Workspace Configuration Options

Email integration

Key	Description	Default value
SMTP_AUTHENTICATION_MODE	Which SMTP authentication mechanism to use. One of "NONE", "LOGIN", or "XOAUTH2". The XOAUTH2 authentication mechanism is supported by Gmail and Office365.	LOGIN
SMTP_CHARSET	The charset being used to encode email messages.	utf-8
SMTP_FROM	The email address used in the "from" field of outgoing messages.	Cloudomation info@cloudomation.com
SMTP_HOST	The host to use to send emails.	``
SMTP_OAUTH2_CLIENT_ID	An OAuth2 client ID to authenticate against the SMTP host. Used with the "XOAUTH2" SMTP_AUTHENTICATION_MODE.	``
SMTP_OAUTH2_CLIENT_SECRET	An Oauth2 client secret to authenticate against the SMTP host. Used with the "XOAUTH2" SMTP_AUTHENTICATION_MODE.	``
SMTP_PASSWORD	The password to authenticate against the SMTP host. Used with the "LOGIN" SMTP_AUTHENTICATION_MODE.	``
SMTP_PORT	The port to connect to at SMTP_HOST.	25
SMTP_USER	The username to authenticate against the SMTP host. Used with the "LOGIN" and the "XOAUTH2" SMTP_AUTHENTICATION_MODE.	``
SMTP_USE_STARTTLS	If to use the STARTTLS command to upgrade an unencrypted SMTP connection.	False
SMTP_USE_TLS	If to use transport-layer-security (TLS) to connect to the SMTP host.	False

Full-text search

Key	Description	Default value
SEARCH_INDEX_BATCH_SIZE	How many queued search-index changes to process at once.	500
SEARCH_INDEX_DICTIONARY	The PostgreSQL text-search dictionary (regconfig) used to build the full-text vectors, e.g. 'simple' (no stemming, language-agnostic), 'english' or 'german'. Changing it requires a full re-index (enqueue all records); until then existing rows keep their old vector.	simple
SEARCH_INDEX_ENABLED	Maintain the full-text search index by draining the search-index queue into the search_index table. Runs on the primary process only.	True
SEARCH_INDEX_INTERVAL_MINUTES	The number of minutes to wait between search-index maintenance runs (maintenance is also triggered immediately when a record changes).	1

Git integration

Key	Description	Default value
GIT_AUTOCOMMIT_ENABLED	If to automatically commit changes to the repository upon saving in the UI. Note that this does not apply to saving via the API.	True
GIT_EXTERNAL_SERVER_NAME	The domain name or ip on which the git server is reachable.	localhost
GIT_EXTERNAL_SSH_PORT	The external port used for ssh to push to the repositories.	2022
GIT_MAX_BLOCK_TIME_SECONDS	How long should a process wait to acquire the git lock, before failing.	5
GIT_REPOSITORY_EXTERNAL_SAVE_PATH	The directory where git repositories will be stored in (on the host).	/git
GIT_REPOSITORY_SAVE_PATH	The directory where git repositories will be stored in.	/data/repositories
GIT_STALE_LOCK_THRESHOLD_SECONDS	If a git lock file is older than this many seconds, it is considered stale and automatically removed when another process tries to acquire the lock (e.g. after a crash or forceful cancellation). Set to 0 to disable automatic stale lock removal.	900
GIT_SYNC_IGNORE_FILE_PATTERNS	Glob patterns for files in a bundle/git repository that are not Cloudomation resource files and must be ignored during git import/sync (e.g. build artifacts, editor/OS cruft such as `__pycache__/`, `*.pyc`, `.DS_Store`). Matching files are skipped silently instead of causing an error, so a stray artifact committed to a bundle repo cannot block bundle content operations. A pattern ending in `/` matches a directory name anywhere in the path; any other pattern is matched (fnmatch-style, case-sensitive) against both the full path and each individual path segment. Files that are not ignored but still do not match the resource file naming pattern are skipped with a warning.	['__pycache__/', '*.pyc', '*.pyo', '.DS_Store', 'Thumbs.db']
GIT_USER_AUTHORIZED_KEYS_FILE	The path where the authorized_keys file of the git user is mounted.	/data/repositories/.ssh/authorized_keys
GIT_USER_NAME	The git user.	git
PENDING_COMMIT_EXPIRY_BATCH_SIZE	How many expired pending changes to commit at once.	100
PENDING_COMMIT_EXPIRY_ENABLED	Automatically commit changes (from the REST API or MCP) that have been left uncommitted (commit=false) for longer than PENDING_COMMIT_EXPIRY_MINUTES, so changes can never be forgotten in an unversioned state.	True
PENDING_COMMIT_EXPIRY_INTERVAL_MINUTES	How often to check for expired pending (uncommitted) changes.	5
PENDING_COMMIT_EXPIRY_MINUTES	The number of minutes an uncommitted change may stay pending before it is automatically committed.	15

