KAIZEN configuration

This article describes the configuration properties available for KAIZEN.

These properties are split across the following configuration sources:

• The config.json file for frontend runtime settings
• The .env file for build-time settings
• The Spring Boot and KAIZEN lowcode application properties for backend service configuration

Properties in the config.json file

The config.json file contains runtime configuration properties that take effect without rebuilding the application. The following table lists the properties available in version 5.3.0.

Module	Property	Description	Possible values	Default
App Designer	AUTO_SAVE_DRAFT_INTERVAL_SECOND	Sets the interval (in seconds) for auto-saving drafts in the UI editor.	Positive integer (seconds)	900
App Designer	MESSAGE_DURATION	Sets the duration (in milliseconds) for the page-locked notice message in the UI editor.	Positive integer (milliseconds)	15000
App Designer	REFRESH_INTERVAL	Sets the interval (in milliseconds) to refresh the page list in the resources panel of the UI editor (e.g. lock status).	Positive integer (milliseconds)	30000
Console	ENABLE_MOBILE	Enables or disables the creation of mobile apps.	TRUE/FALSE	FALSE
Console, Database Designer, App Designer, Theme Designer, Workflow Designer	CLOUD_ENABLE	Enables or disables KAIZEN cloud mode.	TRUE/FALSE	FALSE
General	CONTEXT_PATH	Sets the context path for calling the backend gateway.	(user-defined path e.g. /mycontext)	-
General	CSRF_TOKEN_PREFIX	Sets the CSRF key. This value should match the backend configuration.	(user-defined key e.g. agp-cookie-csrf)	agp-cookie-csrf
General	DATASOURCE_GLOBAL_CUSTOM_TIMEOUT	Sets a timeout (in milliseconds) that overrides all data sources that do not use the global timeout at runtime.	Positive integer (milliseconds)	-
General	DATASOURCE_GLOBAL_TIMEOUT	Sets the timeout (in milliseconds) for all data sources that have global timeout enabled, and for all requests sent in native code.	Positive integer (milliseconds)	60000
General	DYNAMIC_USER_DOMAIN_CODES	Dynamically sets which domains can visit the page at runtime.	JSON array string, e.g. ['mydomain1','mydomain2']	-
General	ICE_ENABLE_FARO	Enables or disables Faro.	TRUE/FALSE	FALSE
General	ICE_FARO_BROWSER_CONFIG_URL	Sets the Faro collection URL.	URL string	/collect
General	MCE_LOGO	Controls whether the MCE editor logo is displayed. Set to FALSE to hide the logo.	TRUE/FALSE	TRUE
General	REFRESH_CSRF_TOKEN_INTERVAL_SEC	Sets the interval (in seconds) to refresh the CSRF token on the front end. This value should match the backend configuration. Applies to the main app and the login page.	Positive integer (seconds)	5400
General	RSA_ENCRYPTION_PADDING	Sets the RSA encryption padding scheme.	PKCS1 / MGF1_SHA1 / MGF1_SHA256	MGF1_SHA256
General	UPLOAD_MAX_SIZE	Sets the maximum file upload size in megabytes.	Positive integer (MB)	20
Main App	MICRO_APPS	Configures which micro apps can be accessed by the main app at runtime.	JSON array string, e.g. [{ activePath: '/iam', loadScriptMode: 'fetch', title: 'KAIZEN Studio - IAM', hashType: true, entry: '/iam/', cached: true }]	-
Main App, Standalone App	MENU_APP_GROUPS	Filters the menu by a list of app identities.	JSON array string, e.g. ['myappidentity1','myappidentity2']	-
Workflow Designer	AI_AGENT_ENABLE	Controls whether AI-related tasks are shown in the Workflow Designer for selection.	TRUE/FALSE	FALSE
UI Renderer	USER_DOMAIN_CODE	Specifies the domain for the current anonymous user.	designer	designer

Properties in the .env file

The .env file contains build-time configuration properties that take effect during the build process.

Property	Description	Possible values	Default
ASSETS_ZIP_URL	Sets the URL from which to download assets, for assets localisation.	URL string	-
DEV_ENV	Sets the development environment identifier.	(user-defined environment ID e.g. dev / development / prod / production)	production
GENERATE_ASSETS_ZIP	Controls whether to generate an assets zip file.	TRUE/FALSE	FALSE
USE_PUBLIC_IP	Controls whether to use the public IP address.	TRUE/FALSE	TRUE
WEBPACK_OBFUSCATOR	Enables code obfuscation to protect source code.	TRUE/FALSE	TRUE

Properties for Spring Boot and KAIZEN lowcode

This section lists the Spring Boot and KAIZEN lowcode application properties available in version 5.3.0, organised by module.

KAIZEN-specific property names follow the naming convention kaizen.{serviceName}.x.x or kaizen.{serviceName}.{groupName}.x.x.

note

This is not an exhaustive list of properties. For more information, refer to the Spring Boot documentation.

