Aidbox User Docs
Run Aidbox locallyRun Aidbox in SandboxTalk to us Ask community
  • Aidbox FHIR platform documentation
    • Features
    • Architecture
  • Getting Started
    • Run Aidbox in Sandbox
    • Run Aidbox locally
    • Run Aidbox on AWS
    • Upload Sample Data
  • Tutorials
    • CRUD, Search Tutorials
      • Delete data
      • Set up uniqueness in Resource
      • Search Tutorials
        • Custom SearchParameter tutorial
        • Create custom Aidbox Search resource
        • Multilingual search tutorial
        • Migrate from Aidbox SearchParameter to FHIR SearchParameter
        • Change sort order by locale collation
    • Bulk API Tutorials
      • 🎓Synthea by Bulk API
      • 🎓$dump-sql tutorial
    • Security & Access Control Tutorials
      • Allow patients to see their own data
      • Restrict operations on resource type
      • Relationship-based access control
      • Creating user & set up full user access
      • Restricting Access to Patient Data
      • Create and test access control
      • RBAC
        • Flexible RBAC built-in to Aidbox
        • RBAC with JWT containing role
        • RBAC with ACL
      • Set-up token introspection
      • Prohibit user to login
      • Managing Admin Access to the Aidbox UI Using Okta Groups
      • Run Multibox locally
      • How to enable labels-based access control
      • How to enable patient data access API
      • How to enable SMART on FHIR on Patient Access API
      • How to enable hierarchical access control
      • How to configure Audit Log
      • How is an HTTP request processed in Aidbox
      • How to configure SSO with another Aidbox instance to access Aidbox UI
      • How to configure SSO with Okta to access Aidbox UI
      • How to configure sign-in with Apple for access to the Aidbox UI
      • How to configure Azure AD SSO for access to the Aidbox UI
      • How to configure Microsoft AD FS for access to the Aidbox UI
      • How to configure Azure AD SSO with certificate authentication for access to the Aidbox UI
      • How to configure GitHub SSO for access to Aidbox UI
      • How to configure Keycloak for access for AidboxUI
      • How to implement Consent-based Access Control using FHIR Search and Aidbox Access Policy
      • Debug Access Control
      • AccessPolicy best practices
      • How to configure Basic Auth flow
      • How to configure Authorization Code Grant
      • How to configure Client Credentials Grant
      • How to configure Implicit Grant
      • How to configure Token Exchange
      • How to configure Resource Owner Grant flow
      • Configuring Two Factor Authentication in Aidbox Identity Provider
      • SSO with external OAuth identity provider
    • Terminology Tutorials
      • Load ICD-10 terminology into Aidbox
      • Uploading IG terminology content to external FHIR terminology server
    • Validation Tutorials
      • Upload FHIR Implementation Guide
        • Environment Variable
        • Aidbox UI
          • IG Package from Aidbox Registry
          • Public URL to IG Package
          • Local IG Package
        • Aidbox FHIR API
        • UploadFIG Tool
      • ISiK
      • Carin BB
      • US Core
      • Davinci Pdex
      • mCode
    • Integration Toolkit Tutorials
      • Postmark integration tutorial
      • Mailgun integration tutorial
    • Subscriptions Tutorials
      • Kafka AidboxTopicDestination
      • Tutorial: produce QuestionnaireResponse to Kafka topic
      • GCP Pub/Sub AidboxTopicDestination
      • Webhook AidboxTopicDestination
      • AidboxTopicSubscription NATS tutorial
    • Other tutorials
      • Run Aidbox with FHIR R6
      • Migrate from Multibox to Aidbox
      • SDC with Custom Resources
      • How to create FHIR NPM package
      • Migrate from legacy licence portal to Aidbox portal
      • Set up Aidbox with Postman
      • How to run Aidbox in GCP Cloud Run
  • Overview
    • Licensing and Support
    • Aidbox user portal
      • Projects
      • Licenses
      • Members
    • Aidbox UI
      • Aidbox Notebooks
      • REST Console
      • Database Console
      • Attrs stats
      • DB Tables
      • DB Queries
    • Versioning
    • Release Notes
    • FAQ
    • Contact us
  • Configuration
    • Settings
    • Configure Aidbox and Multibox
