// ===REMOVE THE NAV BAR FROM THE HOME PAGE=== const hiddenNavUrls = [ "https://docs.bigid.com/", "https://docs.bigid.com/v1/en", ]; const interval = setInterval(function () { const currentUrl = window.location.href; if (hiddenNavUrls.includes(currentUrl)) { $('.nav-bar-nav').hide(); } else { $('.nav-bar-nav').show(); } }, 500); //===CHANGE "NEW" STATUS INDICATOR TO "DESIGN PARTNER" ==== $(document).ready(function () { $('.New-batch').html("Design Partner"); }); /*========SEARCH LOGIC============*/ function liveSearch() { const searchInput = document.getElementById('searchbox'); if (!searchInput) return; const search_query = searchInput.value.toLowerCase(); const words = search_query.split(/\s+/).filter(word => word.length > 0); const boxes = document.querySelectorAll('.box'); boxes.forEach(box => { const boxText = box.textContent.toLowerCase(); let allWordsMatch = true; if (words.length > 0) { allWordsMatch = words.every(word => boxText.includes(word)); } if (allWordsMatch || words.length === 0) { box.classList.remove("is-hidden"); } else { box.classList.add("is-hidden"); } }); checkParentsAndHeaders(); } function checkParentsAndHeaders() { const listItems = document.querySelectorAll('li'); const offsetRows = document.querySelectorAll('tr:not(.offset-group)'); const headerRows = document.querySelectorAll('.offset-group'); listItems.forEach(listItem => { const boxChild = listItem.querySelector('.box'); if (boxChild && boxChild.classList.contains('is-hidden')) { listItem.classList.add('is-hidden'); } else { listItem.classList.remove('is-hidden'); } const parentUl = listItem.parentElement; if (parentUl && parentUl.tagName === 'UL') { const visibleLi = Array.from(parentUl.children).filter(li => !li.classList.contains('is-hidden')); visibleLi.length === 0 ? parentUl.classList.add('is-hidden') : parentUl.classList.remove('is-hidden'); } }); offsetRows.forEach(row => { const ul = row.querySelector('td:nth-child(2) ul'); const offsetBox = row.querySelector('td:nth-child(1) .box'); const isOffsetHidden = offsetBox ? offsetBox.classList.contains('is-hidden') : true; const isUlHidden = ul ? ul.classList.contains('is-hidden') : true; if (isUlHidden && isOffsetHidden) { row.classList.add('is-hidden'); } else { row.classList.remove('is-hidden'); } }); headerRows.forEach(header => { let next = header.nextElementSibling; let visible = false; while (next && !next.classList.contains('offset-group')) { if (!next.classList.contains('is-hidden')) { visible = true; break; } next = next.nextElementSibling; } visible ? header.classList.remove('is-hidden') : header.classList.add('is-hidden'); }); } function initSearch() { const searchInput = document.getElementById('searchbox'); if (searchInput) { let typingTimer; searchInput.addEventListener('input', () => { clearTimeout(typingTimer); typingTimer = setTimeout(liveSearch, 300); }); // Run once in case there is already text in the box liveSearch(); } } // === INITIALIZE EVERYTHING === // We call initSearch here so it actually runs! if (document.readyState === 'complete') { initSearch(); } else { window.addEventListener('load', initSearch); } // === HIDE THE WORKSPACE DROPDOWN IN THE COOKIE CONSENT PAGES ==== if (window.location.href.startsWith('https://docs.bigid.com/consent')) { $('body').addClass('bigid-consent-url'); } // === REDIRECT "BigID Consent Guide" DROPDOWN ITEM === document.addEventListener('click', function (event) { const item = event.target.closest('.dropdown-item'); if (item && item.textContent.includes('BigID Consent Guide')) { event.preventDefault(); event.stopImmediatePropagation(); window.location.href = 'https://docs.bigid.com/consent/docs'; } }, true); // === SHOW BANNER FOR LOGGED-OUT USERS === setInterval(function () { const banner = document.querySelector('blockquote[data-block-id="mdyhvmuw-mhb94q-007"]'); if (!banner) return; const hasLoginButton = !!document.querySelector('d360-header-profile button.btn-link'); if (hasLoginButton) { banner.style.display = 'block'; // confirmed logged out — reveal } }, 500); /*=== ENVIRONMENT VARIABLES ===*/ function articleToggle() {} function articleSearch() {} var envBadgeClass = { 'Feature Flags': 'feature', 'Security': 'security', 'Multi-tenancy': 'multitenancy', 'Scanning': 'scanning', 'AI / ML': 'ai', 'Logging': 'logging', 'Performance': 'performance', 'Service Config': 'service' }; var envLocClass = { 'setenv.sh': 'setenv', 'BigID UI': 'ui', 'Deployment': 'deployment' }; function envRender(data) { var root = document.getElementById('bigid-env-table'); if (!root) return; var tb = root.querySelector('tbody'); if (!tb) return; var cl = root.querySelector('.env-count'); if (data.length === 0) { tb.innerHTML = 'No variables match your search.'; if (cl) cl.textContent = '0 variables'; return; } tb.innerHTML = data.map(function(r) { return '' + '' + r[0] + '' + '' + r[1] + '' + '' + r[2] + '' + '' + r[3] + '' + '' + r[4] + '' + '' + r[5] + '' + ''; }).join(''); if (cl) cl.textContent = data.length + ' variable' + (data.length !== 1 ? 's' : ''); } function envFilter() { var root = document.getElementById('bigid-env-table'); if (!root) return; var searchEl = root.querySelector('input[type="search"]'); var catEl = root.querySelector('.cat-filter'); var locEl = root.querySelector('.loc-filter'); if (!searchEl || !catEl) return; var q = searchEl.value.toLowerCase(); var cat = catEl.value; var loc = locEl ? locEl.value : ''; var filtered = envRows.filter(function(r) { var matchQ = !q || r[0].toLowerCase().indexOf(q) !== -1 || r[3].toLowerCase().indexOf(q) !== -1; var matchC = !cat || r[4] === cat; var matchL = !loc || r[5] === loc; return matchQ && matchC && matchL; }); envRender(filtered); } function envBuild(root) { if (!document.getElementById('bigid-env-styles')) { var s = document.createElement('style'); s.id = 'bigid-env-styles'; s.textContent = [ '#bigid-env-table *{box-sizing:border-box}', '#bigid-env-table{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;font-size:14px;color:#1a1a1a}', '#bigid-env-table h1{font-size:20px;font-weight:600;margin:0 0 .5rem;color:#111}', '#bigid-env-table .subtitle{color:#6b7280;font-size:13px;margin-bottom:1.25rem}', '#bigid-env-table .toolbar{display:flex;gap:10px;margin-bottom:1rem;flex-wrap:wrap;align-items:center}', '#bigid-env-table input[type=search]{flex:1;min-width:180px;padding:8px 12px;font-size:13px;border:1px solid #d1d5db;border-radius:6px;outline:none;color:#1a1a1a;background:#fff}', '#bigid-env-table input[type=search]:focus{border-color:#4f46e5;box-shadow:0 0 0 3px rgba(79,70,229,.1)}', '#bigid-env-table select{padding:8px 12px;font-size:13px;border:1px solid #d1d5db;border-radius:6px;outline:none;color:#1a1a1a;background:#fff;cursor:pointer}', '#bigid-env-table select:focus{border-color:#4f46e5}', '#bigid-env-table .env-count{font-size:12px;color:#6b7280;white-space:nowrap;align-self:center}', '#bigid-env-table .tbl-wrap{overflow-x:auto;border:1px solid #e5e7eb;border-radius:8px}', '#bigid-env-table table{width:100%;border-collapse:collapse;font-size:12.5px;table-layout:fixed}', '#bigid-env-table col.c-name{width:21%}', '#bigid-env-table col.c-default{width:9%}', '#bigid-env-table col.c-values{width:11%}', '#bigid-env-table col.c-desc{width:28%}', '#bigid-env-table col.c-cat{width:13%}', '#bigid-env-table col.c-loc{width:18%}', '#bigid-env-table thead th{background:#f9fafb;padding:10px 12px;text-align:left;font-weight:600;font-size:11.5px;color:#6b7280;text-transform:uppercase;letter-spacing:.04em;border-bottom:1px solid #e5e7eb;position:sticky;top:0;z-index:1}', '#bigid-env-table tbody tr{border-bottom:1px solid #f3f4f6}', '#bigid-env-table tbody tr:last-child{border-bottom:none}', '#bigid-env-table tbody tr:hover{background:#f9fafb}', '#bigid-env-table td{padding:9px 12px;vertical-align:top;word-break:break-word;line-height:1.5}', '#bigid-env-table td.name{font-family:"SFMono-Regular",Consolas,"Liberation Mono",Menlo,monospace;font-size:11.5px;font-weight:600;color:#1a1a1a}', '#bigid-env-table td.default{font-family:"SFMono-Regular",Consolas,"Liberation Mono",Menlo,monospace;font-size:11px;color:#6b7280}', '#bigid-env-table td.values{font-size:11.5px;color:#6b7280}', '#bigid-env-table .badge{display:inline-block;padding:2px 8px;border-radius:4px;font-size:10.5px;font-weight:600;white-space:nowrap}', '#bigid-env-table .badge-feature{background:#eff6ff;color:#1d4ed8}', '#bigid-env-table .badge-security{background:#fef2f2;color:#b91c1c}', '#bigid-env-table .badge-multitenancy{background:#fffbeb;color:#92400e}', '#bigid-env-table .badge-scanning{background:#f0fdf4;color:#15803d}', '#bigid-env-table .badge-logging{background:#f3f4f6;color:#374151}', '#bigid-env-table .badge-service{background:#f3f4f6;color:#374151}', '#bigid-env-table .badge-ai{background:#f5f3ff;color:#6d28d9}', '#bigid-env-table .badge-performance{background:#fff7ed;color:#c2410c}', '#bigid-env-table .loc-badge{display:inline-block;padding:2px 7px;border-radius:4px;font-size:10.5px;font-weight:600;white-space:nowrap}', '#bigid-env-table .loc-setenv{background:#f0fdf4;color:#166534}', '#bigid-env-table .loc-ui{background:#eff6ff;color:#1e40af}', '#bigid-env-table .loc-deployment{background:#f3f4f6;color:#374151}', '#bigid-env-table .env-intro{margin-bottom:1.25rem;color:#374151;font-size:13px;line-height:1.65}', '#bigid-env-table .env-intro p{margin-bottom:.6rem}', '#bigid-env-table .env-intro ul{margin:.3rem 0 .6rem 1.4rem}', '#bigid-env-table .env-intro li{margin-bottom:.3rem}', '#bigid-env-table .env-intro-note{background:#fffbeb;border:1px solid #fde68a;border-radius:6px;padding:.6rem .9rem;color:#92400e;font-size:12.5px}', 'html[data-bs-theme="dark"] #bigid-env-table{color:#e5e7eb}', 'html[data-bs-theme="dark"] #bigid-env-table h1{color:#f9fafb}', 'html[data-bs-theme="dark"] #bigid-env-table .env-intro{color:#d1d5db}', 'html[data-bs-theme="dark"] #bigid-env-table .env-intro strong{color:#e5e7eb}', 'html[data-bs-theme="dark"] #bigid-env-table .env-intro-note{background:#292524;border-color:#78350f;color:#fcd34d}', 'html[data-bs-theme="dark"] #bigid-env-table .env-count{color:#e5e7eb}', 'html[data-bs-theme="dark"] #bigid-env-table input[type=search]{background:#1f2937;border-color:#374151;color:#e5e7eb}', 'html[data-bs-theme="dark"] #bigid-env-table input[type=search]::placeholder{color:#e5e7eb}', 'html[data-bs-theme="dark"] #bigid-env-table select{background:#1f2937;border-color:#374151;color:#e5e7eb}', 'html[data-bs-theme="dark"] #bigid-env-table .tbl-wrap{border-color:#374151}', 'html[data-bs-theme="dark"] #bigid-env-table thead th{background:#111827;color:#9ca3af;border-bottom-color:#374151}', 'html[data-bs-theme="dark"] #bigid-env-table tbody tr{border-bottom-color:#1f2937}', 'html[data-bs-theme="dark"] #bigid-env-table tbody tr:hover{background:#1f2937}', 'html[data-bs-theme="dark"] #bigid-env-table td{color:#e5e7eb}', 'html[data-bs-theme="dark"] #bigid-env-table td.name{color:#f3f4f6}', 'html[data-bs-theme="dark"] #bigid-env-table td.default{color:#e5e7eb}', 'html[data-bs-theme="dark"] #bigid-env-table td.values{color:#e5e7eb}', 'html[data-bs-theme="dark"] #bigid-env-table .badge-feature{background:#1e3a8a;color:#93c5fd}', 'html[data-bs-theme="dark"] #bigid-env-table .badge-security{background:#7f1d1d;color:#fca5a5}', 'html[data-bs-theme="dark"] #bigid-env-table .badge-multitenancy{background:#78350f;color:#fcd34d}', 'html[data-bs-theme="dark"] #bigid-env-table .badge-scanning{background:#14532d;color:#86efac}', 'html[data-bs-theme="dark"] #bigid-env-table .badge-logging{background:#1f2937;color:#d1d5db}', 'html[data-bs-theme="dark"] #bigid-env-table .badge-service{background:#1f2937;color:#d1d5db}', 'html[data-bs-theme="dark"] #bigid-env-table .badge-ai{background:#3b0764;color:#d8b4fe}', 'html[data-bs-theme="dark"] #bigid-env-table .badge-performance{background:#431407;color:#fdba74}', 'html[data-bs-theme="dark"] #bigid-env-table .loc-setenv{background:#14532d;color:#86efac}', 'html[data-bs-theme="dark"] #bigid-env-table .loc-ui{background:#1e3a8a;color:#93c5fd}', 'html[data-bs-theme="dark"] #bigid-env-table .loc-deployment{background:#1f2937;color:#d1d5db}', '#bigid-env-table .env-copy-btn{display:inline-flex;align-items:center;margin-left:5px;padding:1px 3px;background:none;border:none;cursor:pointer;color:#9ca3af;opacity:0;transition:opacity .15s,color .15s;vertical-align:middle;border-radius:3px}', '#bigid-env-table tbody tr:hover .env-copy-btn{opacity:1}', '#bigid-env-table .env-copy-btn:hover{color:#4f46e5}', '#bigid-env-table .env-copy-btn.copied{color:#16a34a;opacity:1}', 'html[data-bs-theme="dark"] #bigid-env-table .env-copy-btn{color:#6b7280}', 'html[data-bs-theme="dark"] #bigid-env-table .env-copy-btn:hover{color:#818cf8}', 'html[data-bs-theme="dark"] #bigid-env-table .env-copy-btn.copied{color:#4ade80}', ].join('\n'); document.head.appendChild(s); } root.innerHTML = [ '

