possible Values: -

compression

string Required

Default: on

Possible Values: -

compressionMinSize

integer Required

Default: 2048

Possible Values: -

noCompressionUserAgents

string Required

Default: gozilla, traviata

Possible Values: -

compressibleMimeType

string Required

Default: text/html,text/javascript,application/x-javascript,application/javascript,application/xml,text/css,application/xslt+xml,text/xsl,image/gif,image/jpg,image/jpeg

Possible Values: -

URIEncoding

string Required

Default: UTF-8

Possible Values: -

enableLookups

boolean Required

Default: false

Possible Values: "true" or "false"

scheme

string Required

Default: https

Possible Values: -

secure

boolean Required

Default: true

Possible Values: "true" or "false"

SSLEnabled

boolean Required

Default: true

Possible Values: "true" or "false"

HTTP/S Pass-through Transport (non-blocking mode)

[transport.passthru_http]
listener.enable = true
listener.parameters.port = 8280
listener.parameters.non-blocking = true
listener.parameters.httpGetProcessor = "org.wso2.carbon.mediation.transport.handlers.PassThroughNHttpGetProcessor"
listener.parameters.WSDLEPRPrefix ="$ref{server.hostname}"
listener.bind-address = "$ref{server.hostname}"
sender.enable = true
sender.parameters.non-blocking = true
sender.warnOnHTTP500 = "*"
sender.http.proxyHost = "$ref{server.hostname}"
sender.http.proxyPort = 3128
sender.http.nonProxyHosts = ["$ref{server.hostname}"]
sender.hostname_verifier = "AllowAll"

[transport.passthru_https]
listener.enable = true
listener.parameters.port = 8243
listener.parameters.non-blocking = true
listener.parameters.httpGetProcessor = "org.wso2.carbon.mediation.transport.handlers.PassThroughNHttpGetProcessor"
listener.parameters.WSDLEPRPrefix ="$ref{server.hostname}"
listener.parameters.bind-address = "$ref{server.hostname}"
listener.parameters.SSLVerifyClient = "require"
listener.protocols = "TLSv1,TLSv1.1,TLSv1.2"
listener.ssl_profile.file_path = "repository/resources/security/listenerprofiles.xml"
listener.ssl_profile_interval = "600000"
listener.preferred_ciphers = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
listener.key_store.file_name ="$ref{keystore.tls.file_name}"
listener.key_store.type = "$ref{keystore.tls.type}"
listener.key_store.password = "$ref{keystore.tls.password}"
listener.key_store.key_password = "$ref{keystore.tls.key_password}"
listener.trust_store.file_name = "$ref{truststore.file_name}"
listener.trust_store.type = "$ref{truststore.type}"
listener.trust_store.password = "$ref{truststore.password}"
sender.enable = true
sender.parameters.non-blocking = true
sender.http.proxyHost = "$ref{server.hostname}"
sender.http.proxyPort = 3128
sender.http.nonProxyHosts = ["$ref{server.hostname}"]
sender.hostname_verifier = "AllowAll"
sender.key_store.file_name ="$ref{keystore.tls.file_name}"
sender.key_store.type = "$ref{keystore.tls.type}"
sender.key_store.password = "$ref{keystore.tls.password}"
sender.key_store.key_password = "$ref{keystore.tls.key_password}"
sender.trust_store.file_name = "$ref{truststore.file_name}"
sender.trust_store.type = "$ref{truststore.type}"
sender.trust_store.password = "$ref{truststore.password}"
sender.ssl_profile.file_path = "repository/resources/security/sslprofiles.xml"
sender.ssl_profile.interval = "600000"

[passthru_http]
http.socket.timeout = "3m"
worker_pool_size_core = 300
worker_pool_size_max = 400
worker_pool_queue_length = -1
io_buffer_size = 16384
http.max.connection.per.host.port = 32767
'http.user.agent.preserve' = false
'http.server.preserve' = true
'http.headers.preserve' = ["Content-Type"]
disable_connection_keepalive = false
max_open_connections = -1
force_xml_validation = false
force_json_validation = false

[transport.passthru_http]

This configuration header is required for configuring the parameters that are used for tuning the default HTTP passthrough transport of the API Manager in non-blocking mode.

listener.enable

boolean

Default: true

Possible Values: "true" or "false"

Enable the HTTP passthrough transport listener.

listener.parameters.port

integer

Default: 8280

Possible Values: -

The port on which this transport receiver should listen for incoming messages.

listener.parameters.non-blocking

string

Default: true

Possible Values: "true" or "false"

Enable non-blocking IO.

listener.parameters.httpGetProcessor

string

Default: org.wso2.carbon.mediation.transport.handlers.PassThroughNHttpGetProcessor

Possible Values: -

The class that processes HTTP GET requests.

listener.parameters.WSDLEPRPrefix

string Required

Default: -

Possible Values: -

A URL prefix which will be added to all service EPRs and EPRs in WSDLs etc.

sender.enable

boolean

Default: true

Possible Values: "true" or "false"

Enable the HTTP passthrough transport sender.

sender.warnOnHTTP500

string Required

Default: -

Possible Values: -

If the outgoing messages should be sent through an HTTP proxy server, use this parameter to specify the target proxy.

sender.http.proxyHost

string

Default: -

Possible Values: -

If the outgoing messages should be sent through an HTTP proxy server, use this parameter to specify the target proxy.

sender.http.proxyPort

integer

Default: -

Possible Values: -

The port through which the target proxy (specified by the 'sender.proxy_port' parameter) accepts HTTP traffic.

sender.http.nonProxyHosts

string Required

Default: -

Possible Values: -

The list of hosts to which the HTTP traffic should be sent directly without going through the proxy. When trying to add multiple hostnames along with an asterisk in order to define a set of sub-domains for non-proxy hosts, you need to add a period before the asterisk when configuring proxy server.

sender.hostname_verifier

string Required

Default: -

Possible Values: -

The list of hosts to which the HTTP traffic should be sent directly without going through the proxy. When trying to add multiple hostnames along with an asterisk in order to define a set of sub-domains for non-proxy hosts, you need to add a period before the asterisk when configuring proxy server.

[transport.passthru_https]

This configuration header is required for configuring the parameters that are used for tuning the default HTTPS passthrough transport of the API Manager in non-blocking mode.

listener.enable

boolean

Default: true

Possible Values: "true" or "false"

Enable the HTTPS passthrough transport listener.

listener.parameters.port

integer Required

Default: 8243

Possible Values: -

The secured port on which this transport receiver should listen for incoming messages.

listener.parameters.httpGetProcessor

string

Default: org.wso2.carbon.mediation.transport.handlers.PassThroughNHttpGetProcessor

Possible Values: -

The class that processes HTTP GET requests.

listener.parameters.WSDLEPRPrefix

string Required

Default: -

Possible Values: -

A URL prefix which will be added to all service EPRs and EPRs in WSDLs etc.

listener.key_store.file_name

string Required

Default: API-M_HOME/repository/resources/security/wso2carbon.jks

Possible Values: -

The path to the keystore file that is used for securing the HTTP passthrough connection. By default, the keystore file of the primary keystore is enabled for this purpose.

listener.key_store.type

string Required

Default: JKS

Possible Values: "JKS" or "PKCS12"

The type of the keystore file. By default, the keystore type of the primary keystore is enabled for this purpose.

listener.key_store.password

string Required

Default: wso2carbon

Possible Values: -

The password of the keystore file that is used for securing the HTTP passthrough connection. This keystore password is used when accessing the keys in the keystore. By default, the keystore password of the primary keystore is enabled for this purpose.

listener.key_store.key_password

string Required

Default: wso2carbon

Possible Values: -

The password of the private key that is used for securing the HTTP passthrough connection. This keystore password is used when accessing the keys in the keystore. By default, the keystore password of the primary keystore is enabled for this purpose.

listener.trust_store.file_name

string Required

Default: API-M_HOME/repository/resources/security/wso2truststore.jks

Possible Values: -

The path to the keystore file that is used for storing the trusted digital certificates. By default, the product's trust store is configured for this purpose.

listener.trust_store.type

string Required

Default: JKS

Possible Values: "JKS" or "PKCS12"

The type of the keystore file that is used as the trust store. By default, the product's trust store is configured for this purpose.

listener.trust_store.password

string Required

Default: wso2carbon

Possible Values: -

The password of the keystore file that is used as the trust store. By default, the product's trust store is configured for this purpose.

sender.http.proxyHost

string

Default: -

Possible Values: -

If the outgoing messages should be sent through an HTTP proxy server, use this parameter to specify the target proxy.

sender.http.proxyPort

integer

Default: -

Possible Values: -

The port through which the target proxy (specified by the 'sender.proxy_port' parameter) accepts HTTP traffic.

sender.http.nonProxyHosts

string Required

Default: -

Possible Values: -

The list of hosts to which the HTTP traffic should be sent directly without going through the proxy. When trying to add multiple hostnames along with an asterisk in order to define a set of sub-domains for non-proxy hosts, you need to add a period before the asterisk when configuring proxy server.

sender.hostname_verifier

string Required

Default: -

Possible Values: -

The list of hosts to which the HTTP traffic should be sent directly without going through the proxy. When trying to add multiple hostnames along with an asterisk in order to define a set of sub-domains for non-proxy hosts, you need to add a period before the asterisk when configuring proxy server.

sender.key_store.file_name

string Required

Default: API-M_HOME/repository/resources/security/wso2carbon.jks

Possible Values: -

The path to the keystore file that is used for securing the HTTP passthrough connection. By default, the keystore file of the primary keystore is enabled for this purpose.

sender.key_store.type

string Required

Default: JKS

Possible Values: "JKS" or "PKCS12"

The type of the keystore file. By default, the keystore type of the primary keystore is enabled for this purpose.

sender.key_store.password

string Required

Default: wso2carbon

Possible Values: -

The password of the keystore file that is used for securing the HTTP passthrough connection. This keystore password is used when accessing the keys in the keystore. By default, the keystore password of the primary keystore is enabled for this purpose.

sender.key_store.key_password

string Required

Default: wso2carbon

Possible Values: -

The password of the private key that is used for securing the HTTP passthrough connection. This keystore password is used when accessing the keys in the keystore. By default, the keystore password of the primary keystore is enabled for this purpose.

sender.trust_store.file_name

string Required

Default: API-M_HOME/repository/resources/security/wso2truststore.jks

Possible Values: -

The path to the keystore file that is used for storing the trusted digital certificates. By default, the product's trust store is configured for this purpose.

sender.trust_store.type

string Required

Default: JKS

Possible Values: "JKS" or "PKCS12"

The type of the keystore file that is used as the trust store. By default, the product's trust store is configured for this purpose.

sender.trust_store.password

string Required

Default: wso2carbon

Possible Values: -

The password of the keystore file that is used as the trust store. By default, the product's trust store is configured for this purpose.

