| LOADER_PATH | Yes | Directory Spring Boot's PropertiesLauncher scans for extension jars; already set to /app/adapters by the image, but startup still fails with MISSING_SOURCE_ADAPTER until you bind-mount a reviewed DataSourceAdapter/IdentityResolver jar there (see the -v arguments above) |
| DATAPRISM_SECURITY_JWT_ISSUER | Yes | OAuth2/OIDC issuer that mints the caller's JWT; required for every protected deployment |
| DATAPRISM_SECURITY_JWT_AUDIENCE | Yes | Expected JWT audience claim for this deployment; required for every protected deployment |
| DATAPRISM_SECURITY_JWT_JWK_SET_URI | Yes | HTTPS JWKS location used to verify caller JWTs; exactly one of this or DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI is required, never both |
| DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI | No | Alternative HTTPS OIDC issuer-discovery location; set this instead of DATAPRISM_SECURITY_JWT_JWK_SET_URI, never both |
| DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL | Yes | JWT claim name that carries the caller's principal identifier; required, must differ from the roles and investigation claims |
| DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES | Yes | JWT claim name that carries the caller's roles; required, must differ from the principal and investigation claims |
| DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION | Yes | JWT claim name that carries the trusted investigation/case identifier; required, must differ from the principal and roles claims |
| DATAPRISM_SECURITY_POLICY_PURPOSES | Yes | Comma-separated list of permitted purposes; at least one is required |
| DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR | Yes | Example only — declare DATAPRISM_SECURITYPOLICY_ROLES_<ROLE> per operator-defined role (no underscore between SECURITY and POLICY: Spring Boot's map-key enumeration under a hyphenated dataprism.security-policy.roles.<role> segment only binds the concatenated prefix, verified by binding this property directly against Spring Boot 4.1.1), a comma-separated list of known MCP tool capabilities; at least one role-to-capability mapping is required |
| DATAPRISM_PRIVACY_PROFILE | Yes | Name of the reviewed privacy profile implementation to apply; required |
| DATAPRISM_PRIVACY_SCOPE_LIFETIME | Yes | Positive duration (e.g. 8h) a privacy scope's synthetic identities remain valid; required |
| DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID | Yes | Identifier of the pinned HMAC key used to derive synthetic identities; required |
| DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE | Yes | Name of the environment variable holding the HMAC key material; exactly one of this or DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE is required, never both, and never a literal key value |
| DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE | No | Reference to an approved secret provider holding the HMAC key material; set this instead of DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE, never both |
| DATAPRISM_AUDIT_SINK | Yes | Audit sink implementation: one of approved-sink, slf4j, hash-chained; required, never downgraded to no-op |
| DATAPRISM_AUDIT_WRITER_ID | Yes | Writer/instance identity recorded on every audit entry; required |
| DATAPRISM_AUDIT_FILE_PATH | No | Path to the durable, hash-chained audit log; required when DATAPRISM_AUDIT_SINK=hash-chained, refused as MISSING_AUDIT_FILE_PATH if absent for that sink, ignored otherwise |
| DATAPRISM_METRICS_SINK | Yes | Metrics sink binding, currently only micrometer; required in production, never the framework no-op |
| DATAPRISM_HAZELCAST_TOPOLOGY | Yes | Cluster read-budget topology: embedded (shared across members that have joined one cluster; set cluster name and join mode) or single-node (enforced per process); required, never defaulted |
| DATAPRISM_HAZELCAST_CLUSTERNAME | No | Hazelcast cluster name; required when DATAPRISM_HAZELCAST_TOPOLOGY=embedded, never dev, refused if set with single-node |
| DATAPRISM_HAZELCAST_JOIN_MODE | No | How cluster members find each other: tcp-ip, kubernetes or none; required when DATAPRISM_HAZELCAST_TOPOLOGY=embedded (none is an explicit single member bound to 127.0.0.1), refused if set with single-node |
| DATAPRISM_HAZELCAST_JOIN_MEMBERS | No | Comma-separated member addresses (host or host:port); required when DATAPRISM_HAZELCAST_JOIN_MODE=tcp-ip, otherwise unused |
| DATAPRISM_HAZELCAST_MEMBER_PORT | No | Hazelcast member port, default 5701, never auto-incremented; must differ from the server, management and operator ports. Member traffic is unencrypted, so keep it on a private network. Optional |
| DATAPRISM_OPERATOR_ENABLED | No | Enables the operator surface; optional, off by default |
| DATAPRISM_OPERATOR_PORT | No | Port of the operator listener; required when DATAPRISM_OPERATOR_ENABLED=true, must differ from the server, management (OPERATOR_PORT_SHARED otherwise) and member ports, and has no fixed default (publish it explicitly) |
| DATAPRISM_OPERATOR_REQUIREDAUDIENCE | No | JWT audience an operator token must carry; required when DATAPRISM_OPERATOR_ENABLED=true |
| DATAPRISM_OPERATOR_REQUIREDSCOPE | No | JWT scope an operator token must carry; required when DATAPRISM_OPERATOR_ENABLED=true |
| DATAPRISM_SOURCES_CUSTOMER_BASE_URL | Yes | Example only — declare DATAPRISM_SOURCES_<NAME>_BASE_URL (HTTPS) per configured source; at least one source, each with its own reviewed DataSourceAdapter bean, is required |
| DATAPRISM_SOURCES_CUSTOMER_TIMEOUT | Yes | Example only — declare DATAPRISM_SOURCES_<NAME>_TIMEOUT (positive duration) per configured source; required alongside its base URL |