System Settings and Limits

bilgi

Navigate to Management > System Settings to access the unified System Settings screen. This screen presents all platform configuration parameters, default limits, and system constraints grouped across 8 tabs.

uyarı

Only users with the Administrator (Admin) role can access this screen. Settings should be configured carefully as they are effective platform-wide.

Overview

The unified System Settings page merges General Settings, System Properties (previously managed on separate screens) along with previously undocumented runtime parameters and system constraints into a single interface. Each setting has a scope badge:

Scope	Color	Description
Deploy Required	Orange	Stored in database, API Proxies must be redeployed for changes to take effect
Restart Required	Blue	Defined as environment variable, pod restart required for changes
Fixed	Gray	Immutable infrastructure limit

Editable settings can be modified directly from the screen using appropriate input controls (number, text, toggle, color picker, etc.). Read-only parameters are shown with a lock icon.

---

Tab 1: Routing & Traffic Management

This tab contains settings that control how API requests are routed to backend servers and connection configuration.

Connection Settings

Parameter	Default	Configurable Range	Scope
Connect Timeout	30 sec	1 – 3,600 sec	Deploy Required
Read Timeout	30 sec	1 – 3,600 sec	Deploy Required
Request Timeout	3 sec	1 – 300 sec	Deploy Required
Max Redirects	50	0 – 100	Deploy Required
Validate After Inactivity	2,000 ms	—	Deploy Required
Idle Timeout	30 sec	—	Deploy Required

Connection Pools

Pool	Per Host	Total	Scope
Routing	1,024	2,048	Restart Required
Cache	—	256	Restart Required
Elasticsearch	256	—	Restart Required
API Call	256	4,096	Restart Required
Default HTTP Client	128	512	Restart Required

Additional connection pool parameters:

Parameter	Default	Scope
Connection time to live	5 minutes	Restart Required
Keep-alive duration	30 seconds	Restart Required
Idle connection eviction	30 seconds	Restart Required

Load Balancing

Parameter	Default	Scope
Algorithm	Round Robin	Deploy Required
Other options	Least Recently Used, Weighted, Random, Pick First	Deploy Required
User agent value	—	Deploy Required

Redirect

Parameter	Default	Scope
Redirect enabled	—	Deploy Required
Relative redirect allowed	—	Deploy Required
Disable compression	—	Deploy Required

Retry Policy

Parameter	Default	Configurable Range	Scope
Fixed delay	500 ms	0 – 60,000 ms	Deploy Required
Initial delay	500 ms	0 – 60,000 ms	Deploy Required
Max delay	10,000 ms	0 – 300,000 ms	Deploy Required
Backoff multiplier	2.0	1 – 10	Deploy Required

Sticky Session

Parameter	Default	Configurable Range	Scope
Cookie name	—	—	Deploy Required
Cookie TTL	1,800 sec (30 min)	0 – 86,400 sec	Deploy Required
Secure cookie	—	—	Deploy Required
HttpOnly	—	—	Deploy Required

Health Check

Parameter	Default	Configurable Range	Scope
Check interval	30 sec	5 – 3,600 sec	Deploy Required
Timeout	5 sec	1 – 60 sec	Deploy Required
Failure threshold	3	1 – 20	Deploy Required
Success threshold	2	1 – 20	Deploy Required

Circuit Breaker

Parameter	Default	Configurable Range	Scope
Error window	10 sec	1 – 3,600 sec	Deploy Required
Error threshold	1	1 – 10,000	Deploy Required
Sleep window	10 sec	1 – 3,600 sec	Deploy Required

Traffic Mirroring

Parameter	Default	Scope
Mirror percentage	10%	Deploy Required

Hop-by-Hop Headers (Read-only)

The following HTTP headers are automatically handled by the gateway during routing and are not forwarded to the backend:

Content-Length, Host, User-Agent, TE, Trailers, Transfer-Encoding, Upgrade

not

These headers are classified as hop-by-hop per HTTP/1.1 RFC 2616 and must be regenerated by proxy servers.