AI

Property	Description	Possible values	Default
DO_NOT_TRACK	Turns off telemetry.	TRUE	TRUE
LANGFLOW_AUTO_LOGIN	You need to set this property value to TRUE: This property will use KAIZEN's authentication. LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD will be redundant.	TRUE	TRUE
LANGFLOW_AUTO_SAVING	You need to set this property value to FALSE, as auto-save is not allowed due to flow versioning.	FALSE	FALSE
LANGFLOW_CACHE_TYPE	Sets the cache type for LangFlow's internal caching system. After setting this property value to redis, you must also set these LangFlow Redis environment variables.	async, redis, or memory	redis
LANGFLOW_CONFIG_DIR	Sets the directory where files, logs, and the database are stored. The default value depends on the persistent volume configuration.	(user-defined directory e.g., /data/files)	/data/files
LANGFLOW_EVENT_DELIVERY	Sets how to deliver build events to the frontend.	polling, streaming, or direct	streaming
LANGFLOW_LOG_LEVEL	Sets the logging level of AI services.	DEBUG	DEBUG
LANGFLOW_NEW_USER_IS_ACTIVE	Automatically activates new accounts.	TRUE	TRUE
LANGFLOW_SAVE_DB_IN_CONFIG_DIR	You need this property only when you use SQLite database to retain the InMemory database.	FALSE	FALSE
LANGFLOW_SECRET_KEY	Sets the secret key for decryption and encryption.	(configurable)	(configurable)
middleware.intercept.projectid	Appends a project ID in the response header for every endpoint call.	x-project-id	x-project-id
LANGFLOW_SKIP_AUTH_AUTO_LOGIN	You need to set this property value to TRUE, so that it will use KAIZEN's RBAC.	TRUE	TRUE
kaizen.ai.websocket.close.timeout	WebSocket connection close timeout duration in seconds.	Positive integer (seconds)	10
kaizen.ai.websocket.enabled	Allows the WebSocket connection for AI services.	TRUE/FALSE	TRUE
kaizen.ai.websocket.max.concurrent.runs	Maximum number of concurrent flow executions per WebSocket connection.	Positive integer	10
kaizen.ai.websocket.max.message.size	Maximum incoming WebSocket message size in bytes.	Positive integer (bytes)	1048576
kaizen.ai.websocket.ping.interval	Ping interval in seconds for WebSocket connections.	Positive integer (seconds)	30
kaizen.ai.websocket.ping.timeout	Timeout in seconds waiting for a response before closing the WebSocket connection.	Positive integer (seconds)	10
kaizen.ai.websocket.token.permissions.enabled	Allows token-based permission checks for AI WebSocket connections.	TRUE/FALSE	FALSE

LangFlow Redis Properties

If the LANGFLOW_CACHE_TYPE value is set to redis, you must set these properties in the table:

Property	Description	Possible values	Default
LANGFLOW_REDIS_CACHE_EXPIRE	Cache expiration time in seconds.	Positive integer (seconds)	3600
LANGFLOW_REDIS_DB	Redis database number.	0	0
LANGFLOW_REDIS_HOST	Redis server hostname.	localhost	localhost
LANGFLOW_REDIS_PASSWORD	Optional password for Redis authentication.	(project-specific password)	-
LANGFLOW_REDIS_PORT	Redis server port.	6379	6379
LANGFLOW_REDIS_SSL_ENABLED	Enables Redis SSL.	TRUE/FALSE	FALSE
LANGFLOW_REDIS_SSL_KEYSTORE	If the LANGFLOW_REDIS_SSL_ENABLED value is set to TRUE, this controls the SSL keystore.	See LangFlow documentation	-
LANGFLOW_REDIS_SSL_KEYSTORE_PASSWORD	If the LANGFLOW_REDIS_SSL_ENABLED value is set to TRUE, this stores the SSL keystore password.	See LangFlow documentation	-
LANGFLOW_REDIS_SSL_TRUSTSTORE	If the LANGFLOW_REDIS_SSL_ENABLED value is set to TRUE, this controls the SSL truststore.	See LangFlow documentation	-
LANGFLOW_REDIS_SSL_TRUSTSTORE_PASSWORD	If the LANGFLOW_REDIS_SSL_ENABLED value is set to TRUE, this stores the SSL truststore password.	See LangFlow documentation	-

Basic

Properties in this module cover core infrastructure, including SSL/TLS, datasource, Redis, and mail configuration.

SSL/TLS configuration

Property	Description	Possible values	Default
server.http2.enabled	Enables HTTP/2.0. Should follow the SSL switch configuration.	TRUE/FALSE	TRUE
server.ssl.client-auth	Sets the mTLS client authentication mode. none disables mTLS, want enables but does not require it, need enables and requires it.	none/want/need	none
server.ssl.enabled	Enables SSL between internal services (mTLS). Recommended to enable in production.	TRUE/FALSE	TRUE
server.ssl.key-alias	Sets the SSL certificate name.	(user-defined string)	KAIZEN
server.ssl.key-store	Sets the SSL keystore path.	(user-defined path)	classpath:certs/tls/keystore.p12
server.ssl.key-store-password	Sets the SSL keystore password.	(user-defined password)	password$1
server.ssl.key-store-type	Sets the SSL keystore type.	PKCS12	PKCS12
server.ssl.trust-store	Sets the SSL truststore path.	(user-defined path)	classpath:certs/tls/truststore.p12
server.ssl.trust-store-password	Sets the SSL truststore password.	(user-defined password)	password$1
server.ssl.trust-store-type	Sets the SSL truststore type.	PKCS12/JKS	PKCS12

Datasource configuration

Property	Description	Possible values	Default
spring.datasource.driver-class-name	Sets the JDBC driver class name.	See Spring Boot documentation	org.postgresql.Driver
spring.datasource.password	Sets the datasource password.	See Spring Boot documentation	password$1
spring.datasource.url	Sets the JDBC datasource URL.	See Spring Boot documentation	(project-specific)
spring.datasource.username	Sets the datasource username.	See Spring Boot documentation	postgres
spring.jpa.properties.hibernate.dialect	Sets the Hibernate dialect.	See Spring Boot documentation	org.hibernate.dialect.PostgreSQLDialect
spring.jpa.show-sql	Enables SQL logging.	TRUE/FALSE	TRUE

HikariCP connection pool

Property	Description	Possible values	Default
spring.datasource.hikari.auto-commit	Enables auto-commit for connections.	TRUE/FALSE	TRUE
spring.datasource.hikari.connection-test-query	Sets the connection test query.	See Spring Boot documentation	SELECT 1
spring.datasource.hikari.connection-timeout	Sets the connection timeout (in milliseconds).	Positive integer (milliseconds)	30000
spring.datasource.hikari.data-source-properties.requireSSL	Requires SSL for datasource connections.	See Spring Boot documentation	TRUE
spring.datasource.hikari.data-source-properties.trustStore	Sets the truststore path for datasource SSL.	See Spring Boot documentation	classpath:certs/tls/truststore.p12
spring.datasource.hikari.data-source-properties.trustStorePassword	Sets the truststore password for datasource SSL.	See Spring Boot documentation	password$1
spring.datasource.hikari.data-source-properties.trustStoreType	Sets the truststore type for datasource SSL. Accepts PKCS12 or JKS.	See Spring Boot documentation	PKCS12
spring.datasource.hikari.idle-timeout	Sets the idle timeout (in milliseconds).	Positive integer (milliseconds)	60000
spring.datasource.hikari.max-lifetime	Sets the maximum connection lifetime (in milliseconds).	See Spring Boot documentation	30000
spring.datasource.hikari.maximum-pool-size	Sets the maximum connection pool size.	See Spring Boot documentation	50
spring.datasource.hikari.minimum-idle	Sets the minimum number of idle connections.	See Spring Boot documentation	50
spring.datasource.hikari.pool-name	Sets the connection pool name.	See Spring Boot documentation	DatebookHikariCP
spring.datasource.hikari.read-only	Sets connections as read-only.	TRUE/FALSE	FALSE
spring.datasource.hikari.validation-timeout	Sets the validation timeout (in milliseconds).	Positive integer (milliseconds)	5000

