Configuration Reference: Services, Connectors & Policies
1. SDK, Parsing & Connector High Level Specifications
1.2 DocParser Section
Configures multi format document extraction (pycaber and pycaber.parser_sdk).
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
DocParser.defaultBackend | string | public | "docling" | Primary structural document parser: "docling", "tika", or "native_rust". |
DocParser.fallbackBackend | string | public | "tika" | Fallback parser invoked if the primary backend fails on a corrupted or legacy file. |
DocParser.tikaServerUrl | string | internal | "http://tika-server:9998" | Apache Tika server endpoint for fallback binary extraction and OCR. |
DocParser.preserveByteOffsets | boolean | public | true | Emits ByteSpanMap mappings linking UTF8 offsets back to source pages and sections. |
DocParser.enableOcr | boolean | public | true | Enables optical character recognition for scanned PDFs and embedded images. |
DocParser.maxFileSizeMb | integer | public | 250 | Maximum single document size in megabytes accepted by the parser pipeline. |
DocParser.pluginModules | array | public | [] | Python module paths or Rust plugin identifiers registered via the Document Parser SDK. |
DocParser.formatRouter | object | public | {"\\.pdf": "docling", "\\.docx": "docling", ...} | Case preserved dictionary mapping file extensions or MIME types to specific registered parser names. |
2. Microservice & Platform Configuration Sections (Exhaustive Parameters)
ENV_Manager Section (15 Parameters)
Configuration for ENV_Manager service that updates and maintains environment
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
ENV_Manager.cfgLocation | string | info | None | ENV_Manager configuration: cfgLocation |
ENV_Manager.cfgServer | object | info | None | ENV_Manager configuration: cfgServer |
ENV_Manager.cfgServer.bind | string | standard | 0.0.0.0 | IPv4 address to bind config server to |
ENV_Manager.cfgServer.port | number | standard | 7576 | TCP port for config server web interface |
ENV_Manager.cfgServer.serveFrom | string | standard | /api | Directory to serve config files from |
ENV_Manager.doc | object | info | None | Documentation metadata for ENV_Manager section |
ENV_Manager.filePrefix | string | standard | INIT | 4 character mixed case prefix for log entries and object names |
ENV_Manager.initDBtables | array | info | None | ENV_Manager configuration: initDBtables |
ENV_Manager.logLevel | string | standard | debug | Logging level: error, warning, info, debug, verbose |
ENV_Manager.pathPrefix | string | standard | csiInit | Mixed case string used for S3 prefixes, logs, etc. from this module |
ENV_Manager.purgeSQS | array | info | None | ENV_Manager configuration: purgeSQS |
ENV_Manager.remoteDebug | boolean | info | None | ENV_Manager configuration: remoteDebug |
ENV_Manager.repoName | string | standard | csi-init | Lower case string for Docker repository naming |
ENV_Manager.runDirs | array | info | None | ENV_Manager configuration: runDirs |
ENV_Manager.updateInterval | number | advanced | 10 | Seconds between config update checks |
Dashboard Section (12 Parameters)
Configuration for Dashboard visualization service
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
Dashboard.doc | object | info | None | Documentation metadata for Dashboard section |
Dashboard.filePrefix | string | standard | DASH | 4 character prefix for logs and object names |
Dashboard.listenPorts | object | caution | None | Listen port configuration for Dashboard |
Dashboard.listenPorts.http | array | info | None | HTTP listen port for Dashboard |
Dashboard.listenPorts.https | array | info | None | HTTPS listen port for Dashboard |
Dashboard.logLevel | string | standard | info | Logging level for dashboard |
Dashboard.pathPrefix | string | standard | csiDashboard | Mixed case prefix for S3 and logs |
Dashboard.policyAdoptionDeadlineSeconds | number | advanced | 240 | Seconds the Dashboard's policy coordinator waits for the SDKs to report adopting a newly activated policy set before it fails the activation. Adoption needs the governance pointer snippet to reach ENV_Manager's snippet check, service discovery to carry it and each SDK's config reload poll to pick it up, which on a cold or busy stack has measured past 120 s. Must be a finite positive number; any other value is logged at ERROR and ignored, so the default applies. Read once when the Dashboard builds its coordinator; a change takes effect at the next Dashboard start. |
Dashboard.refresh | number | standard | 5 | Dashboard refresh interval in seconds |
Dashboard.remoteDebug | boolean | info | None | Dashboard configuration: remoteDebug |
Dashboard.repoName | string | info | None | Repository name for Dashboard module |
Dashboard.useShortAPIname | boolean | standard | True | If true, use only most significant path elements in API naming |
S3_Scanner Section (31 Parameters)
Configuration for S3_Scanner service that indexes S3 objects
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
S3_Scanner.accumulateEvents | object | info | None | S3_Scanner configuration: accumulateEvents |
S3_Scanner.accumulateEvents.maxItems | integer | info | None | S3_Scanner configuration: accumulateEvents.maxItems |
S3_Scanner.accumulateEvents.timeLimit | integer | info | None | S3_Scanner configuration: accumulateEvents.timeLimit |
S3_Scanner.allHTTPevents | array | info | None | S3_Scanner configuration: allHTTPevents |
S3_Scanner.allS3events | array | info | None | S3_Scanner configuration: allS3events |
S3_Scanner.delete | boolean | info | None | Deletion behavior configuration for S3_Scanner |
S3_Scanner.deleteEvents | array | info | None | S3_Scanner configuration: deleteEvents |
S3_Scanner.dependsOn | array | info | None | Service dependencies for S3_Scanner |