---

Tab 2: Protocol Configuration

This tab contains settings specific to different protocol types (gRPC, WebSocket, HTTP/2).

gRPC Routing (Deploy Required)

Parameter	Default	Configurable Range	Scope
Inbound message size	16 MB	1 KB – 256 MB	Deploy Required
Metadata size	8 KB	1 KB – 16 MB	Deploy Required
Per-RPC buffer	1 MB	1 KB – 256 MB	Deploy Required
Keep-alive time	120 sec	—	Deploy Required
Keep-alive timeout	20 sec	—	Deploy Required
Channel idle timeout	5 min	—	Deploy Required
Retry attempts	5	0 – 100	Deploy Required
Hedged attempts	5	0 – 100	Deploy Required
Trace events	—	—	Deploy Required

gRPC Server (Restart Required, Read-only)

Parameter	Default	Scope
Message size	4 MB	Restart Required
Keep-alive time	2 hours	Restart Required
Max header list size	8 KB	Restart Required
Connection max age	1 hour	Restart Required
Connection max age grace	30 sec	Restart Required
Idle connection timeout	5 min	Restart Required
Handshake timeout	20 sec	Restart Required
Permit keep-alive time	5 min	Restart Required
Thread pool size	CPU × 2	Restart Required

WebSocket Routing (Deploy Required)

Parameter	Default	Scope
Connection lost timeout	30 sec	Deploy Required
Reuse address	—	Deploy Required
Connect timeout	10 sec	Deploy Required
Retry count	3	Deploy Required
Auto reconnect	—	Deploy Required

WebSocket Server (Restart Required, Read-only)

Parameter	Default	Scope
Idle timeout	60 sec	Restart Required
Buffer size	64 KB	Restart Required
TCP NoDelay	true	Restart Required

HTTP/2 (Restart Required, Read-only)

Parameter	Default	Scope
HTTP/2 enabled	false	Restart Required

---

Tab 3: Security & Access Control

Authentication & Session

Parameter	Default	Scope
Captcha attempts allowed	3	Deploy Required
User lock attempts allowed	7	Deploy Required
Idle time	92,000 sec	Deploy Required
Idle timeout	5 sec	Deploy Required

JDK TLS/SSL Settings (Restart Required, Read-only)

Parameter	Description	Scope
Disabled Algorithms	Algorithms disabled in TLS	Restart Required
CertPath Disabled Algorithms	Algorithms disabled in certificate path validation	Restart Required
Enabled TLS Versions	TLSv1, TLSv1.1, TLSv1.2, TLSv1.3	Restart Required
Cipher Suites	24 different cipher suites	Restart Required
Allow Unsafe Protocols	JVM-level security setting	Restart Required

CORS (Restart Required, Read-only)

Parameter	Default	Scope
Allow origin	*	Restart Required
Allow credentials	true	Restart Required
Allow methods	*	Restart Required
Allow headers	*	Restart Required
Max age	3600	Restart Required

X-Forwarded-For (Restart Required, Read-only)

Parameter	Default	Scope
IP header name	X-Forwarded-For	Restart Required
Order	rightmost	Restart Required

XML Security (Fixed, Read-only)

Feature	Status	Description
DTD	Disabled	Protection against XXE attacks
External entities	Disabled	Prevents external resource loading
Entity expansion	Disabled	Protection against billion laughs attack
XInclude	Disabled	Prevents external file inclusion

---

Tab 4: Logging & Monitoring

Traffic Log Body Limits

Parameter	Default	Scope
From client body	25 MB	Deploy Required
To backend body	25 MB	Deploy Required
From backend body	25 MB	Deploy Required
To client body	25 MB	Deploy Required
Elasticsearch query buffer	25 MB	Deploy Required

Policy Log

Parameter	Default	Scope
Execution log body	1 MB	Deploy Required
Executable detail limit	1 KB	Deploy Required

Log Retention

Log retention settings determine storage duration and maximum record counts for different log types. Separately configurable for all log types (traffic, application, token, audit, login), including Identity Synchronization History — the durable run-by-run log described in Credential Synchronization, disabled by default so no run record is deleted until an administrator turns it on.