BigID environment variable reference

', '

Environment variables control BigID system configuration and feature availability. Some specify internal service addresses; others enable or tune application features based on your deployment needs.

', '

Variables can be set in two places:

', '

setenv.sh — the compose directory file, applied at service startup. Requires a service restart to take effect.
BigID UI — Settings > Advanced Tools > Services Configuration. Variables marked with a pencil icon can be edited here without restarting, but you may need to log out and back in to see changes.

', '

Note: Variable settings apply only to services running on the host where they are declared. In distributed deployments, ensure variables are set consistently across all hosts.

', '

', '', '

', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', '

Variable name	Default	Accepted values	Description	Category	Configure in

', '

' ].join(''); root.addEventListener('input', function(e) { if (e.target && e.target.tagName === 'INPUT') envFilter(); }); root.addEventListener('change', function(e) { if (e.target && e.target.tagName === 'SELECT') envFilter(); }); root.addEventListener('click', function(e) { var btn = e.target.closest ? e.target.closest('.env-copy-btn') : null; if (!btn) return; var url = window.location.href.split('#')[0] + '#env-' + btn.getAttribute('data-var'); navigator.clipboard.writeText(url).then(function() { btn.classList.add('copied'); setTimeout(function() { btn.classList.remove('copied'); }, 1500); }); }); envRender(envRows); setTimeout(envScrollToHash, 500); setTimeout(envScrollToHash, 1000); } function envScrollToHash() { var hash = window.location.hash; if (!hash) return; var el = document.getElementById(hash.slice(1)); if (!el) return; var offset = 130; // accounts for D360 sticky nav + table header — adjust if needed var top = el.getBoundingClientRect().top + window.pageYOffset - offset; window.scrollTo({ top: top, behavior: 'smooth' }); el.style.transition = 'background 0.3s'; el.style.background = '#fef9c3'; setTimeout(function() { el.style.background = ''; }, 2500); } var envTableTimer = setInterval(function() { var root = document.getElementById('bigid-env-table'); if (root && !root.getAttribute('data-env-init')) { root.setAttribute('data-env-init', '1'); envBuild(root); } }, 300); // Rows: [name, default, accepted values, description, category, configure-in] // configure-in: "setenv.sh" | "BigID UI" | "Deployment" var envRows = [ // ── SECURITY ────────────────────────────────────────────────────────────── // setenv.sh ["SECRET_KEY","(default passphrase)","16–32 char string","Encryption key protecting sensitive values stored in MongoDB. Must be 16–32 characters with uppercase, lowercase, digits, and special characters. Use single quotes when setting in setenv.sh.","Security","setenv.sh"], ["BIGID_MONGO_PWD","(empty)","String","MongoDB connection password. Use single quotes for passwords containing special characters (e.g. export BIGID_MONGO_PWD='my%pass').","Security","setenv.sh"], ["BIGID_MONGO_SSL","false","true / false","Enables SSL/TLS encryption for the MongoDB connection.","Security","setenv.sh"], ["SAML_GROUPS_DELIMITER",",","Delimiter character","Overrides the delimiter used to parse SAML group membership claims. Default is comma.","Security","setenv.sh"], // BigID UI ["REDIS_PASSWORD","(empty)","String","Password for the Redis cache connection. Set if Redis is deployed with authentication enabled.","Security","BigID UI"], ["ACCESS_CONTROL_ALLOW_ORIGIN","(empty)","Origin URL or *","Sets the CORS Access-Control-Allow-Origin response header. Required when the BigID UI is served from a different domain than the API.","Security","BigID UI"], ["SHOW_ONLY_IDP_LOGIN","true","true / false","Blocks local username/password login when SSO is configured, forcing all users through the identity provider.","Security","BigID UI"], ["TOKEN_EXPIRATION_IN_MINUTES","1440","Integer (minutes)","Session token lifetime after login. Default is 24 hours.","Security","BigID UI"], ["TRUST_SELF_SIGNED_CERTS","true","true / false","Allows BigID to connect to data sources presenting self-signed SSL certificates.","Security","BigID UI"], ["UI_IDLE_TIMEOUT_IN_MINUTES","15","Integer (minutes)","Inactivity session timeout. Users are automatically logged out after this many minutes of idle time.","Security","BigID UI"], ["USE_EXTENDED_PERMISSIONS","(empty)","true / false","Enables extended permission roles including OPS, CORP-ID, and IAM Roles.","Security","BigID UI"], ["ENCRYPT_USER_PRIVATE_DATA_FF","false","true / false","Encrypts UniqueID and Display Name fields in correlation results before storing them in MongoDB.","Security","BigID UI"], ["MASK_DISPLAY_NAME","true","true / false","Masks personal names in analytics and reporting views to support privacy-by-default posture.","Security","BigID UI"], ["ENABLE_CREDENTIAL_CUSTOM_TYPES","false","true / false","Enables support for multiple credential types when configuring datasource connections.","Security","BigID UI"], // Deployment ["SIGNING_SERVICE_ENABLED","true","true / false","Enables the signing service and cryptographic key rotation. Required for secure inter-service token validation. Disable only in non-production or legacy environments.","Security","Deployment"], ["SIGNING_TPA_REQUESTS_ENABLED","false","true / false","Validates cryptographic signatures on third-party application (TPA) API requests. Enable to enforce request authenticity for installed apps.","Security","Deployment"], ["INTER_SERVICES_AUTHENTICATION","false","true / false","Enables mutual authentication between internal BigID microservices using signed tokens. Improves security posture for on-prem deployments.","Security","Deployment"], ["INTER_SERVICES_AUTHENTICATION_THROW_EXCEPTION","true","true / false","When inter-service authentication is enabled, controls whether a failed auth check throws an exception (blocking the request) or logs a warning and continues.","Security","Deployment"], ["KEY_ROTATION_ENABLED","false","true / false","Activates automatic rotation of internal encryption keys. Recommended for compliance-driven deployments.","Security","Deployment"], ["KEY_ROTATION_POLLING_INTERVAL_MS","600000","Integer (ms)","How often (ms) the key rotation service checks for rotation eligibility. Default is 10 minutes.","Security","Deployment"], ["KEY_ROTATION_INTERVAL_DAYS","7","Integer (days)","Days between internal encryption key rotations.","Security","Deployment"], ["EXTERNAL_KEY_ROTATION_ENABLED","false","true / false","Enables rotation of external-facing encryption keys (e.g. connector credentials).","Security","Deployment"], ["EXTERNAL_KEY_ROTATION_INTERVAL_DAYS","1","Integer (days)","Days between external key rotations.","Security","Deployment"], ["KEY_ENCRYPTION_KEY_PROVIDER","LEGACY","LEGACY / KMS / VAULT","Which key provider manages the key encryption key. LEGACY uses BigID's internal mechanism; KMS and VAULT integrate with external providers.","Security","Deployment"], ["IS_FIPS_MODE","false","true / false","Runs BigID in FIPS 140-2 compliant mode. Requires a FIPS-compatible JDK and MongoDB driver. Must be set at deployment time — cannot be toggled at runtime.","Security","Deployment"], ["FIPS_LOGIN_BANNER","(empty)","String","Custom text displayed on the login page when FIPS mode is enabled.","Security","Deployment"], ["AUTH_KEY_ENABLED","false","true / false","Enables use of a shared auth secret key for signing JWT tokens.","Security","Deployment"], ["SECRETS_AS_FILES_ENABLED","false","true / false","Mounts Kubernetes secrets as files instead of environment variables. Improves secret security posture in K8s deployments.","Security","Deployment"], ["SECRETS_AS_FILES_MOUNT_PATH","/tmp/secrets","File path","Directory where secrets are mounted when SECRETS_AS_FILES_ENABLED is true.","Security","Deployment"], ["K8S_MONGO_SECRETS_CUSTOM_REFRESH_INTERVAL_MS","2073600000","Integer (ms)","How often BigID re-reads MongoDB credentials mounted from Kubernetes secrets. Default ~24 days.","Security","Deployment"], ["TLS_ENABLED","true","true / false","Enables TLS on the Prompt Protection Gateway. Should remain true in production.","Security","Deployment"], ["TLS_MIN_VERSION","TLSv1_2","TLSv1_2 / TLSv1_3","Minimum TLS protocol version accepted by the Prompt Protection Gateway.","Security","Deployment"], ["TLS_MAX_VERSION","TLSv1_3","TLSv1_2 / TLSv1_3","Maximum TLS protocol version accepted by the Prompt Protection Gateway.","Security","Deployment"], ["TLS_CERT_FILE","./cert.pem","File path","Path to the TLS certificate file used by the Prompt Protection Gateway.","Security","Deployment"], ["TLS_KEY_FILE","./key.pem","File path","Path to the TLS private key file used by the Prompt Protection Gateway.","Security","Deployment"], ["INNER_AUTH_ENABLED","true","true / false","Enables internal JWT-based authentication between the Prompt Protection Gateway and BigID core.","Security","Deployment"], ["INNER_AUTH_SECRET","(required)","String","Shared HMAC secret for signing internal auth tokens in the Prompt Protection Gateway. Must match the value in BigID core.","Security","Deployment"], ["INNER_AUTH_ALGO_TYPE","HS256","HS256 / HS512 / RS256","JWT signing algorithm for internal gateway authentication.","Security","Deployment"], ["INNER_AUTH_EXPIRATION_SECONDS","600","Integer (seconds)","Lifetime of internal auth tokens from the Prompt Protection Gateway. Default is 10 minutes.","Security","Deployment"], // ── MULTI-TENANCY ───────────────────────────────────────────────────────── ["MULTI_TENANT_MODE_ENABLED","false","true / false","Enables multi-tenant deployment mode. Each tenant gets an isolated MongoDB database.","Multi-tenancy","Deployment"], ["MULTI_TENANT_CONFIG_ENABLED","false","true / false","Enables per-tenant configuration overrides via the config service. Use in SaaS or cloud environments.","Multi-tenancy","Deployment"], ["TENANT_DOMAIN_REGEX","(http[s]?://)?(.