Skip to main content
Prisme.ai services can be configured through various environment variables. This reference provides a comprehensive list of available configuration options for your deployment.

​
Configuration Methods

​
Docker Setup

In a Docker deployment, configure these variables in the root docker-compose.yml file. See the Docker Compose documentation for more details.

​
Developer Setup

In a development environment, create a services/*/.env file containing key/value pairs: 
WORKSPACES_STORAGE_TYPE=S3_LIKE
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAME=someBucketName
...
To run a service directly from its Docker image, add an env_file option to its services/*/docker-compose.yml file: 
console:
  entrypoint: npm start --prefix services/console
  restart: on-failure
  image: registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-console:latest
  ports:
    - "3000:3000"
  env_file: ./.env
Note 1: Default values may differ depending on the selected start mode (Docker or Developer), especially URL-related variables. Note 2: Relative paths start from the executing service directory.

​
Variable Categories

​
Domains & URLs

Configure the URLs and domains used by Prisme.ai services.
NameServiceDescriptionDefault Value
INTERNAL_API_URLAll servicesapi-gateway internal URL for internal requests ending with /v2 version suffix (i.e., contact fetching, public JWKS, runtime fetches)http://localhost:3001/v2
API_URLAll servicesapi-gateway public URL ending with /v2 version suffixhttp://studio.local.prisme.ai:3001/v2
CONSOLE_URLapi-gateway, console, pages, runtimeStudio URL, used for emails, auth redirections & runtime variable {{global.studioUrl}}http://studio.local.prisme.ai:3000
PAGES_HOSTapi-gateway, console, pages, runtimePages base domain starting with a ’.’, workspace slug will be prefixed as a subdomain. Used for pages builder, pages sign-in redirection from api gateway, & runtime variable {{global.pagesUrl}}.pages.local.prisme.ai:3100

​
Databases & Storage

​
Redis Configuration

NameServiceDescriptionDefault Value
BROKER_HOSTapi-gateway, workspaces, events, runtimeRedis broker URL (must be the same across services)redis://localhost:6379/0
BROKER_PASSWORDapi-gateway, workspaces, events, runtimeRedis broker password
BROKER_TLS_CA_FILEapi-gateway, workspaces, events, runtimeRedis TLS CA filepath
BROKER_NAMESPACEapi-gateway, workspaces, events, runtimeOptional namespace to segment events when database instance is shared by multiple platforms
BROKER_TOPIC_MAXLENapi-gateway, workspaces, events, runtimeRedis streams max length before getting truncated (Capped Streams)10000
BROKER_EMIT_MAXLENapi-gateway, workspaces, events, runtimeMaximum size (in bytes) of emitted events100000
BROKER_EMIT_EXECUTED_AUTOMATION_MAXLENruntimeMaximum size (in bytes) of emitted runtime.automations.executed events10000
SESSIONS_STORAGE_HOSTapi-gatewayRedis URL for sessions storageredis://localhost:6379/0
SESSIONS_STORAGE_PASSWORDapi-gatewayRedis password for sessions storage
SESSIONS_STORAGE_TLS_CA_FILEapi-gatewayRedis TLS CA filepath
CONTEXTS_CACHE_HOSTruntimeRedis URL for contexts persistenceredis://localhost:6379/0
CONTEXTS_CACHE_PASSWORDruntimeRedis password for contexts persistence
CONTEXTS_CACHE_TLS_CA_FILEruntimeRedis TLS CA filepath
EVENTS_TOPICS_CACHE_HOSTeventsRedis URL for event userTopics persistenceBROKER_HOST variable
EVENTS_TOPICS_CACHE_PASSWORDeventsRedis password for event userTopics persistence
EVENTS_TOPICS_CACHE_TLS_CA_FILEeventsRedis TLS CA filepath

