---
title: Configuration settings
summary: Configuration keys consumed by this library, retrieval methods, and runtime dependencies.
status: draft
owner: andmil
last_reviewed: 2026-09-15
library: SAIF.Web.API
reference_type: package
---

# Configuration settings

`SAIF.Web.API` is a redistributable NuGet class library, not a deployable host — it **consumes** configuration but does not supply it. It ships no `Web.config` and no `<appSettings>` of its own; the only config file in the project (`src/SAIF.Web.API/app.config`) contains solely an assembly binding redirect and a `<startup>` element. Every key below is read from the ambient application's configuration at runtime; no supplying application or its configuration file exists in this repository, so which application (if any) provisions these keys cannot be observed here.* Three unique setting keys are consumed directly: two via `IEnvironmentService.GetConfigSetting` and one via `ConfigurationManager.AppSettings`.

## Configuration retrieval methods

| Method | Class / Interface | Namespace | Usage pattern |
| --- | --- | --- | --- |
| `GetConfigSetting(string key)` | `IEnvironmentService` | `SAIF.Core.Services` (external — `SAIF.Framework.Core` NuGet) | Resolved per-request from the Web API dependency scope (`request.GetDependencyScope().GetService(typeof(IEnvironmentService))`), then passed into `ApiResponseHandler.BuildMessageURL(IEnvironmentService)`, which reads two plain-text keys. Null-guarded: if the service is not registered, hard-coded defaults are used instead. |
| `ConfigurationManager.AppSettings.AllKeys` / `ConfigurationManager.AppSettings[key]` | `System.Configuration.ConfigurationManager` | `System.Configuration` | Direct read of the ambient application's `<appSettings>` section, bypassing `IEnvironmentService`; no such application or `<appSettings>` section exists in this repository.* Key existence is first probed via `AllKeys.FirstOrDefault(x => x == key)`, then the value is read by indexer and parsed with `bool.TryParse`. |

**Retrieval methods explicitly not present in this library** (verified by absence across all `.cs` files in `src/SAIF.Web.API/`): `GetSecureConfigSetting`, `DbConnectionManager`/`GetOracleConnectionString`/`GetSqlConnectionString`/`EnvironmentConfigKeys`, `ApplicationSettingsBase`/`Settings.Default`, `<connectionStrings>`, custom `<configSections>`, `appsettings.json`/`IConfiguration`/`IOptions<T>` (this is .NET Framework 4.6.2).

## Environment API settings

Settings retrieved via `IEnvironmentService` (centralized environment configuration service). Both keys are read on **every** response that passes through `ApiResponseHandler` — there is no caching.

| Setting key | Method | Data type | Purpose | Consuming class | Source |
| --- | --- | --- | --- | --- | --- |
| `splunksearch` | `GetConfigSetting` | string (URL) | Base Splunk search-endpoint URL used to build the `MessageIDUrl` deep-link. Falls back to `https://splunk/en-US/app/search/search` when null/empty (see [BR-WEBAPI-006](business-rules.md#br-webapi-006-splunk-lookup-url-always-produced)). | `ApiResponseHandler.BuildMessageURL` | `src/SAIF.Web.API/ApiResponseHandler.cs` |
| `splunk.error.query` | `GetConfigSetting` | string (Splunk search expression) | Splunk search query fragment (index/sourcetype/time window) appended to the Splunk URL. Only substituted with the hard-coded fallback `search index=db_mssql sourcetype=Businessonline.error earliest=-1month` when `splunksearch` is also blank — a configured `splunksearch` with a blank `splunk.error.query` yields an empty query fragment.* | `ApiResponseHandler.BuildMessageURL` | `src/SAIF.Web.API/ApiResponseHandler.cs` |

**Non-configuration `IEnvironmentService` members consumed** (listed for completeness — hosting-context properties, not config keys): `.User.Identity.Name` (`SaifAuthorizeAttribute.IsAuthorized`) and `.UserId()` (`SaifAuthorizeAttribute.HandleUnauthorizedRequest`, `GetContext`).

