For the complete documentation index, see llms.txt.
Skip to main content
Version: 8.10 (unreleased)

Property reference

As a Spring Boot application, the Orchestration Cluster supports standard Spring configuration methods.

The following configurations apply to all components within the Orchestration Cluster.

API​

camunda.api.long-polling​

PropertyDescriptionDefault value
camunda.api.long-polling.enabled

Enable long-polling for the Camunda gRPC API server.

true
camunda.api.long-polling.timeout

Set the timeout for long polling in milliseconds.

10000
camunda.api.long-polling.probe-timeout

Set the probe timeout for long polling in milliseconds.

10000
camunda.api.long-polling.min-empty-responses

Set the number of minimum empty responses. A minimum number of responses with jobCount of 0 infers that no jobs are available.

10s

API - gRPC​

camunda.api.grpc​

PropertyDescriptionDefault value
camunda.api.grpc.address

Set the address the gateway binds to.

0.0.0.0
camunda.api.grpc.port

Set the port the gateway binds to.

26500
camunda.api.grpc.min-keep-alive-interval

Set the minimum keep alive interval.

  • This setting specifies the minimum accepted interval between keep alive pings.
  • This value must be specified as a positive integer followed by 's' for seconds, 'm' for minutes or 'h' for hours.
30s
camunda.api.grpc.max-message-size

Set the maximum size of the incoming and outgoing messages (that is, commands and events).

4MB
camunda.api.grpc.management-threads

Set the number of threads the gateway will use to communicate with the broker cluster.

1

camunda.api.grpc.ssl​

PropertyDescriptionDefault value
camunda.api.grpc.ssl.enabled

Enable SSL (Secure Sockets Layer) authentication for the gateway.

false
camunda.api.grpc.ssl.certificate

Set the path to the certificate chain file.

Null
camunda.api.grpc.ssl.certificate-private-key

Set the path to the private key file location.

Null
camunda.api.grpc.ssl.key-store.file-path

Configure the keystore file containing both the certificate chain and the private key. Currently only supports PKCS12 format.

/path/to/keystore
camunda.api.grpc.ssl.key-store.password

Configure the keystore password.

Null

camunda.api.grpc.interceptors​

PropertyDescriptionDefault value
camunda.api.grpc.interceptors[]

This property is part of Camunda's gRPC interceptor system, which allows you to add custom processing logic to gRPC requests and responses.

The property is a list of interceptor configurations, each requiring an id, jar-path and class-name.

No entries
camunda.api.grpc.interceptors[].id

The unique identifier for a particular gRPC interceptor configuration.

Null
camunda.api.grpc.interceptors[].jar-path

The file path to a JAR file that contains a custom gRPC interceptor implementation.

Null
camunda.api.grpc.interceptors[].class-name

Set the fully qualified class name of a custom gRPC interceptor implementation that should be loaded and executed by the Camunda gRPC server.

Null

API - REST​

camunda.api.rest.filters​

PropertyDescriptionDefault value
camunda.api.rest.filters[]

This property is part of Camunda's REST filter system, which allows you to add filters to REST requests and responses.

The property is a list of filter configurations, each requiring an id, jar-path and class-name.

No entries
camunda.api.rest.filters[].id

The unique identifier for a particular REST filter configuration.

Null
camunda.api.rest.filters.jar-path

The file path to a JAR file that contains a custom REST filter implementation.

Null
camunda.api.rest.filters.class-name

Set the fully qualified class name of a custom REST filter implementation that should be loaded and executed by the Camunda REST server.

Null

camunda.api.rest.process-cache​

PropertyDescriptionDefault value
camunda.api.rest.process-cache.max-size

Set the maximum number of entries that can be stored in the REST API's process cache.

100
camunda.api.rest.process-cache.expiration-idle

Set the idle expiration time for entries in the REST API's process cache.

null

camunda.api.rest.executor​

PropertyDescriptionDefault value
camunda.api.rest.executor.core-pool-size-multiplier

Multiplier applied to the number of available processors to compute the executor's core pool size (minimum number of threads kept alive).

Effective value: corePoolSize = availableProcessors * corePoolSizeMultiplier.

Use a higher value if you have steady, continuous traffic and want to minimize cold-start latency. Keep it low to allow the pool to scale down when idle.

1
camunda.api.rest.executor.max-pool-size-multiplier

Multiplier applied to the number of available processors to compute the executor's maximum pool size (hard cap on threads).

Effective value: maxPoolSize = availableProcessors * maxPoolSizeMultiplier.

Must be >= corePoolSizeMultiplier.

Increase cautiously, as high values can cause oversubscription for CPU-bound workloads.

2
camunda.api.rest.executor.keep-alive

Time in seconds that threads above the core size may remain idle before being terminated.

Lower values reclaim resources faster after bursts. Higher values reduce thread creation/destruction churn if bursts are frequent.

60s
camunda.api.rest.executor.queue-capacity

Capacity of the executor's task queue. A small bounded queue (for example, 64) is recommended to handle short bursts while still allowing the pool to grow.

64

API - MCP​

camunda.mcp​

PropertyDescriptionDefault value
camunda.mcp.enabled

Enable the MCP server. When enabled, the Orchestration Cluster exposes a Streamable HTTP MCP server at /mcp/cluster.

false

Cluster​

camunda.cluster​

PropertyDescriptionDefault value
camunda.cluster.name

Set the name of the cluster.

zeebe-cluster
camunda.cluster.id

Set the cluster ID used to identify the cluster. It should be unique across clusters.

If not configured, the cluster ID will be set to a new random UUID.

camunda.cluster.network.host

The network host for internal cluster communication.

null
camunda.cluster.node-id

Specifies the unique id of this broker node in a cluster. The id should be between 0 and number of nodes in the cluster (exclusive).

0
camunda.cluster.partition-count

The number of partitions in the cluster.

1
camunda.cluster.replication-factor

The number of replicas for each partition in the cluster. The replication factor cannot be greater than the number of nodes in the cluster.

1
camunda.cluster.size

The number of nodes in the cluster.

1
camunda.cluster.compression-algorithm

Configure the compression algorithm for all messages sent between brokers, and between broker and gateway.

Available options are NONE, GZIP, and SNAPPY.

This can be useful when network latency is high (for example, across data centers), but may impact performance when latency is low.

NONE
camunda.cluster.gateway-id

Set the member ID of this gateway node in the cluster. Only relevant for standalone gateway deployments.

gateway
camunda.cluster.zone

The zone (region or availability zone) this broker belongs to. Used for multi-region deployments. When set, the partitioning scheme (see camunda.cluster.partitioning.scheme) must be set to ZONE_AWARE. If not set, the broker is considered to be in a single-zone setup.

Must be at most 63 characters, start with an alphanumeric character (no leading hyphen), and contain only alphanumeric characters and hyphens ([A-Za-z0-9-]).

camunda.cluster.global-listeners​

PropertyDescriptionDefault value
camunda.cluster.global-listeners.user-task[]

List of configuration entries for global user task listeners (see also Global user task listeners.)

No entries
camunda.cluster.global-listeners.user-task[].id

User-provided unique identifier for the listener. This identifier is used to interact with the global listener through API.

-
camunda.cluster.global-listeners.user-task[].event-types[]

List of user task event types that trigger the listener. Supported values are creating, assigning, updating, completing, and canceling. The shorthand all value is also available if the listener should react to all lifecycle events.

-
camunda.cluster.global-listeners.user-task[].type

The name of the job type. Used as a reference to specify which job workers request the respective task listener job. For example, order-items.

-
camunda.cluster.global-listeners.user-task[].retries

The number of retries for the user task listener job.

3
camunda.cluster.global-listeners.user-task[].after-non-global

Boolean flag indicating whether the listener should run after model-level listeners.

false
camunda.cluster.global-listeners.user-task[].priority

The priority of the listener. Higher priority listeners are executed before lower priority ones. It must be an integer between 0 and 100.

50

camunda.cluster.membership​

PropertyDescriptionDefault value
camunda.cluster.membership.broadcast-updates

Configure whether to broadcast member updates to all members.

If set to false, updates are gossiped among members.

If set to true, network traffic may increase but it can reduce the time to detect membership changes.

true
camunda.cluster.membership.broadcast-disputes

Configure whether to broadcast disputes to all members.

If set to true, network traffic may increase but it can reduce the time to detect membership changes.

true
camunda.cluster.membership.notify-suspect

Configure whether to notify a suspect node on state changes.

false
camunda.cluster.membership.probe-interval

Sets the interval at which to probe a random member.

1s
camunda.cluster.membership.probe-timeout

Sets the timeout for a probe response.

100ms
camunda.cluster.membership.suspect-probes

Sets the number of probes failed before declaring a member is suspect.

3
camunda.cluster.membership.failure-timeout

Sets the timeout after which a suspect member is declared dead.

10s
camunda.cluster.membership.sync-interval

Sets the interval at which this member synchronizes its membership information with a random member.

10s
camunda.cluster.membership.gossip-fanout

Sets the number of members to which membership updates are sent at each gossip interval.

2
camunda.cluster.membership.gossip-interval

Sets the interval at which the membership updates are sent to a random member.

250ms

camunda.cluster.metadata​

PropertyDescriptionDefault value
camunda.cluster.metadata.sync-delay

The delay between two sync requests in the ClusterConfigurationManager. A sync request is sent to another node to get the latest topology of the cluster.

10s
camunda.cluster.metadata.sync-request-timeout

The timeout for a sync request in the ClusterConfigurationManager.

2s
camunda.cluster.metadata.gossip-fanout

The number of nodes to which a cluster topology is gossiped.

2

camunda.cluster.network​

PropertyDescriptionDefault value
camunda.cluster.network.advertised-host

Controls the advertised host for cluster communication (for example, when running behind a proxy).

If not set, the default is computed based on camunda.cluster.network.host (if explicitly set) or by resolving the machine hostname/IP (falling back to the first non-loopback IP, and finally loopback).

null
camunda.cluster.network.port-offset

If set, this offset is added to all configured/default ports to avoid specifying every port individually.