​
MongoDB/PostgreSQL Configuration

NameServiceDescriptionDefault Value
PERMISSIONS_STORAGE_DRIVERapi-gateway, workspaces, events, runtimeDatabase driver for permissions storage (must be the same for both workspaces & events): mongodb, postgresqlmongodb
PERMISSIONS_STORAGE_HOSTapi-gateway, workspaces, events, runtimeDatabase URL for permissions storage (must be the same for both workspaces & events)mongodb://localhost:27017/permissions
PERMISSIONS_STORAGE_TLS_CA_FILEapi-gateway, workspaces, events, runtimeDatabase TLS CA filepath
PERMISSIONS_STORAGE_TLS_SELF_SIGNEDapi-gateway, workspaces, events, runtimeSet to true in order to disable server certificate validationfalse
PERMISSIONS_STORAGE_DEBUGworkspaces, events, runtimeEnable database query logsfalse
USERS_STORAGE_DRIVERapi-gatewayDatabase type for users storage: mongodb, postgresqlmongodb
USERS_STORAGE_HOSTapi-gatewayDatabase URL for users storagemongodb://localhost:27017/users
USERS_STORAGE_TLS_CA_FILEapi-gatewayDatabase TLS CA filepath
USERS_STORAGE_TLS_SELF_SIGNEDapi-gatewaySet to true in order to disable server certificate validationfalse
USERS_STORAGE_DEBUGapi-gatewayEnable database query logsfalse
COLLECTIONS_STORAGE_DRIVERruntimeDatabase type for collections storage: mongodb, postgresqlmongodb
COLLECTIONS_STORAGE_HOSTruntimeDatabase URL for collections storagemongodb://localhost:27017/users
COLLECTIONS_STORAGE_TLS_CA_FILEruntimeDatabase TLS CA filepath
COLLECTIONS_STORAGE_TLS_SELF_SIGNEDruntimeSet to true in order to disable server certificate validationfalse
COLLECTIONS_STORAGE_DEBUGruntimeEnable database query logsfalse

​
Elasticsearch Configuration

NameServiceDescriptionDefault Value
EVENTS_STORAGE_DRIVEReventsEvents storage driver (support elasticseach or opensearch)elasticsearch
EVENTS_STORAGE_ES_HOSTeventsElasticsearch URL for events persistencehttp://localhost:9200
EVENTS_STORAGE_ES_USEReventsElasticsearch user for events persistence
EVENTS_STORAGE_ES_PASSWORDeventsElasticsearch password for events persistence
EVENTS_STORAGE_ES_BULK_REFRESHeventsEnable Elastic “refresh” option when bulk inserting events (might cause overhead)no

​
Storage Configuration

Prisme.ai supports multiple storage backends for workspaces and uploads. Available storage types are:
  • FILESYSTEM: Local file system storage
  • S3_LIKE: Amazon S3 or compatible services (MinIO, etc.)
  • AZURE_BLOB: Azure Blob Storage
  • GCS : Google Cloud Storage

​
Workspaces Storage

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_TYPEruntime & workspacesStorage driver type (FILESYSTEM, S3_LIKE, AZURE_BLOB or GCS)FILESYSTEM
WORKSPACES_STORAGE_FILESYSTEM_DIRPATHruntime & workspacesDirectory path for filesystem storage../../data/models/

​
S3-Compatible Storage for Workspaces

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_S3_LIKE_ACCESS_KEYruntime & workspacesS3 access key
WORKSPACES_STORAGE_S3_LIKE_SECRET_KEYruntime & workspacesS3 secret key
WORKSPACES_STORAGE_S3_LIKE_ENDPOINTruntime & workspacesS3 endpoint
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAMEruntime & workspacesS3 bucket name
WORKSPACES_STORAGE_S3_LIKE_REGIONruntime & workspacesS3 region
STORAGE_S3_LIKE_MAX_RETRIESruntime & workspacesMaximum retries on rate-limited S3 requests5

​
Azure Blob Storage for Workspaces

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_AZURE_BLOB_CONTAINERruntime & workspacesAzure Blob container namemodels
WORKSPACES_STORAGE_AZURE_BLOB_CONNECTION_STRINGruntime & workspacesAzure Blob connection string