Redis configuration

Property	Description	Possible values	Default
spring.cache.type	Sets the cache storage type for @Cacheable.	See Spring Boot documentation	redis
spring.data.redis.host	Sets the Redis host.	See Spring Boot documentation	redis
spring.data.redis.lettuce.pool.max-active	Sets the maximum active connections in the Lettuce pool.	See Spring Boot documentation	8
spring.data.redis.lettuce.pool.max-idle	Sets the maximum idle connections in the Lettuce pool.	See Spring Boot documentation	8
spring.data.redis.lettuce.pool.min-idle	Sets the minimum idle connections in the Lettuce pool.	See Spring Boot documentation	0
spring.data.redis.password	Sets the Redis password.	See Spring Boot documentation	password$1
spring.data.redis.port	Sets the Redis port.	See Spring Boot documentation	6379
spring.data.redis.ssl.enabled	Enables SSL for Redis connections.	See Spring Boot documentation	TRUE
spring.redis.ssl.key-store	Sets the Redis SSL keystore path.	See Spring Boot documentation	classpath:certs/tls/keystore.p12
spring.redis.ssl.key-store-password	Sets the Redis SSL keystore password.	See Spring Boot documentation	password$1
spring.redis.ssl.trust-store	Sets the Redis SSL truststore path.	See Spring Boot documentation	classpath:certs/tls/truststore.p12
spring.redis.ssl.trust-store-password	Sets the Redis SSL truststore password.	See Spring Boot documentation	password$1

Mail configuration

Property	Description	Possible values	Default
email.from	Sets the sender email address.	Email address	KAIZEN@ecquaria.com
email.unique.base.domains	Sets the user domain codes that require unique email addresses. Accepts multiple domain codes separated by commas.	Comma-separated domain codes	-
spring.mail.host	Sets the SMTP server host.	See Spring Boot documentation	-
spring.mail.password	Sets the SMTP server password.	See Spring Boot documentation	-
spring.mail.port	Sets the SMTP server port.	See Spring Boot documentation	25
spring.mail.username	Sets the SMTP server username.	See Spring Boot documentation	-

Common

Property	Description	Possible values	Default
item.code.regex	Sets the regex pattern for MasterCode item validation.	(regex pattern)	^[a-zA-Z0-9_-]+$
kaizen.common.system.config.cache.expire.seconds	Sets the system config cache expiration time (in seconds) for Redis storage.	Positive integer (seconds)	1800
lowcode.auditlog.default.attribute.filter	Sets the default attribute filter list for audit logs.	vault,createdByUserId,updatedByUserId,createdDate,updatedDate	vault,createdByUserId,updatedByUserId,createdDate,updatedDate

Console

General console properties

Property	Description	Possible values	Default
code.generate.backend.dir	Sets the backend code generation output directory.	(project-specific directory)	/workdir/code_generate/fe
code.generate.back.template.dir	Maps KAIZEN versions to backend code generation template directories (JSON object).	(version-specific JSON mapping)	(version-specific JSON mapping)
code.generate.frontend.dir	Sets the frontend code generation output directory.	(project-specific directory)	/workdir/code_generate/fe
generate.code.db.to.java	Maps database column types to Java types and UI components for backend code generation (JSON object).	(database-specific JSON mapping)	(database-specific JSON mapping)
indexjs.get.dir	Maps KAIZEN versions to frontend JavaScript file paths (JSON object).	(version-specific JSON mapping)	(version-specific JSON mapping)
kaizen.branch.name.regex.regexp	Sets the regex pattern for validating Git branch names.	(regex pattern)	(regex pattern)
kaizen.console.service.templates.default.dir	Sets the templates directory for service code generation. External Docker paths can also be configured.	(project-specific directory)	classpath:/templates
lowcode.npmrc.config	Sets the NPM registry source configuration.	(project-specific registry configuration)	(project-specific registry configuration)
lui.version	Controls the lui-materials version.	Version string	1.8.0-1.0.0-SNAPSHOT
server.work.dir	Sets the server working directory. Refer to the Dockerfile configuration.	(project-specific directory)	/workdir
service.datasource.allowed.endpoints	Sets the allowed datasource endpoints.	(comma-separated endpoint list)	(comma-separated endpoint list)

Page scan properties

Property	Description	Possible values	Default
pagescan.connect.request.timeout.ms	Sets the page scan connection request timeout (in milliseconds).	Positive integer (milliseconds)	300000
pagescan.connect.timeout.ms	Sets the page scan connection timeout (in milliseconds).	Positive integer (milliseconds)	300000
pagescan.maxretry	Sets the number of retry attempts for failed scans before marking a scan as failed.	Non-negative integer	3
pagescan.read.timeout.ms	Sets the page scan read timeout (in milliseconds).	Positive integer (milliseconds)	300000
pagescan.target.hostname	Sets the page scan service hostname.	Hostname or IP address	localhost
pagescan.target.port	Sets the page scan service port number.	Integer from 1 to 65535	443
pagescan.target.protocol	Sets the page scan service URL scheme.	http/https	https