*bigid[.]cloud)","Regex string","Regex used to match and extract tenant identifiers from incoming request hostnames.","Multi-tenancy","Deployment"], ["GENERATE_AND_USE_MONGO_CREDS","false","true / false","Auto-generates and rotates per-tenant MongoDB credentials in multi-tenant deployments.","Multi-tenancy","Deployment"], ["USE_SAAS","false","true / false","Signals a SaaS deployment. Enables cloud-specific behaviors, routing, and feature availability.","Multi-tenancy","Deployment"], ["IS_PREMIUM_CLOUD","false","true / false","Marks the tenant as premium cloud tier, unlocking higher resource limits and premium-only features.","Multi-tenancy","Deployment"], ["SAAS_DOMAIN","bigid.cloud","Domain string","Base domain for SaaS tenant routing. Must match the configured ingress host.","Multi-tenancy","Deployment"], ["SAAS_ENV","(empty)","String (e.g. prod, staging)","Identifies the SaaS environment in event payloads sent to the data lake.","Multi-tenancy","Deployment"], ["COMPANY_NAME","(empty)","String","Organization name displayed in UI headers and notifications. Set per tenant in multi-tenant environments.","Multi-tenancy","Deployment"], // ── SCANNING ────────────────────────────────────────────────────────────── ["DATA_PREVIEW_DISABLED","false","true / false","Disables data previews across all data sources. By default (false), previews are enabled — structured object previews in the Data Catalog and field-level previews are both shown. Set to true to block all raw data from being displayed in the UI.","Scanning","BigID UI"], ["SUB_SCAN_IDLE_OPERATION_TIME_MINUTES","360","Integer","Configures the threshold for when the subscan is considered stuck. If a subscan is stuck, BigID automatically sends a resume request.","Scanning","BigID UI"], ["DISABLE_NFS_AUTOMOUNT","false","true / false","Excludes sudo commands used for NFS network share connections. Set true when sudo is restricted on the scanner host.","Scanning","setenv.sh"], ["ENABLE_PRIVILEGED_SCANNER","true","true / false","Runs the scanner container as root. Required for certain connector types. Set false only in restricted container environments.","Scanning","setenv.sh"], ["HYPER_SCAN_ENABLED","false","true / false","Enables Hyperscan high-performance regex engine. (Deprecated — use the standard scanner instead.)","Scanning","setenv.sh"], ["NUMBERS_LENGTH_THRESHOLD","9","Integer","Minimum digit length for a number to be considered a PII confidence match (e.g. SSN = 9 digits).","Scanning","setenv.sh"], ["SCANNER_GROUP_NAME","(empty)","String","Assigns this scanner to a named scanner group, directing specific data sources to specific scanner pools.","Scanning","setenv.sh"], ["PIPE_TO_ORCH2_CONDTIONALLY","true","true / false","Streams correlation sets to the secondary orchestrator (orch2) for stateless processing.","Scanning","setenv.sh"], ["CLASSIFICATION_MATCHER_AMOUNT","(empty)","Integer","Number of regex pattern matches evaluated per text chunk during classification. Tune to balance accuracy vs. performance.","Scanning","setenv.sh"], ["IGNORE_SENDING_CLASSIFICATION_FINDINGS_GLOBAL_FF","(empty)","true / false","Disables transmission of classification findings globally. Use to stop findings from being written during troubleshooting.","Scanning","setenv.sh"], ["REMOTE_SCANNER_VAULT_CUSTOM_HEADER_NAME","(empty)","String","Custom HTTP header name sent by the remote scanner when authenticating with a vault service.","Scanning","setenv.sh"], ["REMOTE_SCANNER_VAULT_CUSTOM_HEADER_VALUE","(empty)","String","Custom HTTP header value paired with REMOTE_SCANNER_VAULT_CUSTOM_HEADER_NAME.","Scanning","setenv.sh"], // BigID UI ["SCAN_JOBS_IN_MEMORY_ENABLED","true","true / false","Processes scan jobs in memory rather than persisting intermediate state to MongoDB. Improves throughput; disable for very large scans.","Scanning","BigID UI"], ["OBJECTS_DIFFERENTIAL_SCAN_ENABLED","true","true / false","Enables differential (delta) scanning — only processes objects changed since the last scan. Significantly reduces scan time.","Scanning","BigID UI"], ["NUMBER_OF_OBJECTS_PER_PART","200","Integer","Number of data objects bundled into a single scan part. Lower = more parallelism; higher = less overhead.","Scanning","BigID UI"], ["MAX_AMOUNT_OF_DS_PER_SCAN_FF","1000","Integer","Maximum number of data sources that can be included in a single scan job.","Scanning","BigID UI"], ["CLASSIFY_FILE_NAMES_ENABLED","false","true / false","Classifies data based on file/object names in addition to content. Useful for catching PII in naming patterns.","Scanning","BigID UI"], ["FULL_SCAN_SUPPORT_RETRY_OBJECTS_LEVEL","false","true / false","Enables object-level retry for failed scans, retrying individual failed objects instead of the entire data source.","Scanning","BigID UI"], ["PER_OBJECT_SUMMARY_ENABLED","false","true / false","Generates a per-object classification summary. Increases detail in results but adds storage overhead.","Scanning","BigID UI"], ["STUCK_QUEUED_SCAN_PARTS_MINUTES_IDLE_TIME","10","Integer (minutes)","Scan parts queued longer than this threshold are considered stuck and eligible for reprocessing.","Scanning","BigID UI"], ["CAPPING_CORRELATION_ENABLED","false","true / false","Limits correlation results per data source to prevent runaway jobs from consuming excessive resources.","Scanning","BigID UI"], ["CAPPING_CORRELATION_LIMIT","100","Integer","Maximum correlation matches returned per data source when capping is enabled.","Scanning","BigID UI"], ["CLASSIFIER_SUPERSCAN_PREFILTERING_ENABLED","true","true / false","Pre-filters objects before classification, skipping those unlikely to contain sensitive data.","Scanning","BigID UI"], ["STOPPED_SCAN_EXPIRATION_SECONDS","21600","Integer (seconds)","How long a stopped scan is retained before being purged. Default is 6 hours.","Scanning","BigID UI"], ["CACHE_FINDINGS_FILTER_TTL_SEC","604800","Integer (seconds)","TTL for cached scan findings filters. Default is 7 days.","Scanning","BigID UI"], ["RUN_CORRELATION_SCAN_WHILE_ACTIVE_CORRELATION_SETS_ENABLED","false","true / false","Allows new correlation scans to start while existing correlation sets are still active.","Scanning","BigID UI"], ["USE_CLASSIC_QUEUE_FOR_CORRELATION","false","true / false","Forces correlation jobs to use classic RabbitMQ queues instead of quorum queues.","Scanning","BigID UI"], ["DSAR_SCAN_JOBS_IN_MEMORY_ENABLED","false","true / false","Processes DSAR scan jobs in memory. Mirrors the main scan in-memory setting but scoped to DSAR workflows.","Scanning","BigID UI"], ["SCALABLE_PII_FINDINGS_DELETION_ENABLED","false","true / false","Enables the scalable background job for bulk deletion of PII findings. Required for large environments managing data retention at scale.","Scanning","BigID UI"], ["DELETE_CLASSIFICATION_FINDINGS_ENABLED","false","true / false","Activates the scheduled job that purges old classification findings from MongoDB after the configured retention period.","Scanning","BigID UI"], ["DELETE_CLASSIFICATION_FINDINGS_PERIOD_DAYS","60","Integer (days)","Age threshold after which classification findings are deleted when the deletion job is enabled.","Scanning","BigID UI"], ["DELETE_PII_RECORDS_ENABLED","false","true / false","Activates the scheduled job that purges old PII records from MongoDB after the configured retention period.","Scanning","BigID UI"], ["DELETE_PII_RECORDS_PERIOD_DAYS","60","Integer (days)","Age threshold after which PII records are deleted when the deletion job is enabled.","Scanning","BigID UI"], ["CORRELATION_RECOVERY_SCHEDULER_FLAG","true","true / false","Enables automatic retry of failed correlation jobs on a scheduled basis.","Scanning","BigID UI"], ["RAPID_UNSTRUCTURED_CORRELATION_ENABLED","false","true / false","Enables stateless orchestrator processing for faster correlation of large unstructured datasets.","Scanning","BigID UI"], ["BLOCK_SCAN_BY_OBJECT_CLEANUP_FF","true","true / false","Updates the data catalog before scan completion, preventing stale catalog entries from accumulating.","Scanning","BigID UI"], ["CLASSIFICATION_FINDINGS_LIMIT_ENABLED","true","true / false","Caps classification findings per object and attribute to prevent runaway resource consumption.","Scanning","BigID UI"], ["SCAN_PARTS_ENABLED","true","true / false","Enables split (partitioned) scanning, breaking large data sources into parallel scan parts.","Scanning","BigID UI"], ["SCAN_PARTS_MAX_IDLE_TIME_MINUTES","60","Integer (minutes)","How long a scanner can be unresponsive before a scan part is considered stuck and retried.","Scanning","BigID UI"], ["SCAN_WINDOW_FF","false","true / false","Enables Scan Windows, which restrict scanning to configured time periods.","Scanning","BigID UI"], ["TABLES_RESULT_SAMPLE_MAX_SIZE","5","Integer (MB)","Maximum MB of data returned when testing a datasource connection.","Scanning","BigID UI"], ["ID_SOURCE_VALID_DAYS","30","Integer (days)","Days after which a correlation set scan is considered stale and must be re-run.","Scanning","BigID UI"], ["SCAN_RESULTS_QUERY_LIMIT","10000","Integer","Maximum rows returned per attribute per table in scan results queries.","Scanning","BigID UI"], ["IDENTITIES_FORCE_SAMPLE","true","true / false","Enables default sampling when running correlation scans.","Scanning","BigID UI"], ["IDENTITIES_SAMPLE_SIZE","100000","Integer","Default sample size when identity sampling is enabled.","Scanning","BigID UI"], ["IDSOR_SERVER_TIMEOUT_IN_MINUTES","20","Integer (minutes)","Maximum time allowed for an entity scan before it is considered failed.","Scanning","BigID UI"], ["COLUMN_PROFILING_ENABLED","false","true / false","Enables column profiling, which collects statistical metadata (min, max, distinct count) for structured data columns.","Scanning","BigID UI"], ["DELETE_OLD_PREVIEW_IN_DAYS","30","Integer (days)","Days after which cached structured data previews are automatically cleared.","Scanning","BigID UI"], ["TABLE_PREVIEW_SKIP_SAMPLE_SIZE","0","Integer","Number of rows to skip in a structured data preview sample.","Scanning","BigID UI"], ["TEST_CONNECTION_TIMEOUT_SECONDS","900","Integer (seconds)","Timeout for datasource connection test operations.","Scanning","BigID UI"], ["REMOVE_EMPTY_VALUES_ON_CLASSIFICATION_CONFIDENCE_LEVEL_FF","false","true / false","Excludes null values from classification confidence level calculations.","Scanning","BigID UI"], ["REMOVE_EMPTY_VALUES_ON_CLASSIFICATION_CONFIDENCE_LEVEL_THRESHOLD","50","Integer (%)","Percentage of null values in a column above which nulls are excluded from confidence calculations.","Scanning","BigID UI"], // ── FEATURE FLAGS ───────────────────────────────────────────────────────── ["ACI_RERUN_FLOW_ENABLED","false","true / false","Enables the ACI rerun flow, allowing completed ACI jobs to be re-triggered without a full rescan.","Feature Flags","BigID UI"], ["ACI_AUTO_AD_SYNC_ENABLED","false","true / false","Enables automatic synchronization of Active Directory group membership data into ACI.","Feature Flags","BigID UI"], ["ACI_AUTO_AD_SYNC_TIMEOUT_MINUTES","180","Integer (minutes)","Maximum time allowed for an auto AD sync operation before it is considered failed.","Feature Flags","BigID UI"], ["ACI_OBJECTS_QUERY_LIMIT","250000","Integer","Maximum number of ACI objects returned in a single query.","Feature Flags","BigID UI"], ["ACI_SUPPORTED_DIRECT_PERMISSIONS","smb_v2","Comma-separated list","Connector types for which direct/effective permission tagging is enabled (e.g. smb_v2, onedrive-v2).","Feature Flags","BigID UI"], ["ACI_LICENSE_VALIDATION_ENABLED","false","true / false","Enforces ACI license validation before allowing ACI operations.","Feature Flags","BigID UI"], ["ACI_CM1_DOUBLE_WRITE_ENABLED","false","true / false","During CM1 migration, writes ACI sharedWith fields to both Elasticsearch and CM1 simultaneously for rollback safety.","Feature Flags","BigID UI"], ["ACI_MIGRATION_ELASTIC_WRITE_ONLY_ENABLED","false","true / false","After CM1 migration, writes ACI sharedWith data exclusively to CM1, stopping Elasticsearch writes.","Feature Flags","BigID UI"], ["ACI_CM1_ELASTIC_READ_ENABLED","false","true / false","Switches ACI object reads to come from CM1 instead of Elasticsearch. Enable after CM1 migration validation.","Feature Flags","BigID UI"], ["ACI_CM1_MIGRATION_ENABLED","false","true / false","Triggers migration of ACI objects from Elasticsearch into the CM1 store.","Feature Flags","BigID UI"], ["ACI_NEW_CONFIGURATION_PAGE_ENABLED","false","true / false","Enables the redesigned ACI configuration UI page.","Feature Flags","BigID UI"], ["ACI_ORG_DOMAIN_LIST","(empty)","Comma-separated domains","Internal organization email domains used by ACI to classify permissions as internal vs external.","Feature Flags","BigID UI"], ["EVENT_BASED_LABELING_ENABLED","false","true / false","Enables event-driven labeling that