​
GCS Storage for Workspaces

NameServiceDescriptionDefault Value
WORKSPACES_STORAGE_GCS_BUCKETruntime & workspacesGCS bucket name (required)
WORKSPACES_STORAGE_GCS_KEYFILEPATHruntime & workspacesService account configuration filepathGOOGLE_APPLICATION_CREDENTIALS environment variable
WORKSPACES_STORAGE_GCS_PROJECTIDruntime & workspacesGCS project id, only required when using apiKey
WORKSPACES_STORAGE_GCS_APIKEYruntime & workspacesApi key
STORAGE_GCS_MAX_RETRIESruntime & workspacesMaximum retries on rate-limited GCS requests5
If WORKSPACES_STORAGE_GCS_KEYFILEPATH or GOOGLE_APPLICATION_CREDENTIALS is provided, only WORKSPACES_STORAGE_GCS_BUCKET is required.

​
File Uploads Storage

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_TYPEworkspacesStorage driver type (FILESYSTEM, S3_LIKE, AZURE_BLOB or GCS)FILESYSTEM
UPLOADS_STORAGE_FILESYSTEM_DIRPATHworkspacesDirectory path for filesystem storage../../data/models/

​
S3-Compatible Storage for uploads

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_S3_LIKE_ACCESS_KEYworkspacesS3 access key
UPLOADS_STORAGE_S3_LIKE_SECRET_KEYworkspacesS3 secret key
UPLOADS_STORAGE_S3_LIKE_ENDPOINTworkspacesS3 endpoint
UPLOADS_STORAGE_S3_LIKE_BUCKET_NAMEworkspacesS3 bucket name
UPLOADS_PUBLIC_STORAGE_S3_LIKE_BUCKET_NAMEworkspacesS3 bucket name for public assets (required if the private uploads bucket does not support object level ACL)
UPLOADS_STORAGE_S3_LIKE_REGIONworkspacesS3 region
STORAGE_S3_LIKE_MAX_RETRIESworkspacesMaximum retries on rate-limited S3 requests5
UPLOADS_STORAGE_S3_LIKE_BASE_URLworkspacesBase download URL (if omitted, workspaces API will be used as proxy)

​
Azure Blob Storage for uploads

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_AZURE_BLOB_CONTAINERworkspacesAzure Blob container namemodels
UPLOADS_STORAGE_AZURE_BLOB_CONNECTION_STRINGworkspacesAzure Blob connection string
UPLOADS_STORAGE_AZURE_BLOB_BASE_URLworkspacesBase download URL (if omitted, workspaces API will be used as proxy)

​
GCS Storage for uploads

NameServiceDescriptionDefault Value
UPLOADS_STORAGE_GCS_BUCKETworkspacesGCS bucket name (required)
UPLOADS_PUBLIC_STORAGE_GCS_BUCKETworkspacesGCS bucket name for public assets (required if the private uploads bucket does not support object level ACL)
UPLOADS_STORAGE_GCS_KEYFILEPATHworkspacesService account configuration filepathGOOGLE_APPLICATION_CREDENTIALS environment variable
UPLOADS_STORAGE_GCS_PROJECTIDworkspacesGCS project id, only required when using apiKey
UPLOADS_STORAGE_GCS_APIKEYworkspacesApi key
STORAGE_GCS_MAX_RETRIESworkspacesMaximum retries on rate-limited GCS requests5
UPLOADS_STORAGE_GCS_BASE_URLworkspacesBase download URL (if omitted, workspaces API will be used as proxy)
If UPLOADS_STORAGE_GCS_KEYFILEPATH or GOOGLE_APPLICATION_CREDENTIALS is provided, only UPLOADS_STORAGE_GCS_BUCKET is required. Notes on uploads bucket: By default, the driver stores all uploads inside the same bucket for both public and private files. This bucket must allow public access and enable object-level ACLs, letting the driver selectively set objects as public or private. If these options are restricted in your environment, you can configure two separate buckets for public/private objects:
  1. Both buckets can maintain default settings (which prohibit public access and disable object-level ACLs)
  2. The public bucket could be served through a CDN allowed to access all objects (or any more restrictive pattern you prefer)
In this setup, UPLOADS_STORAGE_S3_* variables configure the private bucket, while UPLOADS_PUBLIC_STORAGE_S3_* variables configure the “public” bucket (i.e dedicated to public assets, but not necessarily public itself). You can provide separate credentials for the public bucket or simply set these two variables to use the same credentials: 
UPLOADS_PUBLIC_STORAGE_S3_LIKE_BUCKET_NAME="your public uploads bucket name"
UPLOADS_PUBLIC_STORAGE_S3_LIKE_BASE_URL="your OPTIONAL CDN public base URL"
Equivalent variables exist for GCS : 
UPLOADS_PUBLIC_STORAGE_GCS_BUCKET="your public uploads bucket name"
UPLOADS_PUBLIC_STORAGE_GCS_BASE_URL="your OPTIONAL CDN public base URL"
To avoid public buckets / CDN, you can force all file download requests to go through the Prisme.ai API by not providing the UPLOADS_STORAGE_*_BASE_URL environment variable.