The offset is applied to the second last digit, since multiple ports are used; for example, an offset of 5 increments ports by 50 (so 26500 becomes 26550).

0
camunda.cluster.network.max-message-size

Sets the maximum size of incoming and outgoing messages (commands and events).

4MB
camunda.cluster.network.socket-send-buffer

Sets the socket send buffer size (SO_SNDBUF), for example 1MB.

When not set, the operating system determines an optimal size automatically.

1MB
camunda.cluster.network.socket-receive-buffer

Sets the socket receive buffer size (SO_RCVBUF), for example 1MB.

When not set, the operating system determines an optimal size automatically.

1MB
camunda.cluster.network.heartbeat-timeout

Connections that did not receive any message within the specified timeout will be closed.

15s
camunda.cluster.network.heartbeat-interval

Sends a heartbeat when no other data is sent over an open connection within the specified timeout (to keep the connection open).

5s
camunda.cluster.network.command-api.hostOverrides the host used for gateway-to-broker communication.
camunda.cluster.network.command-api.portSets the port used for gateway-to-broker communication.
camunda.cluster.network.command-api.advertisedHost

Controls the advertised host. This is particularly useful if your broker stands behind a proxy.

If omitted, defaults to:

  • If zeebe.broker.network.commandApi.host was set, use this.
  • Use the resolved value of zeebe.broker.network.advertisedHost

camunda.cluster.network.command-api.advertisedPortControls the advertised port; if omitted defaults to the port. This is particularly useful if your broker stands behind a proxy.
camunda.cluster.initial-contact-points

Allows specifying a list of known other nodes to connect to on startup.

The contact points of the internal network configuration must be specified in the format [HOST:PORT] (for example, 192.168.1.22:26502).

You can configure this property in one or both of the following ways:

  1. Specify the addresses of the other nodes in the cluster. To ensure the cluster remains available during network partitions, list all nodes as initial contact points.
  2. Specify a single contact point with a hostname (for example, a DNS name) that resolves to the IP addresses of all nodes.

[]
camunda.cluster.network.internal-api.hostOverrides the host used for internal broker-to-broker communication.
camunda.cluster.network.internal-api.portSets the port used for internal broker-to-broker communication.
camunda.cluster.network.internal-api.advertisedHost

Controls the advertised host. This is particularly useful if your broker stands behind a proxy. If omitted, defaults to:

  • If zeebe.broker.network.internalApi.host was set, use this.
  • Use the resolved value of zeebe.broker.network.advertisedHost

camunda.cluster.network.internal-api.advertisedPortControls the advertised port; if omitted defaults to the port. This is particularly useful if your broker stands behind a proxy.

camunda.cluster.node-id-provider​

PropertyDescriptionDefault value
camunda.cluster.node-id-provider.type

Set the implementation Type for dynamic node ID management.

FIXED disables dynamic node IDs (static node ID configuration).

FIXED
camunda.cluster.node-id-provider.s3.lease-duration

Lease duration before expiry.

camunda.cluster.node-id-provider.s3.bucket-name

Name of the bucket where the leases will be stored.

  • The bucket must be already created.
  • The bucket must not be shared with other Zeebe clusters.
  • bucketName must not be empty.
camunda.cluster.node-id-provider.s3.task-id

The task ID to use when registering to a lease.

camunda.cluster.node-id-provider.s3.endpoint

Configure the URL endpoint for the store.

If no endpoint is provided, it will be determined based on the configured region.

camunda.cluster.node-id-provider.s3.region

Configure the AWS region.

If no region is provided, it will be determined automatically (see AWS SDK region selection documentation).

camunda.cluster.node-id-provider.s3.access-key

Configure access credentials.

If either accessKey or secretKey is not provided, the credentials will be determined automatically (see AWS SDK credential provider chain documentation).

camunda.cluster.node-id-provider.s3.secret-key

Configure access credentials.

If either accessKey or secretKey is not provided, the credentials will be determined automatically (see AWS SDK credential provider chain documentation).

camunda.cluster.node-id-provider.s3.api-call-timeout

Configure a maximum duration for all S3 client API calls.

10s
camunda.cluster.node-id-provider.fixed.node-id

Static node ID used when camunda.cluster.node-id-provider.type is set to FIXED.

0

camunda.cluster.partitioning​

PropertyDescriptionDefault value
camunda.cluster.partitioning.scheme

Configures how partitions are distributed across brokers (the partitioning scheme). Available options are ROUND_ROBIN, FIXED, and ZONE_AWARE.

When using FIXED, the broker-to-partition mapping must be specified under camunda.cluster.partitioning.fixed.

When using ZONE_AWARE, the zones must be specified under camunda.cluster.partitioning.zone-aware.zones.

ROUND_ROBIN
camunda.cluster.partitioning.fixed[].partition-id

Partition ID entry used when camunda.cluster.partitioning.scheme is set to FIXED.

1
camunda.cluster.partitioning.fixed[].nodes[].nodes-id

Broker node ID for a fixed partition mapping entry (used when camunda.cluster.partitioning.scheme is FIXED).

0
camunda.cluster.partitioning.fixed[].nodes[].priority

Priority value associated with a broker node in the fixed partitioning configuration.

1
camunda.cluster.partitioning.zone-aware.zones[].name

The name of the zone. Used when camunda.cluster.partitioning.scheme is set to ZONE_AWARE. Follows the same rules as camunda.cluster.zone.

-
camunda.cluster.partitioning.zone-aware.zones[].number-of-brokers

The total number of brokers deployed in this zone. The sum of all brokers across all zones should be equal to camunda.cluster.size

-
camunda.cluster.partitioning.zone-aware.zones[].number-of-replicas

The number of replicas for each replication group in this zone. The sum of all replicas across all zones should be equal to camunda.cluster.replication-factor

-
camunda.cluster.partitioning.zone-aware.zones[].priority

The priority of the zone. Higher priorities translate to higher Raft election priorities, skewing partition leaders toward the highest-priority zone.

-

camunda.cluster.raft​

PropertyDescriptionDefault value
camunda.cluster.raft

Configuration for the Raft consensus protocol in the cluster.

This class provides settings for Raft algorithm parameters including timing, elections, and log flushing.

none
camunda.cluster.raft.priority-election-enabled

When this flag is enabled, the leader election algorithm attempts to elect leaders based on a predefined priority. As a result, it tries to distribute leaders uniformly across the brokers.

Note that this is only a best-effort strategy. It does not guarantee a strictly uniform distribution.

true
camunda.cluster.raft.flush-enabled

If false, explicit flushing of the Raft log is disabled, and flushing only occurs right before a snapshot is taken. You should only disable explicit flushing if you are willing to accept potential data loss at the expense of performance. Before disabling it, try the delayed options, which provide a trade-off between safety and performance.

By default, for a given partition, data is flushed on every leader commit, and every follower append. This is to ensure consistency across all replicas. Disabling this can cause inconsistencies, and at worst, data corruption or data loss scenarios.

true
camunda.cluster.raft.flush-delay

If the delay is > 0, then flush requests are delayed by at least the given period. It is recommended that you find the smallest delay with which you achieve your performance goals.

It's also likely that anything above 30s is not useful, as this is the typical default flush interval for the Linux OS.

The default behavior is optimized for safety, and flushing occurs on every leader commit and follower append in a synchronous fashion.

0s
camunda.cluster.raft.heartbeat-interval

The heartbeat interval for Raft. The leader sends a heartbeat to a follower every heartbeatInterval. This is an advanced setting.

250ms
camunda.cluster.raft.election-timeout

The election timeout for Raft. If a follower does not receive a heartbeat from the leader within an election timeout, it can start a new leader election.

The electionTimeout should be greater than the configured heartbeatInterval.

When the electionTimeout is large, there will be a delay in detecting a leader failure.

When the electionTimeout is small, it can lead to false positives when detecting leader failures and thus leading to unnecessary leader changes.

If the network latency between the nodes is high, it is recommended to have a higher election timeout.

This is an advanced setting.

2.5s
camunda.cluster.raft.max-appends-per-follower

Sets the maximum number of append requests sent per follower.

6
camunda.cluster.raft.max-appends-batch-size

Sets the maximum batch size sent per append request to a follower.

32KB
camunda.cluster.raft.request-timeout

Sets the timeout for all requests sent by Raft leaders and followers.

When modifying request-timeout, it might also be useful to update snapshot-request-timeout.

2.5s
camunda.cluster.raft.snapshot-request-timeout

Sets the timeout for all snapshot requests sent by Raft leaders to followers.

If network latency between brokers is high, consider setting a higher timeout.

2.5s
camunda.cluster.raft.snapshot-chunk-size

Sets the maximum size of snapshot chunks sent by Raft leaders to followers.

1GB
camunda.cluster.raft.configuration-change-timeout

Sets the timeout for configuration change requests (for example, joining or leaving).

Since changes are usually a multi-step process with multiple commits, a higher timeout than request-timeout is recommended.

10s
camunda.cluster.raft.max-quorum-response-timeout

Defines the maximum time the leader waits for quorum responses before stepping down (in combination with min-step-down-failure-count).

If set to 0, the effective default is election-timeout * 2.

0s
camunda.cluster.raft.min-step-down-failure-count

Defines the number of failed quorum requests after which a leader may step down (in combination with max-quorum-response-timeout).

3
camunda.cluster.raft.prefer-snapshot-replicationThreshold

Threshold (in number of records) used by the leader to decide between replicating a snapshot or records.

If the follower lags behind by at least this many records, the leader prefers replicating snapshots instead of records.

100
camunda.cluster.raft.preallocate-segment-files

Defines whether segment files are pre-allocated to their full size on creation.

If enabled, disk space is reserved for the full maximum segment size when a new segment is created, which can help avoid out-of-disk-space errors (especially with memory-mapped files or network storage).

Disable if your system does not support efficient file allocation, or if you observe an I/O penalty when creating segments.

true
camunda.cluster.raft.segment-preallocation-strategy

Configures the strategy used to pre-allocate journal segment files on disk.