    • Init Bundle
  • API
    • REST API
      • CRUD
        • Create
        • Read
        • Update
        • Patch
        • Delete
      • FHIR Search
        • SearchParameter
        • Include and Revinclude
        • Chaining
      • Aidbox Search
      • Bundle
      • History
      • $everything on Patient
      • Other
        • Aidbox & FHIR formats
        • Capability Statement
        • $document
        • Observation/$lastn
        • $validate
        • SQL endpoints
        • $matcho
        • $to-format
        • Aidbox version
        • Health check
    • Bulk API
      • Configure Access Policies for Bulk API
      • $dump
      • $dump-sql
      • $dump-csv
      • $export
      • $load & /fhir/$load
      • $import & /fhir/$import
      • aidbox.bulk data import
      • Bulk import from an S3 bucket
    • Batch/Transaction
    • GraphQL API
    • Other APIs
      • Plan API
        • Provider Directory API
          • Practitioner
          • PractitionerRole
          • Organization
          • OrganizationAffiliation
        • Plan API Overview
      • Archive/Restore API
        • create-archive
        • restore-archive
        • prune-archived-data
        • delete-archive
      • ETAG support
      • Cache
      • Changes API
      • RPC API
      • Sequence API
      • Encryption API
      • Batch Upsert
  • Access Control
    • Overview
    • Identity Management
      • User Management
      • Application/Client Management
    • Authentication
      • Basic HTTP Authentication
      • OAuth 2.0
      • Token Introspector
      • SSO with External Identity Provider
    • Authorization
      • Access Policies
      • SMART on FHIR
        • SMART Client Authorization
          • SMART App Launch
          • SMART Backend services
        • SMART Client Authentication
          • SMART: Asymmetric (/"private key JWT") authentication
          • SMART: Symmetric (/"client secret") authentication
        • SMART: Scopes for Limiting Access
        • Pass Inferno tests with Aidbox
        • Example: SMART App Launch using Aidbox and Keycloak
        • Example: SMART App Launch using Smartbox and Keycloak
      • Scoped API
        • Organization-based hierarchical access control
        • Compartments API
        • Patient data access API
      • Label-based Access Control
    • Audit & Logging
  • Modules
    • Profiling and validation
      • FHIR Schema Validator
        • Aidbox FHIR IGs Registry
        • Setup Aidbox with FHIR Schema validation engine
      • Skip validation of references in resource using request header
      • Asynchronous resource validation
    • Observability
      • Getting started
        • Run Aidbox with OpenTelemetry locally
        • How to export telemetry to the OTEL collector
      • Logs
        • How-to guides
          • OpenTelemetry logs
          • Elastic Logs and Monitoring Integration
          • Datadog Log management integration
          • Loki Log management integration
        • Tutorials
          • Log analysis and visualization tutorial
          • Export logs to Datadog tutorial
        • Extending Aidbox Logs
        • Technical reference
          • Log appenders
          • Log transformations
          • Log Schema
          • OTEL logs exporter parameters
      • Metrics
        • How-to guides
          • How to export metrics to the OTEL collector
          • Use Aidbox Metrics Server
          • Set-up Grafana integration
        • Technical reference
          • OpenTelemetry Metrics
          • OTEL metrics exporter parameters
      • Traces
        • How to use tracing
        • OTEL traces exporter parameters
    • Subscriptions
      • Aidbox topic-based subscriptions
      • Aidbox SubSubscriptions
    • Aidbox Forms
      • Getting started
      • Aidbox Forms Interface
      • Aidbox UI Builder
        • UI Builder Interface
        • Form creation
          • Form Settings
          • Widgets
          • Components
          • Versioning
          • Form customisation in Theme Editor
          • Form signature
          • How-to guides
            • How to: populate forms with data
            • How to extract data from forms
            • How to calculate form filling percentage
          • Multilingual forms
          • FHIRPath Editor