​
Authentication & Security

​
OIDC Configuration

NameServiceDescriptionDefault Value
OIDC_PROVIDER_URLapi-gateway, pages, console, runtimeOIDC Authorization public server URL (rarely needs changing)API_URL without base path
OIDC_INTERNAL_PROVIDER_URLapi-gatewayOIDC Authorization internal server URL (rarely needs changing)By precedence: INTERNAL_API_URL, OIDC_PROVIDER_URL, or API_URL
OIDC_STUDIO_CLIENT_IDapi-gateway, consoleStudio OIDC client IDlocal-client-id
OIDC_STUDIO_CLIENT_SECRETapi-gatewayStudio OIDC client secret (known only by api-gateway)local-client-id
OIDC_CLIENT_REGISTRATION_TOKENapi-gatewayAccess token required for OIDC clients registration APIlocal-client-id
OIDC_WELL_KNOWN_URLapi-gatewayOIDC provider configuration discovery URL (only for external providers)
JWKS_URLapi-gatewayEndpoint for retrieving JWKS as part of the JWKS strategyOIDC_INTERNAL_PROVIDER_URL/oidc/jwks

​
Session & Token Configuration

NameServiceDescriptionDefault Value
SESSION_COOKIES_MAX_AGEapi-gatewayAuth server session cookies expiration (in seconds)2592000 (1 month)
ACCESS_TOKENS_MAX_AGEapi-gatewaySession expiration for both anonymous & authenticated sessions (in seconds)2592000 (1 month)
SESSION_COOKIES_SIGN_SECRETapi-gatewaySession cookies signing secret
SOCKETIO_COOKIE_MAX_AGEeventsSocket.io cookie maxAgeDefault from ‘cookie’ NodeJS module

​
Security Settings

NameServiceDescriptionDefault Value
CORS_ADDITIONAL_ALLOWED_ORIGINSapi-gatewayAdditional allowed CORS origins (beyond STUDIO_URL, PAGES_HOST, and workspace custom domains)
CSP_HEADERconsole, pagesContent Security Policy header for frontend services (if undefined, no CSP header is returned)
PASSWORD_VALIDATION_REGEXPapi-gatewayPassword validation regular expression.{8,32}
ACCOUNT_VALIDATION_METHODapi-gatewayAccount validation method on signup: “auto”, “email”, or “manual”email

​
Service-Specific Configuration

​
API Gateway

NameServiceDescriptionDefault Value
PORTapi-gatewayListening port number3001
GATEWAY_CONFIG_PATHapi-gatewayPath to gateway.config.yml../../gateway.config.yml
AUTH_PROVIDERS_CONFIGapi-gatewayPath to authProviders.config.yml../../authProviders.config.yml
INTERNAL_API_KEYapi-gateway, workspacesAPI key for internal services to access events /sys/cleanup API
WORKSPACES_API_URLapi-gatewayprismeai-workspaces internal URLhttp://workspaces:3002
EVENTS_API_URLapi-gatewayprismeai-events internal URLhttp://events:3004
RUNTIME_API_URLapi-gatewayprismeai-runtime internal URLhttp://runtime:3003
X_FORWARDED_HEADERSapi-gatewayAdd X-Forwarded-* headers on proxied requestsyes
SUPER_ADMIN_EMAILSapi-gatewayComma-separated list of user emails with access to all workspaces (e.g., “admin@example.com,user@company.com”)None
REQUEST_MAX_SIZEapi-gatewayMaximum request body size (format from bodyParser.json)1mb
EMAIL_DRIVERapi-gatewayEmail driver to use. (“smtp”, “mailgun”)mailgun
EMAIL_FROMapi-gatewayEmail address to use as “from” when sending emails"Prisme.ai" <no-reply@prisme.ai>
SMTP_HOSTapi-gatewayHostname or IP address of your SMTP server. (example: smtp.gmail.com)
SMTP_PORTapi-gatewayPort to connect to587
SMTP_USERapi-gatewayUser authentication
SMTP_PASSapi-gatewayUser’s password
SMTP_SECUREapi-gatewayIf true, the connection will use TLS immediately (recommended for port 465).false