Available options:

  • NOOP: Does not allocate disk space.
  • FILL: Fills new segments with zeroes to ensure disk space is reserved.
  • POSIX: Reserves space using the POSIX posix_fallocate system call. Fails if fallocate is not available.
  • POSIX_OR_NOOP: Tries posix_fallocate, falls back to NOOP if unavailable.
  • POSIX_OR_FILL: Tries posix_fallocate, falls back to FILL if unavailable.
POSIX_OR_FILL

Data​

camunda.data​

PropertyDescriptionDefault value
camunda.data.snapshot-period

How often snapshots are taken of streams (in minutes).

5m
camunda.data.export.distribution-interval

Configures the rate at which exporter positions are distributed to the followers. This is useful for fail-over and taking snapshots.

The follower is able to take snapshots based on replayed and distributed export position. When a follower takes over it can recover from the snapshot, it doesn't need to replay and export everything.

For example, it can start from the last exported position it has received by the distribution mechanism.

15s
camunda.data.export.skip-records

Enable the exporters to skip record position. Allows to skip certain records by their position, per partition.

This is useful for debugging or skipping a record that is preventing processing or exporting to continue.

Record positions defined to skip in this definition will be skipped in all exporters. The value is a partitionId keyed map with a comma-separated list of positions to skip. Whitespace is ignored. For example:

camunda.data.export.skip-records.1: 12345, 67890
camunda.data.export.skip-records.2: 54321

{}

camunda.data.audit-log​

PropertyDescriptionDefault value
camunda.data.audit-log.enabledEnable or disable the audit log.true
camunda.data.audit-log.user.categoriesList of audit log categories to include for user-initiated actions.[ADMIN, DEPLOYED_RESOURCES, USER_TASKS]
camunda.data.audit-log.user.excludesList of audit log entity types to exclude for user-initiated actions.[]
camunda.data.audit-log.client.categoriesList of audit log categories to include for client-initiated actions (API clients).[]
camunda.data.audit-log.client.excludesList of audit log entity types to exclude for client-initiated actions (API clients).[]

camunda.data.wait-states​

PropertyDescriptionDefault value
camunda.data.wait-states.enabledEnable or disable wait state tracking.true

Audit log entity types​

Here is a complete list of audit log entity types you can use to configure camunda.data.audit-log.(user|client).excludes or CAMUNDA_DATA_AUDITLOG_(USER|CLIENT)_EXCLUDES:

  • AUTHORIZATION
  • BATCH
  • DECISION
  • GROUP
  • INCIDENT
  • MAPPING_RULE
  • PROCESS_INSTANCE
  • RESOURCE
  • ROLE
  • TENANT
  • USER_TASK
  • USER
  • VARIABLE

Data - primary storage​

camunda.data.primary-storage​

PropertyDescriptionDefault value
camunda.data.primary-storage.directory

Specify the directory in which data is stored.

'data'
camunda.data.primary-storage.runtime-directory

Specify the directory in which runtime is stored.

  • By default, runtime is stored in directory for data.
  • If runtime-directory is configured, then the configured directory will be used. It will have a subdirectory for each partition to store its runtime.
  • There is no need to store the runtime in a persistent storage.
  • This configuration allows you to split runtime to another disk to optimize for performance and disk usage.

Note: If runtime is on a different disk than the data directory, files must be copied to the data directory while taking the snapshot. This can impact disk i/o or performance during snapshotting.

''

camunda.data.primary-storage.disk​

PropertyDescriptionDefault value
camunda.data.primary-storage.disk.monitoring-interval

Sets the interval at which the disk usage is monitored.

1s
camunda.data.primary-storage.disk.monitoring-enabled

Configure disk monitoring to prevent getting into a non-recoverable state due to out of disk space.

If monitoring is enabled, the broker rejects commands and pauses replication when the required freeSpace is not available.

true
camunda.data.primary-storage.disk.free-space.processing

When the free space available is less than this value, the broker rejects all client commands and pauses processing.

2GB
camunda.data.primary-storage.disk.free-space.replication

When the free space available is less than this value, the broker stops receiving replicated events.

This value must be less than free-space.processing.

It is recommended to configure free space large enough for at least one log segment and one snapshot. This is because a partition needs enough space to take a new snapshot to be able to compact the log segments to make disk space available again.

1GB

camunda.data.primary-storage.logstream​

PropertyDescriptionDefault value
camunda.data.primary-storage.logstream.log-segment-size

The size of data log segment files.

128MB
camunda.data.primary-storage.logstream.log-index-density

The density of the log index, which determines how frequently index entries are created in the log.

This value specifies the number of log entries between each index entry. A lower value increases the number of index entries (improving lookup speed but using more memory), while a higher value reduces the number of index entries (saving memory but potentially slowing lookups).

Valid values: any positive integer (recommended range: 1-1000).

100

camunda.data.primary-storage.rocksdb​

PropertyDescriptionDefault value
camunda.data.primary-storage.rocksdb.statistics-enabled

Enables RocksDB statistics, which will be written to the RocksDB log file.

false
camunda.data.primary-storage.rocksdb.access-metrics

Configures which, if any, RocksDB column family access metrics are exposed. Valid values are none (the default), and fine which exposes many metrics covering the read, write, delete and iteration latency per partition and column family.

none
camunda.data.primary-storage.rocksdb.memory-allocation-strategy

Configures the RocksDB memory allocation strategy. Valid values are PARTITION, BROKER, and FRACTION (default).

  • PARTITION: Total expected RocksDB memory usage equals the actual number of partitions per broker (from the cluster topology) multiplied by memory-limit.
  • BROKER: Total expected RocksDB memory usage equals memory-limit, regardless of the number of partitions.
  • FRACTION: RocksDB memory is allocated as a fraction of total available memory, configured via memory-fraction.
FRACTION
camunda.data.primary-storage.rocksdb.memory-limit

Configures the expected RocksDB memory usage per partition when memory-allocation-strategy is set to PARTITION, or per broker when set to BROKER. Not applicable when using the FRACTION strategy.

512MB
camunda.data.primary-storage.rocksdb.memory-fraction

Configures the fraction of total available memory to allocate to RocksDB. Only applies when memory-allocation-strategy is set to FRACTION.

Valid range: [0,1].

0.1
camunda.data.primary-storage.rocksdb.max-open-files

Configures how many files are kept open by RocksDB. The default is unlimited (-1).

This is a performance optimization: if you set a value greater than zero, it will keep track and cap the number of open files in the TableCache.

On accessing the files it needs to look them up in the cache.

You should configure this property if the maximum open files are limited on your system, or if you have thousands of files in your RocksDB state as there is a memory overhead to keeping all of them open, and setting maxOpenFiles will bound that.

-1
camunda.data.primary-storage.rocksdb.max-write-buffer-number

Configures the maximum number of simultaneous write buffers/memtables RocksDB will have in memory.

Normally about 2/3s of the memoryLimit is used by the write buffers, and this is shared equally by each write buffers.

This means the higher maxWriteBufferNumber is, the less memory is available for each. This means you will flush less data at once, but may flush more often.

6
camunda.data.primary-storage.rocksdb.min-write-buffer-number-to-merge

Configures how many write buffers should be full before they are merged and flushed to disk.

A higher numeric value means you may flush less often, but will flush more data at once.

A lower numeric value means flushing more often, but flushing less data at once.

3
camunda.data.primary-storage.rocksdb.io-rate-bytes-per-second

Configures a rate limit for write I/O of RocksDB.

Setting any value less than or equal to 0 will disable this, which is the default setting.

Setting a rate limit on the write I/O can help achieve more stable performance by avoiding write spikes consuming all available IOPS, leading to more predictable read rates.

0
camunda.data.primary-storage.rocksdb.wal-disabled

Configures if the RocksDB write-ahead-log is used or not.

By default, every write in RocksDB goes to the active write buffer and the WAL; this helps recover a RocksDB instance should it crash before the write buffer is flushed.

Zeebe however only recovers from specific point-in-time snapshot, and never from a previously active RocksDB instance, which makes it a good candidate to disable the WAL. WAL is disabled by default as it can improve performance of Zeebe.

true
camunda.data.primary-storage.rocksdb.sst-partitioning-enabled

Configures if the RocksDB SST files should be partitioned based on some virtual column families.

By default, RocksDB will not partition the SST files, which could influence the compacting of certain key ranges.

Enabling this option gives RocksDB some good hints how to improve compaction and reduce the write amplification.

Benchmarks have shown impressive results, allowing sustained performance on larger states.

This setting will increase the general file count of runtime and snapshots.

true

camunda.data.primary-storage.backup​

PropertyDescriptionDefault value
camunda.data.primary-storage.backup.store

Set the backup store type.

Supported values are NONE, S3, GCS, AZURE, FILESYSTEM.

Note: This configuration applies to the backup of primary storage.

NONE
camunda.data.primary-storage.backup.continousEnables or disables the continuous backups feature.false
camunda.data.primary-storage.backup.requiredForces the backup scheduler mechanism to be properly configured during broker startup.false
camunda.data.primary-storage.backup.scheduleThe interval at which a primary storage backup is taken. Can be a CRON expression, ISO8601 duration or none. For example, every 5 minutes would be 0 */5 * * * * and PT5M respectively.-
camunda.data.primary-storage.backup.checkpoint-intervalThe interval at which checkpoints are ingested in the logstream. ISO8601, for example PT5M duration.-
camunda.data.primary-storage.backup.offsetOffset for the generated backup identifiers.-
camunda.data.primary-storage.backup.read-timeout

The maximum duration for reading a response from the backup store.

A single request that exceeds this timeout fails and can be retried. Applies to the S3, GCS, and AZURE stores.

When not set, the default of the underlying store client applies: 30s for S3, 20s for GCS, and 60s for AZURE.

Accepts a duration, for example 30s or PT30S.

-
camunda.data.primary-storage.backup.write-timeout

The maximum duration for writing a request to the backup store. Applies to the S3, GCS, and AZURE stores.

When not set, the default of the underlying store client applies: 30s for S3 and 60s for AZURE. GCS has no write timeout by default.