reacts to object changes in near-real-time rather than batch scan cycles.","Feature Flags","BigID UI"], ["CONTINUOUS_LABELING_ENABLED","false","true / false","Enables continuous labeling mode, where labeling jobs run on a schedule rather than only during full scans.","Feature Flags","BigID UI"], ["CONTINUOUS_LABELING_MAX_RETRY_COUNT","3","Integer","Maximum retry attempts for a failed continuous labeling job before it is marked permanently failed.","Feature Flags","BigID UI"], ["LABELING_SKIP_UNSUPPORTED_FILES","false","true / false","Labeling jobs silently skip unsupported file formats rather than marking them as errors.","Feature Flags","BigID UI"], ["SC_WITH_MAPPED_LABELS_ENABLED","false","true / false","Enables sensitivity classification results to be mapped to user-defined labels (e.g. MIP sensitivity labels).","Feature Flags","BigID UI"], ["BIGID_LABELS_ENABLED","false","true / false","Enables BigID's native label management system for custom labels on data assets.","Feature Flags","BigID UI"], ["GDRIVE_MAPPABLE_LABELS_PROVIDER_ENABLED","false","true / false","Enables Google Drive as a label provider for the mappable labels feature.","Feature Flags","BigID UI"], ["MIP_SDK_ENABLED","false","true / false","Enables the Microsoft Information Protection (MIP) SDK integration for applying MIP sensitivity labels from BigID.","Feature Flags","BigID UI"], ["SENSITIVITY_CLASSIFICATION_V2_ENABLED","true","true / false","Activates the v2 sensitivity classification engine with improved accuracy and hierarchical sensitivity level support.","Feature Flags","BigID UI"], ["ENABLE_SENSITIVITY_NEW_DEFAULT_GROUP","true","true / false","Uses the four-level sensitivity hierarchy: Public, Internal, Confidential, and Restricted.","Feature Flags","BigID UI"], ["RISK_LOW_THRESHOLD","50","Integer (0–100)","Score below which risk is classified as LOW. Scores between this and RISK_THRESHOLD are MEDIUM.","Feature Flags","BigID UI"], ["RISK_THRESHOLD","70","Integer (0–100)","Score above which risk is classified as HIGH. Scores between RISK_LOW_THRESHOLD and this are MEDIUM.","Feature Flags","BigID UI"], ["CLASSIFIER_TESTER_ENABLED","true","true / false","Shows the Classifier Tester UI panel for testing classifier patterns against sample data.","Feature Flags","BigID UI"], ["CLASSIFIER_TUNING_LIGHT_PREVIEW_ENABLED","true","true / false","Enables the simplified classifier tuning UI for reviewing and adjusting confidence thresholds.","Feature Flags","BigID UI"], ["CLASSIFIER_TUNING_ENABLED","true","true / false","Enables the Classifier Review and Refine workflow for reviewing and adjusting classifier results.","Feature Flags","BigID UI"], ["CLASSIFIER_TUNING_PREFETCHING_FF_ENABLED","true","true / false","Enables preview prefetching in the Classifier Review and Refine workflow.","Feature Flags","BigID UI"], ["CLASSIFIER_TUNING_STRUCTURED_PREVIEW_ATTRIBUTES_ENABLED","false","true / false","Fetches only rows with classifier matches in the Classifier Review structured preview.","Feature Flags","BigID UI"], ["OBJECT_LEVEL_ACTIONS","false","true / false","Enables actions (delete, tag, remediate) triggered at the individual object level.","Feature Flags","BigID UI"], ["OBJECTS_DELETION_ENABLED","false","true / false","Exposes the CM1 object deletion API endpoints. Required for data remediation workflows.","Feature Flags","BigID UI"], ["ENABLE_UNIFIED_VAULTS","false","true / false","Enables unified vault management UI consolidating HashiCorp Vault, Azure Key Vault, and other secret store integrations.","Feature Flags","BigID UI"], ["DSAR_PROFILE_FIELDS_CATALOG_IMPORT_ENABLED_FF","false","true / false","Allows DSAR profile fields to be imported directly from the Data Catalog.","Feature Flags","BigID UI"], ["DSAR_UPLOAD_REPORT_TO_STORAGE_ENABLED_FF","true","true / false","Enables DSAR report upload to cloud storage (S3/Azure Blob) for long-term retention.","Feature Flags","BigID UI"], ["DSAR_SCAN_MANAGEMENT_MONITORING_ENABLED_FF","true","true / false","Shows the DSAR scan management and monitoring dashboard.","Feature Flags","BigID UI"], ["DSAR_REPORT_TEMPLATE_VERSIONING_FF","true","true / false","Enables versioning for DSAR report templates, preserving historical configurations.","Feature Flags","BigID UI"], ["DSAR_REPORT_TEMPLATE_V2_ENABLED_FF","false","true / false","Activates the v2 DSAR report template engine with improved formatting and field support.","Feature Flags","BigID UI"], ["DSAR_SUBMISSION_FLOW_V2_ENABLED_FF","false","true / false","Switches the DSAR request submission pipeline to v2 scalable asynchronous processing.","Feature Flags","BigID UI"], ["DATA_MAPPING_PROFILES_ENABLED_FF","true","true / false","Enables global privacy profiles in the data mapping module for shared DSAR configurations.","Feature Flags","BigID UI"], ["PRIVACY_PORTAL_INTEGRATION_ENABLED","true","true / false","Enables the Privacy Portal integration for external data subject requests to flow into BigID.","Feature Flags","BigID UI"], ["ENABLE_PRIVACY_PORTAL_DATA_SOURCES","false","true / false","Exposes data source configuration within the Privacy Portal.","Feature Flags","BigID UI"], ["CATALOG_ELASTIC_ENABLED","false (on-prem) / true (cloud)","true / false","Routes catalog search and retrieval queries through Elasticsearch rather than MongoDB. Required for metadata search features. Also known as DATA_CATALOG_ELASTIC_ENABLED.","Feature Flags","BigID UI"], ["DISCOVERY_DASHBOARD_ENABLED","false","true / false","Enables the discovery dashboard view providing a high-level overview of datasource discovery status.","Feature Flags","BigID UI"], ["DS_CONNECTIONS_ENRICHMENT_ENABLED","true","true / false","Adds enrichment fields (e.g. asset owner, classification summary) to the datasource connections collection.","Feature Flags","BigID UI"], ["CONNECTIVITY_EXPERIENCE_ENABLED","true","true / false","Enables the redesigned datasource connectivity experience with improved onboarding and connection testing UI.","Feature Flags","BigID UI"], ["NEW_CONNECTION_TAB_ENABLED","true","true / false","Shows the updated new-connection tab layout in the datasource configuration UI.","Feature Flags","BigID UI"], ["DS_COLLABORATION_ENABLED","true","true / false","Enables datasource collaboration for multi-user annotation on shared datasource configurations.","Feature Flags","BigID UI"], ["DYNAMIC_MODIFY_SCAN_WINDOW_FF","true","true / false","Enables dynamic scan window modification, allowing scan schedules to be adjusted in real time.","Feature Flags","BigID UI"], ["USE_SCAN_PAGE_STATE_FF","true","true / false","Preserves scan page UI state across navigation, preventing loss of filter and sort selections.","Feature Flags","BigID UI"], ["ENABLE_SCAN_TEMPLATE_FF","true","true / false","Enables scan templates for reusable scan configurations across multiple datasources.","Feature Flags","BigID UI"], ["DISABLE_LEGACY_ACL_FF","true","true / false","Disables the legacy ACL enforcement path. Keep true unless rolling back from a failed ACL migration.","Feature Flags","BigID UI"], ["USE_DISPLAY_NAME_FOR_POLICY_FF","true","true / false","Uses policy display names in the UI instead of internal policy identifiers.","Feature Flags","BigID UI"], ["ENABLE_LANDING_PAGE_PER_USER","false","true / false","Allows each user to configure a personal landing page in the BigID UI.","Feature Flags","BigID UI"], ["LEGAL_ENTITIES_ENABLED_FF","true","true / false","Enables the legal entities feature for associating data assets with specific legal entities in RoPA and privacy workflows.","Feature Flags","BigID UI"], ["RISK_REGISTER_ENABLED_FF","false","true / false","Enables the risk register module for tracking and managing identified data risks.","Feature Flags","BigID UI"], ["COMPLIANCE_FRAMEWORKS_ENABLED","true","true / false","Enables the compliance frameworks module for mapping data assets and risks to regulatory frameworks (GDPR, CCPA, HIPAA).","Feature Flags","BigID UI"], ["CUSTOMER_EA_PROGRAM_ENABLED","true","true / false","Shows the Customer Early Access Program UI, allowing users to opt into preview features.","Feature Flags","BigID UI"], ["ONBOARDING_ASSISTANT_ENABLED","true","true / false","Enables the in-product onboarding assistant that guides new admins through initial setup tasks.","Feature Flags","BigID UI"], ["USE_ROLES_REFRESH_LOCK_VALUE","false","true / false","Adds a distributed lock when refreshing role data in Redis to prevent duplicate refreshes under high concurrency.","Feature Flags","BigID UI"], ["APPLY_SCANS_UPDATED_AT_INDEX_ENABLED","false","true / false","Creates a MongoDB index on the scans collection using updatedAt to accelerate scan status queries.","Feature Flags","BigID UI"], ["APPLY_PII_RECORDS_ORG_SCAN_ID_INDEX_ENABLED","false","true / false","Creates a compound MongoDB index on pii_records using (fullCollectionName, org_scan_id) to improve PII lookup performance.","Feature Flags","BigID UI"], ["ENABLE_ARCHIVING_DSPM_CASES","true","true / false","Enables automated archiving of resolved DSPM cases.","Feature Flags","BigID UI"], ["ACTIONABLE_INSIGHTS_DIGEST_EMAIL_ENABLED","false","true / false","Sends periodic digest emails summarizing new actionable security insights from DSPM.","Feature Flags","BigID UI"], ["SEND_EMAIL_ACTION_ENABLED","true","true / false","Enables the send-email action type in workflows and action center policies.","Feature Flags","BigID UI"], ["DSPM_DASHBOARDS_ENABLED","true","true / false","Shows DSPM dashboards on the main dashboard screen.","Feature Flags","BigID UI"], ["DSPM_ACTIVITY_MONITORING_ENABLED","false","true / false","Enables DSPM activity monitoring for tracking data access patterns and flagging anomalous behavior.","Feature Flags","BigID UI"], ["DSPM_SECURITY_OVERVIEW_DASHBOARD_ENABLED","true","true / false","Enables the DSPM security overview dashboard panel.","Feature Flags","BigID UI"], ["DS_MULTI_DIM_DASHBOARD_ENABLED","false","true / false","Enables multi-dimensional datasource dashboards for more granular scan and classification breakdowns.","Feature Flags","BigID UI"], ["SAVE_SCANNER_LOGS_IN_DB_ENABLED","false","true / false","Persists scanner execution logs to MongoDB in addition to standard log output. Increases database write load.","Feature Flags","BigID UI"], ["RISK_ASSESSMENT_ENABLED","true","true / false","Enables the risk assessment module for quantifying data risk across the data estate.","Feature Flags","BigID UI"], ["FEEDBACK_LOOP_ENABLED","true","true / false","Enables the feedback loop feature, allowing users to submit classification feedback to improve ML model accuracy.","Feature Flags","BigID UI"], ["ACTIONABLE_INSIGHTS_ENABLED","true","true / false","Enables the Actionable Insights panel in the DSPM dashboard.","Feature Flags","BigID UI"], ["DSPM_SERVICE_NOW_ENABLED","true","true / false","Enables ServiceNow integration within DSPM Actionable Insights.","Feature Flags","BigID UI"], ["DSPM_POLICY_ACTIONS_ENABLED","true","true / false","Enables policy-based automated actions triggered by DSPM findings.","Feature Flags","BigID UI"], ["DATA_EXPLORER_ENABLED","false","true / false","Enables the Data Explorer for browsing and querying raw data objects directly from the BigID UI.","Feature Flags","BigID UI"], ["SHOW_NEW_DASHBOARD","true","true / false","Displays the redesigned BigID dashboard layout.","Feature Flags","BigID UI"], ["ATTR_CONFIDENCE_LEVEL_COLUMN_ENABLED","true","true / false","Shows the confidence