​
Console

NameServiceDescriptionDefault Value
PORTconsoleListening port number3000
WORKSPACE_OPS_MANAGERconsole, pagePublic base url towards AI Governance workspace webhooks for automatically deducing below endpoints (customization, suggestions, products, …). Example: https://<API_URL>/v2/workspaces/{AIG_WORKSPACE_ID}/webhooks/
CUSTOMIZATION_ENDPOINTconsole, pagePublic url for /customization webhook (retrieves platform theme settings)$WORKSPACE_OPS_MANAGER/customization
TRACKING_WEBHOOKconsole, pageurl towards /tracking webhook (tracks builder activity)$WORKSPACE_OPS_MANAGER/tracking
SUGGESTIONS_ENDPOINTconsole, pageurl towards /suggestions webhook (retrieves suggestions on builder left menu)$WORKSPACE_OPS_MANAGER/suggestions
PRODUCTS_ENDPOINTconsole, pageurl towards /products webhook (retrieves products on left menu)$WORKSPACE_OPS_MANAGER/products
TRANSLATIONS_OVERRIDEconsole, pageurl towards /translations webhook (retrieves platform custom translations)$WORKSPACE_OPS_MANAGER/translations
WEBSOCKETS_DEFAULT_TRANSPORTSconsole, pagesDefault Socket.io transport methodspolling,websocket
None of *_ENDPOINT, *_WEBHOOK or *_OVERRIDE should be configured if the generic WORKSPACE_OPS_MANAGER environment variable is set (recommended). In helm, it can be tuned from prismeai-console.workspace_ops_manager and prismeai-pages.workspace_ops_manager environment variables.

​
Events Service

NameServiceDescriptionDefault Value
PORTeventsListening port number3004
EVENTS_BUFFER_FLUSH_ATeventsPersist events in data lake after this many events128
EVENTS_BUFFER_HIGH_WATERMARKeventsStop listening for new events when this many are waiting to be persisted256
EVENTS_BUFFER_FLUSH_EVERYeventsPersist events every N milliseconds, even if EVENTS_BUFFER_FLUSH_AT not reached5000
EVENTS_RETENTION_DAYSeventsDays events are kept in data lake before removal180
EVENTS_CLEANUP_WORKSPACE_INACTIVITY_DAYSeventsDelete workspace events if inactive for more than N days & with fewer than EVENTS_CLEANUP_WORKSPACE_MAX_EVENTS15
EVENTS_CLEANUP_WORKSPACE_MAX_EVENTSeventsDelete workspace events if inactive for more than EVENTS_CLEANUP_WORKSPACE_INACTIVITY_DAYS & with fewer than N events100
EVENTS_SCHEDULED_DELETION_DAYSeventsDays events are kept in data lake after workspace deletion (min_age parameter for the policy-events-deletion-scheduled ILM policy)90
ELASTIC_SEARCH_TIMEOUTeventsBest effort timeout for search requests : https://www.elastic.co/docs/solutions/search/the-search-api#search-timeout20000ms
EVENTS_CLEANUP_AUTOMATION_EXECUTED_EXPIRATIONeventsExpiration period enforced by /cleanup API for payload & output fields of runtime.automations.executed events. Can also be tuned from Helm prismeai-events.events.automationExecutedExpiration value14d