Accepts a duration, for example 30s or PT30S.

-

camunda.data.primary-storage.backup.retention​

PropertyDescriptionDefault value
camunda.data.primary-storage.backup.retention.windowThe active window of backups available for restore in the configured backup store, ISO8601 duration. For example PT5M-
camunda.data.primary-storage.backup.cleanup-scheduleThe interval at which the retention mechanism checks for backups outside the active window. Can be a CRON expression, ISO8601 duration or none. For example, every 5 minutes would be 0 */5 * * * * and PT5M respectively.-

camunda.data.primary-storage.backup.s3​

PropertyDescriptionDefault value
camunda.data.primary-storage.backup.s3.bucket-name

Name of the bucket where the backup will be stored.

  • The bucket must be already created.
  • The bucket must not be shared with other zeebe clusters.
  • The bucketName must not be empty.
Null
camunda.data.primary-storage.backup.s3.endpoint

Configure the URL endpoint for the store. If no endpoint is provided, it will be determined based on the configured region.

Null
camunda.data.primary-storage.backup.s3.region

Configure the AWS region.

If no region is provided it will be determined as documented in setting the AWS Region for the AWS SDK for Java 2.x.

Null
camunda.data.primary-storage.backup.s3.access-key

Configure access credentials.

If either accessKey or secretKey is not provided, the credentials will be determined as documented in using credentials providers in the AWS SDK for Java 2.x.

-
camunda.data.primary-storage.backup.s3.secret-key

Configure access credentials.

If either accessKey or secretKey is not provided, the credentials will be determined as documented in using credentials providers in the AWS SDK for Java 2.x.

-
camunda.data.primary-storage.backup.s3.api-call-timeout

Configure a maximum duration for all S3 client API calls.

Lower values will ensure that failed or slow API calls don't block other backups but may increase the risk that backups can't be stored if uploading parts of the backup takes longer than the configured timeout.

Refer to AWS Java SDK 2.x Best Practices.

180s
camunda.data.primary-storage.backup.s3.force-path-style-access

If enabled, forces the s3 client to use path-style access.

By default, the client will automatically choose between path-style and virtual-hosted-style.

This should only be enabled if the s3 compatible storage cannot support virtual-hosted-style.

Refer to accessing an Amazon S3 general purpose bucket.

false
camunda.data.primary-storage.backup.s3.compression

When set to an algorithm such as 'zstd', enables compression of backup contents.

When not set or set to 'none', backup content is not compressed.

Enabling compression reduces the required storage space for backups in S3 but also increases the impact on CPU and disk utilization while taking a backup.

-
camunda.data.primary-storage.backup.s3.max-concurrent-connections

Maximum number of connections allowed in a connection pool.

This is used to restrict the maximum number of concurrent uploads as to avoid connection timeouts when uploading backups with large/multiple files.

50
camunda.data.primary-storage.backup.s3.connection-acquisition-timeout

Timeout for acquiring an already-established connection from a connection pool to a remote service.

45s
camunda.data.primary-storage.backup.s3.base-path

When set, all objects in the bucket will use this prefix. Must be non-empty and not start or end with '/'.

This is useful for using the same bucket for multiple Zeebe clusters. In this scenario, the basePath must be unique.

Null
camunda.data.primary-storage.backup.s3.support-legacy-md5

Enable s3 md5 plugin for legacy support.

Null

camunda.data.primary-storage.backup.gcs​

PropertyDescriptionDefault value
camunda.data.primary-storage.backup.gcs.bucket-name

Name of the bucket where the backup will be stored.

  • The bucket must already exist.
  • The bucket must not be shared with other Zeebe clusters unless basePath is also set.
Null
camunda.data.primary-storage.backup.gcs.endpoint

When set, all blobs in the bucket will use this prefix. This is useful for using the same bucket for multiple Zeebe clusters.

In this scenario, the basePath must be unique. It should not start or end with a '/' character. It must be non-empty and not consist of only '/' characters.

Null
camunda.data.primary-storage.backup.gcs.host

When set, this overrides the host that the GCS client connects to.

By default, this is not set because the client can automatically discover the correct host to connect to.

AUTO
camunda.data.primary-storage.backup.gcs.auth

Configures which authentication method is used for connecting to GCS.

Can be either 'auto' or 'none'.

  • 'auto': The GCS client uses application default credentials which automatically discovers appropriate credentials from the runtime environment.

  • 'none': No authentication is attempted which is only applicable for testing with emulated GCS.

Null

camunda.data.primary-storage.backup.azure​

PropertyDescriptionDefault value
camunda.data.primary-storage.backup.azure.endpoint

The Azure endpoint to connect to. Required unless a connection string is specified.

Null
camunda.data.primary-storage.backup.azure.account-name

The account name used to authenticate with Azure.

This can only be used in combination with an account key.

If account credentials or a connection string are not provided, authentication will use credentials from the runtime environment.

Null
camunda.data.primary-storage.backup.azure.account-key

The account key that is used to authenticate with Azure.

This can only be used in combination with an account name.

If account credentials or a connection string are not provided, authentication will use credentials from the runtime environment.

Null
camunda.data.primary-storage.backup.azure.connection-string

The connection string configures the endpoint, account name and account key all at once.

Ifa connection string or account credentials are not provided, authentication will use credentials from the runtime environment.

Null
camunda.data.primary-storage.backup.azure.base-path

Defines the container name where backup contents are saved.

Null
camunda.data.primary-storage.backup.azure.create-container

Defines the container name where backup contents are saved.

true
camunda.data.primary-storage.backup.azure.sas-token.type

This setting defines the SAS token to use.

These can be of user delegation, service or account type.

Note: As user delegation and service SAS tokens do not support the creation of containers, createContainer configuration will be overridden to false if sasToken is configured.

The user must make sure that the container already exists, or it will lead to a runtime error. Refer to delegate access by using a shared access signature.

Null
camunda.data.primary-storage.backup.azure.sas-token.value

The actual Shared Access Signature (SAS) token value used for authentication.

Null

camunda.data.primary-storage.backup.filesystem​

PropertyDescriptionDefault value
camunda.data.primary-storage.backup.filesystem.base-path

Set the base path to store all related backup files in.

Null

Data - secondary storage​

Review secondary storage management for guidance on best practices, ensuring data integrity and performance optimization.

warning

When Elasticsearch/OpenSearch Exporter indices and Orchestration Cluster indices share the same Elasticsearch or OpenSearch cluster, they must use different index prefixes. One prefix must not be the beginning of the other (for example, avoid custom and custom-zeebe together because custom* matches both). Do not use operate, tasklist, or camunda as the full exporter prefix, and do not use zeebe-record as the Orchestration Cluster index prefix, as zeebe-record is the default prefix for Elasticsearch/OpenSearch Exporter indices.

The Orchestration Cluster prefix is configured via camunda.data.secondary-storage.{elasticsearch|opensearch}.index-prefix (or CAMUNDA_DATA_SECONDARYSTORAGE_{ELASTICSEARCH|OPENSEARCH}_INDEXPREFIX).

For detailed requirements, configuration examples, and common mistakes, see index prefix configuration.

camunda.data.secondary-storage​

PropertyDescriptionDefault value
camunda.data.secondary-storage.type

Type of secondary storage to use.

Example: elasticsearch, opensearch, rdbms, or none.

elasticsearch (orchestration default).
camunda.data.secondary-storage.autoconfigure-camunda-exporter

If enabled, the default exporter camundaexporter is automatically configured using the secondary-storage properties.

Manual configuration of camundaexporter is not required.

If disabled, camundaexporter will not be configured automatically, but can still be enabled through manual configuration if required.

Manual configuration of camundaexporter is generally not recommended, and can result in unexpected behavior if not configured correctly.

true
camunda.data.secondary-storage.retention.enabledIf true, the ILM Policy is created and applied to the index templates.true
camunda.data.secondary-storage.retention.minimum-ageDefines how old the data must be before the data is deleted, set as a duration.30d

camunda.data.secondary-storage.elasticsearch​

PropertyDescriptionDefault value
camunda.data.secondary-storage.elasticsearch.url

Endpoint for the database configured as secondary storage. Use the variable matching the selected type. Mutually exclusive with urls - configure only one.

http://localhost:9200
camunda.data.secondary-storage.elasticsearch.urls

List of endpoints for the database configured as secondary storage. Use for multi-node clusters. Mutually exclusive with url - configure only one.

[]
camunda.data.secondary-storage.elasticsearch.cluster-name

Secondary storage cluster name. Use the variable matching the selected type.

elasticsearch
camunda.data.secondary-storage.elasticsearch.date-format

The date format for the database configured as secondary storage.

yyyy-MM-dd'T'HH:mm:ss.SSSZZ
camunda.data.secondary-storage.elasticsearch.socket-timeout

The socket timeout for the database connector.

-
camunda.data.secondary-storage.elasticsearch.connection-timeout

The connection timeout for the database connector.

-
camunda.data.secondary-storage.elasticsearch.username

Username for the database configured as secondary storage.

''
camunda.data.secondary-storage.elasticsearch.password

Password for the database configured as secondary storage.

''
camunda.data.secondary-storage.elasticsearch.security.enabled

Enables HTTPS and related SSL/TLS handling for the secondary storage connection.

false
camunda.data.secondary-storage.elasticsearch.security.certificate-path

Path to the trusted root or CA certificate file when using a custom or self-signed certificate.

''
camunda.data.secondary-storage.elasticsearch.security.verify-hostname

Whether the hostname in the certificate must match the endpoint. Disable only for troubleshooting.

true
camunda.data.secondary-storage.elasticsearch.security.self-signed

Indicates the certificate is self-signed (enables relaxed trust handling when supported).

false
camunda.data.secondary-storage.elasticsearch.interceptor-plugins[]

This property is part of Camunda's interceptor system.

An interceptor plugin is a small Java component that can be used to intercept (logs and/or modify) the requests or the responses that happen between Camunda and the secondary storage database.

More than one plugin can be configured, with the configuration declared as a list of interceptor configurations, each requiring an id, jar-path and class-name.