level column in the Data Catalog object view.","Feature Flags","BigID UI"], ["DATA_CATALOG_BULK_OPERATION_UPDATE_MANY","true","true / false","Enables bulk operations on Data Catalog objects.","Feature Flags","BigID UI"], ["ENABLE_CATALOG_PROCESSING_OBJECT_TAGS_UPDATE","true","true / false","Enables bulk tag updates on data catalog objects.","Feature Flags","BigID UI"], ["ELASTIC_SUPPORTED_ENDPOINTS_LIMIT","1000","Integer","Maximum number of distinct data sources supported by Elasticsearch-backed catalog queries.","Feature Flags","BigID UI"], ["SHOW_DATA_CATALOG_HIGHLIGHTS","false","true / false","Shows the Catalog Dashboard highlights panel summarizing catalog coverage and activity.","Feature Flags","BigID UI"], ["CATALOG_TABLE_PREVIEW_VALIDATE_SUPPORTED_LIST_FF","true","true / false","Restricts structured data preview to supported datasource types.","Feature Flags","BigID UI"], ["DATA_CATALOG_GRID_VIEW_CLASSIC_PAGINATION_ENABLED","false","true / false","Uses classic pagination mode for the Data Catalog grid view.","Feature Flags","BigID UI"], ["FETCH_CLEAR_ATTR_VALUE_ENABLED","true","true / false","Enables the Get Attributes Value action in the Data Catalog.","Feature Flags","BigID UI"], ["FF_ENABLE_JODA_TIME","false","true / false","Formats date values for correct Excel sorting in Data Catalog exports.","Feature Flags","BigID UI"], ["COLUMN_CLUSTER_ASSIGNMENT_AUTO_POPULATED","false","true / false","Auto-populates Business Attributes from clustering results in the Data Catalog.","Feature Flags","BigID UI"], ["COLUMN_TAB_ADDITIONAL_METADATA","false","true / false","Enables additional location and position columns in the Data Catalog column tab.","Feature Flags","BigID UI"], ["SHOW_STRUCTURED_CLUSTERING","false","true / false","Enables the Business Attributes feature powered by structured data clustering.","Feature Flags","BigID UI"], ["OBJECT_COLUMN_DETAILS_CATALOG_FF","true","true / false","Enables the Tags API for objects and columns in the Data Catalog.","Feature Flags","BigID UI"], ["TAGS_MANAGEMENT_ENABLED","true","true / false","Enables the Tags Management page for creating and managing custom tags.","Feature Flags","BigID UI"], ["TAGS_ASSIGNMENT_ENABLED","true","true / false","Enables manual tag assignment on individual objects and columns.","Feature Flags","BigID UI"], ["ENTITY_SOURCE_EXPORT_ENABLED","false","true / false","Enables import and export of correlation sets via the BigID UI.","Feature Flags","BigID UI"], ["IDENTITY_RESOLUTION_ENABLED","false","true / false","Merges results across multiple correlation sets to resolve a single identity from multiple sources.","Feature Flags","BigID UI"], ["DATA_OVERVIEW_ENABLED","true","true / false","Enables the Data Overview dashboard panel.","Feature Flags","BigID UI"], ["ENABLE_ACTIVITY_HIGHLIGHTS_PDF","true","true / false","Enables PDF export for Activity Highlights reports.","Feature Flags","BigID UI"], ["SHOW_ACTIVITY_HIGHLIGHTS","true","true / false","Generates Activity Highlights reports summarizing recent scan and classification activity.","Feature Flags","BigID UI"], ["SHOW_EXECUTIVE_REPORT","true","true / false","Shows the Executive Report in the Reports section.","Feature Flags","BigID UI"], ["GENERATE_EXECUTIVE_SUMMARY_INTERVAL_MS","86400000","Integer (ms)","How often the executive summary report is regenerated. Default is once every 24 hours.","Feature Flags","BigID UI"], ["ENABLE_SCANNED_FILES_REPORT","true","true / false","Enables the Scanned Files report generation.","Feature Flags","BigID UI"], ["ENABLE_NOTIFICATIONS","false","true / false","Enables the top-header notification bell in the BigID UI.","Feature Flags","BigID UI"], ["REMOVE_EMPTY_VALUES_ON_CONFIDENCE_LEVEL_FF","false","true / false","Corrects confidence scoring for columns with a high proportion of sparse/null values.","Feature Flags","BigID UI"], ["REMOVE_EMPTY_VALUES_ON_CONFIDENCE_LEVEL_THRESHOLD","50","Integer (%)","Null percentage threshold above which sparse-column confidence correction is applied.","Feature Flags","BigID UI"], ["RESIDENCY_STATES_FIRST","true","true / false","Prefers US state codes over country codes when resolving residency classification matches.","Feature Flags","BigID UI"], ["ENABLE_LEGACY_STRUCTURED_PREVIEW","false","true / false","Enables the newer structured data preview for non-correlation structured data sources.","Feature Flags","BigID UI"], // DSAR feature flags ["BULK_DSAR_SIZE","100","Integer","Maximum number of access requests submittable in a single bulk CSV upload.","Feature Flags","BigID UI"], ["DSAR_ALLOW_CSV_SUMMARY_REPORT","false","true / false","Enables the CSV Personal Information Report as an output format for DSAR responses.","Feature Flags","BigID UI"], ["DSAR_DEDUPLICATE_VALUES","false","true / false","Merges case-variant duplicate values (e.g. 'Smith' and 'smith') in DSAR results.","Feature Flags","BigID UI"], ["DSAR_ENRICH_PII_RECORDS","false","true / false","Stops inserting redundant JIT records during DSAR enrichment, reducing storage overhead.","Feature Flags","BigID UI"], ["DSAR_FILTER_EMPTY_VALUES_IN_RI","false","true / false","Removes empty columns from referential integrity lineage results in DSAR reports.","Feature Flags","BigID UI"], ["DSAR_GROUP_ATTRIBUTE_BY_FRIENDLY_NAME","true","true / false","Aggregates DSAR results by attribute Friendly Name rather than technical field name.","Feature Flags","BigID UI"], ["DSAR_GROUP_PERSONAL_INFORMATION_BY_CATEGORY","false","true / false","Groups personal information by category in the DSAR PDF report.","Feature Flags","BigID UI"], ["DSAR_IGNORE_RBAC_FOR_REPORTS","false","true / false","Ignores role-based access control when generating DSAR reports. Use with caution — bypasses data access restrictions.","Feature Flags","BigID UI"], ["DSAR_JIT_MAX_VALUE_LENGTH","300","Integer (characters)","Maximum character length for a single JIT record value. Values exceeding this are truncated.","Feature Flags","BigID UI"], ["DSAR_PARTS_AUTO_RETRY_THRESHOLD","0","Integer","Automatic retries for failed DSAR scan parts. 0 disables auto-retry.","Feature Flags","BigID UI"], ["DSAR_PARTS_ENABLED","true","true / false","Enables fault-tolerant partitioned processing for DSAR scans.","Feature Flags","BigID UI"], ["DSAR_PARTS_MAX_IN_PROGRESS_TIMEOUT_SEC","43200","Integer (seconds)","Maximum time a DSAR scan part can remain in-progress before being considered stuck. Default is 12 hours.","Feature Flags","BigID UI"], ["DSAR_PDF_LANGUAGE","eng","eng / pt-br","Language used for DSAR PDF report generation.","Feature Flags","BigID UI"], ["DSAR_PDF_REPORT_MAX_JIT_RECORDS_LIMIT","100000","Integer","Maximum JIT records included in a single DSAR PDF report.","Feature Flags","BigID UI"], ["DSAR_REFERENTIAL_INTEGRITY_V2_ENABLED","true","true / false","Enables the v2 referential integrity engine for DSAR lineage traversal.","Feature Flags","BigID UI"], ["DSAR_RI_CONDITIONS_CHUNK_MAX_SIZE","1000","Integer (bytes)","Chunk size for referential integrity condition processing in DSAR scans.","Feature Flags","BigID UI"], ["DSAR_RI_SCAN_DEPTH","3","0–3","Maximum referential integrity lineage hops followed during a DSAR scan.","Feature Flags","BigID UI"], ["DSAR_TIMEOUT_IN_MINUTES","0","Integer (0 = no timeout)","Global timeout for DSAR scan jobs in minutes. Set to 0 for no timeout.","Feature Flags","BigID UI"], ["HIDE_ATTRIBUTE_PURPOSE_OF_USE","false","true / false","Hides the Purpose of Use field in the DSAR attribute configuration UI.","Feature Flags","BigID UI"], ["IS_DSAR_RUNNING_PERSONAL_INFO","true","true / false","Creates the Personal Information Report as part of DSAR processing.","Feature Flags","BigID UI"], ["IS_DSAR_LEGACY_SUMMARY_REPORT","false","true / false","Uses the legacy PDF report format instead of the updated DSAR report layout.","Feature Flags","BigID UI"], ["JIT_RECORDS_LIMIT","10000","Integer","Maximum rows retrieved from unstructured data sources during DSAR just-in-time scanning.","Feature Flags","BigID UI"], ["DSAR_REMAIN_CONFIG_FOR_NON_EXISTING_DS_FIELDS","false","true / false","Retains field configuration for fields that no longer exist in a datasource.","Feature Flags","BigID UI"], ["DSAR_STORE_REQUEST_VALUES","true","true / false","Records the search attributes and values used in each DSAR request for audit purposes.","Feature Flags","BigID UI"], ["DSAR_MANUAL_ATTRIBUTE_AS_SURE_MATCH","false","true / false","Treats manually added low-confidence attributes in DSAR profiles as definite matches.","Feature Flags","BigID UI"], ["SAR_IGNORE_EMPTY_FIELDS","true","true / false","Retains null/empty fields in the DSAR Full Report. Set false to exclude them.","Feature Flags","BigID UI"], ["SAR_MAX_ROWS_PER_OBJECT","10","Integer","Maximum rows returned per attribute per table in DSAR results.","Feature Flags","BigID UI"], ["SAR_REQUEST_EXPIRATION_TIME","7889400000","Integer (ms)","DSAR request expiration time in milliseconds. Default is approximately 91 days.","Feature Flags","BigID UI"], ["SHOULD_USE_DS_FRIENDLY_NAME_IN_PERSONAL_INFO","false","true / false","Shows the datasource friendly name instead of the technical name in Personal Information Reports.","Feature Flags","BigID UI"], ["SHOW_ATTRIBUTES_ENRICHMENT_PAGE","false","true / false","Enables the Correlation Mapping page for configuring attribute enrichment.","Feature Flags","BigID UI"], ["USE_DATA_RETENTION_FOR_DATA_DELETION","false","true / false","Enables automated data deletion based on configured data retention policies.","Feature Flags","BigID UI"], ["USE_DSAR_REPORT_TEMPLATES","false","true / false","Enables configurable report templates for DSAR output customization.","Feature Flags","BigID UI"], ["USE_METADATA_SEARCH_FOR_DSAR","false","true / false","Uses the Metadata Search capability to locate data during DSAR scans.","Feature Flags","BigID UI"], // Labeling / connectors ["BIGID_DRY_RUN_FILES_LIMITATION","20","Integer","Maximum files processed in a labeling dry run to preview label application.","Feature Flags","BigID UI"], ["ENTITY_LEVEL_TAGGING_SUPPORTED","false","true / false","Enables the Labeling feature for applying classification-based tags to data objects.","Feature Flags","BigID UI"], ["LABELER_ENABLED","false","true / false","Activates the Labeling service for writing labels back to data sources (e.g. MIP sensitivity labels to files).","Feature Flags","BigID UI"], ["LABELER_REPORT_TOTAL_SIZE_LIMIT","2M","Size string (e.g. 2M, 5M)","Maximum total records across all files in a single Labeling report.","Feature Flags","BigID UI"], ["LABELER_REPORT_SINGLE_FILE_SIZE","100000","Integer (max 1,000,000)","Maximum records per CSV file in a Labeling report.","Feature Flags","BigID UI"], ["APPLICATIONS_DATA_SOURCE_LIST_ENABLED","true","true / false","Enables multiple data sources to be associated with a single installed application.","Feature Flags","BigID UI"], ["DIM_ENABLED","false","true / false","Enables Data in Motion scanning for monitoring data moving across systems in real time.","Feature Flags","BigID UI"], ["SHOW_DS_TAGS","false","true / false","Enables data source tags for organizing and filtering datasources by custom labels.","Feature Flags","BigID UI"], ["ENABLE_GENERIC_REST_API_CONNECTOR","false","true / false","Enables the Generic REST API connector type for custom data source connections.","Feature Flags","setenv.sh"], ["DATA_SOURCE_CONNECTION_ENRICHMENT_ENABLED","true","true / false","Controls data