Logging

Key	Description	Default value
LOGGING_CURRENT_LEVELS	A comma-separated list of logger names, followed by a colon and a log-level. Possible log-levels are: * ERROR * WARNING * INFO * DEBUG * NOTSET: inherit the log level from the parent logger possible logger names include: (defaults are NOTSET unless specified otherwise) * <empty string>: the root logger. other loggers will inherit the flag from the root logger unless configured otherwise * sqlalchemy: all sqlalchemy logging. default level: WARN * sqlalchemy.engine: database queries * sqlalchemy.pool: database pool operations * aiohttprest: API * common: common methods * connector_types: Cloudomation connectors * connector_types.<connector_type>: a specific connector * resources: Cloudomation resources * resources.<resource name>: a specific resource * sarest: database layer * workspace: workspace processes * workspace.engine: the execution engine	[{'logger': '', 'level': 'WARNING'}, {'logger': 'cloudomation', 'level': 'INFO'}]
LOGGING_DATA_MAX_CHARACTERS	The maximum size of the log entry data in characters. Log entries with data exceeding this limit will be truncated and a warning will be appended to the log entry.	10240
LOGGING_EXPIRY_BATCH_SIZE	How many log entries to remove at once.	100
LOGGING_EXPIRY_ENABLED	Permanently remove log entries after a timeout.	True
LOGGING_EXPIRY_INTERVAL_MINUTES	The number of minutes to wait between checks for expired log entries.	5
LOGGING_EXPIRY_TIME_MINUTES	The number of minutes before log entries are permanently removed.	20160
LOGGING_EXPORT_BATCH_SIZE	How many log entries to read per page when streaming a record log export (/record_log/export). The export is streamed in pages of this size so it never materialises the whole log table in memory.	1000
LOGGING_FORMAT	One of "text" or "json". Setting LOGGING_FORMAT to "json" will produce machine-readable log lines.	text
LOGGING_LEVELS_RESET_MINUTES	The number of minutes after which the manually set configuration value for LOGGING_CURRENT_LEVELS is removed. Logging will reset to the value configured in the environment (if set) or to the default value. Set to `0` to disable.	10
LOGGING_LINE_MAX_CHARACTERS	The maximum length in characters of a single log line emitted by the workspace process (except SQL echo lines, which are capped by `LOGGING_SQL_MAX_CHARACTERS`). Longer lines are truncated with a note. Prevents unbounded payloads (e.g. file contents or connector responses) from flooding the container logs and stalling the process while the line is written. Set to `0` to disable truncation.	100000
LOGGING_SQL_MAX_CHARACTERS	The maximum length in characters of a single SQL echo log line (statements and bound parameters emitted by the "sqlalchemy.engine" logger, visible when its level is set to INFO/DEBUG). Longer lines are truncated with a note so large parameter values (e.g. binary blobs) cannot flood the logs, while the statement and parameters stay visible. SQLAlchemy already truncates each individual parameter value; this caps the overall line. Set to `0` to disable truncation.	2000