Data Retention Profile

Log Retention above decides how long log records are kept; the Data Retention Profile answers a different question — whether a request's body/headers get captured at all. There are three profiles, increasing in strictness:

Profile	Label on screen	Behavior
STANDARD	Standard	Today's behavior — body/header capture, persistence, and tracing all work normally per your existing settings
NO_PAYLOAD	No Payload	Request/response headers, query string, and body are never captured — not scrubbed afterward, simply never populated. Starting Live Trace is locked under this profile; not even an authorized user can turn it on
NO_PERSIST	No Persist	Everything No Payload restricts, plus no record at all is sent to connectors, the Mongo trace store, or OTel spans. Tracing is locked here too

Counter and metric flows (Prometheus, quota counters) are unaffected by all three profiles — these profiles only stop persistent record creation, not counting.

Not the Same as In-Memory Data

These profiles prevent persistent/external record creation. While a request is being processed, the data still exists temporarily in JVM memory (for example, while being forwarded to the backend) — these profiles do not establish a claim that "no trace exists even in memory," only that "no persistent/external record is created."

Cascade: Global → Project → Proxy

The profile can be set at three levels: the global level on this page, the project settings level, and the API proxy's traffic log settings level. The effective profile is the strictest of the three levels — a lower level can never choose a looser profile than the level above it: a project can match the global profile or be stricter than it; a proxy must likewise match or exceed the effective profile it inherits (global + project). Choosing a looser profile is rejected on save.

This cascade isn't just a UI convenience — the gateway computes the effective profile at runtime with the same strictest-wins logic, so trying to bypass a higher level outside the UI (for example, updating a proxy's setting directly through APIops) has no effect.

Metrics (Restart Required, Read-only)

Parameter	Default	Scope
Metrics enabled	false	Restart Required

Connector Circuit Breaker

Installation-wide defaults for the circuit breaker that protects log delivery over Kafka, RabbitMQ, ActiveMQ, Graylog, Webhook, and database (DB) connections. This section is independent of the Routing circuit breaker on Tab 1 — that one governs requests routed to backends; this one only covers connector log delivery.

Parameter	Default	Configuration Range	Scope
Circuit Breaker Enabled	Disabled	-	Deploy Required
Error Window	10 s	1 - 3,600 s	Deploy Required
Error Threshold	5	1 - 10,000	Deploy Required
Sleep Window	30 s	1 - 3,600 s	Deploy Required
Half-Open Attempt Enabled	Enabled	-	Deploy Required

bilgi

These five values are installation-wide defaults. Circuit Breaker Enabled, Error Threshold, and Sleep Window can be overridden per connection from the Resilience (Circuit Breaker) section on the Kafka, RabbitMQ, ActiveMQ, Graylog, Webhook, and database connection screens; fields left empty inherit the defaults configured here. Error Window and Half-Open Attempt Enabled are configured only here, installation-wide.

---

Tab 5: Data Processing & Limits

SOAP Sample Generation

Parameter	Default	Scope
Max element count	1,000	Deploy Required
Max nesting depth	15	Deploy Required
Max size	25 KB	Deploy Required

REST-SOAP Conversion Limits

not

These limits determine the maximum values accepted by the JSON parser during REST-to-SOAP conversion.

Parameter	Default	Scope
Max string length	20,000,000	Deploy Required
Max nesting depth	1,000	Deploy Required
Max number length	1,000	Deploy Required

Reporting & Export

Parameter	Default	Scope
Excel export limit	10,000 records	Deploy Required
Report generator max records	10,000 records	Deploy Required
Traffic log preview	100 rows	Deploy Required
Email attachment size	25 MB	Deploy Required

UI Display Limits

Parameter	Default	Scope
UI body display limit	5 MB	Deploy Required
Test console file upload	5 MB	Deploy Required
Test console request body	5 MB	Deploy Required
Test console response body	5 MB	Deploy Required

Multipart Upload (Restart Required, Read-only)

Parameter	Default	Scope
Max file size	100 MB	Restart Required
Max request size	100 MB	Restart Required
File size threshold	10 MB	Restart Required

System Size Constraints (Read-only)

Constraint	Value	Description
MongoDB document size	16 MB	BSON document size limit, cannot be changed
Elasticsearch max result window	10,000	Default result window limit
Audit log reference object	15 MB	Due to MongoDB 16 MB limit

---

Tab 6: Gateway Runtime

All parameters in this tab are Restart Required scoped and read-only. To change them, define as environment variables and restart the pod.