S3_Scanner.doc | object | info | None | Documentation metadata for S3_Scanner section |
S3_Scanner.dropNoMatch | boolean | info | None | S3_Scanner configuration: dropNoMatch |
S3_Scanner.filePrefix | string | standard | S3SC | 4 character prefix for logs and object names |
S3_Scanner.headObjectOptions | object | info | None | S3_Scanner configuration: headObjectOptions |
S3_Scanner.headObjectOptions.ChecksumMode | string | info | None | S3_Scanner configuration: headObjectOptions.ChecksumMode |
S3_Scanner.ignoreEvents | array | info | None | S3_Scanner configuration: ignoreEvents |
S3_Scanner.indexIfNotFound | boolean | info | None | S3_Scanner configuration: indexIfNotFound |
S3_Scanner.logLevel | string | standard | info | Logging level for S3_Scanner |
S3_Scanner.metadataCache | object | info | None | S3_Scanner configuration: metadataCache |
S3_Scanner.metadataCache.maxItems | integer | info | None | S3_Scanner configuration: metadataCache.maxItems |
S3_Scanner.metadataCache.timeTolive | integer | info | None | S3_Scanner configuration: metadataCache.timeTolive |
S3_Scanner.numIngestMessages | integer | info | None | S3_Scanner configuration: numIngestMessages |
S3_Scanner.objAuthZtags | array | info | None | S3_Scanner configuration: objAuthZtags |
S3_Scanner.outputToS3 | string | info | None | S3_Scanner configuration: outputToS3 |
S3_Scanner.pathPrefix | string | standard | csiS3scanner | Mixed case prefix for S3 and logs |
S3_Scanner.readEvents | array | info | None | S3_Scanner configuration: readEvents |
S3_Scanner.remoteDebug | boolean | info | None | S3_Scanner configuration: remoteDebug |
S3_Scanner.repoName | string | info | None | Repository name for S3_Scanner module |
S3_Scanner.s3Gets | array | info | None | S3_Scanner configuration: s3Gets |
S3_Scanner.s3Posts | array | info | None | S3_Scanner configuration: s3Posts |
S3_Scanner.s3Puts | array | info | None | S3_Scanner configuration: s3Puts |
S3_Scanner.touchEvents | array | info | None | S3_Scanner configuration: touchEvents |
S3_Scanner.writeEvents | array | info | None | S3_Scanner configuration: writeEvents |
API_Tap Section (16 Parameters)
Configuration for API_Tap service that intercepts API requests
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
API_Tap.filePrefix | string | standard | ATAP | 4 character prefix for logs and object names |
API_Tap.listenPorts | object | caution | None | Listen port configuration for API_Tap |
API_Tap.listenPorts.http | array | info | None | HTTP listen port for API_Tap |
API_Tap.listenPorts.https | array | info | None | HTTPS listen port for API_Tap |
API_Tap.listenPorts.testhttp | array | info | None | TESTHTTP listen port for API_Tap |
API_Tap.listenPorts.testhttps | array | info | None | TESTHTTPS listen port for API_Tap |
API_Tap.logLevel | string | standard | info | Logging level for API_Tap |
API_Tap.maxBodyLen | number | advanced | 16777216 | Maximum request body length in bytes |
API_Tap.maxInlineBodyLen | integer | info | None | API_Tap configuration: maxInlineBodyLen |
API_Tap.maxSqsLen | integer | info | None | API_Tap configuration: maxSqsLen |
API_Tap.maxUpload | number | advanced | 16777216 | Maximum upload size in bytes |
API_Tap.noLogTypes | array | info | None | API_Tap configuration: noLogTypes |
API_Tap.pathPrefix | string | standard | csiAPItap | Mixed case prefix for S3 and logs |
API_Tap.processCodeRegex | string | info | None | API_Tap configuration: processCodeRegex |
API_Tap.remoteDebug | boolean | info | None | API_Tap configuration: remoteDebug |
API_Tap.repoName | string | info | None | Repository name for API_Tap module |
ApiMap Section (49 Parameters)
Per API host mappings that API_Tap and the PyCaber intercept use to route, capture and govern each intercepted API. Keys are operator chosen hosts, documented here as <host>; 'doc' and 'default' are reserved keys.
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
ApiMap.<host> | object | standard | None | One intercepted API. The key is the IPv4 address, hostname or URL that API_Tap intercepts (for example 'cabersystems.com' or 'http://selfa:80'). A key whose host part starts with 'self' routes by port number and ignores the HTTP Host header. The key 'default' is the entry used for a host that has no entry of its own. |
ApiMap.<host>.allowNoXFF | boolean | standard | None | Present in older ApiMap entries. No current code reads it. |
ApiMap.<host>.allowRedirects | boolean | standard | False | Follow HTTP redirects returned by the upstream host instead of passing them back to the client. |
ApiMap.<host>.authDefaults | object | standard | {} | Authorization values used for this service when they cannot be looked up elsewhere: user, groups, allow, deny, region, name and type. |
ApiMap.<host>.enableOBO | boolean | caution | True | Per host OBO gate. OBO runs for this host only when this is true AND the process wide obo.enable_obo is on; a host can switch OBO off but cannot switch on an OBO the process has disabled. Also accepted as 'enableObo'. |
ApiMap.<host>.fixNoXFX | string | standard | `` | Fill in forwarding headers when no proxy or gateway in front of API_Tap sets them: 'X Forwarded For' (or 'XFF') or 'X Real IP' (or 'XRIP'). When set, X Forwarded Host, X Forwarded Port and X Forwarded Proto are filled in too. |
ApiMap.<host>.function | string | standard | `` | Function applied to the upstrm value before forwarding: 'resolve ecs task' resolves the host through the ECS task metadata endpoint, 'ecs servicediscovery' resolves it through AWS Cloud Map, and 'drop' is the same as setting upstrm to 'drop'. Empty means use upstrm as written. The PyCaber intercept does not process a host whose function is 'drop', 'pass' or 'log', or whose upstrm is 'drop' or 'pass'. |
