Enable graphql schema introspection. Disabled by default, enabled for preview mode.

Limits the allowed execution time for a query, set in milliseconds. 0 = no timeout.

Limits the complexity of a graphql query if set to a value greater than 0. 0 = off.

Limits the depth of a graphql query if set to a value greater than 0. 0 = off.

Repository paths excluded from retrieval via GraphQL endpoint. The paths may contain glob style expressions. Note, that the document name must be part of the path, if you do not use glob style expressions and want to protect a distinct document.

Examples:

   caas.graphql.repository-path-exclude-patterns[0]=/A/B/C/D   caas.graphql.repository-path-exclude-patterns[1]=/A/*/C/*   caas.graphql.repository-path-exclude-patterns[2]=/A/B/**   caas.graphql.repository-path-exclude-patterns[3]=/A/**/C/* 

List of global or site specific transformation option names defined in image transformation settings whose values are to be considered to compute image hashes.

Time to cache query list search results in seconds. Set it to "-1" to deactivate the query list cache.

Time to cache search query results in seconds. Set it to "-1" to deactivate the search-query cache.

Enable graphql search extensions.

Load the GraphQL search schema extensions.

Limit the count of search results hits. Defaults to 200.

Solr collection to use for CaaS search.

When 'true', wraps ContextHandlers and OutputHandlers while parsing in order to tracelog all parsing events. This is for debugging purposes only. Defaults to false. Additionally this requires the loglevel for 'com.coremedia.caas.richtext.stax.handler.output' to be set to trace level: logging.level.com.coremedia.caas.richtext.stax.handler.output = trace

Configures the maximum number of allowed yaml aliases used by snakeyaml instances while parsing rich text configurations. Defaults to 50.

When 'false', the root tag in the string result of a rich text transformation is not suppressed. Defaults to true.

(Caffeine Cache) configuration: Cache specs by cache name.

Size based eviction:

Time based eviction:

Durations are represented by an integer, followed by one of "d", "h", "m", or "s", representing days, hours, minutes, or seconds respectively.

Map of whether user credentials are supported, based on URL patterns.

Example:

 caas.cors.allow-credentials-for-url-pattern[/**]=true 

See org.springframework.web.util.pattern.PathPattern> for the syntax of allowed path patterns.

Map of headers that a pre-flight request can list as allowed for use during an actual request, based on URL patterns.

A header name is not required to be listed if it is one of: Cache-Control, Content-Language, Expires, Last-Modified or Pragma.

Example:

 caas.cors.allowed-headers-for-url-pattern[/**]=x-requested-with,x-csrf-token 

See org.springframework.web.util.pattern.PathPattern for the syntax of allowed path patterns.

Map of HTTP methods to allow, based on URL patterns.

Example:

 caas.cors.allowed-methods-for-url-pattern[/**]=GET,POST,PUT 

See org.springframework.web.util.pattern.PathPattern for the syntax of allowed path patterns.

Map of origins to allow, based on URL patterns.

Example:

 caas.cors.allowed-origins-for-url-pattern[/**]=https://domain1.com,https://domain2.com 

See org.springframework.web.util.pattern.PathPattern for the syntax of allowed path patterns.

Disable CORS configuration completely. Disabling CORS results effectively in an 'allow all CORS policy'.

Map of response headers other than simple headers (i.e. Cache-Control, Content-Language, Content-Type, Expires, Last-Modified or Pragma) that an actual response might have and can be exposed, based on URL patterns.

Example:

 caas.cors.exposed-headers-for-url-pattern[/**]=x-requested-with,x-csrf-token 

See org.springframework.web.util.pattern.PathPattern for the syntax of allowed path patterns.

Allow credentials flag to be used for path pattern '/**', in the case that no specific CORS configuration exists at all. @see org.springframework.web.cors.CorsConfiguration#setAllowCredentials(Boolean)

The fallback allowed methods to be used for path pattern '/**', in the case that no specific CORS configuration exists at all. @see org.springframework.web.cors.CorsConfiguration#setAllowedMethods(List)

A fallback allowed origin to be used for path pattern '/**', in the case that no specific CORS configuration exists at all.

This may be used to easily configure a minimal CORS config consisting of the FQDN, which is usually set via environment variables. @see org.springframework.web.cors.CorsConfiguration#setAllowedOrigins(List)

Map of how long, as a duration, the response from a pre-flight request can be cached by clients, based on URL patterns.

Example:

 caas.cors.max-age-for-url-pattern[/**]=3m 

See org.springframework.web.util.pattern.PathPattern for the syntax of allowed path patterns.

Set to true to expose extensions as described by the GraphQL spec.

Enables http cookie forwarding of incoming requests on endpoint 'graphql' and for persisted queries on '/caas/v1/*' towards outgoing, secondary requests to 'graphql' (triggered by '/preview') and cae remote link resolving.

Comaseparated enumeration of http headernames to be forwarded for incoming requests on endpoint 'graphql' and for persisted queries on '/caas/v1/*' towards outgoing, secondary requests to 'graphql' (triggered by /preview) and cae remote link resolving.

En-/disable REST mapping controller. Enabled by default (true).

Enables logging for HTTP requests (excluding OPTIONS)

Maximum cache time to set in the com.coremedia.caas.web.controller.MediaController responses via the Cache-Control max-age header.

Flag to set no-transform value for Cache-Control header in the Media Controller responses

Enables preview mode

En/disables the JSLT transformation processor on REST endpoints

Returns the path pattern where to find the jslt transformation resources within headless.

Number of threads for the thread pool of the request executor

Returns the path pattern where to find rest mapping resources within headless.

Fields to be excluded from site restrictions check.

To disable all fields (thus prohibiting all objects not belonging to the filtered site), add the config property without any field names (=empty list).

Adding additional fields requires to add the defaults as mentioned above to the config property! Defaults to "localizedVariant", "localizedVariants" and "derivedSites".

If true, adds the 'includeSubdomains' flag to the Strict-Transport-Security HTTP response header.

Max-Age of the Strict-Transport-Security HTTP response header in seconds, e.g. max-age=63072000.

If true, adds the 'preload' flag to the Strict-Transport-Security HTTP response header.

Enables Swagger.