        • Import Questionnaire
        • Form sharing
        • Printing forms
          • Template-based PDF generation
        • FHIR versions
        • Offline forms
        • Embedding
          • Request Interception
        • Configuration
        • Forms multitenancy
        • Building reports using SQL on FHIR
        • Integration with external terminology servers
        • External FHIR servers as a data backend
        • Store attachments in S3-like storages
      • Access Control in Forms
      • Audit Logging in Forms
      • Aidbox Form Gallery
    • Define extensions
      • Extensions using StructureDefinition
      • Extensions using FHIRSchema
    • Custom Resources
      • Custom resources using FHIR Schema
      • Custom resources using StructureDefinition
      • Migrate to FHIR Schema
        • Migrate custom resources defined with Entity & Attributes to FHIR Schema
        • Migrate custom resources defined with Zen to FHIR Schema
    • Aidbox terminology module
      • Concept
        • $translate-concepts
        • Handling hierarchies using ancestors
      • ValueSet
        • ValueSet Expansion
        • ValueSet Code Validation
        • Create a ValueSet
      • CodeSystem
        • CodeSystem Concept Lookup
        • CodeSystem Subsumption testing
        • CodeSystem Code Composition
      • Import external terminologies
        • Import flat file (/CSV)
        • $import operation
        • Ready-to-use terminologies
      • $translate on ConceptMap
    • SQL on FHIR
      • Defining flat views with View Definitions
      • Query data from flat views
      • Reference
    • Integration toolkit
      • C-CDA / FHIR Converter
        • List of supported templates
          • Admission Diagnosis Section (/V3)
          • Advance Directives Section (/entries optional) (/V3)
          • Advance Directives Section (/entries required) (/V3)
          • Allergies and Intolerances Section (/entries optional) (/V3)
          • Allergies and Intolerances Section (/entries required) (/V3)
          • Assessment Section
          • Chief Complaint Section
          • Chief Complaint and Reason for Visit Section
          • Complications Section (/V3)
          • Course of Care Section
          • DICOM Object Catalog Section - DCM 121181
          • Default Section Rules
          • Discharge Diagnosis Section (/V3)
          • Document Header
          • Encounters Section (/entries optional) (/V3)
          • Encounters Section (/entries required) (/V3)
          • Family History Section (/V3)
          • Functional Status Section (/V2)
          • General Status Section
          • Goals Section
          • Health Concerns Section (/V2)
          • History of Present Illness Section
          • Hospital Consultations Section
          • Hospital Course Section
          • Hospital Discharge Instructions Section
          • Hospital Discharge Physical Section
          • Hospital Discharge Studies Summary Section
          • Immunizations Section (/entries optional) (/V3)
          • Immunizations Section (/entries required) (/V3)
          • Medical (/General) History Section
          • Medical Equipment Section (/V2)
          • Medications Administered Section (/V2)
          • Medications Section (/entries optional) (/V2)
          • Medications Section (/entries required) (/V2)
          • Mental Status Section (/V2)
          • Notes
          • Nutrition Section
          • Objective Section
          • Operative Note Fluids Section
          • Operative Note Surgical Procedure Section
          • Past Medical History (/V3)
          • Payers Section (/V3)
          • Plan of Treatment Section (/V2)
          • Postprocedure Diagnosis Section (/V3)
          • Preoperative Diagnosis Section (/V3)
          • Problem Section (/entries optional) (/V3)
          • Problem Section (/entries required) (/V3)
          • Procedure Description Section
          • Procedure Disposition Section
          • Procedure Estimated Blood Loss Section
          • Procedure Implants Section
          • Procedure Specimens Taken Section
          • Procedures Section (/entries optional) (/V2)
          • Procedures Section (/entries required) (/V2)
          • Reason for Visit Section