## AppSettings (Web.config)

Settings retrieved via `ConfigurationManager.AppSettings`. `src/SAIF.Web.API/app.config` declares **no `<appSettings>` section** of its own; the library reads this key from whatever `<appSettings>` section is present in the ambient application's configuration at runtime — no such application or configuration file exists in this repository.*

| Setting key | Default value | Purpose | Consuming class | Source |
| --- | --- | --- | --- | --- |
| `RequireSSLForLocal` | Not declared in this repository | Controls whether HTTPS is required for **local** requests only. If the key is absent, `requireSSL` is forced to `false` (local requests skip HTTPS). If present, `bool.TryParse(value, out requireSSL)` is applied directly against the field; because `bool.TryParse` always assigns its `out` parameter, a value that fails to parse also results in `requireSSL` being set to `false` (local requests skip HTTPS), the same as when the key is absent. Non-local requests never consult this key and always require HTTPS. | `RequireSSLAttribute.RequiresSSL` | `src/SAIF.Web.API/RequireSSLAttribute.cs` |

## Database connection configuration

**Not applicable — no database configuration detected.** `SAIF.Web.API` performs no database access and declares no connection configuration; no `DbConnectionManager`, `GetOracleConnectionString`, `GetSqlConnectionString`, `<connectionStrings>`, or ORM references exist anywhere in the library. The hard-coded Splunk fallback query string contains the literal token `index=db_mssql`, which is a Splunk index name inside a search expression, not a database connection.

## Secure settings

**Not applicable — no secure/encrypted configuration detected.** Verified by absence: no `GetSecureConfigSetting`, protected-configuration provider, or credential retrieval of any kind. Both configuration keys consumed via `IEnvironmentService` are plain-text.

## Transitive configuration (from dependencies)

`SAIF.Web.API` declares no `<ProjectReference>`s, so no same-repo project's configuration is transitive to it. The only SAIF-internal package dependency is `SAIF.Framework.Core`. Its runtime configuration requirements could not be determined from this repository or the Legends CLI index: the only indexed library matching the name `SAIF.Framework.Core`/`saif.framework.core` is a different library (the `IT.BOF.Framework` BOF-suite package of the same name), not the Framework4 `SAIF.Framework.Core` 2.0.x package this library depends on — every Legends CLI query scoped to the actual package returned no matching content.**

`Grpc.Core` and `Microsoft.AspNet.WebApi.WebHost` are third-party packages with no SAIF-specific configuration keys associated with them.

## Configuration dependencies

| Dependency | Type | Required at | Impact if missing |
| --- | --- | --- | --- |
| `IEnvironmentService` registration | Service (hosting app's `IDependencyResolver`) | Request time | `ApiResponseHandler.BuildMessageURL` degrades gracefully to hard-coded Splunk defaults; `SaifAuthorizeAttribute.IsAuthorized` throws `MissingDependencyException("IEnvironmentService")`. |
| `ISecurityApiClient` registration | Service (hosting app's `IDependencyResolver`) | Request time | `SaifAuthorizeAttribute.IsAuthorized` throws `MissingDependencyException("ISecurityApiClient")` — fails closed rather than allowing or silently denying. |
| `splunksearch` / `splunk.error.query` | Environment API setting | Request time | Hard-coded Splunk URL/query defaults are used instead (graceful). |
| `RequireSSLForLocal` | AppSettings key | Request time (local requests only) | Absent key: local requests bypass HTTPS enforcement. Deployed (non-local) requests are unaffected. |

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- `src/SAIF.Web.API/ApiResponseHandler.cs`
- `src/SAIF.Web.API/RequireSSLAttribute.cs`
- `src/SAIF.Web.API/SaifAuthorizeAttribute.cs`
- `src/SAIF.Web.API/app.config`
- `src/SAIF.Web.API/SAIF.Web.API.csproj`
- `src/SAIF.Web.API/NuGet.config`
- `src/nuget.config`