[passthru_http]

This configuration header is required for configuring the parameters that are used for tuning the default HTTP passthrough transport of the API Manager in non-blocking mode.

http.socket.timeout

integer Required

Default: 180000

Possible Values: -

This is the maximum period of inactivity between two consecutive data packets, specified in milliseconds.

worker_pool_size_core

integer Required

Default: 400

Possible Values: -

The API Manager uses a thread pool executor to create threads and to handle incoming requests. This parameter controls the number of core threads used by the executor pool. If you increase this parameter value, the number of requests received that can be processed by the gateway increases, hence, the throughput also increases. The nature of the integration scenario and the number of concurrent requests received by the gateway are the main factors that helps to determine this parameter.

worker_pool_size_max

integer Required

Default: 400

Possible Values: -

This is the maximum number of threads in the worker thread pool. Specifying a maximum limit avoids performance degradation that can occur due to context switching. If the specified value is reached, you will see the error 'SYSTEM ALERT - HttpServerWorker threads were in BLOCKED state during last minute'. This can occur due to an extraordinarily high number of requests sent at a time when all the threads in the pool are busy, and the maximum number of threads is already reached.

worker_pool_queue_length

integer Required

Default: -1

Possible Values: -

This defines the length of the queue that is used to hold runnable tasks to be executed by the worker pool. The thread pool starts queuing jobs when all the existing threads are busy, and the pool has reached the maximum number of threads. The value for this parameter should be -1 to use an unbound queue. If a bound queue is used and the queue gets filled to its capacity, any further attempts to submit jobs fail causing some messages to be dropped by Synapse.

io_buffer_size

integer Required

Default: 16384

Possible Values: -

This is the value of the memory buffer allocated when reading data into the memory from the underlying socket/file channels. You should leave this property set to the default value.

http.max.connection.per.host.port

integer Required

Default: 32767

Possible Values: -

This defines the maximum number of connections allowed per host port.

'http.user.agent.preserve'

boolean Required

Default: "true" or "false"

Possible Values: -

If this parameter is set to true, the user-agent HTTP header of messages passing through the integrator is preserved and printed in the outgoing message.

'http.headers.preserve'

string Required

Default: Content-Type

Possible Values: -

This parameter allows you to specify the header field/s of messages passing through the EI that need to be preserved and printed in the outgoing message such as Location, CommonsHTTPTransportSenderKeep-Alive, Date, Server, User-Agent, and Host. For example, http.headers.preserve = Location, Date, Server.

disable_connection_keepalive

boolean Required

Default: false

Possible Values: "true" or "false"

This parameter allows you to specify the header field/s of messages passing through the APIM that need to be preserved and printed in the outgoing message such as Location, CommonsHTTPTransportSenderKeep-Alive, Date, Server, User-Agent, and Host.

max_open_connections

integer

Default: -1

Possible Values: -

This property allows connection throttling to restrict the number of simultaneously opened connections. That is, simultaneously opened incoming connections will be restricted by the specified value. To disable throttling, delete the ‘max_open_connections’ setting or set it to -1.

force_xml_validation

boolean

Default: false

Possible Values: "true" or "false"

This property validates badly formed XML messages by building the whole XML document.

force_json_validation

boolean

Default: false

Possible Values: "true" or "false"

This property validates JSON messages by parsing the input message.

HTTP/S Pass-through Transport (blocking mode)

[transport.blocking_http]
sender.parameters.cacheHttpClient = true
sender.parameters.Transfer-Encoding = ""
sender.parameters.defaultMaxConnectionsPerHost = 200
sender.parameters.OmitSOAP12Action = true
sender.parameters.SO_TIMEOUT = 60000
sender.parameters.'http.proxyHost' = "$env{OUT_PROXY_HOST}"
sender.parameters.'http.proxyPort' = "$env{OUT_PROXY_PORT}"
sender.parameters.'http.nonProxyHosts' = "$env{OUT_PROXY_NON_HOSTS}"

[transport.blocking_https]
sender.parameters.cacheHttpClient = true
sender.parameters.Transfer-Encoding = ""
sender.parameters.defaultMaxConnectionsPerHost = 200
sender.parameters.OmitSOAP12Action = true
sender.parameters.SO_TIMEOUT = 60000
sender.parameters.'http.proxyHost' = "$env{OUT_PROXY_HOST}"
sender.parameters.'http.proxyPort' = "$env{OUT_PROXY_PORT}"
sender.parameters.'http.nonProxyHosts' = "$env{OUT_PROXY_NON_HOSTS}"

[transport.blocking_http]

This configuration header is required for configuring the parameters that are used for configuring the default HTTP passthrough transport in blocking mode

sender.parameters.cacheHttpClient

boolean Required

Default: -

Possible Values: "true" or "false"

This parameter is used to specify whether the HTTP client should save cache entries and the cached responses in the JVM memory or not.

sender.parameters.Transfer-Encoding

string Required

Default: -

Possible Values: "chunked" or "true"

This parameter enables you to specify whether the data sent should be chunked. It can be used instead of the Content-Length header if you want to upload data without having to know the amount of data to be uploaded in advance.

sender.parameters.defaultMaxConnectionsPerHost

integer Required

Default: -

Possible Values: -

The maximum number of connections that will be created per host server by the client. If the backend server is slow, the connections in use at a given time will take a long time to be released and added back to the connection pool. As a result, connections may not be available for some requests. In such situations, it is recommended to increase the value for this parameter.

sender.parameters.OmitSOAP12Action

boolean Required

Default: -

Possible Values: "true" or "false"

If following is set to 'true', optional action part of the Content-Type will not be added to the SOAP 1.2 messages.

sender.parameters.SO_TIMEOUT

integer Required

Default: -

Possible Values: 60000

If following is set to 'true', optional action part of the Content-Type will not be added to the SOAP 1.2 messages.

sender.parameters.'http.proxyHost'

string

Default: -

Possible Values: -

If the outgoing messages should be sent through an HTTP proxy server (in blocking mode), use this parameter to specify the target proxy.

sender.parameters.'http.proxyPort'

integer

Default: -

Possible Values: -

The port through which the target proxy (specified by the 'sender.proxy_host' parameter) accepts HTTP traffic (in blocking mode).

sender.parameters.'http.nonProxyHosts'

string

Default: -

Possible Values: -

The list of hosts to which the HTTP traffic should be sent directly without going through the proxy. When trying to add multiple hostnames along with an asterisk in order to define a set of sub-domains for non-proxy hosts, you need to add a period before the asterisk when configuring proxy server.

[transport.blocking_https]

This configuration header is required for configuring the parameters that are used for configuring the default HTTPS passthrough transport in blocking mode

sender.parameters.cacheHttpClient

boolean Required

Default: -

Possible Values: "true" or "false"

This parameter is used to specify whether the HTTPS client should save cache entries and the cached responses in the JVM memory or not.

sender.parameters.Transfer-Encoding

string Required

Default: -

Possible Values: "chunked" or "true"

This parameter enables you to specify whether the data sent should be chunked. It can be used instead of the Content-Length header if you want to upload data without having to know the amount of data to be uploaded in advance.

sender.parameters.defaultMaxConnectionsPerHost

integer Required

Default: -

Possible Values: -

The maximum number of connections that will be created per host server by the client. If the backend server is slow, the connections in use at a given time will take a long time to be released and added back to the connection pool. As a result, connections may not be available for some requests. In such situations, it is recommended to increase the value for this parameter.

sender.parameters.OmitSOAP12Action

boolean Required

Default: -

Possible Values: "true" or "false"

If following is set to 'true', optional action part of the Content-Type will not be added to the SOAP 1.2 messages.

sender.parameters.SO_TIMEOUT

integer Required

Default: -

Possible Values: 60000

If following is set to 'true', optional action part of the Content-Type will not be added to the SOAP 1.2 messages.

sender.parameters.'http.proxyHost'

string

Default: -

Possible Values: -

If the outgoing messages should be sent through an HTTPS proxy server (in blocking mode), use this parameter to specify the target proxy.

sender.parameters.'http.proxyPort'

integer

Default: -

Possible Values: -

The port through which the target proxy (specified by the 'sender.proxy_host' parameter) accepts HTTPS traffic (in blocking mode).

sender.parameters.'http.nonProxyHosts'

string

Default: -

Possible Values: -

The list of hosts to which the HTTPS traffic should be sent directly without going through the proxy. When trying to add multiple hostnames along with an asterisk in order to define a set of sub-domains for non-proxy hosts, you need to add a period before the asterisk when configuring proxy server.

HTTP proxy profile

#You can use one of the two options listed below for the configuration

#Option 1
[transport.passthru_http.sender.parameters]
proxyProfiles = "<targetHosts>example.one.com,example.two.com</targetHosts>
<proxyHost>example.proxy.com</proxyHost>
<proxyPort>8080</proxyPort>
<proxyUserName>ProxyUser</proxyUserName>
<proxyPassword>password</proxyPassword></profile>"

#Option 2
[[transport.http.proxy_profile]]
target_hosts = ["example.one.com","example.two.com"]
proxy_host = "example.proxy.com"
proxy_port = "8080"
proxy_username = "ProxyUser"
proxy_password = "password"
bypass_hosts = ["localhost"]

[[transport.passthru_http.sender.parameters]]

This configuration header is required for configuring HTTP proxy profiles when you need multiple proxy servers to route messages to different endpoints.

proxyProfiles

string Required

Default: -

Possible Values: <profile><targetHosts>example.com</targetHosts><proxyHost>localhost</proxyHost><proxyPort>8080</proxyPort><proxyUserName>squidUser</proxyUserName><proxyPassword>password</proxyPassword></profile>

Attribute to define a full proxy profile. Following fields describes the elements used inside the profile

targetHosts

string Required

Default: -

Possible Values: "*", "example.com", "<any-ip-address>"

A host name or a comma-separated list of host names for a target endpoint. Host names can be specified as regular expressions that match a pattern. When asterisks (*) is specified as the target hostname, it will match all the hosts in the profile.

proxyHost

string Required

Default: -

Possible Values: -

The host name of the proxy server.

proxyPort

integer Required

Default: -

Possible Values: -

The port number of the proxy server.

proxyUserName

string Required

Default: -

Possible Values: -

The username for authenticating the proxy server.

proxyPassword

string Required

Default: -

Possible Values: -

The password for authenticating the proxy server.