​
Runtime Service

NameServiceDescriptionDefault Value
PORTruntimeListening port number3003
MAXIMUM_SUCCESSIVE_CALLSruntimeMaximum automation executions for the same correlation ID20
CONTEXT_RUN_EXPIRE_TIMEruntimeRun context expiration time in seconds60
CONTEXT_UNAUTHENTICATED_SESSION_EXPIRE_TIMEruntimeSession context expiration time in seconds for unauthenticated sessions3600 (1 hour)
ADDITIONALGLOBAL_VARS*runtimeAdditional variables available from global context (e.g., ADDITIONAL_GLOBAL_VARS_apiUrl becomes {{global.apiUrl}})None
WORKSPACECONFIG{{workspaceSlug}}_{{variableName}}runtimeVariables available for specific workspacesNone
APPCONFIG{{appSlug}}_{{variableName}}runtimeVariables available for specific appsNone
FETCH_FORBIDDEN_HOSTSruntimeComma-separated list of forbidden hostnames in fetch instruction
FETCH_MAX_RETRIESruntimeMaximum fetch retries3
FETCH_RETRY_CODESruntimeError codes that trigger fetch retriesECONNRESET,UND_ERR_SOCKET,EPIPE,EHOSTUNREACH,ENETUNREACH
FETCH_RETRY_STATUSruntimeResponse status codes that trigger fetch retries429,503,502
RUNNER_MAX_THREADSruntimeNumber of worker_threads per runtime instance1
CONTEXT_SOCKET_MAX_SIZEruntimeMaximum size in bytes of socket context (this limit only emits error but does not throw, for now100000
CONTEXT_GLOBAL_MAX_SIZEruntimeMaximum size in bytes of global context (this limit only emits error but does not throw, for now500000
CONTEXT_RUN_MAX_SIZEruntimeMaximum size in bytes of run context (this limit only emits error but does not throw, for now500000
CONTEXT_USER_MAX_SIZEruntimeMaximum size in bytes of user context (this limit only emits error but does not throw, for now100000
CONTEXT_SESSION_MAX_SIZEruntimeMaximum size in bytes of session context (this limit only emits error but does not throw, for now1000000
CONTEXT_LOCAL_MAX_SIZEruntimeMaximum size in bytes of local context (this limit only emits error but does not throw, for now50000000
CONTEXT_CONFIG_MAX_SIZEruntimeMaximum size in bytes of config context (this limit only emits error but does not throw, for now100000

​
Workspaces Service

NameServiceDescriptionDefault Value
PORTworkspacesListening port number3002
UPLOADS_ALLOWED_MIMETYPESworkspacesComma-separated list of allowed upload MIME typesimage/,text/,video/,audio/,application/*
UPLOADS_FORBIDDEN_MIMETYPESworkspacesComma-separated list of forbidden upload MIME types (no wildcards)
UPLOADS_DEFAULT_VISIBILITYworkspacesDefault upload visibility if not specified in API requestpublic
UPLOADS_MAX_SIZEworkspaces, api-gateway, runtimeMaximum upload size in bytes10000000 (10MB)
IMPORT_BATCH_SIZEworkspacesMaximum parallel save requests during imports50