ApiMap.<host>.governance | object | standard | None | Per API governance controls. Host side elements (identityAttributes, purpose, clarification, evidence) are applied by the host before the policy wave; policy elements (phi, hipaa, policies) set a policy's operation mode only. Any unknown key or malformed value rejects the whole ApiMap reload and the previous generation keeps serving. |
ApiMap.<host>.governance.allowWhenNoRules | boolean | caution | None | OBO fallback for content that maps to no authorization rule on this API: true permits it, false withholds it. When absent, the process wide obo.allow_when_no_rules applies, and when that is unset too, true. |
ApiMap.<host>.governance.clarification | object | standard | None | Whether a clarification question is shown to the user. |
ApiMap.<host>.governance.clarification.ask | boolean | standard | False | Show a clarification question to the user when the governance decision needs one. |
ApiMap.<host>.governance.evidence | object | standard | None | Evidence sources for this API: all on or off, and each source by source_id. |
ApiMap.<host>.governance.evidence.enabled | boolean | standard | True | Turn every evidence source on or off for this API. |
ApiMap.<host>.governance.evidence.sources | object | standard | {} | Per source switches keyed by evidence source_id. A source that is not listed is on. |
ApiMap.<host>.governance.evidence.sources.<source_id> | object | standard | None | Switch for one evidence source, keyed by its source_id (for example 'caber phi release v1'). |
ApiMap.<host>.governance.evidence.sources.<source_id>.enabled | boolean | standard | None | Whether this evidence source may be resolved for this API. Required in every source entry. |
ApiMap.<host>.governance.hipaa | object | standard | None | Operation mode of every framework policy whose framework is HIPAA, for this API. Accepts 'mode' only. |
ApiMap.<host>.governance.hipaa.mode | string | caution | None | 'observe' or 'enforce'. When absent, the mode authored in the policy set applies. |
ApiMap.<host>.governance.identityAttributes | object | standard | None | Whether the identity replica row is attached to the governance context for this API. |
ApiMap.<host>.governance.identityAttributes.enabled | boolean | standard | True | Attach the identity replica row for this API. |
ApiMap.<host>.governance.phi | object | standard | None | Operation mode of the sensitive delivery guard (CABER SENSITIVE DELIVERY GRANT 001) for this API. Accepts 'mode' only. |
ApiMap.<host>.governance.phi.mode | string | caution | None | 'observe' or 'enforce'. An observe mode policy is still evaluated and recorded but never decides an edge. When absent, the mode authored in the policy set applies. |
ApiMap.<host>.governance.policies | object | standard | {} | Operation mode of individual policies in the active set, keyed by policy id. An entry here wins over phi or hipaa for the same policy. An id the active set does not contain is logged and listed in the governance record as controls_unmatched; it is not an error. |
ApiMap.<host>.governance.policies.<policy_id> | object | standard | None | Mode override for one policy, keyed by its policy id. Accepts 'mode' only; there is no per API 'enabled', and removing a policy is done only in the Rego policy set. Naming CABER INTEGRITY 001 is a load error. |
ApiMap.<host>.governance.policies.<policy_id>.mode | string | caution | None | 'observe' or 'enforce'. Any other value is a load error. |
ApiMap.<host>.governance.purpose | object | standard | None | Purpose lookups for this API: on or off, the sources consulted and their time budget. |
ApiMap.<host>.governance.purpose.enabled | boolean | standard | None | Turn purpose lookups on or off. When absent, lookups run when a prompt purpose classifier is configured or the X Caber Purpose Context header is present. |
ApiMap.<host>.governance.purpose.sources | array | standard | ['declared', 'classifier'] | Purpose sources consulted, in order: 'declared' (the X Caber Purpose Context header) and 'classifier' (the configured classifier). Each may appear once. |
ApiMap.<host>.governance.purpose.timeoutMs | number | advanced | 250 | Time budget for the purpose lookup, in milliseconds. |
ApiMap.<host>.ignorePaths | array | standard | [] | Glob patterns over the request path, matched case insensitively; traffic on a matching path is not processed. The 'default' entry ignores '/health*' when it is not set. |
ApiMap.<host>.inspectAllHeaders | boolean | advanced | False | Capture every request header, including the ones suppressed by default. |
ApiMap.<host>.maxBodyLen | number | advanced | 16777216 | Largest body, in bytes, that is processed for this host; a larger body is skipped. sdk.max_body_size takes precedence when it is set. |
ApiMap.<host>.newhost | string | standard | `` | Value to set or rewrite the HTTP Host header to on the forwarded request. With function 'resolve ecs task', the value 'IP' sets the Host header to the resolved IP address. Also accepted as 'rewriteHost'. |
ApiMap.<host>.noLogHdrs | array | standard | [] | Request headers that are not captured. Honored on WebSocket connections; the HTTP intercept parses but does not apply it. The entry '<no_defaults>' also turns on inspectAllHeaders. Also accepted as 'noLogHeaders'. |
ApiMap.<host>.parseJSONstrVals | boolean | advanced | True | Parse JSON documents found inside JSON string values of the payload. Also accepted as 'parseJsonStrVals'. |
ApiMap.<host>.portForXFPort | string | standard | `` | Numeric X Forwarded Port value to set when fixNoXFX is set. When empty, the upstream URL's port is used, then the incoming connection's. |
ApiMap.<host>.processCodeRegex | string | advanced | 2\d{2} | Regular expression over the upstream HTTP status code; only responses whose code matches are processed. |