HTTP secured proxy profile

#You can use one of the two options listed below for the configuration

#Option 1
[transport. passthru_https.sender.parameters]
proxyProfiles = "<targetHosts>example.one.com,example.two.com</targetHosts>
<proxyHost>example.proxy.com</proxyHost>
<proxyPort>3128</proxyPort>
<proxyUserName>ProxyUser</proxyUserName>
<proxyPassword>password</proxyPassword></profile>"

#Option 2
[[transport.http. secured_proxy_profile]]
target_hosts = ["example.one.com","example.two.com"]
proxy_host = "example.proxy.com"
proxy_port = "3128"
proxy_username = "ProxyUser"
proxy_password = "password"
bypass_hosts = ["localhost"]

[[transport.passthru_https.sender.parameters]]

This configuration header is required for configuring HTTP proxy profiles when you need multiple proxy servers to route messages to different endpoints.

proxyProfiles

string Required

Default: -

Possible Values: <profile><targetHosts>example.com</targetHosts><proxyHost>localhost</proxyHost><proxyPort>8080</proxyPort><proxyUserName>squidUser</proxyUserName><proxyPassword>password</proxyPassword></profile>

Attribute to define a full proxy profile. Following fields describes the elements used inside the profile

targetHosts

string Required

Default: -

Possible Values: "*", "example.com", "<any-ip-address>"

A host name or a comma-separated list of host names for a target endpoint. Host names can be specified as regular expressions that match a pattern. When asterisks (*) is specified as the target hostname, it will match all the hosts in the profile.

proxyHost

string Required

Default: -

Possible Values: -

The host name of the proxy server.

proxyPort

integer Required

Default: -

Possible Values: -

The port number of the proxy server.

proxyUserName

string Required

Default: -

Possible Values: -

The username for authenticating the proxy server.

proxyPassword

string Required

Default: -

Possible Values: -

The password for authenticating the proxy server.

Websocket Transport

[transport.ws]
sender.enable = false
sender.parameters.ws.outflow.dispatch.sequence = "outflowDispatchSeq"
sender.parameters.ws.outflow.dispatch.fault.sequence = "outflowFaultSeq"
sender.parameters.wsSharedEventLoopPoolSize = 5
sender.parameter.customParameter = ""

[transport.ws]

This configuration header groups the parameters that configure the API Manager to communicate through the Websocket transport.

sender.enable

boolean Required

Default: false

Possible Values: "true" or "false"

The parameter for enabling the websocket transport listener.

sender.parameters.ws.outflow.dispatch.sequence

string

Default: outflowDispatchSeq

Possible Values: -

The sequence for the back-end to client mediation.

sender.parameters.ws.outflow.dispatch.fault.sequence

string

Default: outflowFaultSeq

Possible Values: -

The fault sequence for the back-end to client mediation path.

sender.parameters.wsSharedEventLoopPoolSize

integer

Default: -

Possible Values: 5

The thread pool size of the shared EventLoopGroup used by WebsocketConnectionFactory for managing WebSocket client connections.

sender.parameter.customParameter

string

Default: -

Possible Values: -

Replace 'customParameter' with required parameter name.

Secure Websocket Transport

[transport.wss]
sender.enable = false
sender.parameters.ws.outflow.dispatch.sequence = "outflowDispatchSeq"
sender.parameters.ws.outflow.dispatch.fault.sequence = "outflowFaultSeq"
sender.parameters.wsSharedEventLoopPoolSize = 5
sender.parameter.customParameter = ""
sender.trust_store.location = "$ref{truststore.file_name}"
sender.trust_store.password = "$ref{truststore.password}"

[transport.wss]

This configuration header groups the parameters that configure the API Manager to communicate through the secured Websocket transport.

sender.enable

boolean Required

Default: false

Possible Values: "true" or "false"

The parameter for enabling the websocket secured transport sender.

sender.parameters.ws.outflow.dispatch.sequence

string

Default: outflowDispatchSeq

Possible Values: -

The sequence for the back-end to client mediation.

sender.parameters.ws.outflow.dispatch.fault.sequence

string

Default: outflowFaultSeq

Possible Values: -

The fault sequence for the back-end to client mediation path.

sender.parameters.wsSharedEventLoopPoolSize

integer

Default: -

Possible Values: 5

The thread pool size of the shared EventLoopGroup used by WebsocketConnectionFactory for managing WebSocket client connections.

sender.trust_store.location

string Required

Default: API-M_HOME/repository/resources/security/wso2truststore.jks

Possible Values: -

The file path to the truststore that stores the trusted digital certificates for websocket use cases. By default, the product's trust store is configured for this purpose.

sender.trust_store.password

string Required

Default: wso2carbon

Possible Values: -

The password of the keystore file that is used as the trust store.

sender.parameter.customParameter

string

Default: -

Possible Values: -

Replace 'customParameter' with required parameter name.

WebSocket Proxy Profile

# Example deployment.toml entry
[[transport.ws.proxy_profile]]
target_hosts = ["example\\.backend\\.corp"]
proxy_host = "proxy.corp.internal"
proxy_port = 3128
proxy_username = ""
proxy_password = ""
bypass_hosts = ["localhost", "127\\.0\\.0\\.1"]

[[transport.ws.proxy_profile]]
target_hosts = ["*"]
proxy_host = "proxy.corp.internal"
proxy_port = 3128
bypass_hosts = ["localhost"]

[[transport.ws.proxy_profile]]

Configures an HTTP CONNECT proxy profile for outbound WebSocket (ws://) connections from the gateway to the backend. Multiple profiles can be defined; the gateway evaluates them in order and uses the first matching profile. Specific profiles (no wildcard in target_hosts) are evaluated before the catch-all profile (target_hosts = ["*"]).

target_hosts

string Required

Default:

Possible Values: ["example\\.com"], ["*"]

A list of Java regular expression patterns matched against the backend hostname. Use ["*"] to create a catch-all profile that applies to all hosts not matched by a specific profile. Escape dots: "example\\.com".

proxy_host

string Required

Default:

Possible Values: -

Hostname or IP address of the HTTP CONNECT proxy server.

proxy_port

integer Required

Default:

Possible Values: -

Port number of the HTTP CONNECT proxy server.

bypass_hosts

string

Default:

Possible Values: ["localhost", "127\\.0\\.0\\.1"]

A list of Java regular expression patterns. Backend hosts matching any pattern connect directly, bypassing the proxy for this profile. Takes precedence over target_hosts.

proxy_username

string

Default:

Possible Values: -

Username for Proxy-Authorization: Basic authentication. Omit for an unauthenticated proxy.

proxy_password

string

Default:

Possible Values: -

Password for proxy authentication.

Secure WebSocket Proxy Profile

# Example deployment.toml entry
[[transport.wss.proxy_profile]]
target_hosts = ["secure-backend\\.corp"]
proxy_host = "proxy.corp.internal"
proxy_port = 3128
proxy_username = ""
proxy_password = ""
bypass_hosts = ["localhost", "127\\.0\\.0\\.1"]

[[transport.wss.proxy_profile]]
target_hosts = ["*"]
proxy_host = "proxy.corp.internal"
proxy_port = 3128
bypass_hosts = ["localhost"]

[[transport.wss.proxy_profile]]

Configures an HTTP CONNECT proxy profile for outbound secure WebSocket (wss://) connections from the gateway to the backend. The gateway opens a raw TCP tunnel through the proxy via HTTP CONNECT, then performs TLS with the backend inside that tunnel. Multiple profiles can be defined; evaluation rules are the same as for ws proxy profiles.

target_hosts

string Required

Default:

Possible Values: ["example\\.com"], ["*"]

A list of Java regular expression patterns matched against the backend hostname. Use ["*"] to create a catch-all profile that applies to all hosts not matched by a specific profile. Escape dots: "example\\.com".

proxy_host

string Required

Default:

Possible Values: -

Hostname or IP address of the HTTP CONNECT proxy server.

proxy_port

integer Required

Default:

Possible Values: -

Port number of the HTTP CONNECT proxy server.

bypass_hosts

string

Default:

Possible Values: ["localhost", "127\\.0\\.0\\.1"]

A list of Java regular expression patterns. Backend hosts matching any pattern connect directly, bypassing the proxy for this profile. Takes precedence over target_hosts.

proxy_username

string

Default:

Possible Values: -

Username for Proxy-Authorization: Basic authentication. Omit for an unauthenticated proxy.

proxy_password

string

Default:

Possible Values: -

Password for proxy authentication.

Message Builders (non-blocking mode)

[message_builders]
application_xml = "org.apache.axis2.builder.ApplicationXMLBuilder"
form_urlencoded = "org.apache.synapse.commons.builders.XFormURLEncodedBuilder"
multipart_form_data = "org.apache.axis2.builder.MultipartFormDataBuilder"
text_plain = "org.apache.axis2.format.PlainTextBuilder"
application_json = "org.wso2.micro.integrator.core.json.JsonStreamBuilder"
json_badgerfish = "org.apache.axis2.json.JSONBadgerfishOMBuilder"
text_javascript = "org.apache.axis2.json.JSONBuilder"
octet_stream =  "org.wso2.carbon.relay.BinaryRelayBuilder"
application_binary = "org.apache.axis2.format.BinaryBuilder"

[message_builders]

This configuration header is required for configuring the implementation that is used to build messages that are received by the API Manager in the default non-blocking mode.

application_xml

string

Default: org.apache.axis2.builder.ApplicationXMLBuilder

Possible Values: -

The message builder implementation that builds messages with the 'application_xml' content type. If required, you can change the default builder class.

form_urlencoded

string

Default: -

Possible Values: org.apache.synapse.commons.builders.XFormURLEncodedBuilder

The message builder implementation that builds messages with the 'form_urlencoded' content type. If required, you can change the default builder class.

multipart_form_data

string

Default: org.apache.axis2.builder.MultipartFormDataBuilder

Possible Values: -

The message builder implementation that builds messages with the 'multipart_form_data' content type. If required, you can change the default builder class.

text_plain

string

Default: org.apache.axis2.format.PlainTextBuilder

Possible Values: -

The message builder implementation that builds messages with the 'text_plain' content type. If required, you can change the default builder class.

application_json

string

Default: org.wso2.micro.integrator.core.json.JsonStreamBuilder

Possible Values: -

The message builder implementation that builds messages with the 'application_json' content type. If required, you can change the default builder class.

json_badgerfish

string

Default: org.apache.axis2.json.JSONBadgerfishOMBuilder

Possible Values: -

The message builder implementation that builds messages with the 'json_badgerfish' content type. If required, you can change the default builder class.

text_javascript

string

Default: org.apache.axis2.json.JSONBuilder

Possible Values: -

The message builder implementation that builds messages with the 'text_javascript' content type. If required, you can change the default builder class.

octet_stream

string

Default: org.wso2.carbon.relay.BinaryRelayBuilder

Possible Values: -

The message builder implementation that builds messages with the 'octet_stream' content type. If required, you can change the default builder class.

application_binary

string

Default: org.apache.axis2.format.BinaryBuilder

Possible Values: -

The message builder implementation that builds messages with the 'application_binary' content type. If required, you can change the default builder class.

Message Builders (blocking mode)

[blocking.message_builders]
application_xml = "org.apache.axis2.builder.ApplicationXMLBuilder"
form_urlencoded = "org.apache.synapse.commons.builders.XFormURLEncodedBuilder"
multipart_form_data = "org.apache.axis2.builder.MultipartFormDataBuilder"
text_plain = "org.apache.axis2.format.PlainTextBuilder"
application_json = "org.wso2.micro.integrator.core.json.JsonStreamBuilder"
json_badgerfish = "org.apache.axis2.json.JSONBadgerfishOMBuilder"
text_javascript = "org.apache.axis2.json.JSONBuilder"
octet_stream =  "org.wso2.carbon.relay.BinaryRelayBuilder"
application_binary = "org.apache.axis2.format.BinaryBuilder"

[blocking.message_builders]

This configuration header is required for configuring the message builder implementation that is used to build messages that are received by the API Manager in blocking mode. You can use the same list of parameters that are available for message builders in non-blocking mode.