MCP

Key	Description	Default value
MCP_DISABLED_TOOLS	A list of built-in MCP tool names to disable, letting an installation ship a locked-down MCP surface. A disabled built-in tool is neither advertised in the MCP tools/list nor callable via tools/call (it is treated as if it did not exist). Use this to e.g. expose only read-only tools (disable the write/content-maintenance tools such as create_record/update_record/delete_record/commit_pending_changes/run_flow), or disable all built-in tools and expose only a curated set of user tools. Names that do not match a current built-in tool are ignored. The "search_tools" tool cannot be disabled (it is the entry point to tools hidden by progressive disclosure). User (mcp_user_tool) tools are governed by RBAC separately and are NOT affected by this setting. The default (empty list) enables every built-in tool. This is the "enabled" axis of the built-in tool surface; the "announced" axis is MCP_GATED_TOOLS.	[]
MCP_ENFORCE_COMMIT	Always commit MCP-driven writes to git immediately, ignoring any commit=false passed by the agent. When enabled, the "commit" parameter is not even offered on MCP write tools.	True
MCP_GATED_TOOLS	A list of built-in MCP tool names to gate behind progressive tool disclosure. A gated tool is NOT advertised in the MCP tools/list, but stays fully callable via tools/call and is discoverable on demand via the "search_tools" tool (which returns its full input schema). Use this to keep the initial tool-list small on workspaces that expose many tools, so an agent does not have to ingest every tool's schema before starting work — rarely-used tools are loaded only when needed. This is independent of MCP_DISABLED_TOOLS: a disabled tool is removed entirely (not listed and not callable), while a gated tool is only hidden from the list. The "search_tools" tool itself can never be gated (it is the entry point to every gated tool). Names that do not match a current built-in tool are ignored. The default (empty list) announces every enabled built-in tool in tools/list, exactly as if the setting were absent. This is the "announced" axis of the built-in tool surface; the "enabled" axis is MCP_DISABLED_TOOLS.	[]

Notifications

Key	Description	Default value
NOTIFY_DISK_USAGE_CHECK_ENABLED	Notify about disk usage exceeding configured limits.	True
NOTIFY_DISK_USAGE_CHECK_INTERVAL_MINUTES	The number of minutes to wait between checks of disk usage.	60
NOTIFY_DISK_USAGE_FREE_GIB_ERROR_LIMIT	If free disk space GiB is below this amount an error notification is generated.	1
NOTIFY_DISK_USAGE_FREE_GIB_WARNING_LIMIT	If free disk space GiB is below this amount a warning notification is generated.	5
NOTIFY_DISK_USAGE_PERCENT_ERROR_LIMIT	If disk usage exceeds this percentage an error notification is generated.	90
NOTIFY_DISK_USAGE_PERCENT_WARNING_LIMIT	If disk usage exceeds this percentage a warning notification is generated.	75
NOTIFY_LICENSE_CHECK_ENABLED	Notify about license usage exceeding configured limits.	True
NOTIFY_LICENSE_CHECK_INTERVAL_MINUTES	The number of minutes to wait between checks of license usage.	1440
NOTIFY_LICENSE_CONNECTION_USAGE_PERCENT_ERROR_LIMIT	If connection usage exceeds this percentage an error notification is generated.	100
NOTIFY_LICENSE_CONNECTION_USAGE_PERCENT_WARNING_LIMIT	If connection usage exceeds this percentage a warning notification is generated.	90
NOTIFY_LICENSE_STORAGE_USAGE_PERCENT_ERROR_LIMIT	If storage usage exceeds this percentage an error notification is generated.	100
NOTIFY_LICENSE_STORAGE_USAGE_PERCENT_WARNING_LIMIT	If storage usage exceeds this percentage a warning notification is generated.	90