ApiMap.<host>.protoForXFProto | string | standard | `` | X Forwarded Proto value to set when fixNoXFX is set, 'http' or 'https'. When empty, the upstream URL's protocol is used, then the incoming connection's. |
ApiMap.<host>.protobufHandler | string | advanced | `` | Name of the protobuf handler used to decode this API's protobuf bodies. Empty means protobuf bodies are not decoded. |
ApiMap.<host>.redactStrategy | string | caution | `` | Redaction strategy for this host: 'by_nmers', 'by_values', 'by_keys[...]', or 'disabled' (also 'none') to turn redaction off for this API. Empty or absent inherits the process strategy. |
ApiMap.<host>.registeredContentMode | boolean | advanced | False | Treat this API's traffic as registered content. Also set by 'interactionMode': 'registered'. |
ApiMap.<host>.reqTimeout | number | standard | 20 | Timeout in seconds for requests forwarded to the upstream host. Also accepted as 'timeout'. |
ApiMap.<host>.serviceName | string | standard | `` | Service name recorded for this API. When empty the service name is the host part of the upstream URL. |
ApiMap.<host>.sessionCookie | string | standard | `` | Name of the HTTP cookie that carries the session identifier. |
ApiMap.<host>.setHeaders | object | standard | {} | Headers to create or overwrite on the forwarded request, as {header name: value}. Header names are lowercased. |
ApiMap.<host>.stage | string | standard | `` | AWS API Gateway stage inserted into the upstream URI. Superseded; kept only for older AWS API Gateway deployments. |
ApiMap.<host>.upstrm | string | standard | `` | URI of the real API endpoint that intercepted requests are forwarded to, for example 'https://newco nextcloud.newco docs.example.com:6443'. The value 'drop' forwards nothing and answers 404. Also accepted as 'upstream'. |
ApiMap.<host>.userIdKeys | array | standard | [] | Keys that carry the user id for this host: request header names, and keys in the structured request payload. They are consulted together with sdk.user_id_keys; OBO header names are filtered out. |
ApiMap.doc | object | info | None | Inline operator documentation for the ApiMap entries (summary, HOST and params). Every loader skips this key; it is not a host entry. |
Process_API Section (21 Parameters)
Configuration for Process_API service that processes API records
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
Process_API.apiNameLevels | integer | info | None | Process_API configuration: apiNameLevels |
Process_API.dependsOn | array | info | None | Service dependencies for Process_API |
Process_API.dlyDMtrig | integer | info | None | Process_API configuration: dlyDMtrig |
Process_API.doc | object | info | None | Documentation metadata for Process_API section |
Process_API.dropMsgShaList | array | info | None | Process_API configuration: dropMsgShaList |
Process_API.dropNones | boolean | info | None | Process_API configuration: dropNones |
Process_API.filePrefix | string | standard | PAPI | 4 character prefix for logs and object names |
Process_API.inlineHashLimit | integer | info | None | Process_API configuration: inlineHashLimit |
Process_API.keepHdrs | array | info | None | Process_API configuration: keepHdrs |
Process_API.logLevel | string | standard | info | Logging level for Process_API |
Process_API.maxLevels | integer | info | None | Process_API configuration: maxLevels |
Process_API.nextcloudAPIpwd | string | info | None | Process_API configuration: nextcloudAPIpwd |
Process_API.nextcloudAPIusr | string | info | None | Process_API configuration: nextcloudAPIusr |
Process_API.nextcloudServerIP | string | info | None | Process_API configuration: nextcloudServerIP |
Process_API.numIngestMessages | integer | info | None | Process_API configuration: numIngestMessages |
Process_API.outputToS3 | string | info | None | Process_API configuration: outputToS3 |
Process_API.pathPrefix | string | standard | csiProcessAPI | Mixed case prefix for S3 and logs |
Process_API.reTimeout | integer | info | None | Process_API configuration: reTimeout |
Process_API.remoteDebug | boolean | info | None | Process_API configuration: remoteDebug |
Process_API.repoName | string | info | None | Repository name for Process_API module |
Process_API.scanHdrs | boolean | info | None | Process_API configuration: scanHdrs |
Auth_Analyzer Section (22 Parameters)
Configuration for Auth_Analyzer service
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
Auth_Analyzer.checkAuthFail | boolean | info | None | Auth_Analyzer configuration: checkAuthFail |
Auth_Analyzer.connectUserDataAuth | boolean | info | None | Auth_Analyzer configuration: connectUserDataAuth |
Auth_Analyzer.dependsOn | array | info | None | Service dependencies for Auth_Analyzer |
Auth_Analyzer.doc | object | info | None | Documentation metadata for Auth_Analyzer section |
Auth_Analyzer.filePrefix | string | standard | AUTH | 4 character prefix for logs and object names |
Auth_Analyzer.inLinkCutoff | integer | info | None | Auth_Analyzer configuration: inLinkCutoff |
Auth_Analyzer.incrRecs | integer | info | None | Auth_Analyzer configuration: incrRecs |
Auth_Analyzer.initNeoDB | boolean | info | None | Auth_Analyzer configuration: initNeoDB |
Auth_Analyzer.junkStDevs | object | info | None | Auth_Analyzer configuration: junkStDevs |
Auth_Analyzer.junkStDevs.absolute | number | info | None | Auth_Analyzer configuration: junkStDevs.absolute |
Auth_Analyzer.junkStDevs.relative | number | info | None | Auth_Analyzer configuration: junkStDevs.relative |
Auth_Analyzer.logLevel | string | standard | info | Logging level for Auth_Analyzer |
Auth_Analyzer.mergeHostService | boolean | info | None | Auth_Analyzer configuration: mergeHostService |
Auth_Analyzer.nearIdenticalPcnt | integer | info | None | Auth_Analyzer configuration: nearIdenticalPcnt |
Auth_Analyzer.pathPrefix | string | standard | csiAuthAnalyzer | Mixed case prefix for S3 and logs |