Git integration properties

Property	Description	Possible values	Default
git.github.api.url	Sets the GitHub API URL. Can be modified if a proxy is used.	See GitHub documentation	https://api.github.com
git.github.url	Sets the GitHub webpage URL.	See GitHub documentation	https://github.com
gitlab.proxy.enable	Enables the GitLab proxy.	See GitLab documentation	FALSE
gitlab.proxy.host	Sets the GitLab proxy host.	See GitLab documentation	(project-specific IP address)
gitlab.proxy.password	Sets the GitLab proxy password.	See GitLab documentation	(project-specific password)
gitlab.proxy.port	Sets the GitLab proxy port.	See GitLab documentation	7890
gitlab.proxy.username	Sets the GitLab proxy username.	See GitLab documentation	-
gitlab.url.white.path.list	Sets the GitLab address whitelist that KAIZEN can connect to.	See GitLab documentation	https://gitlab.com/

AI translation properties

Property	Description	Possible values	Default
ai.translation.enable	Enables AI translation.	TRUE/FALSE	TRUE
ai.translation.model	Sets the AI translation model. Accepts ollama or openai.	ollama/openai	openai
https.proxy.enable	Enables the proxy used for AI translation.	TRUE/FALSE	FALSE
https.proxy.host	Sets the AI translation proxy host.	(project-specific IP address)	127.0.0.1
https.proxy.port	Sets the AI translation proxy port.	(project-specific port number)	7890
spring.ai.ollama.base-url	Sets the Ollama base URL.	See Spring Boot documentation	-
spring.ai.ollama.chat.model	Sets the Ollama chat model.	See Spring Boot documentation	qwen2:7b
spring.ai.ollama.chat.options.temperature	Sets the Ollama chat temperature.	See Spring Boot documentation	0.7
spring.ai.openai.api-key	Sets the OpenAI API key.	See Spring Boot documentation	xxx
spring.ai.openai.chat.options.model	Sets the OpenAI chat model.	See Spring Boot documentation	gpt-3.5-turbo
spring.ai.openai.chat.options.temperature	Sets the OpenAI chat temperature.	See Spring Boot documentation	0.7

Application asset and page schema properties

Property	Description	Possible values	Default
kaizen.application.default-assets.kaizen	Sets the asset file path for creating KAIZEN apps.	Classpath resource or file path	classpath:/application/assets.json
kaizen.application.default-assets.mobile	Sets the asset file path for creating mobile apps.	Classpath resource or file path	classpath:/application/assets-mobile.json
kaizen.application.default-action-page-schema.kaizen	Sets the default action page schema for KAIZEN apps.	Classpath resource or file path	classpath:/page/defaultpages/Action.json
kaizen.application.default-error-page-schema.kaizen	Sets the default error page schema for KAIZEN apps.	Classpath resource or file path	classpath:/page/defaultpages/ErrorPage.json
kaizen.application.default-force-change-password-page-schema.kaizen	Sets the default force change password page schema for KAIZEN apps.	Classpath resource or file path	classpath:/page/defaultpages/ForceChangePassword.json
kaizen.application.default-login-page-schema.kaizen	Sets the default login page schema for KAIZEN apps.	Classpath resource or file path	classpath:/page/defaultpages/Login.json
kaizen.application.default-page-schema.kaizen	Sets the default page schema for KAIZEN apps.	Classpath resource or file path	classpath:/page/DefaultPage.json
kaizen.application.default-page-schema.mobile	Sets the default page schema for mobile apps.	Classpath resource or file path	classpath:/page/DefaultPageMobile.json
kaizen.application.error-page-schema.kaizen	Sets the error page schema for KAIZEN apps.	Classpath resource or file path	classpath:/page/ErrorPage.json
kaizen.application.error-page-schema.mobile	Sets the error page schema for mobile apps.	Classpath resource or file path	classpath:/page/ErrorPageMobile.json
kaizen.application.other-type-page-schema.kaizen	Sets the other type page schema for KAIZEN apps.	Classpath resource or file path	classpath:/page/OtherTypePage.json
kaizen.application.other-type-page-schema.mobile	Sets the other type page schema for mobile apps.	Classpath resource or file path	classpath:/page/OtherTypeMobile.json

Gateway

Property	Description	Possible values	Default
auth.single.session.enabled	Enables single-session mode.	TRUE/FALSE	FALSE
auth.single.session.on.strategy	Sets the single-session strategy.	serial/block	serial
eic.login.account.domain	Sets the EIC login domain.	Domain code	-
eic.login.cp.access.token	Sets the EIC CP access token.	(user-defined secret)	-
eic.login.govad.access.token	Sets the EIC GovAD access token.	(user-defined secret)	-
eic.login.govad.user.token.url	Sets the EIC GovAD login URL.	(project-specific URL)	(project-specific URL)
eic.login.oidc.user.token.url	Sets the EIC SP/CP login URL.	(project-specific URL)	(project-specific URL)
eic.login.project.custom.api	Sets the EIC login custom API.	API path or URL	-
eic.login.sp.access.token	Sets the EIC SP access token.	(user-defined secret)	-
eic.login.ssl.cert.path	Sets the EIC TLS certificate path.	Classpath resource or file path	-
eic.login.use.custom.enable	Enables the use of a custom EIC TLS certificate.	TRUE/FALSE	-
jwt.samesite.strategy	Sets the JWT SameSite cookie strategy.	LAX/NONE/STRICT	LAX
redis.clear.at.server.restart	Clears the Redis cache before the server starts.	TRUE/FALSE	FALSE
security.check.enabled	Enables security profile checking. From version 5.1.1 onwards, this property is only applicable to the gateway service.	TRUE/FALSE	TRUE
security.token.cached.enabled	Enables JWT token caching in Redis. When TRUE, the gateway stores JWT tokens in the Redis cache.	TRUE/FALSE	FALSE
security.token.cookie.csrf.prefix	Sets the CSRF cookie name prefix.	(user-defined string)	agp-cookie-csrf
security.token.cookie.csrfkey.prefix	Sets the CSRF cookie key name prefix.	(user-defined string)	agp-cookie-csrf_key
security.token.cookie.prefix	Sets the cookie name prefix.	(user-defined string)	agp-cookie
security.token.service.prefix	Sets the service token prefix for internal security information.	(user-defined string)	agp-service
service.public.white.path.additional.list	Sets project-specific additional public endpoints (JSON array of path/method pairs).	JSON array of path/method objects	-
service.public.white.path.list	Sets the KAIZEN basic public endpoint list (JSON array of path/method pairs).	JSON array of path/method objects	(KAIZEN default list)
service.security.black.path.additional.list	Sets project-specific additional blacklisted endpoints.	JSON array of path/method objects	-
service.security.black.path.list	Sets the KAIZEN basic blacklisted endpoint list (JSON array of path/method pairs).	JSON array of path/method objects	See this list for the default
springdoc.api-docs.path	Sets the URL path for the OpenAPI specification document.	See Spring Boot documentation	-
tecq.lowcode.gateway.csrf.additional.white.list	Sets project-specific additional CSRF-exempt endpoints.	Comma-separated endpoint paths	/gateway/console/api/v1/pagerevision,/login/anonymous,/auth-ott
tecq.lowcode.gateway.csrf.enabled	Enables CSRF protection.	TRUE/FALSE	TRUE
tecq.lowcode.gateway.csrf.white.list	Sets the KAIZEN basic CSRF whitelist (comma-separated endpoint paths).	Comma-separated endpoint paths	See this list for the default