Undertow Thread Pool

Parameter	Default	Description
Worker Threads	CPU × 8	Worker thread count
Worker Max Threads	CPU × 16	Maximum worker thread count
IO Threads	CPU count	I/O thread count

Undertow Buffers

Parameter	Default	Description
Buffer Size	16 KB	Buffer size
TCP Backlog	1,000	TCP connection queue
Max Concurrent Request	0 (unlimited)	Max concurrent requests
Max Queue Size	0 (unlimited)	Max queue size
Direct Buffers	true	Direct memory buffers

Undertow Timeouts

Parameter	Default	Description
Read Timeout	0 (unlimited)	Read timeout
Streaming Read Timeout	0 (unlimited)	Streaming read timeout
No Request Timeout	60 sec	Idle connection timeout

Virtual Threads

Parameter	Default	Description
Routing VT enabled	true	Virtual threads for routing
Logging VT enabled	true	Virtual threads for logging

Async Executor

Parameter	Default	Description
Core pool size	2	Core pool size
Max pool size	100	Maximum pool size
Queue capacity	10,000	Queue capacity

General

Parameter	Default	Description
Log level	INFO	Application log level
Charset	UTF-8	Default character encoding
Deployment timeout	30 sec	Worker deployment timeout
Cluster name	—	Cluster name

Default Ports (Fixed, Read-only)

Port	Description
8080	API Gateway HTTP
8090	Cache Server
8091	Management API
8443	API Gateway HTTPS
8092	gRPC
8094	WebSocket
9091	Undertow Admin

---

Tab 7: Cache & Clustering

All parameters in this tab are Restart Required scoped and read-only.

Hazelcast Threads

Parameter	Default	Description
Operation thread count	—	Operation threads
Generic thread count	—	General-purpose threads

Partitioning

Parameter	Default	Description
Partition count	271	Hazelcast partition count

Map Configuration

Parameter	Default	Description
Max entries	10,000	Maximum entries per map
Backup count	1	Synchronous backups
Async backup count	0	Asynchronous backups
Read backup data	true	Read from backup copies

Write-Behind

Parameter	Default	Description
Write delay	5 sec	Batch write interval
Batch size	100	Records per write batch
Coalescing	true	Merge same-key writes
Queue capacity	100,000	Write queue size

Networking

Parameter	Default	Description
Heartbeat interval	5 sec	Heartbeat period
Max no heartbeat	60 sec	Heartbeat timeout
Socket keep alive	true	Socket keep alive
Socket no delay	true	TCP NoDelay

Timeouts

Parameter	Default	Description
Operation call timeout	60 sec	Operation timeout
Backup timeout	5 sec	Backup operation timeout

Serialization

Parameter	Default	Description
Native byte order	true	Platform byte order
IO write through	false	Direct write

Map Loading

Parameter	Default	Description
Chunk size	10,000	Bulk load chunk size
Batch size	10,000	Bulk load step

---

Tab 8: Platform

Deployment

Parameter	Default	Scope
History revision count	6	Deploy Required

Correlation ID

Parameter	Default	Scope
Correlation ID header name	APINIZER-CORRELATION-ID	Deploy Required

not

The correlation ID header name is currently fixed and cannot be changed. This value is used for distributed tracing between requests.

---

User Interface Constants

The following limits are hardcoded in the UI and cannot be changed from the system settings screen:

Limit	Default
Pagination	10 records (options: 10 / 25 / 50 / 100)
Portal pagination	20 records
Test timeout	10 seconds
Notification duration	5 seconds
Logo/favicon upload	5 MB
API product file upload	2 MB
Bulk import	100 MB
Password length	4 – 100 characters

---

MCP (Portal WebSocket)

Parameter	Default	Configuration
Max concurrent connections	100	YAML
Session timeout	5 minutes	YAML
Rate limit	100 requests per minute	YAML

---

Saving Changes

Use the Apply Changes button in the top-right corner of the screen to save changes. The system saves changes to different data sources separately:

• Deploy Required (DB) settings are instantly distributed to all nodes
• Restart Required settings require the relevant pod to be restarted
• Fixed values are read-only and cannot be changed

uyarı

Changing some settings (for example API Root Context) may require a platform restart.