Auth_Analyzer.reTrigger | integer | info | None | Auth_Analyzer configuration: reTrigger |
Auth_Analyzer.remoteDebug | boolean | info | None | Auth_Analyzer configuration: remoteDebug |
Auth_Analyzer.repoName | string | info | None | Repository name for Auth_Analyzer module |
Auth_Analyzer.splitAPIpath | boolean | info | None | Auth_Analyzer configuration: splitAPIpath |
Auth_Analyzer.splitOBJpath | boolean | info | None | Auth_Analyzer configuration: splitOBJpath |
Auth_Analyzer.startRecs | integer | info | None | Auth_Analyzer configuration: startRecs |
Auth_Analyzer.waitOnBuildNum | integer | info | None | Auth_Analyzer configuration: waitOnBuildNum |
SQL_Scanner Section (7 Parameters)
Configuration for SQL_Scanner service that scans SQL databases
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
SQL_Scanner.doc | object | info | None | Documentation metadata for SQL_Scanner section |
SQL_Scanner.enableScan | boolean | standard | False | Enable or disable SQL scanning |
SQL_Scanner.filePrefix | string | standard | SQLS | 4 character prefix for logs and object names |
SQL_Scanner.logLevel | string | standard | info | Logging level for SQL_Scanner |
SQL_Scanner.pathPrefix | string | standard | csiSQLscanner | Mixed case prefix for S3 and logs |
SQL_Scanner.remoteDebug | boolean | info | None | SQL_Scanner configuration: remoteDebug |
SQL_Scanner.repoName | string | info | None | Repository name for SQL_Scanner module |
Kafka_Scanner Section (6 Parameters)
Configuration for Kafka_Scanner service
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
Kafka_Scanner.doc | object | info | None | Documentation metadata for Kafka_Scanner section |
Kafka_Scanner.filePrefix | string | standard | KAFK | 4 character prefix for logs and object names |
Kafka_Scanner.logLevel | string | standard | info | Logging level for Kafka_Scanner |
Kafka_Scanner.pathPrefix | string | standard | csiKafkaScanner | Mixed case prefix for S3 and logs |
Kafka_Scanner.repoName | string | info | None | Repository name for Kafka_Scanner module |
Kafka_Scanner.topics | array | info | None | Kafka_Scanner configuration: topics |
Compliance_Policies Section (2 Parameters)
Runtime governance settings a host needs to evaluate the activated policy artifact. Policy activation in the csiMVP Dashboard writes this section into the governance_runtime.json config snippet; it names no policy (policies live in the Governance_Policies policy set). This entry documents the two metapolicy keys only; the policy_runtime pointer, actor_context, evidence_sources, schema_version and assurance_acknowledged keys are defined by PyCaber Caber runtime. actor_context.role_source was removed (PyCaber docs/superpowers/specs/2026 10 12 idp attributed governance design.md section 7.3) and is refused at start up: actor roles come from the directory, a 'scim' Identity_Sources entry whose users' roles reach csi_identity_map (user.roles).
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
Compliance_Policies.default_disposition | string | standard | permit | The one global default disposition, applied whenever no policy decides a request. Allowed values: 'permit' or 'deny'. Set in the Console policy set editor and written by policy activation, which composes the same value into the policy artifact (data.caber.policy_set.default_disposition, read by Rego) and into this key (read by the host). Absent means the shipped default, PyCaber Caber runtime ('permit'). Activation refuses any other value. |
Compliance_Policies.default_release_grant | string | standard | granted | The release grant assumed for a sensitive tier edge with an established purpose when no release grant evidence of the required type exists for it (policy CABER SENSITIVE DELIVERY GRANT 001). Allowed values: 'granted' (the edge is permitted, reason sensitive_delivery_default_release_grant) or 'not_granted' (the edge is denied). Real grant evidence in any state always decides instead, and an edge with no established purpose still asks for clarification. Separate from default_disposition so a deployment can deny ungranted sensitive content without denying everything else. Set in the Console policy set editor beside Default disposition and written by policy activation with the same value it composes into the policy artifact (data.caber.policy_set.default_release_grant). Absent means the shipped default, PyCaber GLOBAL_DEFAULT_RELEASE_GRANT ('granted'). Activation refuses any other value. |
Identity_Sources Section (23 Parameters)
Identity sources: the SCIM directory sync, traffic side issuer declarations, and the lookup sources csiMVP and the PyCaber enrichers use. Keys are operator chosen source names, documented here as <source>; 'doc' is a reserved key. Removed by PyCaber docs/superpowers/specs/2026 10 12 idp attributed governance design.md section 7.3 and refused by PyCaber at start up with a message naming the replacement: Identity_Sources entries of type 'api' (with their query, prefilter, postfilter and outmap), the top level AuthDefaultMap, and Compliance_Policies.actor_context.role_source.
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
Identity_Sources.<source> | object | standard | None | One identity source. The key is an operator chosen name (for example 'zt_mimic_directory' or 'ncFileToUser'). The entry's 'type' selects what it is and which other fields apply. Allowed types: 'scim' (a SCIM 2.0 directory sync), 'issuer' (a traffic side issuer declaration), 'sqldb', 'dns', 'demo', 'aws_iam' and 'aws4_hmac'. Type 'api' was removed (PyCaber docs/superpowers/specs/2026 10 12 idp attributed governance design.md section 7.3): PyCaber refuses it at start up with a message naming the 'scim' replacement. |