          • Results Section (/entries optional) (/V3)
          • Results Section (/entries required) (/V3)
          • Review of Systems Section
          • Social History Section (/V3)
          • Vital Signs Section (/entries optional) (/V3)
          • Vital Signs Section (/entries required) (/V3)
        • How to deploy the service
        • Producing C-CDA documents
        • How to customize conversion rules
      • HL7 v2 Integration
        • HL7 v2 integration with Aidbox Project
        • Mappings with lisp/mapping
      • X12 message converter
      • Analytics
        • Power BI
      • Mappings
      • Email Providers integration
        • Setup SMTP provider
    • SMARTbox | FHIR API for EHRs
      • Get started
        • Set up Smartbox locally
        • Deploy Smartbox with Kubernetes
      • (/g)(/10) Standardized API for patient and population services
      • The B11 Decision Support Interventions
        • Source attributes
        • Feedback Sections
      • How-to guides
        • Pass Inferno tests with Smartbox
        • Perform EHR launch
        • Pass Inferno Visual Inspection and Attestation
        • Revoke granted access
        • Set up EHR-level customization
        • Check email templates
        • Setup email provider
        • Register users
        • Set up SSO with Auth0
        • Publish Terms of Use link onto the documentation page
        • Find out what resources were exported during the $export operation
        • Find documentation endpoint
      • Background information
        • Considerations for Testing with Inferno ONC
        • Adding Clients for Inferno tests
        • Multitenancy approach
        • What is Tenant
        • Email templating
    • ePrescription
      • Getting started
      • Authentication with mTLS
      • Pharmacies synchronization
      • Prescribing
        • NewRx Message
        • CancelRx Message
        • How to test Callback
      • Directory
        • DirectoryDownload Message
        • GetProviderLocation Message
        • AddProviderLocation Message
        • UpdateProviderLocation Message
        • DisableProviderLocation Message
      • Medications
        • FDB
      • References
        • Environment Variables
        • List of metrics
      • Frequently Asked Questions
    • Other modules
      • MDM
        • Train model
        • Configure MDM module
        • Find duplicates: $match
        • Mathematical details
      • MCP
      • AidboxTrigger
  • Database
    • Overview
    • Database schema
    • PostgreSQL Extensions
    • AidboxDB
      • HA AidboxDB
    • Tutorials
      • Migrate to AidboxDB 16
      • Working with pgAgent
  • File storage
    • AWS S3
    • GCP Cloud Storage
    • Azure Blob Storage
    • Oracle Cloud Storage
  • Deployment and maintenance
    • Deploy Aidbox
      • Run Aidbox on Kubernetes
        • Deploy Production-ready Aidbox to Kubernetes
        • Deploy Aidbox with Helm Charts
        • Highly Available Aidbox
        • Self-signed SSL certificates
      • Run Aidbox on managed PostgreSQL
      • How to inject env variables into Init Bundle
    • Backup and Restore
      • Crunchy Operator (/pgBackRest)
      • pg_dump
      • pg_basebackup
      • WAL-G
    • Indexes
      • Get suggested indexes
      • Create indexes manually
  • App development
    • Use Aidbox with React
    • Aidbox SDK
      • Aidbox JavaScript SDK
      • Apps
      • NodeJs SDK
      • Python SDK
    • Examples
  • Reference
    • Matcho DSL reference
    • FHIR Schema reference
    • Settings reference
      • General
      • FHIR
      • Security & Access Control
      • Modules
      • Database
      • Web Server
      • Observability
      • Zen Project
    • Environment variables
      • Aidbox required environment variables
      • Optional environment variables
      • AidboxDB environment variables
    • System resources reference
      • IAM Module Resources
      • SDC Module Resources
      • Base Module Resources
      • Bulk Module Resources
      • AWF Module Resources
      • Cloud Module Resources
      • HL7v2 Module Resources
      • SQL on FHIR Module Resources
    • Email Providers reference
      • Notification resource reference
      • Mailgun environment variables
      • Postmark environment variables