source connection enrichment — when enabled, BigID enriches DS connection records with additional status fields and metadata, tracks connection status history, and runs enrichment field migrations at startup. Disabling it skips all enrichment tracking and status detail updates.","Feature Flags","setenv.sh"], // ── AI / ML ─────────────────────────────────────────────────────────────── ["AI_SECURITY_ENABLED","true","true / false","Enables the AI Security module, which scans AI model inputs/outputs for sensitive data exposure.","AI / ML","BigID UI"], ["PROMPT_SECURITY_ENABLED","false","true / false","Enables the Prompt Security service (Prompt Protection Gateway) that inspects LLM prompts for sensitive data.","AI / ML","Deployment"], ["BIGCHAT_FF_ENABLED","false","true / false","Enables BigChat, BigID's AI chat assistant for querying data catalog and privacy insights in natural language.","AI / ML","BigID UI"], ["BIG_LLM_ENABLED_FF","false","true / false","Enables the BigID LLM engine for AI-powered data classification and analysis.","AI / ML","BigID UI"], ["LLM_CLASSIFIER_ENABLED","false","true / false","Activates the LLM-based data classifier. Higher accuracy at greater computational cost than pattern-based classifiers.","AI / ML","BigID UI"], ["CLUSTERING_ENABLED","true","true / false","Enables Data Clustering, which groups similar data objects to identify patterns and concentration hotspots.","AI / ML","BigID UI"], ["NER_CREATE","false","true / false","Deploys the Named Entity Recognition (NER) service for ML-based PII detection.","AI / ML","Deployment"], ["CLUSTERING_CREATE","false","true / false","Deploys the ML clustering service for grouping similar data objects.","AI / ML","Deployment"], ["HOTSPOTS_ENABLED","false","true / false","Enables the hotspots feature in the clustering service, identifying concentrations of sensitive data.","AI / ML","BigID UI"], ["NER_CLASSIFIER_ENABLED_FEATURE_FLAG","false","true / false","Enables the NER (Named Entity Recognition) ML-based classifier as a classification method.","AI / ML","BigID UI"], ["METADATA_CLASSIFIER_ENABLED","false","true / false","Enables metadata-based classification, which classifies objects using column names and schema metadata rather than content.","AI / ML","BigID UI"], ["DATA_CLEANSING_ENABLED","false","true / false","Enables AI-assisted data cleansing workflows that identify and flag low-quality or duplicate data records.","AI / ML","BigID UI"], ["PREDICTION_CHUNK_SIZE","10000","Integer","Minimum number of files required per training batch for ML prediction models.","AI / ML","BigID UI"], ["REQUIRED_NER_TEXT_SIZE","100000","Integer (characters)","Maximum characters extracted from an object for NER classification.","AI / ML","BigID UI"], ["AZURE_OPENAI_API_KEY","(empty)","String","API key for Azure OpenAI integration. Required when using Azure-hosted LLM features.","AI / ML","BigID UI"], ["AZURE_OPENAI_ENDPOINT","https://testmarch.openai.azure.com/","URL","Azure OpenAI service endpoint URL.","AI / ML","BigID UI"], ["DATA_LAKE_CLIENT_ENABLED","false","true / false","Enables the Data Lake client for streaming BigID events to an external data lake (e.g. AWS Kinesis).","AI / ML","Deployment"], ["DL_STREAM_NAME","(empty)","String","Data Lake stream name to publish BigID events to.","AI / ML","Deployment"], ["DL_REGION_NAME","(empty)","String (AWS region)","AWS region where the Data Lake stream is hosted.","AI / ML","Deployment"], ["CLASSIFIERS_PER_PAGE_THRESHOLD","500","Integer","Maximum classifiers fetched per page from BigID core by the Prompt Protection Gateway.","AI / ML","Deployment"], // ── LOGGING ─────────────────────────────────────────────────────────────── ["AUDIT_FILE_MAX_SIZE","10M","Size string (e.g. 10M, 5M)","Maximum size of a single audit log file before rotation. Minimum 1024B.","Logging","setenv.sh"], ["MONGO_COMMENT_ENABLED","false","true / false","Appends human-readable comment annotations to MongoDB queries, making slow-query analysis easier.","Logging","BigID UI"], ["SHOULD_DISABLE_LOGS","false","true / false","Disables service-level log output. Use only when external log aggregation manages output independently.","Logging","BigID UI"], ["ENABLE_VERBOSE_LOG","false","true / false","Unmasks personal information in BigID service logs. Enable temporarily for debugging only — logs become sensitive data.","Logging","BigID UI"], ["PRINT_AUDIT_TO_STDOUT","false","true / false","Prints audit log entries to standard output in addition to the audit log file.","Logging","BigID UI"], ["JSON_LOGS_ENABLED","false","true / false","Outputs all BigID service logs in structured JSON format. Required for most log aggregation platforms (Datadog, Splunk).","Logging","BigID UI"], ["AMOUNT_OF_LOGS_FILES","5","Integer","Number of rotating log files retained on disk per service before the oldest is deleted.","Logging","BigID UI"], ["ORCHESTRATOR_LOG_LEVEL","info","debug / info / warn / error","Log verbosity for the orchestrator service.","Logging","BigID UI"], ["ORCHESTRATOR2_LOG_LEVEL","info","debug / info / warn / error","Log verbosity for the secondary orchestrator service.","Logging","BigID UI"], ["DATADOG_ENABLED","false","true / false","Enables BigID metrics export to Datadog. Requires DD_API_KEY to be set.","Logging","BigID UI"], ["DD_API_KEY","(empty)","String","Datadog API key for metrics export. Required when DATADOG_ENABLED is true.","Logging","BigID UI"], ["DD_URI","https://api.datadoghq.com/api/v1/series","URL","Datadog API endpoint for metrics ingestion. Change for EU region or proxy setups.","Logging","BigID UI"], ["LOGS_CONSOLE_THRESHOLD","INFO","DEBUG / INFO / WARN / ERROR","Minimum log level written to stdout for the Prompt Protection Gateway.","Logging","Deployment"], ["LOGS_HTTP_THRESHOLD","INFO","DEBUG / INFO / WARN / ERROR","Minimum log level forwarded to the remote log aggregation endpoint.","Logging","Deployment"], ["LOGS_FILE_THRESHOLD","(empty)","DEBUG / INFO / WARN / ERROR","Minimum log level written to a log file. Leave empty to disable file logging.","Logging","Deployment"], ["LOGS_REPORTING_INTERVAL_SECONDS","5","Integer (seconds)","How frequently the Prompt Protection Gateway flushes its log buffer to the remote endpoint.","Logging","Deployment"], ["LOGS_BUFFER_SIZE","100","Integer","Maximum log entries held in memory before being flushed.","Logging","Deployment"], ["METRICS_ENABLED","true","true / false","Enables internal metrics collection and reporting in the Prompt Protection Gateway.","Logging","Deployment"], ["METRICS_SAMPLING_PERCENTAGE","100","0–100","Percentage of requests sampled for metrics. Lower to reduce overhead in high-traffic environments.","Logging","Deployment"], ["METRICS_FLUSH_INTERVAL_MSEC","10000","Integer (ms)","How frequently metrics are sent from the Prompt Protection Gateway to the remote metrics endpoint.","Logging","Deployment"], ["METRICS_LIMIT_PER_SECOND","1000","Integer","Maximum metrics events emitted per second from the Prompt Protection Gateway.","Logging","Deployment"], // ── PERFORMANCE ─────────────────────────────────────────────────────────── ["BIGID_CORR_CACHE_SIZE","10","Integer (GB)","Off-heap memory (GB) allocated to the correlator service for caching. Increase for large identity datasets.","Performance","setenv.sh"], ["SCANNER_JAVA_OPTS","-Xmx16g","JVM flag string","Java heap size for the scanner process. Increase for large data sources (e.g. -Xmx32g).","Performance","setenv.sh"], ["SCANNER_JAVA_MEMORY_ARG","-Xmx16g","JVM flag string","Default scanner Java heap memory argument. Overrides SCANNER_JAVA_OPTS when both are set.","Performance","setenv.sh"], ["SCANNER_THREADS","5","Integer","Maximum concurrent scanner threads per scanner instance.","Performance","setenv.sh"], ["FETCH_CLEAR_THREADS","5","Integer (0 = investigations only)","Maximum concurrent scanner threads for data retrieval. Set to 0 to restrict to investigation mode only.","Performance","BigID UI"], ["BIGID_MQ_USE_QUORUM_QUEUE","true","true / false","Uses RabbitMQ quorum queues for greater message durability and automatic leader election. Recommended for all production deployments.","Performance","Deployment"], ["BIGID_MQ_QUORUM_QUEUE_EXPIRES_MS","60000","Integer (ms)","TTL for quorum queue messages that have not been consumed.","Performance","Deployment"], ["BACKPRESSURE_ENABLED","false","true / false","Enables the backpressure system that throttles scan throughput when RabbitMQ queues exceed configured thresholds.","Performance","BigID UI"], ["BACKPRESSURE_DRY_RUN_ENABLED","false","true / false","Runs the backpressure system in observation mode — logs what it would throttle without actually throttling.","Performance","BigID UI"], ["BACKPRESSURE_RECOVERY_THRESHOLD_PCT","40","0–100","Queue capacity percentage at which the backpressure system considers the system recovered and resumes normal throughput.","Performance","BigID UI"], ["BACKPRESSURE_STATUS_TTL_SEC","120","Integer (seconds)","How long a backpressure status entry is cached before being re-evaluated.","Performance","BigID UI"], ["BACKPRESSURE_EXCESSIVE_LOAD_WINDOW_MIN","5","Integer (minutes)","Rolling window used to detect sustained excessive queue load before triggering backpressure.","Performance","BigID UI"], ["BACKPRESSURE_ALLOWED_CONCURRENT_SCANNER_JOBS","0","Integer (0 = unlimited)","Cap on concurrent scanner jobs when backpressure is active.","Performance","BigID UI"], ["SCALABLE_HEALTH_CHECK_ENABLED","true","true / false","Enables the scalable health check system that distributes health probe load across service replicas.","Performance","BigID UI"], ["SCANNER_REPLICA_COUNT","1","Integer","Number of scanner pod replicas. Increase for parallel scan capacity in Kubernetes deployments.","Performance","Deployment"], ["SCALER_CREATE","false","true / false","Deploys the BigID scaler service, which dynamically adjusts scanner replica count based on queue depth and CPU usage.","Performance","Deployment"], ["SCANNER_CONTROLLER_ENABLED","false","true / false","Enables the scanner controller inside the scaler to manage scanner deployment lifecycle.","Performance","Deployment"], ["SCALER_MIN_PODS","1","Integer","Minimum number of scanner pods the scaler will maintain.","Performance","Deployment"], ["SCALER_MAX_PODS","3","Integer","Maximum number of scanner pods the scaler can scale up to.","Performance","Deployment"], ["SCALER_CPU_THRESHOLD","80","0–100","CPU usage percentage that triggers a scale-up event.","Performance","Deployment"], ["SCALER_CPU_SCALE_DOWN_THRESHOLD","20","0–100","CPU usage percentage below which the scaler scales down the scanner fleet.","Performance","Deployment"], ["SCALER_QUEUE_SCAN_PARTS_THRESHOLD","30","0–100","Queue depth percentage threshold that triggers scanner scale-up.","Performance","Deployment"], ["BULK_SIZE_FOR_SCAN_OPERATION_CONSUMER","20","Integer","Number of scan operations consumed in a single batch by the orchestrator consumer.","Performance","BigID UI"], ["JIT_SCAN_THREADS","5","Integer","Maximum concurrent threads used during DSAR just-in-time scanning.","Performance","BigID UI"], ["CONFIG_REQUEST_TIMEOUT_SEC","3","Integer (seconds)","Timeout for requests from Python services to the BigID config service.","Performance","Deployment"], ["SERVER_WORKERS_NUMBER","2","Integer","Number of Gunicorn worker processes for the Prompt Protection Gateway.","Performance","Deployment"], ["SERVER_WORKER_CONNECTIONS","1000","Integer","Maximum