Resumer

Key	Description	Default value
EXECUTION_MAX_RUNTIME_MINUTES	The global maximum runtime of an execution in minutes. If set to 0, there is no limit. Changes to this setting will only affect new executions.	0
RESUMER_CHECK_FOR_DEPRECATIONS_ENABLED	Check for deprecations in flow scripts, wrappers, connectors and schedulers.	True
RESUMER_CHECK_MAX_RUNTIME_ENABLED	Check if executions are running longer than the global maximum runtime.	True
RESUMER_CLEAN_ORPHANED_ACTIVITIES_ENABLED	Delete partial activities.	True
RESUMER_CLEAN_ORPHANED_IDENTITIES_ENABLED	Delete partial identities.	True
RESUMER_CLEAN_ORPHANED_RECORDS_ENABLED	Delete partial records.	True
RESUMER_CLEAN_ORPHANED_RESOURCES_ENABLED	Delete partial resources.	True
RESUMER_CLEAN_TRASHED_EXECUTION_DUMPS_ENABLED	Delete execution dumps of executions in trash.	True
RESUMER_NOTIFY_LOST_DEPENDENCY_ENABLED	Notify about executions waiting for a dependency. WARNING: disabling this will impact functionality of the workspace.	True
RESUMER_NOTIFY_LOST_EXECUTION_ENABLED	Resume active executions after workspace restart. WARNING: disabling this will impact functionality of the workspace.	True
RESUMER_NOTIFY_LOST_LOCK_ENABLED	Resume executions waiting for a lock. WARNING: disabling this will impact functionality of the workspace.	True
RESUMER_NOTIFY_LOST_SCHEDULE_ENABLED	Ensure enabled schedules have a schedule execution. WARNING: disabling this will impact functionality of the workspace.	True
RESUMER_NOTIFY_LOST_SYNC_CONFIG_ENABLED	Resume executions waiting for a remote workspace. WARNING: disabling this will impact functionality of the workspace.	True
RESUMER_NOTIFY_LOST_WAIT_RECORD_ENABLED	Resume executions waiting for a record trash, restore, or delete when the operation completed but the notify was missed. WARNING: disabling this will impact functionality of the workspace.	True
RESUMER_POLL_DELAY_SECONDS	The number of seconds between activity checks.	30
RESUMER_POLL_SLOW_DELAY_SECONDS	The number of seconds between database cleanup routine runs.	1800
RESUMER_RESUME_SCHEDULED_ENABLED	Resume executions waiting for a timeout. WARNING: disabling this will impact functionality of the workspace.	True

Runtime statistics

Key	Description	Default value
RUNTIME_STATS_AGGREGATE_BATCH_SIZE	How many queued execution runtime samples to aggregate at once.	500
RUNTIME_STATS_AGGREGATE_ENABLED	Aggregate queued execution runtime samples into persistent runtime statistics. Runs on the primary process only.	True
RUNTIME_STATS_AGGREGATE_INTERVAL_MINUTES	The number of minutes to wait between runtime-statistics aggregation runs (aggregation is also triggered immediately when new samples arrive).	1
RUNTIME_STATS_MAX_RUNTIME_KEYS	Maximum number of distinct caller-supplied runtime_key buckets to keep globally. runtime_key values are caller-chosen and unbounded, so this caps how many can accumulate: when the limit is exceeded the least-recently-updated runtime_key buckets are rotated out (deleted). Set to 0 (or a negative value) to disable the cap and keep runtime_key buckets unbounded.	1000

Security

Key	Description	Default value
CONNECTION_TEST_ON_SAVE_ENABLED	When enabled, the frontend automatically runs a live connectivity & authentication check after a workspace-configuration record (vault_config, ldap_config, devolutions_config, ...) is saved or enabled, so a bad credential or unreachable server surfaces immediately instead of silently at first use. The check reuses the record's existing "test-connection" action; its result is shown inline to the user who saved. Disable to skip the automatic post-save check (the manual "test connection" action remains available).	True
LOGIN_METHOD_CLOUDOMATION_ENABLED	If set, users can log in to the Workspace using a Cloudomation user stored in the workspace's database.	True
LOGIN_TOKEN_VALIDITY_HOURS	The maximum number of hours a user stays signed in before having to re-authenticate.	720