​
Platform Repositories

Platform repositories are shared repositories automatically available to all workspaces for versioning (push/pull). They are configured entirely through environment variables and require no per-workspace setup. Each workspace’s files are stored in a subdirectory named after the workspace slug within the repository. This allows a single repository to serve as a centralized versioning backend for every workspace on the platform. Multiple platform repositories can be configured by using the following naming convention: 
WORKSPACES_STORAGE_GIT_PLATFORM_{repoId}_{FIELD}
Where {repoId} is a unique identifier for the repository (e.g., prismeai, backup) and {FIELD} is one of the supported fields listed below.
Field suffixDescriptionDefault Value
TYPERepository type: git (remote Git repository) or filesystem (local directory)git
URLGit repository URL (required for git type — the repository is only enabled if this is set)
NAMEDisplay name shown in the UI{repoId}
BRANCHGit branch to use (only for git type)main
MODEAccess mode: read-write or read-onlyread-write
DIRPATHFor git type: base directory path inside the repository. Each workspace’s files are stored under {dirpath}/{workspaceSlug}. If omitted, workspace files are stored directly under {workspaceSlug} at the repository root. For filesystem type: required absolute path to the local directory containing workspace subdirectories.
AUTH_USERUsername for HTTPS authentication (only for git type)
AUTH_PASSWORDPassword or personal access token (PAT) for HTTPS authentication (only for git type)
AUTH_SSHKEYSSH private key content for SSH authentication (only for git type)
The filesystem type is reserved for platform repositories and cannot be used in workspace-level repository configurations.
Example — single platform Git repository: 
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_URL=https://github.com/myorg/workspaces.git
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_NAME=Platform Repository
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_BRANCH=main
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_AUTH_USER=your-user
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_AUTH_PASSWORD=github_pat_xxxxxxx
Example — filesystem platform repository (like the one embedded in prismeai-workspaces Docker image): 
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_TYPE=filesystem
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_NAME=Built-in Workspaces
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_DIRPATH=/www/platform-workspaces
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_MODE=read-only
With this configuration, the platform expects workspace directories directly inside /www/platform-workspaces/ (e.g., /www/platform-workspaces/ai-knowledge/, etc.). Example — with a custom directory path (Git): 
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_URL=https://github.com/myorg/monorepo.git
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_NAME=Platform Repository
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_DIRPATH=workspaces
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_AUTH_USER=your-user
WORKSPACES_STORAGE_GIT_PLATFORM_prismeai_AUTH_PASSWORD=github_pat_xxxxxxx
With this configuration, a workspace with slug myapp would be stored under workspaces/myapp/ in the repository. Example — multiple platform repositories: 
# Primary read-write Git repository
WORKSPACES_STORAGE_GIT_PLATFORM_primary_URL=https://github.com/myorg/workspaces.git
WORKSPACES_STORAGE_GIT_PLATFORM_primary_NAME=Main Repository
WORKSPACES_STORAGE_GIT_PLATFORM_primary_AUTH_USER=x-access-token
WORKSPACES_STORAGE_GIT_PLATFORM_primary_AUTH_PASSWORD=ghp_xxxxxxxxxxxx

# Read-only backup Git repository
WORKSPACES_STORAGE_GIT_PLATFORM_backup_URL=git@github.com:myorg/workspaces-backup.git
WORKSPACES_STORAGE_GIT_PLATFORM_backup_NAME=Backup (read-only)
WORKSPACES_STORAGE_GIT_PLATFORM_backup_MODE=read-only
WORKSPACES_STORAGE_GIT_PLATFORM_backup_AUTH_SSHKEY="-----BEGIN OPENSSH PRIVATE KEY-----\n..."

# Built-in filesystem repository (Docker image)
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_TYPE=filesystem
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_NAME=Built-in Workspaces
WORKSPACES_STORAGE_GIT_PLATFORM_builtin_DIRPATH=/www/platform-workspaces
Notes:
  • Platform repositories are returned in the platformRepositories field of the workspace API response — they do not include auth details, and are never persisted into the workspace configuration.
  • Authentication credentials are never exposed in API responses.
  • For GitHub HTTPS authentication, use your username as AUTH_USER and a personal access token (PAT) with read-write permissions on Contents as AUTH_PASSWORD.

​
Workspace Groups

Workspace groups define logical sets of workspaces that can be imported together via bulk import. Groups are configured through environment variables: 
WORKSPACES_GROUP_{groupName}_LABELS="label1,label2,..."
A workspace belongs to a group if at least one of its labels matches one of the group’s labels. When a workspace is pushed to a platform repository, the groups it belongs to are recorded in its .import.yml file.
NameServiceDescriptionDefault Value
WORKSPACES_GROUP_{groupName}_LABELSworkspacesComma-separated list of labels for the group. A workspace with any matching label is included in this group.
Example: 
# Core dependencies
WORKSPACES_GROUP_base1_LABELS=production:app:base1
WORKSPACES_GROUP_base2_LABELS=production:app:base2