For example:

.interceptor-plugins[0].id=plugin1
.interceptor-plugins[0].class-name=
.interceptor-plugins[0].jar-path=
.interceptor-plugins[1].id=plugin2
.interceptor-plugins[1].class-name=
.interceptor-plugins[1].jar-path=

-
camunda.data.secondary-storage.elasticsearch.interceptor-plugins[].idThe mnemonic ID associated with the interceptor plugin.-
camunda.data.secondary-storage.elasticsearch.interceptor-plugins[].class-nameThe Java identifier of the class that implements the interceptor plugin.-
camunda.data.secondary-storage.elasticsearch.interceptor-plugins[].jar-pathThe location of the JAR archive that contains the code of the plugin.-
camunda.data.secondary-storage.elasticsearch.index-prefix

Prefix to apply to the indexes.

Set only if you need to separate Orchestration Cluster indices from other indices in the same cluster (for example, when multiple Camunda environments share one cluster). Leave blank (-) to use the default.

''
camunda.data.secondary-storage.elasticsearch.number-of-shards

Default number of primary shards for new indices.

1
camunda.data.secondary-storage.elasticsearch.number-of-replicas

Default number of replicas for new indices.

1
camunda.data.secondary-storage.elasticsearch.template-priority

Priority applied to index templates created by the platform. Higher values override provider defaults.

0
camunda.data.secondary-storage.elasticsearch.number-of-shards-per-index

Map overriding shard count per index (key=index name, value=shards).

{}
camunda.data.secondary-storage.elasticsearch.number-of-replicas-per-index

JSON map overriding replica count per index (key=index name, value=replicas).

{}
camunda.data.secondary-storage.elasticsearch.variable-size-threshold

Variable size threshold for the database configured as secondary storage.

8191
camunda.data.secondary-storage.elasticsearch.bulk.delay

Delay before forced flush (in seconds).

'5s'
camunda.data.secondary-storage.elasticsearch.bulk.size

Bulk size before flush.

1000
camunda.data.secondary-storage.elasticsearch.bulk.memory-limit

Bulk memory usage before flush (in MB).

'20MB'
camunda.data.secondary-storage.elasticsearch.process-cache.max-cache-size

Process cache max size.

1000
camunda.data.secondary-storage.elasticsearch.form-cache.max-cache-size

Form cache max size.

1000
camunda.data.secondary-storage.elasticsearch.batch-operation-cache.max-cache-size

Batch operations cache max size.

1000
camunda.data.secondary-storage.elasticsearch.create-schema

Whether to create the schema automatically.

true
camunda.data.secondary-storage.elasticsearch.post-export.batch-size

Defines the default number of records processed in each batch during post-export operations from secondary storage.

100
camunda.data.secondary-storage.elasticsearch.post-export.delay-between-runs

Defines the default time interval between successive post-export processing runs for secondary storage.

'2s'
camunda.data.secondary-storage.elasticsearch.post-export.max-delay-between-runs

Defines the default maximum time interval between successive post-export processing runs for secondary storage.

'60s'
camunda.data.secondary-storage.elasticsearch.post-export.ignore-missing-data

Defines default error handling behavior when post-export processing encounters missing data in secondary storage.

false
camunda.data.secondary-storage.elasticsearch.incident-notifier.auth0-protocol

The incident notifier is a Camunda Exporter feature that sends HTTP webhook notifications when incidents are created.

The type of protocol to use for the incident notifier.

'https'
camunda.data.secondary-storage.elasticsearch.incident-notifier.webhookThe webhook to use when the notifier is triggered.''
camunda.data.secondary-storage.elasticsearch.incident-notifier.m2m-client-idThe M2M client ID secret provided by the IdP or the auth0 admin.''
camunda.data.secondary-storage.elasticsearch.incident-notifier.m2m-client-secretThe M2M client secret provided by the IdP or the auth0 admin.''
camunda.data.secondary-storage.elasticsearch.incident-notifier.m2m-audienceThe M2M audience provided by the IdP or the auth0 admin.''
camunda.data.secondary-storage.elasticsearch.batch-operations.export-items-on-creationExport the batch operation items when the initial chunk records are processed. If set to false, the batch operation items will be exported only when they have been processed and have completed or failed.true
camunda.data.secondary-storage.elasticsearch.history.process-instance-enabled

If true, enables the archiving of the completed process instances and their related objects.

true
camunda.data.secondary-storage.elasticsearch.history.els-rollover-date-format

Date format for historical indices in Java DateTimeFormatter syntax.

date
camunda.data.secondary-storage.elasticsearch.history.rollover-interval

Time range for creating dated indices. For example, 1d creates daily indices.

'1d'
camunda.data.secondary-storage.elasticsearch.history.rollover-batch-size

Maximum number of process instances selected for archiving per run. Defaults to 500 when archiveByIdEnabled is true, and 100 when false. Set to 500 or higher when using archiveByIdEnabled to maintain a healthy pipeline of data.

500
camunda.data.secondary-storage.elasticsearch.history.archive-by-id-enabled

When true, archiving moves documents in small, targeted batches

true
camunda.data.secondary-storage.elasticsearch.history.reindex-batch-size

Number of individual Elasticsearch/OpenSearch documents archived in each targeted batch when archiveByIdEnabled is true.

2500
camunda.data.secondary-storage.elasticsearch.history.wait-period-before-archiving

Grace period before archiving completed processes. Processes finished within this window are not yet archived.

'1h'
camunda.data.secondary-storage.elasticsearch.history.delay-between-runs

Time interval between archiver runs.

'2s'
camunda.data.secondary-storage.elasticsearch.history.max-delay-between-runs

Maximum time interval between archiver runs due to failure backoffs.

'60s'
camunda.data.secondary-storage.elasticsearch.history.policy-name

Defines the name of the created and applied ILM policy.

'camunda-history-retention-policy'
camunda.data.secondary-storage.elasticsearch.proxy.enabled

Enable proxy for connecting to Elasticsearch.

false
camunda.data.secondary-storage.elasticsearch.proxy.host

Proxy host. Required if proxy is enabled.

''
camunda.data.secondary-storage.elasticsearch.proxy.port

Proxy port. Required if proxy is enabled.

''
camunda.data.secondary-storage.elasticsearch.proxy.ssl-enabled

Enable SSL for the proxy connection.

false
camunda.data.secondary-storage.elasticsearch.proxy.username

Username for proxy authentication.

''
camunda.data.secondary-storage.elasticsearch.proxy.password

Password for proxy authentication.

''
camunda.data.secondary-storage.elasticsearch.backup.repository-name

Set the Elasticsearch snapshot repository name.

Note: This setting applies to backups of secondary storage.

''
camunda.data.secondary-storage.elasticsearch.backup.snapshot-timeout

A backup of history data consists of multiple Elasticsearch snapshots.

The snapshotTimeout controls the maximum time to wait for a snapshot operation to complete during backup creation. When set to 0, the system will wait indefinitely for snapshots to finish.

Note: This setting applies to backups of secondary storage.

0
camunda.data.secondary-storage.elasticsearch.backup.incomplete-check-timeout

Defines the timeout period for determining whether an incomplete backup should be considered as failed or still in progress.

This property helps distinguish between backups that are actively running versus those that may have stalled or failed silently.

Note: This setting applies to backups of secondary storage.

5m

camunda.data.secondary-storage.opensearch​

PropertyDescriptionDefault value
camunda.data.secondary-storage.opensearch.url

Endpoint for the database configured as secondary storage. Use the variable matching the selected type. Mutually exclusive with urls - configure only one.

http://localhost:9200
camunda.data.secondary-storage.opensearch.urls

List of endpoints for the database configured as secondary storage. Use for multi-node clusters. Mutually exclusive with url - configure only one.

[]
camunda.data.secondary-storage.opensearch.cluster-name

Secondary storage cluster name. Use the variable matching the selected type.

elasticsearch
camunda.data.secondary-storage.opensearch.date-format

The date format for the database configured as secondary storage.

yyyy-MM-dd'T'HH:mm:ss.SSSZZ
camunda.data.secondary-storage.opensearch.socket-timeout

The socket timeout for the database connector.

-
camunda.data.secondary-storage.opensearch.connection-timeout

The connection timeout for the database connector.

-
camunda.data.secondary-storage.opensearch.aws-enabled

Enables AWS-related connection handling for the secondary storage connection.

false
camunda.data.secondary-storage.opensearch.username

Username for accessing the secondary storage REST API (leave blank if not secured).

''
camunda.data.secondary-storage.opensearch.password

Password for accessing the secondary storage REST API.

''
camunda.data.secondary-storage.opensearch.security.enabled

Enables HTTPS and related SSL/TLS handling for the secondary storage connection.

false
camunda.data.secondary-storage.opensearch.security.certificate-path

Path to the trusted root or CA certificate file when using a custom or self-signed certificate.

''
camunda.data.secondary-storage.opensearch.security.verify-hostname

Whether the hostname in the certificate must match the endpoint. Disable only for troubleshooting.

true
camunda.data.secondary-storage.opensearch.security.self-signed

Indicates the certificate is self-signed (enables relaxed trust handling when supported).

false
camunda.data.secondary-storage.opensearch.interceptor-plugins[]

This property is part of Camunda's interceptor system.

An interceptor plugin is a small Java component that can be used to intercept (logs and/or modify) the requests or the responses that happen between Camunda and the secondary storage database.

More than one plugin can be configured, with the configuration declared as a list of interceptor configurations, each requiring an id, jar-path and class-name.

For example:

.interceptor-plugins[0].id=plugin1
.interceptor-plugins[0].class-name=
.interceptor-plugins[0].jar-path=
.interceptor-plugins[1].id=plugin2
.interceptor-plugins[1].class-name=
.interceptor-plugins[1].jar-path=

-
camunda.data.secondary-storage.opensearch.interceptor-plugins[].idThe mnemonic ID associated with the interceptor plugin.-
camunda.data.secondary-storage.opensearch.interceptor-plugins[].class-nameThe Java identifier of the class that implements the interceptor plugin.-
camunda.data.secondary-storage.opensearch.interceptor-plugins[].jar-pathThe location of the JAR archive that contains the code of the plugin.-
camunda.data.secondary-storage.opensearch.index-prefix

Prefix to apply to the indexes.