Trash

Key	Description	Default value
BACKGROUND_DELETE_INTERVAL_MINUTES	The number of minutes to wait between background delete operations.	1
BACKGROUND_RESTORE_INTERVAL_MINUTES	The number of minutes to wait between background restore operations.	1
BACKGROUND_TRASH_INTERVAL_MINUTES	The number of minutes to wait between background trash operations.	1
FLOW_WAIT_RECORD_OPERATION_TIMEOUT_SECONDS	Maximum time in seconds to wait for a trash, restore, or permanent delete operation when wait=True (Flow API and REST API).	3600
TRASH_ACTIVITY_EXPIRY_BATCH_SIZE	How many expired activities to move to the trash at once.	100
TRASH_ACTIVITY_EXPIRY_ENABLED	Move ended executions to the trash after a timeout.	True
TRASH_ACTIVITY_EXPIRY_FULLSCAN_INTERVAL_MINUTES	How often the activity-expiry loop performs a full sweep (ignoring its internal ended_at watermark) to catch old executions that only became eligible for trashing after the watermark had already passed their end time (e.g. restored from trash, or un-pinned). Between full sweeps the loop only examines newly-aged executions, so this bounds the extra delay for such stragglers.	1440
TRASH_ACTIVITY_EXPIRY_INTERVAL_MINUTES	The number of minutes to wait between checks for ended executions.	5
TRASH_ACTIVITY_EXPIRY_TIME_MINUTES	The number of minutes before an ended execution will be moved to the trash.	20160
TRASH_RETENTION_TIME_ACTIVITIES_ENABLED	Permanently delete activities from the trash after a timeout.	True
TRASH_RETENTION_TIME_ACTIVITIES_MINUTES	The number of minutes before activities are permanently deleted from the trash.	20160
TRASH_RETENTION_TIME_BATCH_SIZE	How many records to permanently delete from the trash at once.	100
TRASH_RETENTION_TIME_INTERVAL_MINUTES	The number of minutes to wait between checks for permanently deleting records from the trash.	100
TRASH_RETENTION_TIME_RESOURCES_ENABLED	Permanently delete resources from the trash after a timeout.	True
TRASH_RETENTION_TIME_RESOURCES_MINUTES	The number of minutes before resources are permanently deleted from the trash.	20160

User Interface

Key	Description	Default value
FILE_SIZE_BYTES_ALWAYS_LOAD_LIMIT	The maximum size of a file to always load into the in-browser editor.	1048576
FILE_SIZE_BYTES_OPTIONAL_LOAD_LIMIT	The maximum size of a file to optionally load into the in-browser editor.	10485760
ICON_MAX_SIZE_PX	The maximum size of an icon in pixels. Larger icons will be scaled down.	256
INPUT_VALUE_SIZE_BYTES_ALWAYS_LOAD_LIMIT	The maximum size of an input value to always load into the in-browser editor.	1048576
INPUT_VALUE_SIZE_BYTES_OPTIONAL_LOAD_LIMIT	The maximum size of an input value to optionally load into the in-browser editor.	10485760
MAX_OPEN_EXECUTIONS_PER_LOCATION	The maximum number of executions a user can have opened in each project or bundle. When this number is exceeded, the oldest opened execution will be closed.	3
MAX_OPEN_RESOURCES_PER_LOCATION	The maximum number of resources a user can have opened in each project, bundle, or on the workspace level. When this number is exceeded, the oldest opened resource will be closed.	5
MAX_OPEN_USER_INTERFACE_COUNT	The maximum number of user interfaces that can be opened in each workspace at a time. Will display a warning when 80 percent or more are reached, and will ask for confirmation when 100 percent or more are reached.	10
MESSAGE_LIST_SUBMITTED_LIMIT	How many submitted messages to display in the messages popover	10
MESSAGE_LIST_UNSUBMITTED_LIMIT	How many unsubmitted messages to display in the messages popover	10
ON_SAVE_MIGRATE_DEPRECATIONS_ENABLED	Automatically migrate deprecations upon saving in the UI. Note that this does not apply to saving via the API.	False
OUTPUT_VALUE_SIZE_BYTES_ALWAYS_LOAD_LIMIT	The maximum size of an output value to always load into the in-browser editor.	1048576
OUTPUT_VALUE_SIZE_BYTES_OPTIONAL_LOAD_LIMIT	The maximum size of an output value to optionally load into the in-browser editor.	10485760
VISUALIZATION_MAX_NODES	The maximum number of nodes shown in the dependency visualization graph.	500
VISUALIZATION_REFRESH_INTERVAL_SECONDS	The number of seconds between refreshes of the dependency visualization graph.	3
WORKSPACE_HIGHLIGHT_COLOR	To quickly visually identify Cloudomation workspaces you can choose the background color of the top bar.	#FFFFFF