# Core products
WORKSPACES_GROUP_extended_LABELS=production:app,production:product
These group names are then used in:
  • The bulk import API (groups body parameter): POST /v2/workspaces/platform/versions/latest/pull
  • The bulk push API (groups body parameter): POST /v2/workspaces/platform/versions
  • STARTUP_IMPORT_GROUPS to select which workspaces to import automatically on startup

​
Automatic Import at Startup

The workspaces service can automatically trigger a bulk import when it starts. This is useful for initial deployments and platform upgrades, ensuring that reference workspaces from a platform repository are always up to date.
NameServiceDescriptionDefault Value
STARTUP_IMPORT_GROUPSworkspacesComma-separated list of group names to import at startup. Each group is imported sequentially. If any group encounters errors, remaining groups are skipped. If empty, no auto-import is performed.
STARTUP_IMPORT_REPOSITORYworkspacesRepository ID (matching a configured platform repository) to import from at startup.
Example: 
# Import core workspaces from the built-in filesystem repository at startup
STARTUP_IMPORT_GROUPS=base1,base2,extended
STARTUP_IMPORT_REPOSITORY=builtin
At startup, the service:
  1. Ensures the platform workspace exists (creates it if needed)
  2. Waits for the platform to be ready (checks the /v2/readiness endpoint, with a 5-minute timeout)
  3. Imports each group sequentially using the bulk import mechanism, with a 30s pause between each group
  4. Skips workspaces already at the correct version (based on .import.yml version matching)
When multiple replicas start simultaneously (e.g., during a rollout), only one replica acquires the write lock on the Platform workspace and performs the import. Other replicas skip the import entirely.

​
Performance & Limits

​
Rate Limiting

NameServiceDescriptionDefault Value
DISABLE_RATE_LIMITapi-gatewaySet it to true in order to disable all rate limits
RATE_LIMIT_SIGNUPapi-gatewayMaximum signups per IP per minute1
RATE_LIMIT_ANONYMOUS_LOGINapi-gatewayMaximum anonymous logins per IP per minute10
RATE_LIMIT_PRISMEAI_LOGINapi-gatewayMaximum email/password login attempts per email per minute5
RATE_LIMIT_PASSWORD_RESETapi-gatewayMaximum password reset requests per IP per minute1

​
Integration & APIs

NameServiceDescriptionDefault Value
OPENAPI_FILEPATHAll servicesPath to Swagger file for requests & events validation../specifications/swagger.yml

​
Examples

​
S3 Storage Configuration

# Configure workspace storage with S3
WORKSPACES_STORAGE_TYPE=S3_LIKE
WORKSPACES_STORAGE_S3_LIKE_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
WORKSPACES_STORAGE_S3_LIKE_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
WORKSPACES_STORAGE_S3_LIKE_BUCKET_NAME=prisme-workspaces
WORKSPACES_STORAGE_S3_LIKE_REGION=us-west-1
WORKSPACES_STORAGE_S3_LIKE_BASE_URL=https://prisme-workspaces.s3.us-west-1.amazonaws.com

# Configure uploads with the same credentials but different bucket
UPLOADS_STORAGE_TYPE=S3_LIKE
UPLOADS_STORAGE_S3_LIKE_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
UPLOADS_STORAGE_S3_LIKE_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
UPLOADS_STORAGE_S3_LIKE_BUCKET_NAME=prisme-uploads
UPLOADS_STORAGE_S3_LIKE_REGION=us-west-1
UPLOADS_STORAGE_S3_LIKE_BASE_URL=https://prisme-uploads.s3.us-west-1.amazonaws.com

​
Authentication and Rate Limiting for Production

# Set a strong password policy
PASSWORD_VALIDATION_REGEXP= "YOUR_REGEX"

# Enable manual account validation
ACCOUNT_VALIDATION_METHOD=manual

# Configure super admins
SUPER_ADMIN_EMAILS=admin@company.com,security@company.com

# Set stricter rate limits
RATE_LIMIT_SIGNUP=1
RATE_LIMIT_ANONYMOUS_LOGIN=5
RATE_LIMIT_PRISMEAI_LOGIN=3
RATE_LIMIT_PASSWORD_RESET=1