Identity_Sources.<source>.authoritativeEmailDomains | array | standard | [] | For 'scim': email domains this directory is authoritative for under its issuer, compared case insensitively. A directory user's email is trusted evidence only when its domain is listed; entries must be bare domains (no '@'). |
Identity_Sources.<source>.baseUrl | string | standard | None | For 'scim' (required): SCIM 2.0 base URL without a trailing '/Users', for example 'http://zt mimic:8090/scim/v2'. The sync pages through GET {baseUrl}/Users with startIndex and count (RFC 7644 section 3.4.2.4). |
Identity_Sources.<source>.base_col | string | standard | None | Field of the removed type 'api'. Nothing reads it; a config carrying a type 'api' source is refused at start up. |
Identity_Sources.<source>.bearerTokenEnv | string | caution | None | For 'scim' (required): name of the environment variable holding the SCIM bearer token, sent as 'Authorization: Bearer <token>'. The token itself never appears in config; an unset variable fails the sync tick without calling the server. |
Identity_Sources.<source>.columns | array | standard | None | Columns whose values are looked up through this source (for example 'object.id'). Not read for 'scim' or 'issuer'. |
Identity_Sources.<source>.defaults | object | standard | None | Fill in values for lookup results (for example an authenticator or acceptor). Not read for 'scim' or 'issuer'. |
Identity_Sources.<source>.dropNetName | boolean | standard | None | For 'dns': drop the network name from resolved host names. |
Identity_Sources.<source>.emailTrust | string | standard | None | For 'issuer' (required): how far the issuer's email claim is trusted for linking. 'provisioned' trusts every email the issuer asserts; 'verified_only' trusts only an email marked email_verified: true. An undeclared issuer's emails are untrusted. |
Identity_Sources.<source>.enabled | boolean | standard | True | Whether the source is used. A disabled 'scim' source registers no sync. |
Identity_Sources.<source>.identifier | string | standard | None | Short identifier of the source (for example 'MIMU', 'F2U', 'DNS'). For 'scim' it names the raw attribute columns: each SCIM user attribute lands at user.attr.<identifier lowercased>.<attribute> on csi_identity_map. Required for 'scim'; not read for 'issuer'. |
Identity_Sources.<source>.inplace | array | standard | None | For 'dns': whether and which lookup columns are replaced by the result. |
Identity_Sources.<source>.issuer | string | standard | None | For 'scim' (required): the issuer every directory user's iss_sub evidence is keyed by, for example 'http://zt mimic:8090'; two directories cannot share an issuer. For 'issuer' (required): the traffic side token issuer being declared, compared exactly (case sensitive), for example 'agentic chat app'; each issuer is declared once. |
Identity_Sources.<source>.outmap | object | standard | None | How lookup results map to identity elements (name, groups, allow, authenticator, acceptor, region). Not accepted on type 'api', which was removed; a 'scim' source maps SCIM attributes itself and takes no outmap. |
Identity_Sources.<source>.postfilter | object | standard | None | For 'dns': regex or python expression applied to the lookup result, with optional test cases. Not accepted on type 'api', which was removed. |
Identity_Sources.<source>.prefilter | object | standard | None | For 'sqldb' and 'dns': regex or python expression extracting the lookup name from the input, with optional test cases. Not accepted on type 'api', which was removed. |
Identity_Sources.<source>.priority | integer | standard | None | csiMVP lookup order: lookups start with the source with the lowest priority number and the first source to provide a result wins. Not read for 'scim' or 'issuer'. |
Identity_Sources.<source>.query | string | standard | None | For 'sqldb': the SQL query, or 'file:<name>' to fetch it from the customer key. For 'dns': MATCH(...) over the prefilter group names. Not accepted on type 'api', which was removed. |
Identity_Sources.<source>.refreshSeconds | integer | standard | None | For 'scim' (required): seconds between full directory syncs; must be greater than zero. Only users whose content changed since the last sync are republished; a user missing from a complete listing is republished once as inactive. |
Identity_Sources.<source>.sqlConfig | string | standard | None | For 'sqldb': the name of the SQL source configuration to query. |
Identity_Sources.<source>.type | string | standard | None | Source type: 'scim', 'issuer', 'sqldb', 'dns', 'demo', 'aws_iam' or 'aws4_hmac'. Also accepted as 'source_type'. 'scim' registers the SCIM directory sync, which publishes each directory user onto the identity_directory hub stream as an authoritative record (groups, roles, tenant, active) under its issuer. 'issuer' registers no connector: it declares a traffic side token issuer and how far its email claim is trusted. 'demo' registers the demo (f2u) enrichment connector. 'api' was removed together with its per row query, prefilter, postfilter and outmap; PyCaber refuses it at start up. Replacement: a 'scim' entry. |
Identity_Sources.<source>.usage | array | standard | None | Planes the source serves: 'Object', 'Service', or both. The demo (f2u) enricher is registered only when 'Object' is listed. Not read for 'scim' or 'issuer'. |
Identity_Sources.doc | object | info | None | Inline operator documentation for the Identity_Sources entries (summary and a field guide). Every loader skips this key; it is not a source entry. |
Environment_Variables Section (89 Parameters)
Environment variables referenced in Caber code that do not map directly to a JSON config parameter
| Key Path | Type | Sensitivity | Default | Description |
|---|---|---|---|---|
Environment_Variables.AWS_ACCESS_KEY | string | caution | None | AWS SDK/runtime environment variable: AWS_ACCESS_KEY |