    • Aidbox Forms reference
      • FHIR SDC API
      • Aidbox SDC API
      • Generating Questionnaire from PDF API
    • Aidbox SQL functions
  • Deprecated
    • Deprecated
      • Zen-related
        • RPC reference
          • aidbox
            • mdm
              • aidbox.mdm/update-mdm-tables
              • aidbox.mdm/match
        • FTR
        • Aidbox configuration project
          • Run Aidbox locally using Aidbox Configuraiton project
          • Aidbox configuration project structure
          • Set up and use configuration projects
          • Enable IGs
          • Repository
          • Seed Import
          • Manage Indexes in Zen Project
          • Seed v2
          • 🎓Migrate to git Aidbox Configuration Projects
          • Aidbox Configuration project reference
            • Zen Configuration
            • Aidbox project RPC reference
            • aidbox.config/config
          • Custom resources using Aidbox Project
          • First-Class Extensions using Zen
          • Zen Indexes
        • US Core IG
          • US Core IG support reference
        • Workflow Engine
          • Task
            • Aidbox Built-in Tasks
            • Task Executor API
            • Task User API
          • Workflow
            • Workflow User API
          • Services
          • Monitoring
        • FHIR conformance Deprecated guides
          • Touchstone FHIR 4.0.1 basic server
          • Touchstone FHIR USCore ClinData
          • How to enable US Core IG
            • Start Aidbox locally with US Core IG enabled
            • Add US Core IG to a running Aidbox instance
          • HL7 FHIR Da Vinci PDex Plan Net IG
        • Terminology Deprecated Tutorials
          • Inferno Test-Suite US Core 3.1.1
        • API constructor (/beta)
        • zen-lang validator
          • Write a custom zen profile
          • Load zen profiles into Aidbox
        • FHIR topic-based subscriptions
          • Set up SubscriptionTopic
          • Tutorial: Subscribe to Topic (/R4B)
          • API Reference
            • Subscription API
        • 🏗️FHIR Terminology Repository
          • FTR Specification
          • Create an FTR instance
            • FTR from CSV
            • FTR from FHIR IG
            • FTR from FTR — Direct Dependency
            • FTR from FTR — Supplement
          • FTR Manifest
          • Load SNOMED CT into Aidbox
          • Load LOINC into Aidbox
          • Load ICD-10-CM into Aidbox
          • Load RxNorm into Aidbox
          • Load US VSAC Package to Aidbox
          • Import via FTR
        • Zen Search Parameters
        • Access control lists (/ACL)
      • Entity / Attribute
        • Entities & Attributes
        • First-Class Extensions using Attribute
        • Custom Resources using Entity
        • Working with Extensions
        • Aidbox Search Parameters
      • Forms
      • Other
        • Custom Search
        • SearchQuery
        • Subscribe to new Patient resource
        • App Development Deprecated Tutorials
          • Receive logs from your app
            • X-Audit header
          • Patient Encounter notification Application
        • Other Deprecated Tutorials
          • Resource generation with map-to-fhir-bundle-task and subscription triggers
          • APM Aidbox
          • Automatically archive AuditEvent resources in GCP storage guide
          • HL7 v2 pipeline with Patient mapping
          • How to migrate to Apline Linux
          • How to migrate transaction id to bigint
          • How to fix broken dates
          • Configure multi-tenancy
        • AidboxProfile
        • GCP Pub/Sub
Powered by GitBook
On this page
  • Grant page URL
  • Enable FHIR Audit Log
  • Audit Log repository URL
  • Audit Log file path
  • Audit Log flush interval
  • Audit Log retry interval
  • Audit Log batch count
  • Enable access control for mapping
  • Encryption API secret
  • Allow CORS requests
  • Allow CORS requests from origins
  • Content security policy header
  • Skip JWT validation
  • JWT public key
  • JWT private key
  • JWT secret
  • Auto-create users from foreign tokens
  • Auth with non-validated JWT
  • Enable LBAC
  • Strip security labels
  • Enable organization-based hierarchical access control
  • Enable SU header
  • Enable Aidbox developer mode