Default value of service.security.black.path.list

"[{""path"":""/iam/api/v1/endpoints"",""method"":""GET""},{""path"":""/common/api/v1/auditlogs/authAuditLog"",""method"":""POST""},\
  {""path"":""/common/api/v1/systemConfigs/configValue"",""method"":""GET""},\
  {""path"":""/iam/api/v1/users/accounts/detail/**"",""method"":""GET""},\
  {""path"":""/iam/api/v1/users/changePasswordWithLinkedAccount"",""method"":""POST""},\
  {""path"":""/iam/api/v1/users/resetPasswordWithLinkedAccount"",""method"":""POST""},\
  {""path"":""/iam/api/v1/users/createUserWithLinkedAccount"",""method"":""POST""},\
  {""path"":""/iam/api/v1/users/attempt/**"",""method"":""PATCH""},\
  {""path"":""/console/api/v1/applicationProfile/removeApplicationProfiles/byUserAccountId"",""method"":""DELETE""},\
  {""path"":""/console/api/v1/userassign/removeUserConsoleAssignments/byUserId"",""method"":""DELETE""},\
  {""path"":""/cloud/api/v1/members/deleteUserOrgs"",""method"":""DELETE""},\
  {""path"":""/common/api/v1/auditlogs"",""method"":""DELETE""},\
  {""path"":""/*/api/v1/jdbc/update/column"",""method"":""POST""},\
  {""path"":""/cloud/api/v1/members/retrieveInviteUsers/byUserAccountId"",""method"":""GET""},\
  {""path"":""/console/api/v1/projects/deleteByProjectIds"",""method"":""DELETE""},\
  {""path"":""/console/api/v1/projects/cloudRemoveProjectUserAssignments"",""method"":""DELETE""},{""path"":""/iam/auth/**"",""method"":""POST""},{""path"":""/*/api/v1/ping/**"",""method"":""GET""}]"

Default value of tecq.lowcode.gateway.csrf.white.list

/gateway/console/api/v1/pagerevision,/auth-ott,/gateway/console/api/v1/migrations/fromEDS,/gateway/iam/api/v1/migrations/fromEDS,/gateway/common/api/v1/migrations/fromEDS,/gateway/job/api/v1/migrations/fromEDS,/gateway/projectDemo/seamless/token,/internal/bridge

General

Server properties

Property	Description	Possible values	Default
application.version	Sets the project version.	Version string	{projectVersion}
server.compression.enabled	Enables HTTP response compression (e.g. GZIP).	TRUE/FALSE	TRUE
server.compression.mime-types	Sets the MIME types eligible for compression.	Comma-separated MIME types	application/json,application/xml,text/html,text/xml,text/plain,text/css,application/javascript
server.compression.min-response-size	Sets the minimum response size before compression is applied.	Data size, e.g. 1024KB	1024KB
server.max-http-request-header-size	Sets the maximum allowed request header size. Increased to accommodate JWT token length.	Data size, e.g. 64KB, 128KB, or 1MB	128KB
server.port	Sets the server port.	Integer from 1 to 65535	80
spring.application.name	Sets the service name. Only modify for custom services.	See Spring Boot documentation	{serviceName}
spring.servlet.multipart.max-file-size	Sets the maximum size for a single uploaded file.	See Spring Boot documentation	10MB
spring.servlet.multipart.max-request-size	Sets the maximum size for the entire HTTP request, including all files and form data.	See Spring Boot documentation	100MB

JWT and authentication properties

Property	Description	Possible values	Default
com.ecquaria.lowcode.iam.access.jwt.check-issuer	Enables JWT issuer verification.	TRUE/FALSE	TRUE
com.ecquaria.lowcode.iam.access.jwt.issuer	Sets the JWT issuer.	(user-defined string)	ecq-jwt-issuer
com.ecquaria.lowcode.iam.access.jwt.refresh-token-expiration-sec-admin	Sets the refresh token (session) expiry time (in seconds). Recommended to set to 3 times the access token expiry value.	Positive integer (seconds)	5400
com.ecquaria.lowcode.iam.access.jwt.session-token-expiration-sec-admin	Sets the access token expiry time (in seconds).	Positive integer (seconds)	1800
com.ecquaria.lowcode.iam.access.jwt.signer.key.location	Sets the private key path used for signing JWT tokens. It is safer to generate your own private key.	Classpath resource or file path	classpath:certs/jwt/signer-private-key-rsa.pem
com.ecquaria.lowcode.iam.access.jwt.trusted-issuers	Sets the trusted JWT issuer for token validation.	Comma-separated issuer names	ecq-jwt-issuer

Encryption properties

Property	Description	Possible values	Default
rsa.cipher.algorithm	Sets the RSA encryption algorithm for password and secret token encryption. Must match the frontend RSA_ENCRYPTION_PADDING configuration.	RSA/ECB/OAEPWithSHA-256AndMGF1Padding\nRSA/ECB/PKCS1Padding	RSA/ECB/PKCS1Padding
rsa.cipher.oaep.padding.md	Sets the message digest algorithm name for the OAEP padding mask generation function (MGF1).	SHA-256 for version 5.x.x or nSHA-1 for version 4.x.x	SHA-1