simultaneous connections per worker in the Prompt Protection Gateway.","Performance","Deployment"], ["SERVER_TIMEOUT","120","Integer (seconds)","Request processing timeout for the Prompt Protection Gateway.","Performance","Deployment"], ["SERVER_GRACEFUL_TIMEOUT","30","Integer (seconds)","Grace period for in-flight requests when the Prompt Protection Gateway shuts down.","Performance","Deployment"], ["SERVER_KEEP_ALIVE","5","Integer (seconds)","HTTP keep-alive timeout for the Prompt Protection Gateway.","Performance","Deployment"], ["SERVER_ALLOW_ORIGINS","*","CORS origin pattern","Allowed origins for CORS requests to the Prompt Protection Gateway. Restrict to known domains in production.","Performance","Deployment"], ["HTTPX_RETRY_DEFAULT_HTTP_MAX_ATTEMPTS","5","Integer","Maximum HTTP retry attempts for outbound requests from the Prompt Protection Gateway.","Performance","Deployment"], ["HTTPX_RETRY_EXPONENTIAL_MAX_WAIT_SEC","3","Number (seconds)","Maximum backoff wait between HTTP retries in the Prompt Protection Gateway.","Performance","Deployment"], ["UPLOADER_RETRY_MAX_ATTEMPTS","5","Integer","Maximum retry attempts for upload operations from the Prompt Protection Gateway.","Performance","Deployment"], ["CACHE_UPDATE_FIXED_INTERVAL_SECONDS","30","Integer (seconds)","Interval at which the Prompt Protection Gateway refreshes its internal caches from BigID core.","Performance","Deployment"], ["SESSION_CLEANUP_TASK_FIXED_INTERVAL_SECONDS","65","Integer (seconds)","How often the Prompt Protection Gateway runs its chat session cleanup job.","Performance","Deployment"], ["SESSION_CLEANUP_TTL","60","Integer (seconds)","Idle chat session TTL in seconds. Sessions older than this are removed by the cleanup task.","Performance","Deployment"], ["VIOLATIONS_BUFFER_MAX_SIZE","200","Integer","Maximum violations buffered in memory before being flushed to BigID core.","Performance","Deployment"], ["EVENTS_BUFFER_MAX_SIZE","200","Integer","Maximum events buffered before flush in the Prompt Protection Gateway.","Performance","Deployment"], ["CHAT_SESSIONS_BUFFER_MAX_SIZE","200","Integer","Maximum chat session records buffered before flush.","Performance","Deployment"], // ── SERVICE CONFIG ──────────────────────────────────────────────────────── ["BIGID_ENV","(empty)","Docker tag string","Docker image tag for BigID service containers (e.g. :release). Required for on-prem deployments pulling a specific version.","Service Config","setenv.sh"], ["BIGID_MONGO_HOST_EXT","(empty)","URL","External MongoDB service URL. Set when MongoDB runs outside the default compose network.","Service Config","setenv.sh"], ["BIG_ID_REPORT_LANGUAGE","eng","eng / jpn / kor / thai","Language used for generated reports (e.g. DSAR PDFs, activity reports).","Service Config","setenv.sh"], ["ORCHESTRATOR_URL_EXT","(empty)","URL","External URL for the orchestrator service. Set when the orchestrator is accessed from outside the default compose network.","Service Config","setenv.sh"], ["TIME_ZONE","UTC","IANA timezone string","System timezone for all BigID services. Affects scan scheduling, report timestamps, and audit log entries (e.g. America/New_York).","Service Config","setenv.sh"], ["SET_SAP_SECUDIR","false","true / false","Sets the SAP SECUDIR property for SAP connector authentication.","Service Config","setenv.sh"], ["USE_OJDBC7","false","true / false","Uses Oracle JDBC driver version 7 instead of version 8 for Oracle database connections.","Service Config","setenv.sh"], ["CUSTOMER_MAIL_INCLUDE_DATA_SOURCE_NAME","true","true / false","Includes the data source name in the subject line of scan notification emails.","Service Config","BigID UI"], ["DISPLAY_CHINA_REGULATIONS","false","true / false","Displays Hong Kong, Macao, and Taiwan as regions under China in regulatory mapping.","Service Config","BigID UI"], ["MAX_UPLOAD_LIMITATION","50","Integer (MB)","Maximum file size allowed for UI uploads (e.g. classifier import files).","Service Config","BigID UI"], ["UI_DATE_TIME_LOCALE","(empty)","Locale string (e.g. en-US)","Date and time display format in the BigID UI. Leave empty to use browser default.","Service Config","BigID UI"], ["USER_TO_NOTIFY_ON_SERVICE_FAILURE","(empty)","Email address","Email address of the administrator who receives alerts on service failures.","Service Config","BigID UI"], ["WORKSPACES_ENABLED","true","true / false","Enables the BigID Workspaces feature, allowing users to organize datasources and assets into logical workspace groups.","Service Config","BigID UI"], ["WORKSPACES_LAST_VISITED_PAGE_ENABLED","true","true / false","Restores the last visited page within a workspace when a user returns to it.","Service Config","BigID UI"], ["GENERATE_TOKEN_ENABLED","false","true / false","Enables automatic JWT token generation for the BigID application during initialization.","Service Config","Deployment"], ["AUTH0_DOMAIN","(empty)","Domain string","Auth0 domain for OAuth2 SSO integration with the BigID web service.","Service Config","Deployment"], ["AUTH0_CUSTOM_DOMAIN","(empty)","Domain string","Custom branded Auth0 domain for SSO, if using a custom Auth0 domain.","Service Config","Deployment"], ["WEB_PORT","3000","Port number","Port on which the BigID web backend service listens.","Service Config","Deployment"], ["ORCHESTRATOR_PORT","3001","Port number","Port on which the primary orchestrator service listens.","Service Config","Deployment"], ["ORCHESTRATOR2_PORT","3003","Port number","Port on which the secondary orchestrator service listens.","Service Config","Deployment"], ["CONFIG_SERVICE_PORT","3004","Port number","Port on which the config service listens.","Service Config","Deployment"], ["REPORTS_PORT","3005","Port number","Port on which the reports service listens.","Service Config","Deployment"], ["CRYPTMGR_PORT","3007","Port number","Port on which the crypto manager service listens.","Service Config","Deployment"], ["DATA_CATALOG_PORT","3555","Port number","Port on which the data catalog service listens.","Service Config","Deployment"], ["ACTION_CENTER_PORT","3556","Port number","Port on which the action center service listens.","Service Config","Deployment"], ["REPORTING_ETL_PORT","3557","Port number","Port on which the reporting ETL service listens.","Service Config","Deployment"], ["TENANT_SERVICE_PORT","3558","Port number","Port on which the tenant service listens (multi-tenant deployments only).","Service Config","Deployment"], ["NER_PORT","8080","Port number","Port on which the NER service listens.","Service Config","Deployment"], ["ELASTICSEARCH_PORT","9200","Port number","Port on which Elasticsearch listens.","Service Config","Deployment"], ["ACI_PORT","4001","Port number","Port on which the Access Intelligence Center service listens.","Service Config","Deployment"], ["CLUSTERING_PORT","3300","Port number","Port on which the ML clustering/gateway service listens.","Service Config","Deployment"], ["SNIPPET_PERSISTER_PORT","9990","Port number","Port on which the snippet persister service listens.","Service Config","Deployment"], ["SCANNER_PORT","9999","Port number","Port on which the scanner service listens.","Service Config","Deployment"], ["SERVER_PORT","8001","Port number","Port on which the Prompt Protection Gateway service listens.","Service Config","Deployment"], ["SERVER_BIND_HOST","0.0.0.0","IP address","Network interface the Prompt Protection Gateway binds to. Use 0.0.0.0 to listen on all interfaces.","Service Config","Deployment"], // ── RABBITMQ CONNECTION ─────────────────────────────────────────────────── ["BIGID_MQ_HOST","bigid-mq","Hostname / IP","Hostname or IP of the RabbitMQ broker. Override when RabbitMQ runs on a separate host from the BigID services.","Service Config","Deployment"], ["BIGID_MQ_PORT","5672","Port number","AMQP port RabbitMQ listens on. Use 5671 for TLS-encrypted AMQP connections.","Service Config","Deployment"], ["BIGID_MQ_VHOST","/","Virtual host string","RabbitMQ virtual host BigID connects to. Change when using a dedicated vhost for isolation.","Service Config","Deployment"], ["BIGID_MQ_MANAGEMENT_PROTOCOL","https://","http:// / https://","Protocol used when querying the RabbitMQ Management API (e.g. for queue-depth monitoring).","Service Config","Deployment"], ["BIGID_MQ_LOG_MESSAGE_PROCESS_TIME_THRESHOLD_MINUTES","(empty)","Integer (minutes)","Logs a warning when a message takes longer than this many minutes to process. Leave empty to disable slow-message logging.","Logging","Deployment"], // ── REDIS ───────────────────────────────────────────────────────────────── ["REDIS_AUTH_ENABLED","true","true / false","Enables password authentication when connecting to Redis. Set to false only in trusted internal networks.","Security","Deployment"], ["REDIS_SENTINEL_ENABLED","true","true / false","Enables Redis Sentinel for high-availability Redis deployments. When true, BigID connects via Sentinel instead of directly to a Redis node.","Service Config","Deployment"], ["DISABLE_REDIS_CACHE","(empty)","true / false","Bypasses the Redis cache in the clustering/NER service. Useful for debugging stale-cache issues. Leave empty (default) in production.","Performance","Deployment"], // ── ELASTICSEARCH CONNECTION ────────────────────────────────────────────── ["ELASTICSEARCH_HOST","(empty)","Hostname / IP","Hostname of the Elasticsearch cluster. Required when Elasticsearch runs externally.","Service Config","Deployment"], ["ELASTICSEARCH_URL","(empty)","URL","Full URL to the Elasticsearch cluster (e.g. https://es-host:9200). Takes precedence over ELASTICSEARCH_HOST when both are set.","Service Config","Deployment"], ["ELASTICSEARCH_ENDPOINT","(empty)","URL","Alternative Elasticsearch endpoint URL used by certain connector and catalog services.","Service Config","Deployment"], ["ELASTICSEARCH_AUTHORIZATION","(empty)","Authorization header value","Value of the Authorization header sent with Elasticsearch requests (e.g. Basic base64string or Bearer token).","Security","Deployment"], // ── PROXY ───────────────────────────────────────────────────────────────── ["HTTP_PROXY","(empty)","Proxy URL","HTTP proxy URL for outbound connections from BigID services (e.g. http://proxy.corp:3128).","Service Config","setenv.sh"], ["HTTPS_PROXY","(empty)","Proxy URL","HTTPS proxy URL for outbound TLS connections from BigID services (e.g. https://proxy.corp:3128).","Service Config","setenv.sh"], // ── SECURITY ────────────────────────────────────────────────────────────── ["BIGID_KERBEROS_SPNEGO_AUTH_ENABLED","false","true / false","Enables Kerberos SPNEGO authentication for data source connections that require it (e.g. HDFS, HBase with Kerberos).","Security","setenv.sh"], ["SECRET_KEY_ROTATION_ENABLED","false","true / false","Enables automatic rotation of the internal encryption secret key used by Python services (NER, clustering). Separate from KEY_ROTATION_ENABLED which governs the Node.js side.","Security","Deployment"], ["SECRET_SALT","(empty)","String","Salt value used when hashing sensitive data in Python services. If unset, a default empty salt is used.","Security","Deployment"], ["AUTH_KEY_FAILED_LOG_BATCH","1000","Integer","Number of failed auth-key verifications to accumulate before emitting a batched warning log entry.","Logging","Deployment"], // ── VAULT INTEGRATIONS ──────────────────────────────────────────────────── ["HASHICORP_ROLE_ID","(empty)","UUID