Environment_Variables.AWS_CONTAINER_CREDENTIALS_FULL_URI | string | caution | None | AWS SDK/runtime environment variable: AWS_CONTAINER_CREDENTIALS_FULL_URI |
Environment_Variables.AWS_EXECUTION_ENV | string | caution | None | AWS SDK/runtime environment variable: AWS_EXECUTION_ENV |
Environment_Variables.AWS_LAMBDA_RUNTIME_API | string | caution | None | AWS SDK/runtime environment variable: AWS_LAMBDA_RUNTIME_API |
Environment_Variables.AWS_PARTITION | string | caution | None | AWS SDK/runtime environment variable: AWS_PARTITION |
Environment_Variables.AWS_PROFILE | string | caution | None | AWS SDK/runtime environment variable: AWS_PROFILE |
Environment_Variables.AWS_REGION | string | caution | None | AWS SDK/runtime environment variable: AWS_REGION |
Environment_Variables.AWS_ROLE_ARN | string | caution | None | AWS SDK/runtime environment variable: AWS_ROLE_ARN |
Environment_Variables.AWS_ROLE_SESSION_NAME | string | caution | None | AWS SDK/runtime environment variable: AWS_ROLE_SESSION_NAME |
Environment_Variables.AWS_SECRET_KEY | string | caution | None | AWS SDK/runtime environment variable: AWS_SECRET_KEY |
Environment_Variables.AWS_SESSION_TOKEN | string | caution | None | AWS SDK/runtime environment variable: AWS_SESSION_TOKEN |
Environment_Variables.AWS_SHARED_CREDENTIALS_FILE | string | caution | None | AWS SDK/runtime environment variable: AWS_SHARED_CREDENTIALS_FILE |
Environment_Variables.AWS_WEB_IDENTITY_TOKEN_FILE | string | caution | None | AWS SDK/runtime environment variable: AWS_WEB_IDENTITY_TOKEN_FILE |
Environment_Variables.CABER_API_KEY | string | danger | None | Caber API key for SDK/CLI authentication. Used by pycaber.configure() when no explicit api_key parameter is provided |
Environment_Variables.CABER_AWS_ACCESS_KEY_ID | string | caution | None | Caber infrastructure environment variable: CABER_AWS_ACCESS_KEY_ID |
Environment_Variables.CABER_AWS_CREDENTIALS_IN_SECRETS_ARN | string | caution | None | Caber infrastructure environment variable: CABER_AWS_CREDENTIALS_IN_SECRETS_ARN |
Environment_Variables.CABER_AWS_REGISTRY_ACCESS_SECRETS_ARN | string | caution | None | Caber infrastructure environment variable: CABER_AWS_REGISTRY_ACCESS_SECRETS_ARN |
Environment_Variables.CABER_AWS_SECRETS_KMS_KEY_ARN | string | caution | None | Caber infrastructure environment variable: CABER_AWS_SECRETS_KMS_KEY_ARN |
Environment_Variables.CABER_AWS_SECRET_ACCESS_KEY | string | caution | None | Caber infrastructure environment variable: CABER_AWS_SECRET_ACCESS_KEY |
Environment_Variables.CABER_CF_IAM_REGION | string | info | None | Caber infrastructure environment variable: CABER_CF_IAM_REGION |
Environment_Variables.CABER_PRIV_TOKEN | string | danger | None | Privileged authentication token for Caber staff (prefix: caber priv ). Allows privileged mode without stored session file |
Environment_Variables.CABER_TF_IAM_POLICY_ARN | string | caution | None | Caber infrastructure environment variable: CABER_TF_IAM_POLICY_ARN |
Environment_Variables.CABER_TF_LOG_LEVEL | string | info | None | Caber infrastructure environment variable: CABER_TF_LOG_LEVEL |
Environment_Variables.CABER_TF_REPO_URI | string | info | None | Caber infrastructure environment variable: CABER_TF_REPO_URI |
Environment_Variables.CABER_TF_SCRIPT_FOLDER | string | info | None | Caber infrastructure environment variable: CABER_TF_SCRIPT_FOLDER |
Environment_Variables.CSI_APITAP_TORNADO_DEBUG | string | info | None | Caber service environment variable: CSI_APITAP_TORNADO_DEBUG |
Environment_Variables.CSI_API_MAP_FILTER | string | info | None | Caber service environment variable: CSI_API_MAP_FILTER |
Environment_Variables.CSI_AWS_ACCESS_KEY | string | danger | None | Caber service environment variable: CSI_AWS_ACCESS_KEY |
Environment_Variables.CSI_AWS_CLOUDTRAIL | string | info | None | Caber service environment variable: CSI_AWS_CLOUDTRAIL |
Environment_Variables.CSI_AWS_SCHEMES_REGEX | string | info | None | Caber service environment variable: CSI_AWS_SCHEMES_REGEX |
Environment_Variables.CSI_AWS_SECRET_KEY | string | danger | None | Caber service environment variable: CSI_AWS_SECRET_KEY |
Environment_Variables.CSI_BOOTSTRAP_CONFIG | string | info | None | Caber service environment variable: CSI_BOOTSTRAP_CONFIG |
Environment_Variables.CSI_BUILD_GRAPH | string | info | None | Caber service environment variable: CSI_BUILD_GRAPH |
Environment_Variables.CSI_CHECK_HTTP_PROXY | string | info | None | Caber service environment variable: CSI_CHECK_HTTP_PROXY |
Environment_Variables.CSI_CONFIG_FILE | string | info | None | Caber service environment variable: CSI_CONFIG_FILE |
Environment_Variables.CSI_CONFIG_PREFIX | string | info | None | Caber service environment variable: CSI_CONFIG_PREFIX |
Environment_Variables.CSI_CONFIG_SNIPPET_DIR | string | info | None | Caber service environment variable: CSI_CONFIG_SNIPPET_DIR |
Environment_Variables.CSI_CONFIG_UPDATE_QUEUE | string | info | None | Caber service environment variable: CSI_CONFIG_UPDATE_QUEUE |
Environment_Variables.CSI_CONTAINER_NAME | string | info | None | Caber service environment variable: CSI_CONTAINER_NAME |
Environment_Variables.CSI_CONTAINER_SHUTDOWN | string | info | None | Caber service environment variable: CSI_CONTAINER_SHUTDOWN |
Environment_Variables.CSI_CUSTOMER_CONFIG | string | info | None | Caber service environment variable: CSI_CUSTOMER_CONFIG |
Environment_Variables.CSI_DASH_PORT | string | info | None | Caber service environment variable: CSI_DASH_PORT |
Environment_Variables.CSI_DEBUG_API_KEY | string | danger | None | Caber service environment variable: CSI_DEBUG_API_KEY |
Environment_Variables.CSI_DEBUG_IP | string | info | None | Caber service environment variable: CSI_DEBUG_IP |
Environment_Variables.CSI_DEBUG_LOAD_DATA_DIR | string | info | None | Caber service environment variable: CSI_DEBUG_LOAD_DATA_DIR |