Service mesh and routing properties

Property	Description	Possible values	Default
service.names.mesh	Sets the service mesh routing configuration (JSON object) for local development. Each entry maps a service name to its host and port. Used when use.mesh.name is TRUE.	(JSON service map)	(JSON service map)
service.port	Sets the default service port. Used when use.mesh.name is FALSE.	Integer from 1 to 65535	80
use.mesh.name	Enables KAIZEN's own service mesh. Set to FALSE if using Istio service mesh.	TRUE/FALSE	TRUE

System user and domain properties

Property	Description	Possible values	Default
admin.account.id	Sets the admin account ID.	User account ID	admin
designer.user.domain.code	Sets the designer user domain code.	Domain code	designer
kaizen.default.domain.code	Sets the default domain code.	Domain code	kaizen_default
system.user.admin.account.id	Sets the system admin account ID for internal service operations.	User account ID	systemsecurityuser
system.user.admin.domain	Sets the system admin user domain for internal service operations (e.g. job triggers).	Domain code	kaizen_default
system.user.admin.vault	Sets the system admin password. Obtain from the setup default password.	(project-specific password)	Password$1234

WebClient timeout properties

Property	Description	Possible values	Default
agp.webclient.connect.timeout	Sets the WebClient connection timeout (in seconds).	Positive integer (seconds)	300
agp.webclient.read.timeout	Sets the WebClient read timeout (in seconds).	Positive integer (seconds)	300
agp.webclient.request.timeout	Sets the WebClient request timeout (in seconds).	Positive integer (seconds)	300
agp.webclient.write.timeout	Sets the WebClient write timeout (in seconds).	Positive integer (seconds)	300

Job executor properties

Property	Description	Possible values	Default
job.executor.appname	Sets the batch job executor name. KAIZEN uses this to register the executor's name, IP, and port with the job service for routing. Defaults to spring.application.name if not set.	(user-defined string)	-
job.executor.group	Sets the batch job executor group.	(user-defined string)	DEFAULT
job.executor.log.path	Sets the job log path.	File path	/logs/job-log
job.executor.logretentiondays	Sets the job log retention period (in days). Use -1 for indefinite retention.	Positive integer (days) or -1	-1
job.executor.registry.enable	Enables the batch job executor. When enabled, the service registers as a KAIZEN job executor.	TRUE/FALSE	TRUE

Logging properties

Property	Description	Possible values	Default
logging.level.com.ecquaria.lowcode	Sets the log level for the lowcode module.	info/debug	info
logging.level.com.ecquaria.lowcode.config.RestTemplateInterceptor	Sets the log level for HTTP utility logging.	info/debug	info
logging.level.com.ecquaria.lowcode.job	Sets the log level for job executor logging.	info/debug	info
logging.level.com.ecquaria.lowcode.utils	Sets the log level for utility logging.	info/debug	info

Other general properties

Property	Description	Possible values	Default
all.resource.mapping.story.location	Sets the endpoint cache storage location.	memory/redis	memory
base64string.max-file-size	Limits the length of imported Base64 strings (in bytes).	Positive integer (bytes)	20971520
cloud.enable	Enables cloud functionality.	TRUE/FALSE	FALSE
kaizen.all.lowcode.search.case-sensitive	Enables case sensitivity for query data search.	TRUE/FALSE	-
kaizen.all.logging.request-response.enabled	Enables logged server side request/response body and header.	TRUE/FALSE	FALSE
kaizen.cloud.sign.up.enabled	Enables cloud sign-up functionality.	TRUE/FALSE	FALSE
kaizen.json.date.validation.formats	Sets the date format patterns for user data validation.	Comma-separated date/time patterns	yyyy-MM-dd'T'HH:mm:ss.SSS'Z',yyyy-MM-dd'T'HH:mm:ss
lowcode.rbac.user.account.id.case	Sets whether the user account ID is case-sensitive.	case-sensitive/case-insensitive	case-sensitive
lowcode.setup.needed.services	Sets the list of services needed for system setup.	Comma-separated service names	iam,common,job,workflow,theme,dbeditor,iamproxy,oidc,report,ai,console
lowcode.system.setup.run	Enables system setup execution.	TRUE/FALSE	TRUE
rbac.enabled	Enables RBAC identity and permission verification at the service level. This property should only be used for services behind the gateway and only for development purposes.	TRUE/FALSE	TRUE
system.agp.public.permission	Sets the public privilege code.	Privilege code	hogd6

IAM

Authentication properties

Property	Description	Possible values	Default
lowcode.security.authentication.attempts.enabled	Enables the password lock feature. When FALSE, users will not be locked out due to failed login attempts.	TRUE/FALSE	TRUE
lowcode.security.authentication.max-failed-login-attempts	Sets the maximum number of failed login attempts before the account is locked.	Positive integer	10
password.change.required.enable	Enables mandatory password change after certain reset operations (e.g. reset to a system-defined password).	TRUE/FALSE	FALSE
password.encrypt.type	Sets the password encryption algorithm type. Accepts BCRYPT, SCRYPT, or HASH.	BCRYPT/SCRYPT/HASH	BCRYPT
password.expired.period	Sets the password expiration period (in days).	Positive integer (days)	365
password.expired.period.feature.enable	Enables the password expiration feature.	TRUE/FALSE	TRUE
password.first.login.feature.enable	Enables mandatory password change on first login for new accounts.	TRUE/FALSE	FALSE

