--- title: Configuration summary: Configuration surface of DBConnectionAPI by key name only, including the run-time resolution chain for database connections. status: draft owner: Architecture last_reviewed: 2026-10-09 --- # Configuration This page lists configuration key names only. No credential, host, URL or secret value is reproduced here. ## appsettings files | Key | Defined in | Read by local code | Notes | | --- | --- | --- | --- | | `Logging:LogLevel:Default` | `appsettings.json`, `appsettings.Development.json` | No (framework logging) | Default log level | | `Logging:LogLevel:System` | `appsettings.Development.json` | No (framework logging) | Development override | | `Logging:LogLevel:Microsoft` | `appsettings.Development.json` | No (framework logging) | Development override | | `AllowedHosts` | `appsettings.json` | No (framework host filtering) | Host filter | | `AppSettings:ApplicationHost` | `appsettings.json` | No | Takes effect only on developer machines† | | `AppSettings:ApplicationName` | `appsettings.json` | No | Not read by the package† | No `ConnectionStrings` section exists in either file. ## Environment API settings Environment API group: `dbconnectionapi` (`EnvironmentKeys.EnvAPISection`). | Setting | Kind | Key or pattern | Read by | | --- | --- | --- | --- | | SQL Server template | Template | `sqlconnectiontemplate` | `ConnectionManager` through `GetSettingValue` | | PostgreSQL template | Template | `postgresqlconnectiontemplate` | `ConnectionManager` through `GetSettingValue` | | Oracle template | Template | `oraconnectiontemplate` | `ConnectionManager` through `GetSettingValue` | | Oracle credential | Secure | `ora__` | `HasSetting` then `GetSecureSetting` | | SQL Server credential | Secure | `sql___` | `HasSetting` then `GetSecureSetting` | | PostgreSQL credential | Secure | `postgres__` | `HasSetting` then `GetSecureSetting` | Secure keys are lower-cased ([BR-DBC-005](business-rules.md#br-dbc-005-secure-setting-keys-are-lower-cased)) and decrypted with the web-application system hash. The Admin operations read the secure key without the `HasSetting` guard ([BR-DBC-023](business-rules.md#br-dbc-023-admin-inspection-discloses-raw-credentials)). `IEnvironmentClient.TrackName` is read only for error-message text. ## Options binding None. No `IOptions` class is bound. An inline `UnitOfWorkOptions` is built for each connectivity probe (Oracle unit name `temp`, SQL Server unit name `temp2`). ## Runtime-resolved database connections The API declares no connection string. Connections are resolved per request: 1. The caller names the database type, instance, user and (for SQL Server and PostgreSQL) server 2. `ConnectionManager` builds the cache key and the secure-setting key ([BR-DBC-002](business-rules.md#br-dbc-002-cache-key-format)) 3. It reads the template for the database type from the Environment API group `dbconnectionapi` on every request, before the cache check, and substitutes the server and instance placeholders ([BR-DBC-007](business-rules.md#br-dbc-007-templates-come-from-the-environment-api-group)) 4. It checks the in-memory cache ([BR-DBC-001](business-rules.md#br-dbc-001-serve-from-the-cache-when-the-key-is-present)). A hit bypasses secure-setting retrieval, credential splitting and composition, probing, and cache insertion (steps 5 to 8), then returns the cached value; the template read in step 3 already happened before this check 5. On a miss it reads and decrypts the secure credential whose key follows the pattern above ([BR-DBC-009](business-rules.md#br-dbc-009-missing-secure-setting-returns-404)) 6. It substitutes the user and password placeholders ([BR-DBC-008](business-rules.md#br-dbc-008-credentials-are-substituted-into-the-template)) 7. For Oracle and SQL Server it probes the result through `IUnitOfWorkFactory` ([BR-DBC-018](business-rules.md#br-dbc-018-probe-validity-definition)); PostgreSQL is not probed 8. It caches the string for the process lifetime and returns it ([BR-DBC-004](business-rules.md#br-dbc-004-cache-entries-never-expire)) The API consumes no connection of its own. Each distinct probed string leaves one session factory in memory*. See [Data model](data-model.md) for the probes. ## Hosting configuration | Item | Finding | | --- | --- | | Hosting model | IIS in-process (set in the project file) | | `web.config` environment variables | `ENVIRONMENT`, `COMPLUS_ForceENC`, `ASPNETCORE_ENVIRONMENT` (set to Development), `ASPNETCORE_HTTPS_PORT`, `ASPNETCORE_DETAILEDERRORS` | | `web.config` handler | `processPath` names the Visual Studio launcher; the hosting model is not set on the handler | | `launchSettings.json` | Not present | | Variables read by the base package† | `OTEL_EXPORTER_OTLP_ENDPOINT`, `EnvironmentApiUrl`, `APP_POOL_ID`, `AppSettings:EnvApiDeveloperSettingsOverride` | | Developer request tooling | `DBConnectionAPI.http` with `env/.env` and per-environment `env/.env*` files defining `DBConnectionAPI_HostAddress` and `DBConnectionAPI_Instance` | Whether publish transforms `web.config` is not determined from source**. See [Hosting pipeline](hosting-pipeline.md). ## Serialization configuration The JSON formatter is configured inside the opaque base startup**. The Connections actions return a string, which is probably plain text*, and the Admin actions return a JSON dictionary. ## Logging configuration `ISaifLogService` records an informational audit entry, an informational validation entry and an error entry per failed probe attempt. The log sink is not determined from source**. OpenTelemetry is enabled through `ConfigureOpenTelemetry` with owner `Architecture`. ## Environment variance | Setting | Dev | Test | Prod | | --- | --- | --- | --- | | Environment API template and secure values | Unknown** | Unknown** | Unknown** | No `environmentsettings/settings.yml` exists in the repository, so per-environment values are not determined from source**. ## Related documentation - [API index](index.md) - [Overview](overview.md) - [Architecture](architecture.md) - [Hosting pipeline](hosting-pipeline.md) - [Endpoints](endpoints.md) - [Authentication and authorization](authentication-authorization.md) - [Dependencies](dependencies.md) - [Operations and processes](operations-processes.md) - [Business rules](business-rules.md) - [Data model](data-model.md) - [Operational runbook](operational-runbook.md) - [Tech debt](tech-debt.md) > **Note:** Statements marked with `†` are derived from dependency library > documentation via the Legends CLI. Statements marked with `*` were inferred > from code structure or contextual evidence. Statements marked with `**` could > not be confirmed; treat as unknown until verified. ## Sources - DBConnectionAPI/DBConnectionAPI/EnvironmentKeys.cs - DBConnectionAPI/DBConnectionAPI/Services/ConnectionManager.cs - DBConnectionAPI/DBConnectionAPI/Startup.cs - DBConnectionAPI/DBConnectionAPI/appsettings.json - DBConnectionAPI/DBConnectionAPI/appsettings.Development.json - DBConnectionAPI/DBConnectionAPI/web.config - DBConnectionAPI/DBConnectionAPI/DBConnectionAPI.http