Internals

Key	Description	Default value
BACKGROUND_DELETE_BATCH_SIZE	How many records to delete at once.	100
BACKGROUND_DELETE_ENABLED	Permanently delete records marked for deletion. WARNING: disabling this will impact functionality of the workspace.	True
BACKGROUND_DELETE_REFERENCE_CLOSURE_MAX	Maximum number of records in a reference closure the permanent-delete path will resolve as one atomic batch. When a record marked for permanent deletion is referenced by other records, the delete path collects the transitive set of referencing records (the reference closure) and, if they are all being deleted, removes them together in one transaction. If the closure is larger than this limit the delete fails with an actionable error rather than attempting an unbounded atomic delete.	1000
BACKGROUND_DELETE_REFERENCE_GRACE_SECONDS	Grace period before a permanent delete blocked by a *live* referencing record (one not itself marked for deletion) fails with an actionable error instead of retrying. A record that is still referenced by another record cannot be permanently deleted (the reference is a foreign key with ON DELETE RESTRICT). When every referencing record is itself pending permanent deletion — e.g. a reference cycle A->B->C->A deleted as a set — the whole set is deleted together atomically, so no error occurs. But when a referrer is a live record that the user is not deleting, the delete can never succeed. This grace period gives sibling deletes of a set time to be marked (so a genuine cycle is not misclassified as blocked by a "live" referrer during the brief window before all marks are set) before the delete gives up and reports the blocking record(s).	30
BACKGROUND_RESTORE_BATCH_SIZE	How many records to restore from trash at once.	100
BACKGROUND_RESTORE_ENABLED	Restore records from trash. WARNING: disabling this will impact functionality of the workspace.	True
BACKGROUND_TRASH_BATCH_SIZE	How many records to move to trash at once.	100
BACKGROUND_TRASH_ENABLED	Move records to trash. WARNING: disabling this will impact functionality of the workspace.	True
BACKGROUND_WAITER_TIER_BUDGET_PERCENT	Per-iteration cap on the FIFO "waiter" tier's share of a background trash/restore/delete batch. Records with a flow blocked on wait_record_operation are processed oldest-first (FIFO) ahead of the default newest-first (LIFO) backlog. Without a cap, at least batch-size perpetually-failing waiter records would consume the whole examine budget every iteration and starve the LIFO tier - the exact head-of-line pathology LIFO ordering avoids. Once this percentage of the batch size has been spent skipping failing waiter records in one iteration, the waiter tier is no longer peeked for the rest of that iteration and the LIFO tier proceeds; the waiter tier gets a fresh budget on the next iteration. Successful waiter acts do not count against the budget. 100 disables the cap (waiters may use the entire budget); the effective cap is at least 1 so the waiter tier is always tried at least once.	50
CONNECTION_SHUTDOWN_GRACE_SECONDS	On workspace shutdown, how long to wait for running connector threads to unwind (detach from resumable remote work or finish cancelling) before abandoning them so the process can exit.	10
CUSTOM_OBJECT_REFERENCING_LIMIT	When ``referencing_custom_objects`` is requested on a custom object read or list, the maximum number of referencing custom objects returned per referencing attribute for each target custom object. Bounds the result size of an otherwise unbounded reverse-reference lookup. Set to 0 to disable the limit.	100
DB_KEEPALIVE_INTERVAL_SECONDS	The number of seconds to wait between checking database connectivity.	20
DB_KEEPALIVE_TIMEOUT_SECONDS	The number of seconds after which a workspace process is considered "dead".	60
ENGINE_CHECK_ENABLED	Enable a periodic check to confirm that the workspace can process executions successfully. The result of the last engine check can be retrieved by making a GET request to `/api/latest/alive`.	True