Password strength properties

Property	Description	Possible values	Default
lowcode.security.password.history.length	Sets the number of previous passwords to retain for history checks.	Non-negative integer	3
lowcode.security.password.min-strength	Sets the minimum password strength requirement.	strong/medium	strong
lowcode.security.password.strength.medium.allow-user-id	Allows user ID inclusion in medium-strength passwords.	TRUE/FALSE	FALSE
lowcode.security.password.strength.medium.min-length	Sets the minimum length for medium-strength passwords.	Positive integer	8
lowcode.security.password.strength.medium.required-digit	Requires a digit in medium-strength passwords.	TRUE/FALSE	TRUE
lowcode.security.password.strength.medium.required-lowercase	Requires a lowercase letter in medium-strength passwords.	TRUE/FALSE	FALSE
lowcode.security.password.strength.medium.required-symbol	Requires a symbol in medium-strength passwords.	TRUE/FALSE	TRUE
lowcode.security.password.strength.medium.required-uppercase	Requires an uppercase letter in medium-strength passwords.	TRUE/FALSE	FALSE
lowcode.security.password.strength.strong.allow-user-id	Allows user ID inclusion in strong passwords.	TRUE/FALSE	FALSE
lowcode.security.password.strength.strong.min-length	Sets the minimum length for strong passwords.	Positive integer	12
lowcode.security.password.strength.strong.required-digit	Requires a digit in strong passwords.	TRUE/FALSE	TRUE
lowcode.security.password.strength.strong.required-lowercase	Requires a lowercase letter in strong passwords.	TRUE/FALSE	FALSE
lowcode.security.password.strength.strong.required-symbol	Requires a symbol in strong passwords.	TRUE/FALSE	TRUE
lowcode.security.password.strength.strong.required-uppercase	Requires an uppercase letter in strong passwords.	TRUE/FALSE	TRUE

Password encryption properties

Property	Description	Possible values	Default
lowcode.security.password.encrypt.bcrypt.factor.log_rounds	Sets the BCrypt encryption log rounds factor.	Positive integer	12
lowcode.security.password.encrypt.scrypt.factor.n	Sets the SCrypt encryption factor N.	Positive integer	16384
lowcode.security.password.encrypt.scrypt.factor.p	Sets the SCrypt encryption factor P.	Positive integer	1
lowcode.security.password.encrypt.scrypt.factor.r	Sets the SCrypt encryption factor R.	Positive integer	8
lowcode.security.password.generator.class	Sets the password generator class.	Fully qualified Java class name	com.ecquaria.lowcode.iam.security.RandomPasswordGenerator
lowcode.security.password.generator.RandomPasswordGenerator.cipher.algorithm	Sets the cipher algorithm for random password generation.	Cipher algorithm, e.g. AES	AES
lowcode.security.password.generator.RandomPasswordGenerator.cipher.mode	Sets the cipher mode for random password generation.	Cipher mode, e.g. ECB	ECB
lowcode.security.password.generator.RandomPasswordGenerator.cipher.padding	Sets the cipher padding for random password generation.	Cipher padding, e.g. NoPadding	NoPadding
lowcode.security.password.generator.RandomPasswordGenerator.key.algorithm	Sets the key algorithm for random password generation.	Key algorithm, e.g. AES	AES
lowcode.security.password.hash.SimpleHashManager.algorithm	Sets the simple hash manager algorithm.	Hash algorithm, e.g. SHA-256	SHA-256

User account properties

Property	Description	Possible values	Default
lowcode.rbac.user.account.id.allow-symbols	Sets the allowed symbols in user account IDs.	_ , $	_
lowcode.rbac.user.account.id.case	Sets whether user account IDs are case-sensitive.	case-sensitive/case-insensitive	case-sensitive
user.email.regex.regexp	Sets the regex pattern for user email validation.	(regex pattern)	(regex pattern)
user.mobile.country.code.regex.regexp	Sets the regex pattern for mobile country code validation.	(regex pattern)	(regex pattern)
user.mobile.number.regex.regexp	Sets the regex pattern for mobile number validation.	(regex pattern)	(regex pattern)

User inactivity and cleanup properties

Property	Description	Possible values	Default
kaizen.jobs.user-state.cleanup.enabled	Enables the IAM job to identify inactive users who have not been reactivated within the configured retention period and permanently remove them from the database.	TRUE/FALSE	FALSE
kaizen.jobs.user-state.inactive.enabled	Enables the IAM job to identify users who have not logged in beyond the configured threshold and mark them as inactive.	TRUE/FALSE	FALSE
kaizen.user.delete.notify.first.at-ratio	Sets the ratio used to determine when to send the first warning notification before permanent deletion. The trigger time is calculated by multiplying this ratio by the kaizen.user.inactivity.delete.after-days value.	Decimal between 0 and 1	0.8
kaizen.user.delete.notify.second.before-days	Sets the number of days before the deletion deadline to send the second warning notification.	Positive integer (days)	3
kaizen.user.delete.on-termination.email.enabled	Enables email notification on user account termination.	TRUE/FALSE	FALSE
kaizen.user.inactivity.deactivate.after-days	Sets the inactivity threshold (in days). Users who have not logged in beyond this duration are marked as inactive.	Positive integer (days)	90
kaizen.user.inactivity.delete.after-days	Sets the retention period (in days) for inactive users. Inactive users who remain beyond this duration are permanently deleted.	Positive integer (days)	30
kaizen.user.inactivity.notify.first.at-ratio	Sets the ratio used to determine when to send the first warning notification before deactivation. The trigger time is calculated by multiplying this ratio by the kaizen.user.inactivity.deactivate.after-days value.	Decimal between 0 and 1	0.8
kaizen.user.inactivity.notify.second.before-days	Sets the number of days before the deactivation deadline to send the second warning notification.	Positive integer (days)	3

OIDC client properties

Property	Description	Possible values	Default
oidc.client.id	Sets the OIDC client ID.	(user-defined client ID)	oidc-client
oidc.client.secret	Sets the OIDC client secret.	(user-defined secret)	oidc-secret
oidc.redirect.uri	Sets the OIDC redirect URI.	URL string	https://ecq.lowcode.com/oidc-callback.html
oidc.response.type	Sets the OIDC response type.	code	code
oidc.scope	Sets the OIDC scope.	Space-separated OIDC scopes, e.g. openid profile email	profile openid

Azure AD integration properties

Property	Description	Possible values	Default
kaizen.iam.ad.user.domain.code	Sets the domain code for synced AD users.	Domain code	kaizen_default
kaizen.iam.azure.ad.authority	Sets the Microsoft authority URL.	URL string	https://login.microsoftonline.com/
kaizen.iam.azure.ad.client-id	Sets the registered app's Azure AD client ID.	(user-defined string)	-
kaizen.iam.azure.ad.client-secret	Sets the registered app's Azure AD client secret.	(user-defined string)	-
kaizen.iam.azure.ad.enabled	Enables the Azure AD sync job handler.	TRUE/FALSE	TRUE
kaizen.iam.azure.ad.graph-endpoint	Sets the Microsoft Graph API URL.	URL string	https://graph.microsoft.com/v1.0
kaizen.iam.azure.ad.tenant-id	Sets the organisation's Azure AD tenant ID.	(user-defined string)	-