string","HashiCorp Vault AppRole role ID for BigID to authenticate and retrieve secrets. Required when using Vault as the key encryption key provider.","Security","Deployment"], ["HASHICORP_SECRET_ID","(empty)","UUID string","HashiCorp Vault AppRole secret ID paired with HASHICORP_ROLE_ID. Treat as a credential — restrict file permissions accordingly.","Security","Deployment"], ["HASHICORP_CLOUD_ROLE_ID","(empty)","UUID string","HashiCorp Cloud Platform (HCP) Vault role ID. Use instead of HASHICORP_ROLE_ID when connecting to Vault running on HCP rather than self-hosted.","Security","Deployment"], ["AZURE_KEY_VAULT_URL","(empty)","URL (https://...)","URL of the Azure Key Vault instance BigID uses for key management (e.g. https://myvault.vault.azure.net/).","Security","Deployment"], ["AZURE_KEY_VAULT_SCOPE","(empty)","String","Azure AD OAuth2 scope for Key Vault authentication (e.g. https://vault.azure.net/.default).","Security","Deployment"], ["DELINEA_VAULT_URL","(empty)","URL","URL of the Delinea (Thycotic) Secret Server instance for credential retrieval.","Security","Deployment"], // ── AWS SECRETS MANAGER ─────────────────────────────────────────────────── ["ENV_SECRET_PREFIX","bigid-development-secrets-","String prefix","Prefix used to filter secrets from AWS Secrets Manager. Only secrets whose names start with this prefix are loaded as environment variables.","Service Config","Deployment"], ["ENV_SECRET_REGION","us-east-1","AWS region string","AWS region where BigID's Secrets Manager secrets are stored.","Service Config","Deployment"], ["ENV_SECRET_ROLE","(empty)","AWS IAM role ARN","IAM role ARN BigID assumes when fetching secrets from AWS Secrets Manager. Leave empty to use the instance/pod's default role.","Service Config","Deployment"], // ── MONGODB ADVANCED ────────────────────────────────────────────────────── ["MONGO_PORT","27017","Port number","MongoDB port. Override when MongoDB is deployed on a non-standard port.","Service Config","Deployment"], ["MONGO_AUTH_SOURCE","(empty)","Database name","MongoDB authentication source database. Set when credentials are stored in a database other than the target database (e.g. admin).","Service Config","Deployment"], ["MONGO_EXTERNAL_FULL_URL","(empty)","MongoDB URI","Full MongoDB connection URI. Overrides all individual MONGO_* host/port/auth settings when set.","Service Config","Deployment"], ["MONGO_EXTERNAL_FULL_URL_PREFIX","(empty)","URI prefix (mongodb:// or mongodb+srv://)","Protocol prefix for the external MongoDB URI. Use mongodb+srv:// for Atlas or DNS SRV deployments.","Service Config","Deployment"], ["MONGO_EXTERNAL_FULL_URL_SECRET_PATH","(empty)","File path","Path to a file containing the full MongoDB connection URI. Used with SECRETS_AS_FILES_ENABLED to avoid passing the URI as a plain environment variable.","Service Config","Deployment"], ["MONGO_PASSWORD_SECRET_PATH","(empty)","File path","Path to a file containing the MongoDB password. Used with SECRETS_AS_FILES_ENABLED.","Security","Deployment"], ["IS_MONGO_SHARDED","false","true / false","Signals that MongoDB is running in sharded cluster mode. Adjusts query patterns to avoid scatter-gather on non-shard-key fields.","Service Config","Deployment"], ["IS_MONGO_STANDALONE_DEPLOYMENT","false","true / false","Signals a single-node MongoDB deployment (no replica set). Disables replica-set-dependent features like change streams.","Service Config","Deployment"], ["MONGODB_DUMP_SYNC_TO_S3","false","true / false","Enables automatic upload of MongoDB backup dumps to S3 after they are created.","Service Config","Deployment"], ["MONGODB_DUMP_S3_BUCKET_NAME","(empty)","S3 bucket name","Destination S3 bucket for MongoDB backup dumps when MONGODB_DUMP_SYNC_TO_S3 is enabled.","Service Config","Deployment"], // ── KUBERNETES ──────────────────────────────────────────────────────────── ["K8S_NAMESPACE","default","Namespace string","Kubernetes namespace BigID services are deployed in. Used for metrics labeling and pod-level health checks.","Service Config","Deployment"], ["USE_K8S_CERTIFICATES","false","true / false","Instructs BigID to use certificates mounted from Kubernetes secrets rather than certificates passed as environment variables.","Security","Deployment"], // ── HTTP CLIENT ─────────────────────────────────────────────────────────── ["BIGID_HTTP_HANDLER_RETRIES","3","Integer","Number of retry attempts for outbound HTTP requests made by Python services (NER, clustering) before failing.","Performance","Deployment"], ["BIGID_HTTP_HANDLER_TIMEOUT","5","Integer (seconds)","Timeout in seconds for outbound HTTP requests from Python services. Increase for slow or high-latency endpoints.","Performance","Deployment"], // ── SCANNER (JAVA) ──────────────────────────────────────────────────────── ["API_CALLS_LRU_SIZE","(empty)","Integer","LRU cache size for scanner API calls. When set, caches repeated API responses to reduce load on data sources.","Performance","setenv.sh"], ["BIGID_VERBOSE","false","true / false","Enables verbose debug output in the Java scanner. Logs full request/response bodies for connector API calls. Use temporarily for troubleshooting only.","Logging","setenv.sh"], ["IS_REMOTE_SCANNER","(empty)","true / false","Marks this scanner as a remote (standalone) scanner instance, separate from the main BigID host. Affects token handling and orchestrator registration.","Service Config","setenv.sh"], ["MICROSOFT_GRAPH_API_PAGE_SIZE","(empty)","Integer","Overrides the page size for Microsoft Graph API queries (e.g. OneDrive, SharePoint, Teams). Leave empty to use the Graph API default.","Scanning","setenv.sh"], ["ENABLE_LABELING_THREAD_WRAPPER","false","true / false","Wraps MIP labeling sub-process calls in a thread to prevent blocking the scanner worker thread during long labeling operations.","Scanning","setenv.sh"], // ── MIP DECRYPTION ──────────────────────────────────────────────────────── ["MIP_DECRYPTION_ENABLED","false","true / false","Enables the MIP decryption sidecar, which decrypts MIP-protected files before the scanner classifies them.","Feature Flags","setenv.sh"], ["MIP_DECRYPTION_PORT","8787","Port number","Port on which the MIP decryption sidecar listens.","Service Config","setenv.sh"], ["MIP_JAVA_OPTS","(empty)","JVM flag string","Additional JVM options for the MIP decryption process (e.g. -Xmx2g).","Performance","setenv.sh"], ["MIP_PRINCIPAL_ID","(empty)","String","Azure service principal ID used by the MIP SDK to authenticate with Microsoft Information Protection.","Security","setenv.sh"], // ── NER (ML SERVICE) ────────────────────────────────────────────────────── ["NER_SERVER_NUMBER_OF_THREADS","4","Integer","Number of worker threads in the NER service. Increase on multi-core hosts to improve classification throughput.","Performance","Deployment"], ["NUMBER_OF_WORKERS_NER","8","Integer","Number of Gunicorn worker processes for the NER service.","Performance","Deployment"], ["NER_LOG_LEVEL","info","debug / info / warning / error","Log verbosity for the NER service.","Logging","Deployment"], ["NER_FINGERPRINT_SIZE_LIMIT","(default from config)","Integer (characters)","Maximum character length of text fingerprints created by the NER service for object deduplication.","AI / ML","Deployment"], ["PRINT_NER_TO_LOG","false","true / false","Logs raw NER classifier input/output for each classification call. Enable only for debugging — produces large log volumes.","Logging","Deployment"], // ── CLUSTERING (ML SERVICE) ─────────────────────────────────────────────── ["CLUSTERING_SCHEDULER_TICK_TIME_SEC","30","Integer (seconds)","How often the clustering scheduler checks for pending work. Lower values increase responsiveness; higher values reduce CPU overhead.","Performance","Deployment"], ["CLUSTERING_SERVER_NUMBER_OF_WORKERS","(required)","Integer","Number of Gunicorn worker processes for the clustering service. Must be set explicitly — there is no default.","Performance","Deployment"], ["SKIP_CLUSTERING_CONF","false","true / false","Skips loading the clustering service configuration from the BigID config service. Use only in isolated or debug environments.","Service Config","Deployment"], // ── CRYPTMGR ────────────────────────────────────────────────────────────── ["CRYPTMGR_KEY_ROTATION_POLLING_INTERVAL_MS","600000","Integer (ms)","How often Python services poll the crypto manager for key rotation. Default is 10 minutes. Applies to NER and clustering; the Node.js equivalent is KEY_ROTATION_POLLING_INTERVAL_MS.","Security","Deployment"], ["CRYPTMGR_RETRY_MAX_ATTEMPTS","(empty)","Integer","Maximum retry attempts when connecting to the crypto manager service. Leave empty to use the service default.","Performance","Deployment"], // ── REPORTING ETL ───────────────────────────────────────────────────────── ["REPORTING_ETL_CLUSTER_MODE","false","true / false","Runs the Reporting ETL service in cluster mode, distributing workload across multiple Node.js worker processes.","Performance","Deployment"], ["REPORTING_ETL_CLUSTER_NODES_COUNT","8","Integer","Number of worker processes when REPORTING_ETL_CLUSTER_MODE is true.","Performance","Deployment"], // ── DATA CATALOG ────────────────────────────────────────────────────────── ["FF_DISABLE_CATALOG_CONSUME_COUNTERS","false","true / false","Disables the data catalog's message consumption counters. Use to reduce MongoDB write load when counter metrics are not needed.","Feature Flags","Deployment"], ["FF_DISABLE_CATALOG_PRODUCE_COUNTERS","false","true / false","Disables the data catalog's message production counters. Use to reduce MongoDB write load when counter metrics are not needed.","Feature Flags","Deployment"], // ── AI / ML ─────────────────────────────────────────────────────────────── ["BUSINESS_TERM_FILTER_TOP_K","30","Integer","Maximum number of business term candidates returned by the NER clustering model for each attribute during classification.","AI / ML","Deployment"], ["EVAL_JUDGE_MODEL","(empty)","Model identifier string","LLM model ID used as the evaluation judge in BigID's LLM evaluation pipeline (e.g. for automated quality assessment of classifier results).","AI / ML","Deployment"], ["MLFLOW_TRACKING_URI","(empty)","URL","URI of the MLflow tracking server. Set to enable experiment tracking for BigID ML model training and evaluation runs.","AI / ML","Deployment"], ["ENABLE_MLFLOW_TRACING","false","true / false","Enables MLflow trace logging for LLM-based classification and evaluation workflows.","AI / ML","Deployment"], ["LITELLM_LOG","(empty)","DEBUG / INFO / WARNING","Log level for the LiteLLM library used by BigID's LLM integration layer.","Logging","Deployment"], // ── MULTI-TENANCY ───────────────────────────────────────────────────────── ["TENANTS_STATUSES_REPORTER_CRON_JOB","0 * * * *","Cron expression","Cron schedule controlling how often the tenant status reporter job runs. Default is every hour.","Multi-tenancy","Deployment"], ["DETELED_TENANT_CONFIGURATION_CLEANUP_CRON","0 1 * * *","Cron expression","Cron schedule for the job that cleans up configuration left behind by deleted tenants. Default is 1 AM daily.","Multi-tenancy","Deployment"] ]; // Auto-generates search index text from envRows — updates automatically when rows are added. // Uses document.write() so the content is emitted synchronously into the HTML stream. document.write('');

Documentation Index

BigID Public Documentation Portal