ENGINE_CHECK_INTERVAL_MINUTES	The interval in minutes to check if the engine is ok. This creates a hidden dummy execution with priority 1000 and checks if it is processed successfully.	10
ENGINE_CHECK_LEEWAY_MINUTES	The number of minutes to add to the engine check interval to account for high workspace load.	1
ENGINE_CLAIM_RETRY_DELAY_SECONDS	How long a workspace process waits before retrying to claim queued executions when a claim found nothing but queued+unowned executions still exist. This happens when their row is transiently locked by a concurrent transaction (e.g. a background cleanup delete): FOR UPDATE SKIP LOCKED skips the locked row, and because the execution_queued notify is edge-triggered it would otherwise never be retried, hanging the execution until the lock releases. A short retry closes that starvation window; retries stop as soon as the backlog is empty, so there is no polling in the healthy idle case. Changes apply without a restart.	1
ENGINE_CONCURRENT_EXECUTIONS	How many executions one workspace process handles concurrently. 1 restores the historical strictly-serial behavior. With a higher value the database stages of one execution (claiming, waits, pending operations, command processing, connections) overlap the sandbox session of another; whole sandbox sessions stay strictly serialized. Changes apply to running workspace processes without a restart (evaluated before each claim).	4
ENGINE_ERROR_RETRY_DELAY_SECONDS	How long the engine waits before an execution re-enters the flowchart loop after an unexpected internal error. Without this delay, a deterministically-failing execution (e.g. one that hits a broken query while ending) spins into a hot crash loop that runs many times per second and starves the whole engine. Set to 0 to retry immediately (not recommended).	1
ENGINE_MAX_CLAIM_DUMP_BYTES	Out-of-memory guard for concurrent execution processing: while at least one execution is in flight, a workspace process does not claim executions whose latest dump is larger than this budget (in bytes) - they stay queued for a process with a free slot. 0 disables the check. A process with nothing in flight claims unconditionally, so oversized executions cannot starve. Changes apply without a restart.	67108864
ENGINE_MEMORY_SOFT_LIMIT_KB	Out-of-memory guard for concurrent execution processing: while at least one execution is in flight, a workspace process claims further work only when its RSS is below this soft limit (in KB). 0 disables the check. A process with nothing in flight always claims one execution, so no execution can starve. Changes apply without a restart.	2097152
EXECUTION_DEFAULT_PRIORITY	The default priority of executions. Higher priority executions will be processed first.	42
EXECUTION_PROCESSOR_ENABLED	When disabled the workspace will not process executions.	True
EXECUTION_RECENT_HOURS	Number of hours to consider an execution "recent" when determining processing order. Executions created within this window are prioritized ahead of older executions, regardless of priority, while still ordered among themselves by priority (descending) and creation time (ascending). Executions older than this threshold are processed afterward, also ordered by priority and creation time.	24
FILE_STORAGE_PATH	The path to the directory where files are stored.	/data/files
GRAPHQL_QUERY_COMPLEXITY_LIMIT	The maximum "cost" of a single graphql query. TODO: document how cost is calculated...	2000
INTERNAL_AUTH_CACHE_TTL_SECONDS	How long a resolved auth entry (identity info + permissions) for an internal API call may be cached before it is re-read from the database. Internal calls (engine status updates, log writes, pending ops) otherwise re-resolve auth from the DB on every call. Correctness does not depend on this timeout: caches are invalidated immediately across all workspace processes whenever roles, permissions or an identity's location change. This is only a safety net bounding staleness for changes that have no explicit invalidation (e.g. disabling a user). Set to 0 to disable the cache entirely.	30