Message Formatters (non-blocking mode)

[message_formatters]
form_urlencoded =  "org.apache.synapse.commons.formatters.XFormURLEncodedFormatter"
multipart_form_data =  "org.apache.axis2.transport.http.MultipartFormDataFormatter"
application_xml = "org.apache.axis2.transport.http.ApplicationXMLFormatter"
text_xml = "org.apache.axis2.transport.http.SOAPMessageFormatter"
soap_xml = "org.apache.axis2.transport.http.SOAPMessageFormatter"
text_plain = "org.apache.axis2.format.PlainTextFormatter"
application_json =  "org.wso2.micro.integrator.core.json.JsonStreamFormatter"
json_badgerfish = "org.apache.axis2.json.JSONBadgerfishMessageFormatter"
text_javascript = "org.apache.axis2.json.JSONMessageFormatter"
octet_stream = "org.wso2.carbon.relay.ExpandingMessageFormatter"
application_binary =  "org.apache.axis2.format.BinaryFormatter"

[message_formatters]

This configuration header is required for configuring the message formatting implementation that is used for formatting messages that are sent out of the API Manager in non-blocking mode.

application_xml

string

Default: org.apache.axis2.transport.http.ApplicationXMLFormatter

Possible Values: -

The message formatting implementation that formats messages with the 'application_xml' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

form_urlencoded

string

Default: -

Possible Values: org.apache.synapse.commons.formatters.XFormURLEncodedFormatter

The message formatting implementation that formats messages with the 'form_urlencoded' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

multipart_form_data

string

Default: org.apache.axis2.transport.http.MultipartFormDataFormatter

Possible Values: -

The message formatting implementation that formats messages with the 'multipart_form_data' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

text_plain

string

Default: org.apache.axis2.format.PlainTextFormatter

Possible Values: -

The message formatting implementation that formats messages with the 'text_plain' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

application_json

string

Default: org.wso2.micro.integrator.core.json.JsonStreamFormatter

Possible Values: -

The message formatting implementation that formats messages with the 'application_json' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

json_badgerfish

string

Default: org.apache.axis2.json.JSONBadgerfishMessageFormatter

Possible Values: -

The message formatting implementation that formats messages with the 'json_badgerfish' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

text_javascript

string

Default: org.apache.axis2.json.JSONMessageFormatter

Possible Values: -

The message formatting implementation that formats messages with the 'text_javascript' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

octet_stream

string

Default: org.wso2.carbon.relay.ExpandingMessageFormatter

Possible Values: -

The message formatting implementation that formats messages with the 'octet_stream' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

application_binary

string

Default: org.apache.axis2.format.BinaryFormatter

Possible Values: -

The message formatting implementation that formats messages with the 'application_binary' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

text_xml

string

Default: org.apache.axis2.transport.http.SOAPMessageFormatter

Possible Values: -

The message formatting implementation that formats messages with the 'text_xml' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

soap_xml

string

Default: org.apache.axis2.transport.http.SOAPMessageFormatter

Possible Values: -

The message formatting implementation that formats messages with the 'soap_xml' content type before they are sent out of the Micro Integrator. If required, you can change the default formatting class.

Message Formatters (blocking mode)

[blocking.message_formatters]
form_urlencoded =  "org.apache.synapse.commons.formatters.XFormURLEncodedFormatter"
multipart_form_data =  "org.apache.axis2.transport.http.MultipartFormDataFormatter"
application_xml = "org.apache.axis2.transport.http.ApplicationXMLFormatter"
text_xml = "org.apache.axis2.transport.http.SOAPMessageFormatter"
soap_xml = "org.apache.axis2.transport.http.SOAPMessageFormatter"
text_plain = "org.apache.axis2.format.PlainTextFormatter"
application_json =  "org.wso2.micro.integrator.core.json.JsonStreamFormatter"
json_badgerfish = "org.apache.axis2.json.JSONBadgerfishMessageFormatter"
text_javascript = "org.apache.axis2.json.JSONMessageFormatter"
octet_stream = "org.wso2.carbon.relay.ExpandingMessageFormatter"
application_binary =  "org.apache.axis2.format.BinaryFormatter"

[blocking.message_formatters]

This configuration header is required for configuring the message formatter implementations that are used to format messages that are sent out from the API Manager in blocking mode. You can use the same list of parameters that are available for message formatters in non-blocking mode.

Custom Message Builders (non-blocking mode)

[[custom_message_builders]]
content_type = "application/json/badgerfish"
class = "org.apache.axis2.json.JSONBadgerfishOMBuilder"

[[custom_message_builders]]

This configuration header is required for configuring the custom message builder implementation class and the selected content types to which the builder should apply in non-blocking mode.

content_type

string Required

Default: -

Possible Values: -

The content types to which the custom message builder implementation should apply. You can specify the list of content types as follows: application/json/badgerfish.

class

string Required

Default: -

Possible Values: -

The custom message builder implementation that should apply to the given content types.

Custom Message Builders (blocking mode)

[[blocking.custom_message_builders]]
content_type = "application/json/badgerfish"
class = "org.apache.axis2.json.JSONBadgerfishOMBuilder"

[[blocking.custom_message_builders]]

This configuration header is required for configuring the custom message builder implementation class and the selected content types to which the builder should apply in blocking mode. You can use the same list of parameters that are available for custom message builders in non-blocking mode.

Custom Message Formatters (non-blocking mode)

[[custom_message_formatters]]
content_type = "application/json/badgerfish"
class = "org.apache.axis2.json.JSONBadgerfishMessageFormatter"

[[custom_message_formatters]]

This configuration header is required for configuring the custom message formatter implementation class and the selected content types to which the formatter should apply in non-blocking mode.

content_type

string Required

Default: -

Possible Values: -

The content types to which the custom message formatter implementation should apply. You can specify the list of content types as follows: application/json/badgerfish.

class

string Required

Default: -

Possible Values: -

The custom message formatter implementation that should apply to the given content types.

Custom Message Formatters (blocking mode)

[[blocking.custom_message_formatters]]
content_type = "application/json/badgerfish"
class = "org.apache.axis2.json.JSONBadgerfishMessageFormatter"

[[blocking.custom_message_formatters]]

This configuration header is required for configuring the custom message formatter implementation class and the selected content types to which the formatter should apply in blocking mode. You can use the same list of parameters that are available for custom message formatters in non-blocking mode.

Message Formatter Options

[message_formatter.options]
disableSendingMultipartPartCharset = true
preserveMultipartPartContentTransferEncoding = true

[message_formatter.options]

disableSendingMultipartPartCharset

boolean

Default: true

Possible Values: true, false

Defines whether the charset parameter in the Content-Type header should be preserved in each part of multipart form data.

preserveMultipartPartContentTransferEncoding

boolean

Default: false

Possible Values: true, false

Defines whether the Content-Transfer-Encoding header should be preserved in each part of multipart form data.

Message Mediation

[mediation]
synapse.core_threads = 20
synapse.max_threads = 100
synapse.threads_queue_length = 10

synapse.global_timeout_interval = "120000ms"

synapse.enable_xpath_dom_failover=true
synapse.temp_data_chunk_size=3072

synapse.command_debugger_port=9005
synapse.event_debugger_port=9006

synapse.script_mediator_pool_size=15
synapse.enable_xml_nil=false
synapse.disable_auto_primitive_regex = "^-?(0|[1-9][0-9]*)(\\.[0-9]+)?([eE][+-]?[0-9]+)?$"
synapse.disable_custom_replace_regex = "@@@"
synapse.enable_namespace_declaration = false
synapse.build_valid_nc_name = false
synapse.enable_auto_primitive = false
synapse.json_out_auto_array = false
synapse.preserve_namespace_on_xml_to_json=false
flow.statistics.enable=false
flow.statistics.capture_all=false
statistics.enable_clean=true
statistics.clean_interval = "1000ms"
stat.tracer.collect_payloads=false
stat.tracer.collect_mediation_properties=false
inbound.core_threads = 20
inbound.max_threads = 100

[mediation]

This configuration header groups the parameters used for tuning the mediation process (Synapse engine) of the API Manager. These parameters are mainly used when mediators such as Iterate and Clone (which uses the internal thread pools) are used.

synapse.core_threads

integer

Default: 20

Possible Values: -

The initial number of synapse threads in the pool. This parameter is applicable only if the Iterate and Clone mediators are used to handle a higher load. These mediators use a thread pool to create new threads when processing messages and sending messages in parallal. You can configure the size of the thread pool by this parameter. The number of threads specified via this parameter should be increased as required to balance an increased load. Increasing the value specified for this parameter results in higher performance of the Iterate and Clone mediators.

synapse.max_threads

integer

Default: 100

Possible Values: -

The maximum number of synapse threads in the pool. This parameter is applicable only if the Iterate and Clone mediators are used to handle a higher load. The number of threads specified for this parameter should be increased as required to balance an increased load.

synapse.threads_queue_length

integer

Default: 10

Possible Values: -

The length of the queue that is used to hold the runnable tasks that are to be executed by the pool. This parameter is applicable only if the Iterate and Clone mediators are used to handle a higher load. You can specify a finite value as the queue length by giving any positive number. If this parameter is set to (-1) it means that the task queue length is infinite. If the queue length is finite, there can be situations where requests are rejected when the task queue is full and all the cores are occupied. If the queue length is infinite, and if some thread locking happens, the server can go out of memory. Therefore, you need to decide on an optimal value based on the actual load.

synapse.global_timeout_interval

integer

Default: 120000

Possible Values: -

The maximum number of milliseconds within which a response for the request should be received. A response that arrives after the specified number of seconds cannot be correlated with the request. Hence, a warning will be logged and the request will be dropped. This parameter is also referred to as the time-out handler.

synapse.enable_xpath_dom_failover

boolean

Default: true

Possible Values: "true" or "false"

If this parameter is set to true, the Micro Integrator can switch to XPATH 2.0. This parameter can be set to false if XPATH 2.0 evaluations cause performance degradation. The Micro Integrator uses the Saxon Home Edition when implementing XPATH 2.0 functionalities, and thus supports all the functions that are shipped with it. For more information on the supported functions, see the Saxon Documentation.

synapse.temp_data_chunk_size

integer

Default: 3072

Possible Values: -

The message size that can be processed by the Micro Integrator.

synapse.script_mediator_pool_size

integer

Default: 15

Possible Values: -

When using externally referenced scripts, this parameter specifies the size of the script engine pool that should be used per script mediator. The script engines from this pool are used for externally referenced script execution where updates to external scripts on an engine currently in use may otherwise not be thread safe. It is recommended to keep this value at a reasonable size since there will be a pool per externally referenced script.