Set only if you need to separate Orchestration Cluster indices from other indices in the same cluster (for example, when multiple Camunda environments share one cluster). Leave blank (-) to use the default.

''
camunda.data.secondary-storage.opensearch.number-of-shards

Default number of primary shards for new indices.

1
camunda.data.secondary-storage.opensearch.number-of-replicas

Default number of replicas for new indices.

1
camunda.data.secondary-storage.opensearch.template-priority

Priority applied to index templates created by the platform. Higher values override provider defaults.

0
camunda.data.secondary-storage.opensearch.number-of-shards-per-index

Map overriding shard count per index (key=index name, value=shards).

{}
camunda.data.secondary-storage.opensearch.number-of-replicas-per-index

JSON map overriding replica count per index (key=index name, value=replicas).

{}
camunda.data.secondary-storage.opensearch.variable-size-threshold

Variable size threshold for the database configured as secondary storage.

8191
camunda.data.secondary-storage.opensearch.bulk.delay

Delay before forced flush (in seconds).

'5s'
camunda.data.secondary-storage.opensearch.bulk.size

Bulk size before flush.

1000
camunda.data.secondary-storage.opensearch.bulk.memory-limit

Bulk memory usage before flush (in MB).

'20MB'
camunda.data.secondary-storage.opensearch.process-cache.max-cache-size

Process cache max size.

1000
camunda.data.secondary-storage.opensearch.form-cache.max-cache-size

Form cache max size.

1000
camunda.data.secondary-storage.opensearch.batch-operation-cache.max-cache-size

Batch operations cache max size.

1000
camunda.data.secondary-storage.opensearch.create-schema

Whether to create the schema automatically.

true
camunda.data.secondary-storage.opensearch.post-export.batch-size

Defines the default number of records processed in each batch during post-export operations from secondary storage.

100
camunda.data.secondary-storage.opensearch.post-export.delay-between-runs

Defines the default time interval between successive post-export processing runs for secondary storage.

'2s'
camunda.data.secondary-storage.opensearch.post-export.max-delay-between-runs

Defines the default maximum time interval between successive post-export processing runs for secondary storage.

'60s'
camunda.data.secondary-storage.opensearch.post-export.ignore-missing-data

Defines default error handling behavior when post-export processing encounters missing data in secondary storage.

false
camunda.data.secondary-storage.opensearch.incident-notifier.auth0-protocol

The incident notifier is a Camunda Exporter feature that sends HTTP webhook notifications when incidents are created.

The type of protocol to use for the incident notifier.

'https'
camunda.data.secondary-storage.opensearch.incident-notifier.webhookThe webhook to use when the notifier is triggered.''
camunda.data.secondary-storage.opensearch.incident-notifier.m2m-client-idThe M2M client ID secret provided by the IdP or the auth0 admin.''
camunda.data.secondary-storage.opensearch.incident-notifier.m2m-client-secretThe M2M client secret provided by the IdP or the auth0 admin.''
camunda.data.secondary-storage.opensearch.incident-notifier.m2m-audienceThe M2M audience provided by the IdP or the auth0 admin.''
camunda.data.secondary-storage.opensearch.batch-operations.export-items-on-creationExport the batch operation items when the initial chunk records are processed. If set to false, the batch operation items will be exported only when they have been processed and have completed or failed.true
camunda.data.secondary-storage.opensearch.history.process-instance-enabled

If true, enables the archiving of the completed process instances and their related objects.

true
camunda.data.secondary-storage.opensearch.history.els-rollover-date-format

Date format for historical indices in Java DateTimeFormatter syntax.

date
camunda.data.secondary-storage.opensearch.history.rollover-interval

Time range for creating dated indices. For example, 1d creates daily indices.

'1d'
camunda.data.secondary-storage.opensearch.history.rollover-batch-size

Maximum number of process instances selected for archiving per run. Defaults to 500 when archiveByIdEnabled is true, and 100 when false. Set to 500 or higher when using archiveByIdEnabled to maintain a healthy pipeline of data.

500
camunda.data.secondary-storage.opensearch.history.archive-by-id-enabled

When true, archiving moves documents in small, targeted batches instead of attempting to move all relevant records in a single attempt. This incrementally continues until all documents for the selected process instances have been archived to the relevant dated indices. There are no changes to the core archiving concept - data is still moved to the same dated destination indices. When archiving by ID, archiving is executed in a less resource-intensive manner, which improves stability.

true
camunda.data.secondary-storage.opensearch.history.reindex-batch-size

Number of individual Elasticsearch/OpenSearch documents archived in each targeted batch when archiveByIdEnabled is true.

2500
camunda.data.secondary-storage.opensearch.history.wait-period-before-archiving

Grace period before archiving completed processes. Processes finished within this window are not yet archived.

'1h'
camunda.data.secondary-storage.opensearch.history.delay-between-runs

Time interval between archiver runs.

'2s'
camunda.data.secondary-storage.opensearch.history.max-delay-between-runs

Maximum time interval between archiver runs due to failure backoffs.

'60s'
camunda.data.secondary-storage.opensearch.history.policy-name

Defines the name of the created and applied ILM policy.

'camunda-history-retention-policy'
camunda.data.secondary-storage.opensearch.proxy.enabled

Enable proxy for connecting to OpenSearch.

false
camunda.data.secondary-storage.opensearch.proxy.host

Proxy host. Required if proxy is enabled.

''
camunda.data.secondary-storage.opensearch.proxy.port

Proxy port. Required if proxy is enabled.

''
camunda.data.secondary-storage.opensearch.proxy.ssl-enabled

Enable SSL for the proxy connection.

false
camunda.data.secondary-storage.opensearch.proxy.username

Username for proxy authentication.

''
camunda.data.secondary-storage.opensearch.proxy.password

Password for proxy authentication.

''
camunda.data.secondary-storage.opensearch.backup.repository-name

Set the OpenSearch snapshot repository name.

Note: This setting applies to backups of secondary storage.

''
camunda.data.secondary-storage.opensearch.backup.snapshot-timeout

A backup of history data consists of multiple OpenSearch snapshots.

The snapshotTimeout controls the maximum time to wait for a snapshot operation to complete during backup creation. When set to 0, the system will wait indefinitely for snapshots to finish.

Note: This setting applies to backups of secondary storage.

0
camunda.data.secondary-storage.opensearch.backup.incomplete-check-timeout

Defines the timeout period for determining whether an incomplete backup should be considered as failed or still in progress.

This property helps distinguish between backups that are actively running versus those that may have stalled or failed silently.

Note: This setting applies to backups of secondary storage.

5m

camunda.data.secondary-storage.rdbms​

PropertyDescriptionDefault value
camunda.data.secondary-storage.rdbms.url

Endpoint for the database configured as secondary storage.

''
camunda.data.secondary-storage.rdbms.username

Username for accessing the secondary storage REST API (leave blank if not secured).

''
camunda.data.secondary-storage.rdbms.password

Password for the database configured as secondary storage.

''
camunda.data.secondary-storage.rdbms.prefix

The prefix to use for all database artifacts such as tables, indexes, and so on.

''
camunda.data.secondary-storage.rdbms.flush-interval

The interval at which the exporters execution queue is flushed.

'PT0.5S'
camunda.data.secondary-storage.rdbms.queue-size

The maximum size of the exporters execution queue before it is flushed to the database.

1000
camunda.data.secondary-storage.rdbms.queue-memory-limit

The maximum memory (in MB) that the execution queue can consume before it is flushed to the database. This helps prevent OOM when processing large processes with large variables.

20
camunda.data.secondary-storage.rdbms.auto-ddlIf set to true, the database schema is automatically created and updated on application startup.true
camunda.data.secondary-storage.rdbms.database-vendor-id

Camunda attempts to automatically detect the database vendor from the connection. To override this automation, declare the database vendor here.

Values: h2, oracle, postgresql, mariadb, mysql, mssql.

''
camunda.data.secondary-storage.rdbms.history.default-history-ttl

The default time to live for all camunda entities that support history time to live. Specified in Java Duration format.

'P30D'
camunda.data.secondary-storage.rdbms.history.default-batch-operation-history-ttl

The default time to live for all batch operations. Specified in Java Duration format.

'P5D'
camunda.data.secondary-storage.rdbms.history.batch-operation-cancel-process-instance-history-ttl

The default time to live for cancel process instance batch operations. Specified in Java Duration format.

'P5D'
camunda.data.secondary-storage.rdbms.history.batch-operation-migrate-process-instance-history-ttl

The default time to live for migrate process instance batch operations. Specified in Java Duration format.

'P5D'
camunda.data.secondary-storage.rdbms.history.batch-operation-modify-process-instance-history-ttl

The default time to live for modify process instance batch operations. Specified in Java Duration format.

'P5D'
camunda.data.secondary-storage.rdbms.history.batch-operation-resolve-incident-history-ttl

The default time to live for resolve incident batch operations. Specified in Java Duration format.

'P5D'
camunda.data.secondary-storage.rdbms.history.usage-metrics-cleanup

Interval how often usage metrics cleanup is performed. Specified in Java Duration format.

'P1D'
camunda.data.secondary-storage.rdbms.history.usage-metrics-ttl

The default time to live for usage metrics. Specified in Java Duration format.

'P730D'
camunda.data.secondary-storage.rdbms.history.min-history-cleanup-interval

The min interval between two history cleanup runs. This will be reached when the system is constantly finding data to clean up. Specified in Java Duration format.

'PT1M'
camunda.data.secondary-storage.rdbms.history.max-history-cleanup-interval

The max interval between two history cleanup runs. This will be reached when the system is constantly finding no data to clean up. Specified in Java Duration format.

'PT1H'
camunda.data.secondary-storage.rdbms.history.history-cleanup-batch-size

The number of history records to delete in one batch.