Was this helpful?

Edit on GitHub
  1. Reference
  2. Settings reference

Security & Access Control

Security & Access Control settings

Grant page URL

URL of consent screen. A consent screen is an interface presented to a user during the authorization code grant flow.

ID

security.grant-page-url

Type

String

Default value

/auth/grant

Environment variable

BOX_SECURITY_GRANT_PAGE_URL

Deprecated environment variables

BOX_AUTH_GRANT__PAGE__URL

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

Enable FHIR Audit Log

Generates structured audit logs in FHIR AuditEvent format.

ID

security.audit-log.enabled

Type

Bool

Default value

false

Environment variable

BOX_SECURITY_AUDIT_LOG_ENABLED

Deprecated environment variables

AIDBOX_SECURITY_AUDIT__LOG_ENABLED

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

false — setting requires system restart

Audit Log repository URL

Full URL of the external destination where Aidbox streams all audit events. Before setting the URL, you must enable the audit log in Aidbox. If audit log is enabled, repository URL not specified, Aidbox will store Audit Event in the PostgreSQL database.

ID

security.audit-log.repository-url

Type

String

Default value

(no default)

Environment variable

BOX_SECURITY_AUDIT_LOG_REPOSITORY_URL

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

false — setting requires system restart

Audit Log file path

If provided, Aidbox stores any Audit Events that it could not deliver to the audit repository in this file.

ID

security.audit-log.file-path

Type

String

Default value

(no default)

Environment variable

BOX_SECURITY_AUDIT_LOG_FILE_PATH

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

Audit Log flush interval

Interval time in ms to flush audit events to Audit Log Repository

ID

security.audit-log.flush-interval

Type

Int

Default value

5000

Environment variable

BOX_SECURITY_AUDIT_LOG_FLUSH_INTERVAL

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

false — setting requires system restart

Audit Log retry interval

Interval time in ms to retry send Audit Events from audit log file.

ID

security.audit-log.retry-interval

Type

Int

Default value

10000

Environment variable

BOX_SECURITY_AUDIT_LOG_RETRY_INTERVAL

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

false — setting requires system restart

Audit Log batch count

Max count of Audit Log batch (FHIR bandle entry count).

ID

security.audit-log.batch-count

Type

Int

Default value

1000

Environment variable

BOX_SECURITY_AUDIT_LOG_BATCH_COUNT

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

false — setting requires system restart

Enable access control for mapping

Enable access control for /Mapping/<mapping-id>/$apply operation. If enabled, access control will be applied to the resulting transaction. If disabled, only access to $apply endpoints are verified.

ID

security.iam.mapping.enable-access-control

Type

Bool

Default value

false

Environment variable

BOX_SECURITY_IAM_MAPPING_ENABLE_ACCESS_CONTROL

Deprecated environment variables

BOX_FEATURES_MAPPING_ENABLE__ACCESS__CONTROL

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

Encryption API secret

ID

security.encrypt-secret

Type

String

Default value

(no default)

Environment variable

BOX_SECURITY_ENCRYPT_SECRET

Deprecated environment variables

AIDBOX_ENCRYPT_KEY

Sensitive

true — value will be masked in Admin UI

Set via

Environment variables

Hot reload

true — setting can be changed at runtime

Allow CORS requests

Enable Cross-Origin Resource Sharing (CORS) request handling.

ID

security.cors.enabled

Type

Bool

Default value

true

Environment variable

BOX_SECURITY_CORS_ENABLED

Deprecated environment variables

BOX_WEB_CORS_ENABLED

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

Allow CORS requests from origins

Comma separated list of origins [schema]://[domain]:[port] Default is wildcard value "*"

ID

security.cors.origins

Type

String

Default value

*

Environment variable

BOX_SECURITY_CORS_ORIGINS

Deprecated environment variables

BOX_WEB_CORS_ORIGINS

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

Content security policy header

Defines the Content Security Policy (CSP) header to enhance security by restricting resource loading. It specifies the policies for loading scripts, styles, media, fonts, and other resources.

Recommended value:

default-src 'self'; script-src 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'report-sample' 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; connect-src 'self'; font-src 'self'; frame-src 'self'; frame-ancestors 'self'; img-src 'self'; manifest-src 'self'; media-src 'self'; worker-src 'self';

ID

security.content-security-policy-header

Type

String

Default value

(no default)

Environment variable

BOX_SECURITY_CONTENT_SECURITY_POLICY_HEADER

Deprecated environment variables

AIDBOX_CONTENT_SECURITY_POLICY_HEADER

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

Skip JWT validation

Skip JWT token validation process.

ID

security.skip-jwt-validation

Type

Bool

Default value

false

Environment variable

BOX_SECURITY_SKIP_JWT_VALIDATION

Deprecated environment variables

BOX_FEATURES_AUTHENTICATION_SKIP__JWT__VALIDATION

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

JWT public key

RS256 signing algorithm expects providing private key for signing JWT and public key for verifying it.

ID

security.auth.keys.public

Type

String

Default value

(no default)

Environment variable

BOX_SECURITY_AUTH_KEYS_PUBLIC

Deprecated environment variables

BOX_AUTH_KEYS_PUBLIC

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

false — setting requires system restart

JWT private key

RS256 signing algorithm expects providing private key for signing JWT and public key for verifying it.