synapse.preserve_namespace_on_xml_to_json

boolean

Default: false

Possible Values: "true" or "false"

Preserves the namespace declarations in the JSON output during XML to JSON message transformations.

flow.statistics.enable

boolean

Default: false

Possible Values: "true" or "false"

Set this property to true and enable statistics for the required integration artifact to record information such as the following: <ul><li>The time spent on each mediator.</li><li>The time spent on processing each message.</li><li>The fault count of a single message flow.</li></ul>

flow.statistics.enable

boolean

Default: false

Possible Values: "true" or "false"

Set this property to 'true' and set the flow.statistics.enable property also to 'true'. This will enable mediation statistics for all the integration artifacts by default. If you set this property to 'false', you need to set the flow.statistics.enable property to 'true' and manually enable statistics for the required integration artifact.

statistics.enable_clean

boolean

Default: true

Possible Values: "true" or "false"

If this parameter is set to true, all the existing statistics would be cleared before processing a request. This is recommended if you want to increase the processing speed.

stat.tracer.collect_payloads

boolean

Default: false

Possible Values: "true" or "false"

Set this property to true and enable tracing for the required integration artifact to record the message payload before and after the message mediation performed by individual mediators.

stat.tracer.collect_mediation_properties

boolean

Default: false

Possible Values: "true" or "false"

Set this property to true and enable tracing for the required integration artifact to record the following information:<ul><li>Message context properties.</li><li>Message transport-scope properties.</li></ul>

Synapse Handlers

enabled_global_handlers= ["custom_logger"]
[synapse_handlers]
custom_logger.name= "SynapseLogHandler"
custom_logger.class= "com.wso2.apim.log.handler.SynapseLogHandler"

[[synapse_handlers]]

This configuration header is required for configuring a synapse handler with the name and the implementation class.

name

string Required

Default: -

Possible Values: -

Name of the synapse handler.

class

string Required

Default: -

Possible Values: -

The synapse handler implementation.

Governance Configurations

[governance]
life_cycle_checklist_items_enabled = true

[governance]

This includes configurations related to underlying governance registry in API-M.

life_cycle_checklist_items_enabled

boolean

Default: true

Possible Values: true,false

Enable lifecycle checklist items.

Qpid broker heartbeat configurations

[qpid.heartbeat]
delay = 1
timeout_factor = 3.0

[qpid.heartbeat]

This includes configurations related to the frequency of the internal heartbeat sent by the underlying Qpid broker component of Traffic Manager. You need to configure a proper delay for the heartbeat value if the connections will stay idle for a long time.

delay

integer

Default: 0

This defines an interval (in seconds) between the pings sent to a subscriber to keep the connection alive.

timeoutFactor

float

Default: 2.0

The time duration (in seconds) allowed for a subscriber to respond to a heartbeat request. If this time elapses before the response is received, the channel of communication between the server and the subscriber will end.

Health Check API configurations

[carbon_health_check]
enable = true

[carbon_health_check]

This includes configurations related to carbon health check API.

enable

boolean

Default: false

Possible Values: true,false

Enable carbon health checker.

[carbon_health_check.health_checker.super_tenant_health_checker]
enable = true
order = "98"

[carbon_health_check.health_checker.super_tenant_health_checker]

This includes configurations related to super tenant userstore health check.

enable

boolean

Default: true

Possible Values: true,false

Enable user store health checker.

order

integer

Default: 98

The execution order.

[carbon_health_check.health_checker.super_tenant_health_checker.properties]
monitored.user.stores = "primary,sec"

[carbon_health_check.health_checker.super_tenant_health_checker.properties]

This includes properties related to super tenant userstore health check.

monitored.user.stores

string array

Default:

An array of domain names of the userstores to monitor health. If not given, health is monitored on all the super tenant secondary user stores.

[carbon_health_check.health_checker.data_source_health_checker]
enable = true
order = "97"

[carbon_health_check.health_checker.data_source_health_checker]

This includes configurations related to the health check of data sources which are configured in master-datasources by checking the connection pool information and by getting a connection from the pool.

enable

boolean

Default: true

Possible Values: true,false

Enable datasource health checker.

order

integer

Default: 98

The execution order.

[carbon_health_check.health_checker.data_source_health_checker.properties]
pool_usage_limit_percentage = 80
monitored.datasources = "jdbc/WSO2AM_DB,jdbc/SHARED_DB,jdbc/WSO2CarbonDB"

[carbon_health_check.health_checker.data_source_health_checker.properties]

This includes properties related to datastore health check.

pool_usage_limit_percentage

integer

Default: 80

Datasource connection pool usage

monitored.datasources

string array

Default:

An array of jndiConfig names of datasources to monitor health. If not given, health is monitored on all the datastores.

[health_checker]
name = "CustomHealthChecker"
order = "90"
[health_checker.properties]
first_property = "value"

[health_checker]

This includes configurations related to adding custom health checkers.

name

string

Default: -

The custom health checker name.

order

integer

Default: -

The custom health checker execution order.

properties

integer

Default: -

The custom health checker properties. Provide as key value pairs.

OAuth configurations

[oauth]
allowed_scopes = ["scope1", "scope2"]
additional_params_from_error_url = true
timestamp_skew = "0"

[oauth.extensions]
token_generator="org.wso2.carbon.identity.oauth2.token.OauthTokenIssuerImpl"
token_context_generator = "org.wso2.carbon.identity.oauth2.authcontext.JWTTokenGenerator"
token_context_claim_retriever = "org.wso2.carbon.identity.oauth2.authcontext.DefaultClaimsRetriever"
token_context_dialect_uri = "http://wso2.org/claims"

[oauth]

This includes OAuth configurations in API-M.

additional_params_from_error_url

boolean

Default: false

Possible Values: true,false

Allow additional parameters in OAuth2 error url.

allowed_scopes

list of strings

Default:

Configuration to pass a list of scopes which are allowed without any validation.

timestamp_skew

integer

Default: 0

Time stamp skew in seconds.

extensions.token_generator

string

Default: org.wso2.carbon.identity.oauth2.token.OauthTokenIssuerImpl

Token Issuer class.

extensions.token_context_generator

string

Default: org.wso2.carbon.identity.oauth2.authcontext.JWTTokenGenerator

Token Issuer class for Authorization Context.

extensions.token_context_claim_retriever

string

Default: org.wso2.carbon.identity.oauth2.authcontext.DefaultClaimsRetriever

Claim Retriever Implementation class for Authorization Context.

extensions.token_context_dialect_uri

string

Default: http://wso2.org/claims

Consumer Dialect URI for Authorization Context.

[oauth.token_validation]
user_access_token_validity = "3000"
app_access_token_validity = "2000"
refresh_token_validity = "86400"
 

[oauth.token_validation]

This includes configurations for OAuth token validation.

app_access_token_validity

integer

Default: 3600

Default validity period for application access tokens in seconds.

user_access_token_validity

integer

Default: 3600

Default validity period for user access tokens in seconds.

refresh_token_validity

integer

Default: 86400

Default validity period for refresh tokens in seconds.

[oauth.token_cleanup]
enable = true
retain_access_tokens_for_auditing = true

[oauth.token_cleanup]

This includes OAuth configurations for old, invalid token cleanup in API-M.

enable

boolean

Default: true

Possible Values: true,false

Enable token cleanup.

retain_access_tokens_for_auditing

boolean

Default: true

Possible Values: true,false

Set this to true, to move the old, invalid tokens to the Audit table when token cleaning is enabled. Set this to false, if you do not wish to store old tokens in the Audit table.

[oauth.oidc.extensions]
id_token_builder = "org.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilder"
claim_callback_handler = "org.wso2.carbon.identity.openidconnect.SAMLAssertionClaimsCallback"
user_info_claim_retriever = "org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoUserStoreClaimRetriever"

[oauth.oidc.user_info]
response_type = "json"

[oauth.oidc.token_validation]
id_token_validity = "3600"

[oauth.oidc.id_token]
issuer = "${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/token"
redirect_error_page = true

[oauth.oidc.claims]
enable_oidc_dialect = true
enable_unmapped_user_attributes = true

[oauth.oidc]

This includes configurations related to OpenID Connect authorization server in API-M.

extensions.id_token_builder

string

Default: org.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilder

IDToken builder implementation class.

extensions.claim_callback_handler

string

Default: org.wso2.carbon.identity.openidconnect.SAMLAssertionClaimsCallback

This can be used to return extra custom claims with the IDToken. You can implement a claims callback handler to push the custom claims to the IDToken by implementing the CustomClaimsCallbackHandler interface.

extensions.user_info_claim_retriever

string

Default: org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoUserStoreClaimRetriever

Defines the class which builds the claims for the User Info Endpoint's response. This class needs to implement the interface UserInfoClaimRetriever.

user_info.response_type

string

Default: json

The value that is set to get JWT response from user info endpoint.

token_validation.id_token_validity

integer

Default: 3600

The expiration value of the IDToken in seconds.

id_token.issuer

string

Default: ${carbon.protocol}://${carbon.host}:${carbon.management.port}/oauth2/token (OAuth2 Token Endpoint URL)

The value of issuer of the IDToken. This should be changed according to the deployment values.

id_token.redirect_error_page

boolean

Default: true

Possible Values: true,false

Send the response to OAuth2 error page.

claims.enable_oidc_dialect

boolean

Default: false

Possible Values: true,false

Enable converting original claims from assertions to OIDC Dialect.

claims.enable_unmapped_user_attributes

boolean

Default: false

Possible Values: true,false

Enable adding unmapped user attributes.