1000
camunda.data.secondary-storage.rdbms.process-cache.max-size

The maximum number of entries the process cache may contain. When the size of the cache exceeds this, the oldest entries are removed.

1000
camunda.data.secondary-storage.rdbms.batch-operation-cache.max-size

The maximum number of batch operations entries the cache may contain. When the size of the cache exceeds this, the oldest entries are removed.

1000
camunda.data.secondary-storage.rdbms.export-batch-operation-items-on-creation

If true, batch operation items are exported to the database when the batch operation is created (status = ACTIVE). If false, the items are created on demand when they have been processed.

When set to true, this ensures that the items are available when the batch operation is created, but it may lead to a delay in the creation of the batch operation if there are many items to create.

true
camunda.data.secondary-storage.rdbms.batch-operation-item-inserts-block-size

The number of batch operation items to insert in a single batched SQL when creating the items for a batch operation. This is only relevant when exportBatchOperationItemsOnCreation is set to true.

1000
camunda.data.secondary-storage.rdbms.connection-pool.maximum-pool-size

Pass-through property for the Hikari connection pool.

Controls the maximum size that the pool is allowed to reach, including both idle and in-use connections.

10
camunda.data.secondary-storage.rdbms.connection-pool.minimum-idle

Pass-through property for the Hikari connection pool.

Controls the minimum number of idle connections that HikariCP tries to maintain in the pool.

10
camunda.data.secondary-storage.rdbms.connection-pool.idle-timeout

Pass-through property for the Hikari connection pool.

Controls the maximum amount of time that a connection is allowed to sit idle in the pool. This setting only applies when minimumIdle is defined to be less than maximumPoolSize.

600000
camunda.data.secondary-storage.rdbms.connection-pool.max-lifetime

Pass-through property for the Hikari connection pool.

Controls the maximum lifetime of a connection in the pool. An in-use connection will never be retired, only when it is closed will it then be removed.

1800000
camunda.data.secondary-storage.rdbms.connection-pool.connection-timeout

Pass-through property for the Hikari connection pool.

Controls the maximum number of milliseconds that a client will wait for a connection from the pool before an exception is thrown.

30000
camunda.data.secondary-storage.rdbms.async-replication.enabled

If the async replication monitoring should be enabled.

false
camunda.data.secondary-storage.rdbms.async-replication.type

The type name of the replication monitoring strategy. Possible values: DELAY, LOG_SEQ.

''
camunda.data.secondary-storage.rdbms.async-replication.min-sync-replicas

The minimal number of replicas in sync.

1
camunda.data.secondary-storage.rdbms.async-replication.polling-interval

The interval in which to check the replicas.

PT15S
camunda.data.secondary-storage.rdbms.async-replication.max-lag

The max tolerated lag of a replication. Specified in Java Duration format.

PT15M
camunda.data.secondary-storage.rdbms.async-replication.pause-on-max-lag-exceeded

If the exporter should pause exporting when the maximum lag limit is exceeded.

false
camunda.data.secondary-storage.rdbms.async-replication.delay

The delay to wait until a flushed record is acknowledged to the broker.

''
camunda.data.secondary-storage.rdbms.async-replication.queue-capacity

Size of the internal queue of record positions to acknowledge

8192
camunda.data.secondary-storage.rdbms.async-replication.queue-debounce-time

A debounce time to not add every record to the queue but only one every X seconds. Specified in Java Duration format.

PT5S
note

Durations support ISO-8601 (P30D) or simplified suffix formats (30d, 12h). Use simplified suffix formats unless strict ISO-8601 compliance is required.

Secure connection (HTTPS / TLS)​

To connect to a secured (https) Elasticsearch or OpenSearch cluster for secondary storage:

  • Change the URL protocol from http to https.
  • Provide username and password if the cluster requires authentication.
  • Use additional security properties to handle custom certificates or strict hostname verification:
    • Set security.enabled=true (or simply use an https URL if auto-detection applies) to activate SSL/TLS handling.
    • Use security.certificatePath when the server certificate is signed by a custom CA or is self-signed so the JVM can trust it.
    • Set security.selfSigned=true if the certificate is self-signed and the client logic requires this hint.
    • Keep security.verifyHostname=true for production. Disable it only temporarily to diagnose hostname/certificate mismatch issues.
note
  • Import the certificate (or its issuing CA) into the JVM trust store if it is not already trusted.
  • For Kubernetes-based deployments, mount a trust store and point certificatePath to it.

Index & retention settings​

Properties such as camunda.data.secondary-storage.elasticsearch.number-of-shards control index creation characteristics (shards, replicas, template priority) and retention/lifecycle policies for Orchestration Cluster indices.

note

Shards/replicas and template priority overrides are not currently exposed as Helm values. Configure these via environment variables or application.yaml properties if supported by your runtime version.

Replica count changes (number-of-replicas and per-index overrides`)​

  • For newer versions (8.8+), changes are applied to existing indices on the next application restart, with settings updated in place.
  • These are also written to the index templates so that newly created indices inherit the updated replica configuration.

Shard count changes (number-of-shards and per-index overrides`)​

  • These are only applied to index templates, affecting indices created after the change.
  • Existing indices retain their original shard layout.

Template priority changes​

  • Adjusts which template is applied when multiple patterns match.
  • The effect is only for indices created after the change.
note

Some Elasticsearch and OpenSearch deployments may ship predefined wildcard (* pattern) index templates with their own priorities. Assign a strictly higher priority to the Camunda index templates to ensure Camunda's mappings and settings take precedence when multiple templates match the same index name. If the priority is not higher, provider wildcard templates may override shard/replica defaults, analyzers, or field mappings, leading to unexpected index behavior.

note

Maps (for example, shards/replicas overrides) are key-value objects:

camunda.data.secondary-storage.elasticsearch.number-of-shards-per-index:
  list-view: 3
  task: 2

Data - exporters​

warning

When Elasticsearch/OpenSearch Exporter indices and Orchestration Cluster indices share the same Elasticsearch or OpenSearch cluster, they must use different index prefixes. One prefix must not be the beginning of the other (for example, avoid custom and custom-zeebe together because custom* matches both). Do not use operate, tasklist, or camunda as the full exporter prefix, and do not use zeebe-record as the Orchestration Cluster index prefix, as zeebe-record is the default prefix for Elasticsearch/OpenSearch Exporter indices.

The exporter prefix is configured via camunda.data.exporters.elasticsearch.args.index-prefix (or CAMUNDA_DATA_EXPORTERS_{ELASTICSEARCH|OPENSEARCH}_ARGS_INDEX_PREFIX).

For detailed requirements, configuration examples, and common mistakes, see index prefix configuration.

camunda.data.exporters​

PropertyDescriptionDefault value
camunda.data.exporters.elasticsearch.class-name

Fully qualified class name pointing to the class implementing the exporter interface.

'io.camunda.zeebe.exporter.ElasticsearchExporter'
camunda.data.exporters.elasticsearch.jar-path

Path to the JAR file containing the exporter class

Optional field: if missing, will lookup the class in the zeebe classpath.

-
camunda.data.exporters.elasticsearch.argsMap of arguments to use when instantiating the exporter.-

Expression​

See expressions.

camunda.expression​

PropertyDescriptionDefault value
camunda.expression.timeout

The timeout for expression evaluation. If an expression takes longer to evaluate than this timeout, the evaluation will be interrupted. An incident is raised if the expression is evaluated for a process instance.

Setting a lower value avoids the expression evaluation blocking the execution of other process instances on the same partition for too long. We recommend keeping this below five seconds to avoid unhealthy partitions due to 'actor appears blocked'.

5s

Licensing​

Installations of Camunda 8 Self-Managed that require a license can provide their license key to the components. See licensing.

camunda.license​

PropertyDescriptionDefault value
camunda.license.key

Your Camunda 8 license key, if your installation requires a license.

Null

Monitoring​

camunda.monitoring​

PropertyDescriptionDefault value
camunda.monitoring.metrics.actorControls whether to collect metrics about actor usage such as actor job execution latencies.true
camunda.monitoring.metrics.enable-exporter-execution-metricsEnable exporter execution metrics.false
camunda.monitoring.jfrAllows registering and tracking metrics based on JFR events.true

Process instance creation​

camunda.process-instance-creation​

PropertyDescriptionDefault value
camunda.process-instance-creation.business-id-uniqueness-enabled

When enabled, process instance creation is rejected if a root process instance of the same process definition is already active with the same business ID.

Requires the process instance creation request to include a businessId. See business ID uniqueness control.

false

Processing​

camunda.processing​

PropertyDescriptionDefault value
camunda.processing.max-commands-in-batch

Sets the maximum number of commands processed within one batch.

The processor will process until no more follow-up commands are created by the initial command or the configured limit is reached.

Can be set to 1 to disable batch processing.

Must be a positive integer number.

Note that the resulting batch may contain more entries than this limit because it includes follow-up events. If the resulting batch is too large (see maxMessageSize), processing will be rolled back and retried with a smaller maximum batch size.

100
camunda.processing.scheduled-tasks-check-interval

Configures how often a partition leader checks for expired scheduled tasks (for example, due date checking).

Use a lower interval to potentially decrease delays between requested and actual execution, but note that low values can create unnecessary load while idle; benchmark changes.

1s
camunda.processing.skip-positions

Allows skipping certain commands by their position.

This is intended for debugging and data recovery and is not recommended for production use.

The value is a comma-separated list of positions to skip. Whitespace is ignored.

camunda.processing.engine.distribution.max-backoff-durationAllows configuring the maximum backoff duration for command redistribution retries. The retry interval is doubled after each retry until it reaches this maximum duration.5m
camunda.processing.engine.distribution.redistribution-intervalAllows configuring command redistribution retry interval. This is the initial interval used when retrying command distributions that have not been acknowledged.10s
camunda.processing.engine.job.include-variables-in-job-completed-event

Specifies whether variables are included in the JobIntent.COMPLETED follow-up event.

When set to false (default), the event is emitted without variables. This prevents ExceededBatchRecordSizeException when a job completes with very large variables. Without this setting, the JobIntent.COMPLETE command could be rejected and the job could time out.