Environment_Variables.CSI_DEBUG_PORT | string | info | None | Caber service environment variable: CSI_DEBUG_PORT |
Environment_Variables.CSI_DEPENDENCY_CONFIG | string | info | None | Caber service environment variable: CSI_DEPENDENCY_CONFIG |
Environment_Variables.CSI_DEPLOYMENT_ID | string | info | None | Caber service environment variable: CSI_DEPLOYMENT_ID |
Environment_Variables.CSI_DEPLOYMENT_LOGS_TABLE | string | info | None | Caber service environment variable: CSI_DEPLOYMENT_LOGS_TABLE |
Environment_Variables.CSI_DEP_KAFKA_ZOOKEEPER_TARGET | string | info | None | Caber service environment variable: CSI_DEP_KAFKA_ZOOKEEPER_TARGET |
Environment_Variables.CSI_DUMP_OUTPUT_DIRECTORY | string | info | `` | Directory path for writing debug dump files. Falls back to /shared if not set or empty |
Environment_Variables.CSI_DUMP_OUTPUT_MODULES | string | info | None | Caber service environment variable: CSI_DUMP_OUTPUT_MODULES |
Environment_Variables.CSI_DYNAMIC_DEPLOY | string | info | None | Caber service environment variable: CSI_DYNAMIC_DEPLOY |
Environment_Variables.CSI_ENV_MANAGER_HOST | string | info | csi-init:7576 | HTTP host and port for the ENV_Manager configuration service endpoint |
Environment_Variables.CSI_FLOWLOGS_LOG_GROUP | string | info | None | Caber service environment variable: CSI_FLOWLOGS_LOG_GROUP |
Environment_Variables.CSI_INDX_TORNADO_DEBUG | string | info | None | Caber service environment variable: CSI_INDX_TORNADO_DEBUG |
Environment_Variables.CSI_INTERSECTOR_API | string | info | None | Caber service environment variable: CSI_INTERSECTOR_API |
Environment_Variables.CSI_INTERSECTOR_PATH | string | info | None | Caber service environment variable: CSI_INTERSECTOR_PATH |
Environment_Variables.CSI_KAFKA_HOST | string | info | None | Caber service environment variable: CSI_KAFKA_HOST |
Environment_Variables.CSI_LOCAL_DATA_DIR | string | info | None | Caber service environment variable: CSI_LOCAL_DATA_DIR |
Environment_Variables.CSI_MODULE | string | info | None | Caber service environment variable: CSI_MODULE |
Environment_Variables.CSI_MODULE_NAME | string | info | None | Caber service environment variable: CSI_MODULE_NAME |
Environment_Variables.CSI_NEO4J_INITDB | string | info | None | Caber service environment variable: CSI_NEO4J_INITDB |
Environment_Variables.CSI_PACKAGE_NAME | string | info | None | Caber service environment variable: CSI_PACKAGE_NAME |
Environment_Variables.CSI_PG_LOG_DB | string | info | dashboard_logs | PostgreSQL database name for the dashboard logging and event data store |
Environment_Variables.CSI_PG_LOG_HOST | string | info | None | PostgreSQL host for the dashboard logging database. Falls back to POSTGRES_HOST if not set |
Environment_Variables.CSI_PIPELINE_MODE | string | info | None | Environment variable override for pipeline mode selection (overrides GLOBAL.pipelineMode.mode config value). Values: 'legacy' or 'roaring' |
Environment_Variables.CSI_POSTGRES_INITDB | string | info | None | Caber service environment variable: CSI_POSTGRES_INITDB |
Environment_Variables.CSI_PYMOD_DEBUG | string | info | None | Caber service environment variable: CSI_PYMOD_DEBUG |
Environment_Variables.CSI_REDIS_HOST | string | info | None | Caber service environment variable: CSI_REDIS_HOST |
Environment_Variables.CSI_REDIS_PASSWORD | string | danger | None | Caber service environment variable: CSI_REDIS_PASSWORD |
Environment_Variables.CSI_REWRITE_LOCALHOST | string | info | None | Caber service environment variable: CSI_REWRITE_LOCALHOST |
Environment_Variables.CSI_RKCQF_NAME | string | info | None | Caber service environment variable: CSI_RKCQF_NAME |
Environment_Variables.CSI_ROLE_EXTERNAL_ID | string | info | None | Caber service environment variable: CSI_ROLE_EXTERNAL_ID |
Environment_Variables.CSI_RUNNING_CONFIG | string | info | None | Caber service environment variable: CSI_RUNNING_CONFIG |
Environment_Variables.CSI_SERVICE_DOMAIN | string | info | None | Caber service environment variable: CSI_SERVICE_DOMAIN |
Environment_Variables.CSI_SKIP_PARSE_HEAVY | string | info | None | When set to any truthy value, skips heavyweight document parsing (Tika) for performance optimization |
Environment_Variables.CSI_SOFTWARE_VERSION_NUMBER | string | info | None | Caber service environment variable: CSI_SOFTWARE_VERSION_NUMBER |
Environment_Variables.CSI_STANDALONE | string | info | None | Enables standalone deployment mode, bypassing AWS platform requirements. Used by the Dashboard service to run without cloud infrastructure dependencies. Set to 'true' to enable. |
Environment_Variables.CSI_STATUS_LOG_GROUP | string | info | None | Caber service environment variable: CSI_STATUS_LOG_GROUP |
Environment_Variables.CSI_SUPABASE_API_KEY | string | danger | None | Caber service environment variable: CSI_SUPABASE_API_KEY |
Environment_Variables.CSI_SUPABASE_URL | string | info | None | Caber service environment variable: CSI_SUPABASE_URL |
Environment_Variables.CSI_SYSDIG_AWSSQS_URL | string | info | None | Caber service environment variable: CSI_SYSDIG_AWSSQS_URL |
Environment_Variables.CSI_SYSDIG_BUCKET_LIST | string | info | None | Caber service environment variable: CSI_SYSDIG_BUCKET_LIST |
Environment_Variables.CSI_SYSDIG_COMMAND | string | info | None | Caber service environment variable: CSI_SYSDIG_COMMAND |
Environment_Variables.CSI_SYSDIG_IGNORE_EMPTY_OBJECT | string | info | None | Caber service environment variable: CSI_SYSDIG_IGNORE_EMPTY_OBJECT |
Environment_Variables.CSI_SYSDIG_RSPCODE_REGEX | string | info | None | Caber service environment variable: CSI_SYSDIG_RSPCODE_REGEX |
Environment_Variables.CSI_TENANT_ID | string | info | None | Caber service environment variable: CSI_TENANT_ID |
Environment_Variables.CSI_TENANT_ROLE_ARN | string | info | None | Caber service environment variable: CSI_TENANT_ROLE_ARN |