[oauth.grant_type.authorization_code]
enable = true
grant_handler = "org.wso2.carbon.identity.oauth2.token.handlers.grant.AuthorizationCodeGrantHandler"

[oauth.grant_type.password]
enable = true
grant_handler = "org.wso2.carbon.identity.oauth2.token.handlers.grant.PasswordGrantHandler"

[oauth.grant_type.refresh_token]
enable = true
grant_handler = "org.wso2.carbon.identity.oauth2.token.handlers.grant.RefreshGrantHandler"

[oauth.grant_type.client_credentials]
enable = true
grant_handler = "org.wso2.carbon.identity.oauth2.token.handlers.grant.ClientCredentialsGrantHandler"

[oauth.grant_type.saml_bearer]
enable = true
grant_handler = "org.wso2.carbon.identity.oauth2.token.handlers.grant.saml.SAML2BearerGrantHandler"

[oauth.grant_type.iwa_ntlm]
enable = true
grant_handler = "org.wso2.carbon.identity.oauth2.token.handlers.grant.iwa.ntlm.NTLMAuthenticationGrantHandlerWithHandshake"
grant_validator = "org.wso2.carbon.identity.oauth.common.NTLMAuthenticationValidator"

[oauth.grant_type.jwt_bearer]
enable = true
grant_handler = "org.wso2.carbon.identity.oauth2.grant.jwt.JWTBearerGrantHandler"
grant_validator = "org.wso2.carbon.identity.oauth2.grant.jwt.JWTGrantValidator"

[oauth.grant_type.kerberos]
enable = true
grant_handler = "org.wso2.carbon.identity.oauth2.grant.kerberos.KerberosGrant"
grant_validator = "org.wso2.carbon.identity.oauth2.grant.kerberos.KerberosGrantValidator"

[oauth.grant_type]

This includes configurations for supported OAuth grant types in API-M.

authorization_code.enable

boolean

Default: true

Possible Values: true,false

Enable Authorization Code grant.

authorization_code.grant_handler

string

Default: org.wso2.carbon.identity.oauth2.token.handlers.grant.AuthorizationCodeGrantHandler

Authorization Code grant implementation class.

password.enable

boolean

Default: true

Possible Values: true,false

Enable Password grant.

password.grant_handler

string

Default: org.wso2.carbon.identity.oauth2.token.handlers.grant.PasswordGrantHandler

Password grant implementation class.

refresh_token.enable

boolean

Default: true

Possible Values: true,false

Enable Refresh Token grant.

refresh_token.grant_handler

string

Default: org.wso2.carbon.identity.oauth2.token.handlers.grant.RefreshGrantHandler

Refresh Token grant implementation class.

client_credentials.enable

boolean

Default: true

Possible Values: true,false

Enable Refresh Token grant.

client_credentials.grant_handler

string

Default: org.wso2.carbon.identity.oauth2.token.handlers.grant.ClientCredentialsGrantHandler

Client Credentials grant implementation class.

client_credentials.allow_refresh_tokens

boolean

Default: false

Possible Values: true,false

Enable to allow refresh tokens for client credentials grant.

client_credentials.allow_id_token

boolean

Default: false

Possible Values: true,false

Enable to allow ID tokens for client credentials grant.

saml_bearer.enable

boolean

Default: true

Possible Values: true,false

Enable SAML2 Bearer grant.

saml_bearer.grant_handler

string

Default: org.wso2.carbon.identity.oauth2.token.handlers.grant.saml.SAML2BearerGrantHandler

SAML2 Bearer grant implementation class.

iwa_ntlm.enable

boolean

Default: true

Possible Values: true,false

Enable NTLM grant.

iwa_ntlm.grant_handler

string

Default: org.wso2.carbon.identity.oauth2.token.handlers.grant.iwa.ntlm.NTLMAuthenticationGrantHandlerWithHandshake

NTLM grant implementation class.

iwa_ntlm.grant_validator

string

Default: org.wso2.carbon.identity.oauth.common.NTLMAuthenticationValidator

NTLM grant validator implementation class.

jwt_bearer.enable

boolean

Default: true

Possible Values: true,false

Enable JWT Bearer grant.

jwt_bearer.grant_handler

string

Default: org.wso2.carbon.identity.oauth2.grant.jwt.JWTBearerGrantHandler

JWT Bearer grant implementation class.

jwt_bearer.grant_validator

string

Default: org.wso2.carbon.identity.oauth2.grant.jwt.JWTGrantValidator

JWT Bearer grant validator implementation class.

kerberos.enable

boolean

Default: false

Possible Values: true,false

Enable Kerberos Bearer grant.

kerberos.grant_handler

string

Default: org.wso2.carbon.identity.oauth2.grant.kerberos.KerberosGrant

Kerberos grant implementation class.

kerberos.grant_validator

string

Default: org.wso2.carbon.identity.oauth2.grant.kerberos.KerberosGrantValidator

Kerberos grant validator implementation class.

Token persistence configurations

[session_data.persistence]
persistence_pool_size = 0

[session_data.persistence]

This includes configuration for session data persistence of tokens.

persistence_pool_size

integer

Default: 0

This value determines the number of threads in the thread pool that are used to consume the token persisting queue. Set the value 0 to enable synchronous token persistence. Set the value higher than 0 to enable asynchronous token persistence.

[oauth.token_generation]
retry_count_on_persistence_failures = 5

[oauth.token_generation]

This includes configuration for OAuth2 token persistence.

retry_count_on_persistence_failures

integer

Default: 5

This indicates how many times to retry in the event of a CONN_APP_KEY violation when storing the access token.

User Store Properties

[user_store.properties]
TenantManager= "org.wso2.carbon.user.core.tenant.CommonHybridLDAPTenantManager"
ConnectionURL="ldap://localhost:10390"
ConnectionName="uid=admin,ou=system"
UserSearchBase="ou=Users,dc=wso2,dc=org"
GroupSearchBase="ou=Groups,dc=wso2,dc=org"
ConnectionPassword="admin"
AnonymousBind= "false"
WriteGroups= "true"
UserEntryObjectClass= "identityPerson"
UserNameAttribute= "uid"
UserNameSearchFilter= "(&(objectClass=person)(uid=?))"
UserNameListFilter= "(objectClass=person)"
DisplayNameAttribute= ""
GroupEntryObjectClass= "groupOfNames"
GroupNameAttribute= "cn"
GroupNameSearchFilter= "(&(objectClass=groupOfNames)(cn=?))"
GroupNameListFilter= "(objectClass=groupOfNames)"
MembershipAttribute= "member"
BackLinksEnabled= "false"
SCIMEnabled= "true"
IsBulkImportSupported= "true"
UsernameJavaRegEx= "[a-zA-Z0-9._\\-|//]{3,30}$"
RolenameJavaRegEx= "[a-zA-Z0-9._\\-|//]{3,30}$"
PasswordHashMethod= "PLAIN_TEXT"
ConnectionPoolingEnabled= "false"
LDAPConnectionTimeout= "5000"
ReplaceEscapeCharactersAtUserLogin= "true"
EmptyRolesAllowed= "true"
kdcEnabled= "false"
defaultRealmName= "WSO2.ORG"
StartTLSEnabled= "false"
UserRolesCacheEnabled= "true"
ConnectionRetryDelay= "2m"
UserCoreCacheTimeOut = 5 

[user_store.properties]

TenantManager

string Required

Default:

Possible Values: org.wso2.carbon.user.core.tenant.JDBCTenantManager, org.wso2.carbon.user.core.tenant.CommonHybridLDAPTenantManager

MaxUserNameListLength

int

Default:

Controls the number of users listed in the user store of a WSO2 product. This is useful when you have a large number of users and don't want to list them all. Setting this property to 0 displays all users.

ConnectionURL

string

Default:

Connection URL to the user store server. In the case of default LDAP in Carbon, the port is specified in the carbon.xml file, and a reference to that port is included in this configuration.

ConnectionName

string

Default:

The username used to connect to the database and perform various operations. This user does not have to be an administrator in the user store or have an administrator role in the WSO2 product that you are using, but this user MUST have permissions to read the user list and users' attributes and to perform search operations on the user store. The value you specify is used as the DN ( Distinguish Name ) attribute of the user. This property is mandatory.

ConnectionPassword

string

Default:

Password for the ConnectionName user.

DisplayNameAttribute

string

Default:

This is an optional property. The Display Name Attribute is the name by which users will be listed when you search for users in the management console (Go to Configuration -> Users tab).

PasswordHashMethod

string

Default:

Password hash method to use when storing user entries in the user store.

UserNameListFilter

string

Default:

Possible Values: SHA SHA-1 SHA-256 MD5 PLAIN_TEXT

Filtering criteria for listing all the user entries in the user store. This query or filter is used when doing search operations on users. In this case, the search operation only provides the objects created from the specified class. This query is the same as listing out all the available users in the management console.

UserEntryObjectClass

string

Default: wso2Person

Object class used to construct user entries. By default, it is a custom object class defined with the name wso2Person .

UserSearchBase

string

Default:

DN of the context or object under which the user entries are stored in the user store. In this case, it is the "users" container. When the user store searches for users, it will start from this location of the directory. Different databases have different search bases.

UserNameSearchFilter

string

Default:

Filtering criteria used to search for a particular user entry.

UserNameAtribute

string

Default:

The attribute used for uniquely identifying a user entry. Users can be authenticated using their email address, UID, etc. The name of the attribute is considered as the username.

PasswordJavaScriptRegEx

string

Default:

Policy that defines the password format.

UsernameJavaScriptRegEx

string

Default:

The regular expression used by the front-end components for username validation.

UsernameJavaRegEx

string

Default:

A regular expression to validate usernames. By default, strings have a length of 5 to 30. Only non-empty characters are allowed. You can provide ranges of alphabets, numbers and also ranges of ASCII values in the RegEx properties.

PasswordJavaRegEx

string

Default:

(LDAP and JDBC) A regular expression to validate passwords. By default, strings having a length between 5 to 30 with non-empty characters are allowed.

RolenameJavaRegEx

string

Default:

A regular expression to validate role names. By default, strings having a length between 5 to 30 with non-empty characters are allowed.

ReadGroups

boolean

Default:

Possible Values: true false

Specifies whether groups should be read from the user store. If this is disabled by setting it to false , none of the groups in the user store can be read, and the following group configurations are NOT mandatory: GroupSearchBase , GroupNameListFilter , or GroupNameAttribute .

WriteGroups

boolean

Default:

Possible Values: true false

Specifies whether groups should be written to user store.

GroupSearchBase

string

Default:

DN of the context under which user entries are stored in the user store.

GroupNameListFilter

string

Default:

Filtering criteria for listing all the group entries in the user store. Groups are created in LDAP using the "groupOfName" class. The group search operation only returns objects created from this class.

GroupEntryObjectClass

string

Default:

Object class used to construct group entries.

GroupNameSearchFilter

string

Default:

Filtering criteria used to search for a particular group entry.

GroupNameAttribute

string

Default:

Attribute used for uniquely identifying a user entry. This attribute is to be treated as the group name.

MembershipAttribute

string

Default:

Attribute used to define members of groups.

MembershipAttributeRange

int

Default: 1500

Attribute used by Active Directories where they need limit membership attributes. The default value for this is 1500.

UserRoleCacheEnabled

boolean

Default: true

Possible Values: true false

This is to indicate whether to cache the role list of a user. By default this is set to true . Set it to false if the user roles are changed by external means and those changes should be instantly reflected in the Carbon instance.

UserDNPattern

string

Default:

(LDAP) The pattern for the user's DN, which can be defined to improve the search. When there are many user entries in the LDAP user store, defining a UserDNPattern provides more impact on performances as the LDAP does not have to travel through the entire tree to find users.

ReplaceEscapeCharactersAtUserLogin

string

Default:

(LDAP) If the user name has special characters it replaces it to validate the user logging in. Only " \ " and " \\ " are identified as escape characters.

MultiTenantRealmConfigBuilder

string

Default:

Tenant Manager specific realm config parameter. Can be used to build different types of realms for the tenant.

LDAPConnectionTimeout

string

Default:

If the connection to an LDAP is inactive for the length of time (in milliseconds) specified by this property, the connection will be terminated.