Windows AD integration properties

Property	Description	Possible values	Default
kaizen.iam.windows.ad.base-dn	Sets the base distinguished name. Used as a fallback if user and group search bases are not set.	LDAP distinguished name, e.g. DC=example,DC=com	DC=ecq,DC=com
kaizen.iam.windows.ad.enabled	Enables the Windows AD sync job handler.	TRUE/FALSE	FALSE
kaizen.iam.windows.ad.group.filter	Sets the group search filter for Windows AD.	LDAP filter, e.g. (objectClass=group)	(LDAP filter for active groups)
kaizen.iam.windows.ad.group.search-base	Sets the group distinguished name for Windows AD.	LDAP distinguished name, e.g. OU=Groups,DC=example,DC=com	CN=Users,DC=ecq,DC=com
kaizen.iam.windows.ad.user.filter	Sets the user search filter for Windows AD.	LDAP filter, e.g. (objectClass=user)	(LDAP filter for active users)
kaizen.iam.windows.ad.user.search-base	Sets the user distinguished name for Windows AD.	LDAP distinguished name, e.g. OU=Users,DC=example,DC=com	CN=Users,DC=ecq,DC=com
spring.ldap.base	Sets the LDAP base DN.	See Spring Boot documentation	-
spring.ldap.password	Sets the LDAP password.	See Spring Boot documentation	password$1
spring.ldap.urls	Sets the LDAP server URLs.	See Spring Boot documentation	ldap://{hostname}:389
spring.ldap.username	Sets the LDAP username.	See Spring Boot documentation	CN=Administrator,CN=Users,DC=ecq,DC=com

Other IAM properties

Property	Description	Possible values	Default
lowcode.nonworkingday.weekend	Sets the non-working weekend days.	Sun,Mon,Tue,Wed,Thu,Fri,Sat	Sun,Sat

OIDC

Property	Description	Possible values	Default
kaizen.oidc.oauth2.security.cookie.persistence	Sets the OIDC cookie type. When FALSE, uses session cookies. When TRUE, uses persistent cookies.	TRUE/FALSE	FALSE
oauth2.security.context.expired.time	Sets the cookie expiry time (in seconds) when kaizen.oidc.oauth2.security.cookie.persistence is TRUE.	Positive integer (seconds)	300

Pagescan

Property	Description	Possible values	Default
puppeteer.executable.path	Sets the browser executable path for Puppeteer.	(user-defined path)	/usr/bin/chromium-browser
server.scan.max.process	Sets the maximum number of concurrent scans. Exceeding this limit causes the service to reject incoming scan requests.	Positive integer	4

SaaS (Cloud)

Property	Description	Possible values	Default
cloud.base.roles	Sets the base roles for cloud users.	Comma-separated role codes	cloud_common
cloud.pm.roles	Sets the project manager role for cloud users. Cloud users need this permission to operate projects.	Comma-separated role codes	agp_projectManager
lowcode.activation.expired.time	Sets the cloud user sign-up activation code expiry time (in seconds).	Positive integer (seconds)	18000
lowcode.invitation.accept.url	Sets the URL for accepting organisation invitations.	URL string	https://ecq.lowcode.com/#/signIn
lowcode.invitation.create.user.url	Sets the URL for registration and organisation join invitations.	URL string	https://ecq.lowcode.com/#/signUp
lowcode.invitation.expired.time	Sets the cloud invitation expiry time (in seconds).	Positive integer (seconds)	18000

Setup

Property	Description	Possible values	Default
kaizen.backend.services	Maps backend service identifiers to display names (JSON object). Can be extended with project-specific service names.	JSON object, e.g. {"iam":"IAM","common":"Common"}	(KAIZEN default service map)
lowcode.required.services	Sets the required services that must be selected during system setup.	Comma-separated service names	iam,common

Workflow

Property	Description	Possible values	Default
workflow.async.executor.allow.core.thread.timeout	Controls whether core threads can time out and be scaled down.	TRUE/FALSE	FALSE
workflow.async.executor.await.termination.seconds	Sets the time (in seconds) to wait for graceful shutdown of the thread pool.	Positive integer (seconds)	60
workflow.async.executor.core.pool.size	Sets the minimum number of threads kept alive for job execution.	Positive integer	8
workflow.async.executor.keep.alive.seconds	Sets the time (in seconds) a thread must stay alive before it is destroyed.	Positive integer (seconds)	5
workflow.async.executor.max.pool.size	Sets the maximum number of threads for job execution.	Positive integer	8
workflow.async.executor.queue.size	Sets the size of the queue for jobs to be executed.	Positive integer	2048
workflow.async.executor.thread.name.prefix	Sets the naming prefix for workflow thread pool threads.	(user-defined string)	WorkflowThreadPoolExecutor:
workflow.auth.feature.cache	Controls whether the workflow engine uses cached access tokens from Redis for inter-service calls. When FALSE, it always generates a fresh token.	TRUE/FALSE	TRUE
workflow.auth.retry.status-codes	Sets the HTTP status codes that trigger an HTTP task retry.	Comma-separated HTTP status codes	401,403,406
workflow.GET.request.max.pagesize	A configurable property for pagination GET endpoints under workflow to limit the maximum number of data in a single page.	Positive integer	100
workflow.custom.task.generate-store.doc.feature.size-limit-in-bytes	Sets the maximum size (in bytes) for storing generated embeddings in the vector database.	Positive integer	20000000
workflow.custom.task.http.deser.feature.include-source	Controls whether the response body is printed when HTTP call deserialisation fails. Disable this if there is a security concern.	TRUE/FALSE	TRUE
workflow.privilege.code.bypass.task.completion.check	Sets the privilege code to bypass task completion ownership check for cross-domain operations.	Privilege code	w0f26
workflow.privilege.code.bypass.user.assign.check	Sets the privilege code to bypass user task assignment check for cross-domain operations.	Privilege code	w0f27

Last updated on 21 Sep 2026