ID

security.auth.keys.private

Type

String

Default value

(no default)

Environment variable

BOX_SECURITY_AUTH_KEYS_PRIVATE

Deprecated environment variables

BOX_AUTH_KEYS_PRIVATE

Sensitive

true — value will be masked in Admin UI

Set via

Environment variables

Hot reload

false — setting requires system restart

JWT secret

HS256 signing algorithm needs only having a secret for both operations.

ID

security.auth.keys.secret

Type

String

Default value

(no default)

Environment variable

BOX_SECURITY_AUTH_KEYS_SECRET

Deprecated environment variables

BOX_AUTH_KEYS_SECRET

Sensitive

true — value will be masked in Admin UI

Set via

Environment variables

Hot reload

false — setting requires system restart

Auto-create users from foreign tokens

Creates local user accounts automatically when valid external JWT tokens are presented but no matching user exists.

ID

security.introspection-create-user

Type

Bool

Default value

false

Environment variable

BOX_SECURITY_INTROSPECTION_CREATE_USER

Deprecated environment variables

BOX_FEATURES_AUTHENTICATION_INTROSPECTION_CREATE__USER

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

Auth with non-validated JWT

This configuration is used when skip-jwt-validation setting is enabled. It's a string that contains EDN object with :headers and :user-id-paths keys. For example: {:headers #{"authorization" "x-client-token"}, :user-id-paths #{[:authorization :user_id] [:my-client-token :user :id]}}

ID

security.auth-with-not-validated-jwt

Type

String

Default value

(no default)

Environment variable

BOX_SECURITY_AUTH_WITH_NOT_VALIDATED_JWT

Deprecated environment variables

BOX_FEATURES_AUTHENTICATION_AUTH__WITH__NOT__VALIDATED__JWT

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

false — setting requires system restart

Enable LBAC

Label-based Access Control engine provides a mechanism to restrict access to bundles, resources, or resource elements depending on permissions associated with a request.

ID

security.lbac.enabled

Type

Bool

Default value

false

Environment variable

BOX_SECURITY_LBAC_ENABLED

Deprecated environment variables

BOX_FEATURES_SECURITY__LABELS_ENABLE

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

Strip security labels

Removes security labels from resource responses before returning them to clients. When enabled, prevents sensitive security metadata from being exposed in API responses while maintaining access control enforcement internally. Useful for hiding security implementation details from end users.

ID

security.lbac.strip-labels

Type

Bool

Default value

false

Environment variable

BOX_SECURITY_LBAC_STRIP_LABELS

Deprecated environment variables

BOX_FEATURES_SECURITY__LABELS_STRIP__LABELS

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

Enable organization-based hierarchical access control

Activates hierarchical access control based on organizational structure. Restricts user access to resources based on their organizational affiliation and hierarchy position.

ID

security.orgbac.enabled

Type

Bool

Default value

false

Environment variable

BOX_SECURITY_ORGBAC_ENABLED

Deprecated environment variables

BOX_FEATURES_ORGBAC_ENABLE

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

false — setting requires system restart

Enable SU header

This setting enables SU header functionality.SU header allows a user to substitute User ID for the duration of the request. Only the administrator is allowed to use the SU header.

ID

security.debug-su-enable

Type

Bool

Default value

false

Environment variable

BOX_SECURITY_DEBUG_SU_ENABLE

Deprecated environment variables

BOX_DEBUG_SU_ENABLE

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

Enable Aidbox developer mode

Activates debugging features for access policy development, including the _debug=policy URL parameter and x-debug header. Returns detailed policy evaluation traces showing why requests were allowed or denied. For development environments only - not recommended for production systems.

ID

security.dev-mode

Type

Bool

Default value

false

Environment variable

BOX_SECURITY_DEV_MODE

Deprecated environment variables

AIDBOX_DEV_MODE

Sensitive

false — value will be visible in plaintext in Admin UI

Set via

Admin UI → Settings Environment variables

Hot reload

true — setting can be changed at runtime

PreviousFHIRNextModules

Last updated 4 days ago

Was this helpful?

Secret key for encryption API.

Refer to the

Learn more
OWASP Content Security Policy Cheat Sheet