SCIMEnabled

boolean

Default: false

Possible Values: true false

This is to configure whether user store is supported for SCIM provisioning.

kdcEnabled

string

Default: false

Possible Values: true false

If your user store is capable of acting as a Kerberos, Key Distribution Center (KDC) and if you like to enable it, set this property to true.

ConnectionPoolingEnabled

string

Default: false

Possible Values: true false

Define whether LDAP connection pooling is enabled

ReadTimeout

string

Default:

The value of this property is the read timeout in milliseconds for LDAP operations. If the LDAP provider cannot get a LDAP response within that period, it aborts the read attempt. The integer should be greater than zero. An integer less than or equal to zero means no read timeout is specified which is equivalent to waiting for the response infinitely until it is received.

RetryAttempts

string

Default:

Retry the authentication request if a timeout happened

BackLinksEnabled

string

Default: false

Possible Values: true false

Defines whether the backlink support is enabled. If you are using MemberOfAttribute attributes this should be set to true.

UserCoreCacheTimeOut

string

Default: 5

User core cache expiration duration

CaseInsensitiveUsername

string

Default:

Set the value to false for case insensitive JDBC user stores

Custom keystore configurations

[custom_keystore.APIKeyKeyStore]
file_name = "apikeysigner.jks"
type = "JKS"
password = "wso2carbon"
alias = "apikeysigner"
key_password = "wso2carbon"

[custom_keystore.APIKeyKeyStore]

This includes configuration for custom Keystores in WSO2 API Manager

file_name

string

Default:

The name of the Keystore (the Keystore file should be placed inside <API-M_HOME>/repository/resources/security directory)

type

string

Default:

The Keystore type.

password

string

Default:

The Keystore password.

alias

string

Default:

Private key alias of the Keystore.

key_password

string

Default:

The private key password of the Keystore (WSO2 recommends that you maintain the identical Keystore password and key password due to known limitations).

HTTP Access Logs

[http_access_log]
enabled = true

[http_access_log]

This includes configuration for HTTP access log records.

useLogger

boolean

Default: false

Possible Values: true,false

Set this to true to allow logs to get written into the `<APIM_HOME>repository/logs/wso2carbon.log` or any other log file and show up on the console.

Registry Handler properties

#### Sample deployment.toml entry
##### Registry handler 1 #####
[[registry_handler]]
class="org.wso2.carbon.registry.extensions.handlers.WSDLMediaTypeHandler"
filter_class="org.wso2.carbon.registry.core.jdbc.handlers.filters.MediaTypeMatcher"

[registry_handler.properties]
disableSymlinkCreation = "true"
myprop1= "true"

### parent property 1: schemaLocationConfiguration
[[registry_handler.nested_property]]
enable = true
name = "schemaLocationConfiguration"
type = "xml"

# nested property 1
[[registry_handler.nested_property.schemaLocationConfiguration]]
tag = 'location'
value = "/trunk/schemas/1"
key = "mykey"

# nested property 2
[[registry_handler.nested_property.schemaLocationConfiguration]]
tag = 'location'
value = "/trunk/schemas/2"
key = "mykey2"

# nested property 3
[[registry_handler.nested_property.schemaLocationConfiguration]]
tag = 'newlocation'
value = "/trunk/schemas/3"
key = "mykey3"

## parent property 2: wsdlLocationConfiguration
[[registry_handler.nested_property]]
enable = true
name = "wsdlLocationConfiguration"
type = "xml"

# nested property 1
[[registry_handler.nested_property.wsdlLocationConfiguration]]
tag = 'location'
value = "/trunk/wsdls/"

## parent property 3: policyLocationConfiguration
[[registry_handler.nested_property]]
enable = true
name = "policyLocationConfiguration"
type = "xml"

# nested property 1
[[registry_handler.nested_property.policyLocationConfiguration]]
tag = 'location'
value = "/trunk/policies/"

[registry_handler.filter_properties]
mediaType = "application/vnd.wso2-service+xml"

##### Registry handler 2 #####
[[registry_handler]]
class="org.wso2.carbon.registry.extensions.handlers.ZipWSDLMediaTypeHandle"
filter_class="org.wso2.carbon.registry.core.jdbc.handlers.filters.MediaTypeMatcher2"

[registry_handler.properties]
wsdlMediaType = "application/wsdl+xml"
schemaMediaType = "application/xsd+xml"
threadPoolSize = 50
disableSymlinkCreation = true
numberOfRetry = 3

## parent property 1: schemaLocationConfiguration
[[registry_handler.nested_property]]
enable = true
name = "schemaLocationConfiguration"
type = "xml"

# nested property 1
[[registry_handler.nested_property.schemaLocationConfiguration]]
tag = 'location'
value = "/trunk/schemas/1"
key = "mykey"

[registry_handler.filter_properties]
mediaType = "application/vnd.wso2-service+xml"


#### Sample registry.xml entry generated will be as follows
<!--Config for custom registry handlers.-->
<handler class="org.wso2.carbon.registry.extensions.handlers.WSDLMediaTypeHandler">
    <property name="myprop1">true</property>
    <property name="disableSymlinkCreation">true</property>
    <property name="schemaLocationConfiguration" type="xml">
            <location key="mykey">/trunk/schemas/1</location>
            <location key="mykey2">/trunk/schemas/2</location>
            <newlocation key="mykey3">/trunk/schemas/3</newlocation>
    </property>
    <property name="wsdlLocationConfiguration" type="xml">
            <location>/trunk/wsdls/</location>
    </property>
    <property name="policyLocationConfiguration" type="xml">
            <location>/trunk/policies/</location>
    </property>
    <filter class="org.wso2.carbon.registry.core.jdbc.handlers.filters.MediaTypeMatcher">
        <property name="mediaType">application/vnd.wso2-service+xml</property>
    </filter>
</handler>
<handler class="org.wso2.carbon.registry.extensions.handlers.ZipWSDLMediaTypeHandle">
    <property name="schemaMediaType">application/xsd+xml</property>
    <property name="threadPoolSize">50</property>
    <property name="numberOfRetry">3</property>
    <property name="wsdlMediaType">application/wsdl+xml</property>
    <property name="disableSymlinkCreation">true</property>
    <property name="schemaLocationConfiguration" type="xml">
            <location key="mykey">/trunk/schemas/1</location>
    </property>
    <filter class="org.wso2.carbon.registry.core.jdbc.handlers.filters.MediaTypeMatcher2">
        <property name="mediaType">application/vnd.wso2-service+xml</property>
    </filter>
</handler>

[[registry_handler]]

Registry Handler configurations.

class

string Required

Default:

The class name of the Handler. Provided in the class attribute in the Handler.

filter_class

string Required

Default:

The class name of the filter which is associated with the Handler (Ex: org.wso2.carbon.registry.core.jdbc.handlers.filters.MediaTypeMatcher, org.wso2.carbon.registry.core.jdbc.handlers.filters.URLMatcher).

[registry_handler.properties]

Registry Handler custom properties which do not have nested elements. Properties are listed as key, value pairs. These custom properties will be used in Handler processing logic.

[[registry_handler.nested_property]]

Registry Handler custom property which has nested elements under it.

enable

boolean

Default: false

Possible Values: true, false

Enables nested properties.

name

string Required

Default:

The name of the custom parent property.

type

string

Default: xml

Possible Values: xml, null

The type of the custom parent property.

[[registry_handler.nested_property.<parent_property_name>]]

Nested element which is under a custom Registry Handler property.

tag

string Required

Default:

XML element name of the nested property.

value

string Required

Default:

Value of the nested property element.

key

string

Default:

Value of the additional key attribute of the XML element generated for the nested property.

[registry_handler.filter_properties]

Define registry handler filter element configurations.

Transport Header Handler

[apim.transport_headers]
enable = false
removeRequestHeaders = "true"
preserveRequestHeaders = ""
excludeRequestHeaders = ""
excludeResponseHeaders = ""

[apim.transport_headers]

This includes configuration to enable TransportHeaderHandler.

enabled

boolean

Default: false

Possible Values: true,false

Enable TransportHeaderHandler.

removeRequestHeaders

string

Default: false

Possible Values: true,false

Indicates whether to remove the request headers from the response in a failure scenario. For OPTIONS call, request headers will always be removed.

preserveRequestHeaders

string

Default:

Comma separated List of headers preserved while removing request headers from the response. Default is empty. This list of headers will be preserved only when removeRequestHeaders is set to true.

excludeRequestHeaders

string

Default:

Comma separated List of well known request headers that should be removed in a Response to the client.

excludeResponseHeaders

string

Default:

Comma separated List of well known response headers that should be removed in a Request sent to backend.

Global handler configurations

[synapse_handlers.custom_handler_name]
enabled=true
class="org.wso2.carbon.apimgt.gateway.handlers.custom.customer_handler"

[synapse_handlers.custom_handler_name]

Configuration used to define, enable, or disable a global handler.

enabled

boolean

Default:

Enable or disable a defined global handler.

class

string Required

Default:

Fully qualified class name of the global handler.

APIM Governance Configurations

[apim.governance.scheduler]
thread_pool_size = 20
queue_size = 20
task_check_interval_minutes = 2
task_cleanup_interval_minutes = 30

[apim.governance.scheduler]

Configurations used to configure governance task scheduler.

thread_pool_size

integer

Default: 20

Specifies the number of threads available in the governance scheduler’s thread pool.

queue_size

integer

Default: 20

Defines the maximum number of tasks that can be queued in the scheduler thread pool for execution.

task_check_interval_minutes

integer

Default: 2

Determines how frequently (in minutes) the scheduler checks for pending tasks.

task_cleanup_interval_minutes

integer

Default: 30

Specifies how often (in minutes) long-lasting, stuck tasks are cleaned up from the scheduler queue.

OAuth token endpoint trust store configurations

[apim.mediator_config.oauth.trust_store]
location = "${carbon.home}/repository/resources/security/client-truststore.jks"
type = "JKS"
password = "wso2carbon"

[apim.mediator_config.oauth.trust_store]

Trust store configurations used for OAuth token endpoint connection.

location

string

Default:

Location path of the trust store file.

type

string

Default:

Type of the trust store.

password

string

Default:

Password for accessing the trust store.