MEMORY_TRACING_FRAMES	Memory tracing frame count. Zero (0) disables tracing.	0
MEMORY_TRACING_INTERVAL_SECONDS	How many seconds to wait before taking another snapshot.	3600
MEMORY_TRACING_SAVE_DIRECTORY	The directory to save tracing dumps to.	/tmp
OBJECT_TEMPLATE_SCHEMA_RECONCILE_INTERVAL_SECONDS	Interval at which each workspace process performs a full reconciliation of its in-memory object_template schema cache against the database. This is a backstop: cross-process cache sync is normally driven by LISTEN/NOTIFY, but a missed notification or a cache that diverged for another reason would otherwise only heal on a process restart. Set to 0 to disable and rely solely on NOTIFY plus restart-on-connection-loss.	3600
PROFILING_ENABLED	Enable profiling of the workspace. While enabled, the workspace will collect profiling data. After running your test disable profiling. The collected data will then be saved to `$TMP/workspace[A-Z].prof` and can be analyzed using tools like snakeviz.	False
RECURSE_MAX_SIZE	The maximum number of records in an array or object to recurse into. If the number is exceeded, the value will be returned as is. This affects datatype coercion, default value application, and secrets expansion. A high value can lead to performance issues.	100
RETRY_ON_DEADLOCK_ENABLED	Defence-in-depth for the engine. When a database transaction that performs execution-lifecycle bookkeeping fails with a transient PostgreSQL serialization/deadlock error (40P01 deadlock_detected or 40001 serialization_failure), retry the whole transaction a bounded number of times with jittered backoff instead of failing the execution. The engine bookkeeping writes are designed to avoid deadlocks at the source (see the AB-BA fix in Engine.apply_updates); this retry only catches rare residual lock-order cycles. Set to false to surface deadlocks immediately -- e.g. on an integration system where they must be observed and root-caused. When false the wrapped transactions behave exactly like an ordinary single-attempt transaction.	True
SAVEPOINT_RETENTION	Savepoint retention behaviour. Possible values are: * ALL: keep all savepoints of executions * LAST: keep the last implicit and all explicit savepoints of executions. Note: It is possible to override this configuration in an execution using the `savepoint_retention` argument. Note: Even with SAVEPOINT_RETENTION set to ALL, savepoints will be deleted after SAVEPOINT_RETENTION_TIME_MINUTES or if the execution is deleted.	LAST
SAVEPOINT_RETENTION_TIME_BATCH_SIZE	How many old savepoints to delete at once.	100
SAVEPOINT_RETENTION_TIME_ENABLED	Automatically delete old savepoints of executions.	True
SAVEPOINT_RETENTION_TIME_INTERVAL_MINUTES	The number of minutes to wait between checks for old savepoints.	60
SAVEPOINT_RETENTION_TIME_MINUTES	The number of minutes before old savepoints of executions are deleted. The last savepoint of an execution is always kept.	20160
SCHEDULE_MIN_INTERVAL_FAILED_SECONDS	If a schedule fails to execute wait this many seconds before creating a new one.	60
SCHEDULE_MIN_INTERVAL_SUCCEEDED_SECONDS	If a schedule succeeds wait this many seconds before creating a new one.	60
WEBHOOK_CANCEL_ENABLED	Enable cancelling webhook calls. Only affects webhook calls which are triggered without `async=true`.	True
WORKSPACE_CONFIGURATION_RECONCILE_INTERVAL_SECONDS	Interval at which each workspace process reloads all workspace_configuration values from the database when no NOTIFY arrives. Cross-process config sync is normally driven by LISTEN/NOTIFY on the workspace_configuration channel; a missed notification would otherwise leave a process serving stale final_value until restart. Set to 0 to disable and rely solely on NOTIFY plus restart-on-connection-loss.	60