[transport.receiver]
enable = true
tcpPort = 9611
sslPort = 9711
sslEnabledProtocols = "TLSv1,TLSv1.1,TLSv1.2"
ciphers = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
sslReceiverThreadPoolSize = 100
tcpReceiverThreadPoolSize = 100

[transport.binary.agent]
queue_size = 32768
batch_size = 200
core_pool_size = 1
socket_timeout_ms = 30000
max_pool_size = 1
keep_alive_time_in_pool = 20
reconnection_interval = 30
max_transport_pool_size = 250
max_idle_connections = 250
eviction_time_period = 5500
min_idle_time_in_pool = 5000
secure_max_transport_pool_size = 250
secure_max_idle_connections = 250
secure_eviction_time_period = 5500
secure_min_idle_time_in_pool = 5000
max_reconnection_interval = 3600

API-M Basic auth configurations

[apim.basic_authenticator]
init_idle_capacity = 20
max_idle = 50
max_active = 100
max_wait_millis = 30000

[apim.basic_authenticator]

This includes configuration for basic authenticator client pool mechanism to access Axis2 services. The client pool prevents intermittent 500 server errors by managing client connections efficiently.

init_idle_capacity

integer

Default: 20

Initial number of idle connections to maintain in the client pool.

max_idle

integer

Default: 50

Maximum number of idle connections that can be maintained in the pool.

max_active

integer

Default: 100

Maximum number of active connections that can be allocated from the pool at any given time.

max_wait_millis

integer

Default: 30000

Maximum time (in milliseconds) to wait for a connection from the pool when the pool is exhausted.

Synapse Artifact Generator Pool Configurations

[apim.synapse_artifact_generator.thread_pool]
core_pool_size = 4
max_pool_size = 4
keep_alive_time_ms = 60000
queue_capacity = 50

[synapse_artifact_generator_pool]

This configuration is available from WSO2 API Manager (API-M) 4.0 - update level 368 onwards. Defines the settings for the dedicated thread pool used for parallel synapse artifact generation. Proper tuning of these parameters is recommended based on the Control Plane server's hardware (CPU cores, memory) and the expected load (number of APIs, artifact size).

core_pool_size

integer

Default: 4

The initial number of threads to keep in the pool, even if they are idle. For CPU-intensive tasks like artifact generation, setting this close to the number of available CPU cores is often optimal for stability, especially on lower-resource machines.

max_pool_size

integer

Default: 4

The maximum number of threads allowed in the pool. When the queue is full and the current number of threads is less than max_pool_size, the pool will create new threads to handle the load. For CPU-bound tasks, setting this significantly higher than the number of CPU cores can lead to performance degradation due to context switching. Setting it equal to core_pool_size creates a fixed-size pool.

keep_alive_time_ms

integer

Default: 60000

When the number of threads is greater than the core_pool_size, this is the maximum time (in milliseconds) that excess idle threads will wait for new tasks before terminating. This allows the pool to shrink during idle periods, saving resources. This setting has no effect if core_pool_size is equal to max_pool_size.

queue_capacity

integer

Default: 50

The size of the queue used to hold tasks before they are executed. A bounded queue prevents the system from running out of memory under high load. When the queue is full and the max_pool_size is reached, the rejection policy (CallerRunsPolicy) is triggered, providing back-pressure. A smaller queue applies back-pressure sooner, prioritizing stability, while a larger queue can absorb larger bursts but increases memory usage.

Encryption Configurations

[encryption]
key = ""

[encryption]

Defines symmetric encryption settings. Configure this explicitly before first startup in production or distributed deployments.

key

string Required

Default:

The symmetric encryption key used for internal data protection. In distributed or cloud deployments, all API Manager instances must use the same key.

SameSite attribute of cookies configurations

[web_app.cookie_processor]
same_site_cookies = "lax"

[web_app.cookie_processor]

This can be configured to update SameSite attribute of the cookies.

same_site_cookies

string

Default:

Possible Values: strict, lax, none

This configuration should be used only if it is required to override the SameSite attribute of all the cookies handled by the web app to the configured value. Allowed values: strict, lax, none. Note: when set to none, cookies must also be marked Secure, or modern browsers may reject them.

API-M AWS Lambda Configurations

[apim.aws_lambda]
enable_proxy_response_mapping = true

[apim.aws_lambda.sdk]
retry_max_attempts = 2

[apim.aws_lambda]

Configures the AWS Lambda backend integration for WSO2 API Manager.

enable_proxy_response_mapping

boolean

Default: false

Possible Values: true, false

Enables proxy response mapping mode for the AWS Lambda mediator. When enabled, Lambda functions must return payloads in the AWS API Gateway Lambda proxy integration response envelope format (containing statusCode, headers, multiValueHeaders, body, and isBase64Encoded fields). The mediator maps these fields to the HTTP response, allowing Lambda functions to control the response status code, headers, and content type. Supported content types for body routing are application/json, text/plain, and application/xml. Note that this configuration is available in wso2am-4.7.0 and wso2am-universal-gw-4.7.0 starting from update level 8.

[apim.aws_lambda.sdk]

Configures the AWS SDK behavior used by the AWS Lambda mediator.

retry_max_attempts

integer

Default: 4

The total number of attempts for AWS Lambda invocations, including the initial request. Must be an integer greater than or equal to 1. If this configuration is not provided, the AWS SDK default retry behavior will be used. Note that this configuration is available in wso2am-4.7.0 and wso2am-universal-gw-4.7.0 starting from update level 8.

Synapse Properties

[synapse_properties]
'synapse.mediators.access.control.mode' = "ALLOW_LIST"
'synapse.mediators.access.control.list' = "aggregate,builder,cache,call,class,clone,drop,enrich,filter,foreach,header,in,iterate,log,loopback,makefault,opa,out,payloadfactory,property,propertygroup,respond,rewrite,scatter-gather,script,send,sequence,switch,throwerror,variable"

[synapse_properties]

This includes configurations for synapse runtime.

'synapse.mediators.access.control.mode'

string

Default: ALLOW_LIST

Possible Values: NONE, ALLOW_LIST, DENY_LIST

This property controls the access control mode for mediators in the Synapse runtime. It can be set to one of the following values: NONE (no access control), ALLOW_LIST (only mediators in the allow list are accessible), DENY_LIST (mediators in the deny list are not accessible). By default, it is set to ALLOW_LIST, which means only mediators explicitly listed in the allow list will be accessible. Adjust this setting based on your security requirements and the mediators you need to use in your API configurations.

'synapse.mediators.access.control.list'

string

Default: aggregate,builder,cache,call,class,clone,drop,enrich,filter,foreach,header,in,iterate,log,loopback,makefault,opa,out,payloadfactory,property,propertygroup,respond,rewrite,scatter-gather,script,send,sequence,switch,throwerror,variable

Possible Values: comma-separated list of mediator local names

This property specifies the list of mediators for access control based on the mode defined in 'synapse.mediators.access.control.mode'. It should be a comma-separated list of mediator local names. For example, if 'synapse.mediators.access.control.mode' is set to ALLOW_LIST, only the mediators listed in this property will be accessible. If the mode is set to DENY_LIST, the mediators listed here will be blocked from access. If the mode is NONE, this property is ignored. Configure this list according to the mediators you want to allow or deny access to in your Synapse runtime environment.

Dependency Configurations

[dependency_properties]
'snakeyaml.max_file_size_limit' = 10

[dependency_properties]

This includes configurations for dependency related properties.

snakeyaml.max_file_size_limit

integer

Default:

This sets the maximum file size (in MB) for YAML files processed by SnakeYAML during API definition import/export operations. Overrides the default codepoint limit of 3,145,728 characters (~3MB) to support larger YAML OpenAPI files. The system calculates the actual codepoint limit using the formula: configured_value × 4 × 1024 × 1024 (e.g., 10 MB = 41,943,040 codepoints). Increasing this value may expose the system to DoS attacks via large malicious files - configure based on actual requirements and security policies.

OIDC Authenticator Parameters

[authentication.authenticator.oidc.parameters]
excludedClaimAttributes="at_hash,iss,iat,exp,aud,azp"

[authentication.authenticator.oidc.parameters]

This includes configurations for OIDC authenticator claim mapping behavior.

excludedClaimAttributes

string

Default: at_hash,iss,iat,exp,aud,azp

Possible Values: comma-separated list of JWT claim attributes

This property defines the JWT claim attributes that should be excluded during OIDC claim mapping. The value should be provided as a comma-separated list of claim names. When configured, only the specified claim attributes will be excluded from the claim mapping process. If this property is not explicitly configured, the system falls back to the default exclusion list to preserve existing behavior. Customizing this property allows users to control which JWT claims are ignored during mapping based on application requirements.

Embedding Provider configurations

[apim.ai.embedding_provider]
type = "openai"
[apim.ai.embedding_provider.properties]
apikey = ""
embedding_endpoint = "https://api.openai.com/v1/embeddings"
embedding_model = ""

[apim.ai.embedding_provider] Required

Configuration for the embedding provider used to generate vector embeddings for AI features.

type

string Required

Default:

Possible Values: openai,azure-openai,mistral

The embedding provider type. Supported values are openai, azure-openai, and mistral.

[apim.ai.embedding_provider.properties] Required

Provider-specific properties for the embedding provider.

apikey

string Required

Default:

The API key used to authenticate requests to the embedding provider.

embedding_endpoint

string Required

Default:

The endpoint URL of the embedding API. For OpenAI use https://api.openai.com/v1/embeddings, for Mistral use https://api.mistral.ai/v1/embeddings, and for Azure OpenAI use the Azure OpenAI-provided endpoint.

embedding_model

string

Default:

The embedding model to use. Required for openai (e.g., text-embedding-3-small) and mistral (e.g., mistral-embed) provider types. Not required for azure-openai as the model is determined by the endpoint.

Vector DB Provider configurations

[apim.ai.vector_db_provider]
type = "zilliz"
[apim.ai.vector_db_provider.properties]
uri = ""
token = ""
ttl = 3600

[apim.ai.vector_db_provider] Required

Configuration for the vector database provider used to store and query vector embeddings for AI features.

type

string Required

Default:

Possible Values: zilliz

The vector database provider type. Use zilliz to connect to either Zilliz Cloud or a Milvus instance.

[apim.ai.vector_db_provider.properties] Required

Provider-specific connection properties for the vector database.

uri

string Required

Default:

The URI of the vector database instance. For Zilliz, use the Zilliz Cloud cluster endpoint. For Milvus, use the Milvus server address (e.g., http://localhost:19530).

token

string Required

Default:

The access token for authenticating with the vector database. For Zilliz, use the Zilliz Cloud API token. For Milvus, use the username and password in the format username:password (e.g., root:Milvus).

ttl

integer

Default: 3600

Time-to-live in seconds for cached vector entries. If not specified, defaults to 3600 seconds (1 hour).

Authentication Policy

[authentication_policy]
disable_account_disable_handler = false
disable_account_confirmation_validation_handler = false

[authentication_policy]

Defines the authentication policy settings for WSO2 API Manager.

disable_account_disable_handler

boolean

Default: false

Possible Values: true,false

Disables the account disable handler during authentication. Note that this configuration is available in wso2am-4.7.0, wso2am-universal-gw-4.7.0, wso2am-acp-4.7.0, and wso2am-tm-4.7.0 starting from update level 9.

disable_account_confirmation_validation_handler

boolean

Default: false

Possible Values: true,false

Disables the account confirmation validation handler during authentication. Note that this configuration is available in wso2am-4.7.0, wso2am-universal-gw-4.7.0, wso2am-acp-4.7.0, and wso2am-tm-4.7.0 starting from update level 9.