When set to true, variables are included in the event, matching the behavior in releases earlier than 8.10.

Exporters or integrations that need completion variables can read them from the JobIntent.COMPLETE command record or the follow-up ProcessEvent.TRIGGERING event. Both records always include the variables regardless of this setting.

false
camunda.processing.engine.secrets.interval

Sets the idle fallback cadence at which the broker checks for secret references that are waiting to be resolved.

Resolution runs in the background, off the processing path, so a slow secret store cannot stall processing. Under a steady stream of pending references, wake-delay governs how quickly cycles repeat; this interval instead bounds how long a scheduler that has found nothing to resolve waits before checking again.

The interval is an upper bound on the wait, not a fixed cadence. A cycle that reaches batch-resolution-limit and makes progress, or reaches its record batch capacity, schedules the next cycle immediately. While a store is in retry backoff, the next cycle is scheduled for that store's retry deadline when it falls sooner than this interval.

5s
camunda.processing.engine.secrets.wake-delay

Sets how soon the next cycle runs after one that resolved a reference, or after an activation requested a resolution since the last cycle ran.

Under a steady stream of pending references, this is the effective cadence: cycles run close to this delay apart rather than at interval, which only governs an idle scheduler's slower fallback cadence. A cycle that neither makes progress nor is woken backs off geometrically from this value up to interval instead of jumping straight there.

Lower it to reduce activation latency under a steady load, at the cost of polling stores more often.

50ms
camunda.processing.engine.secrets.batch-resolution-limit

Sets the maximum number of pending secret references the broker resolves in one cycle.

References beyond the limit stay pending and are picked up by a later cycle, so the limit bounds the work per cycle rather than discarding anything. When a cycle reaches the limit, the next cycle starts immediately instead of waiting interval.

Raise it to clear a large backlog faster, at the cost of more concurrent load on the secret stores.

20
camunda.processing.engine.secrets.retry-max-attempts

Sets how many consecutive attempts the broker makes against an unavailable secret store before it stops retrying.

The value counts the initial attempt and subsequent retries. At the default of 3, the broker tries the store once and retries twice. After the third failure, the broker fails every reference still pending for that store. Those failures raise an incident for the jobs waiting on them. Attempts are counted per store rather than per secret, and the count is held in memory only, so it resets when the broker restarts or the partition changes leader.

A secret that the store reports as missing or forbidden is not retried at all, because that failure is permanent.

3
camunda.processing.engine.secrets.retry-initial-delay

Sets the delay before the first retry after a secret store becomes unavailable.

For each subsequent attempt, the broker multiplies the delay by retry-backoff-factor, up to retry-max-delay.

1s
camunda.processing.engine.secrets.retry-backoff-factor

Sets the multiplier applied to the retry delay after each consecutive secret store failure.

A value of 1 keeps the delay constant at retry-initial-delay. Higher values increase the delay more quickly, up to retry-max-delay.

2
camunda.processing.engine.secrets.retry-max-delay

Sets the longest delay the broker waits between retries of an unavailable secret store.

The delay grows from retry-initial-delay by retry-backoff-factor on each attempt and is capped at this value.

30s
camunda.processing.enable-preconditions-check

Configures whether basic RocksDB operations (for example, insert/delete) should check preconditions (for example, key does not already exist when inserting).

false
camunda.processing.enable-foreign-key-checks

Configures whether inserting or updating key-value pairs in RocksDB should check that foreign keys exist.

false
camunda.processing.enable-yielding-duedate-checker

Changes the due date timer checker behavior to yield to other processing steps when there are very many timers.

This avoids worst-case situations where processing could be blocked for an indefinite amount of time and the node becomes unhealthy.

Under sustained high load, yielding can cause activated timers to fall behind real time.

true
camunda.processing.enable-async-message-ttl-checker

When enabled, the message TTL checker runs asynchronously to the engine stream processor.

This can improve throughput/latency when many messages with a non-zero TTL are published. Test in non-production before enabling.

false
camunda.processing.enable-async-timer-duedate-checker

When enabled, the due date checker runs asynchronously to the engine stream processor.

This can improve throughput/latency when there are many timers. Test in non-production before enabling.

false
camunda.processing.enable-straightthrough-processing-loop-detectortrue
camunda.processing.enable-message-body-on-expired

Controls whether the full message body is included in the follow-up event when a message expires.

When enabled, full message details can be exported by allowing Message.EXPIRED events, but it increases follow-up event size and can reduce how many messages can be expired per batch, potentially impacting performance and growth of expired message state.

false
camunda.processing.flow-control.request.enabled

Enable request limiting for user requests (takes precedence over backpressure configuration).

true
camunda.processing.flow-control.request.windowed

Use windowed request limiting.

true
camunda.processing.flow-control.request.algorithm

The request limiting algorithm to use.

Supported values: aimd, fixed, vegas, gradient, gradient2, legacy-vegas.

aimd
camunda.processing.flow-control.request.aimd.request-timeout

AIMD: request timeout used by the algorithm.

200ms
camunda.processing.flow-control.request.aimd.initial-limit

AIMD: initial request limit.

100
camunda.processing.flow-control.request.aimd.min-limit

AIMD: minimum request limit.

1
camunda.processing.flow-control.request.aimd.max-limit

AIMD: maximum request limit.

1000
camunda.processing.flow-control.request.aimd.backoff-ratio

AIMD: backoff ratio applied when backing off.

0.9
camunda.processing.flow-control.request.fixed.limit

Fixed: constant request limit.

20
camunda.processing.flow-control.request.gradient.min-limit

Gradient: minimum request limit.

10
camunda.processing.flow-control.request.gradient.initial-limit

Gradient: initial request limit.

20
camunda.processing.flow-control.request.gradient.rtt-tolerance

Gradient: RTT tolerance used by the algorithm.

2.0
camunda.processing.flow-control.request.gradient2.min-limit

Gradient2: minimum request limit.

10
camunda.processing.flow-control.request.gradient2.initial-limit

Gradient2: initial request limit.

20
camunda.processing.flow-control.request.gradient2.rtt-tolerance

Gradient2: RTT tolerance used by the algorithm.

2.0
camunda.processing.flow-control.request.gradient2.long-window

Gradient2: long-window size used by the algorithm.

600
camunda.processing.flow-control.request.vegas.alpha

Vegas: alpha parameter.

3
camunda.processing.flow-control.request.vegas.beta

Vegas: beta parameter.

6
camunda.processing.flow-control.request.vegas.initial-limit

Vegas: initial request limit.

20
camunda.processing.flow-control.request.legacy-vegas.initial-limit

Legacy Vegas: initial request limit.

1024
camunda.processing.flow-control.request.legacy-vegas.max-concurrency

Legacy Vegas: maximum concurrency.

1024*32
camunda.processing.flow-control.request.legacy-vegas.alpha-limit

Legacy Vegas: alpha limit parameter.

0.7
camunda.processing.flow-control.request.legacy-vegas.beta-limit

Legacy Vegas: beta limit parameter.

0.95
camunda.processing.flow-control.write.enabled

Enable write rate limiting.

false
camunda.processing.flow-control.write.limit

Sets the maximum number of records written per second.

0
camunda.processing.flow-control.write.ramp-up

Sets the ramp up time for reaching the configured write rate limit (for example, 10s).

0s
camunda.processing.flow-control.write.throttle.enabled

Enable throttling. If enabled, throttle the write rate based on exporting backlog.

false
camunda.processing.flow-control.write.throttle.acceptable-backlog

When exporting is a bottleneck, the write rate is throttled to keep the backlog at this value.

100000
camunda.processing.flow-control.write.throttle.minimum-limit

Even when exporting is fully blocked, always allow this many writes per second.

100
camunda.processing.flow-control.write.throttle.resolution

How often to adjust the throttling.

100s

Secrets​

Configure the secret stores and cache used to resolve camunda.secrets.<name> references in process variables.

This configuration is part of an alpha feature and may be subject to change in future releases. See Secret resolution for the reference syntax and how references are resolved.

note

This secret store configuration applies only to Self-Managed. In SaaS, the secret store is provisioned and managed for you, so you don't configure a store type, path, or credentials. Manage secret values on the cluster's Cluster secrets tab and reference them as camunda.secrets.<key>. See Manage connector secrets.

camunda.secrets.* sets the defaults inherited by every physical tenant. Override them per physical tenant under camunda.physical-tenants.<tenant-key>.secrets.*. See Validation and constraints in the Physical Tenants configuration reference.

<id> is the store identifier and must be default. Each physical tenant supports exactly one secret store across all store types. For example, configuring both a file store and an AWS store counts as two stores.

Camunda validates this constraint against the merged configuration for each tenant. If a tenant inherits a store, you cannot add another store under a different ID to override it. To override an inherited store, reuse the default ID.

A secret name must match [\p{Alnum}_-]+ and be at most 240 characters to be listed and resolved through /v2/secrets (the reference camunda.secrets.<name> is capped at 256 characters, and the camunda.secrets. prefix takes 16 of those). A period (.), such as the one used in a file extension, falls outside the allowed character set. Camunda stores a secret whose name fails either check, but omits it from list results and cannot resolve it by reference.

File store​

The default path below only takes effect once a file store is declared somewhere in the merged configuration. If you don't declare a file store, the physical tenant uses a no-op store: it cannot resolve secrets and does not read a directory.

PropertyDescriptionDefault value
camunda.secrets.stores.file.<id>.pathPath to the directory backing this file-based secret store, once the store is declared. Each file in the directory is one secret: the file name is the secret name and the file contents are the value./etc/camunda/secrets

AWS Secrets Manager store​

Configuration for a secret store backed by AWS Secrets Manager. Authentication is always identity-based, via the AWS SDK's default credentials provider chain. No static credentials are accepted at all. Secrets are always read at the AWSCURRENT version stage; pinning to a different stage is not supported.

PropertyDescriptionDefault value
camunda.secrets.stores.aws.<id>.regionAWS region for this store. Optional: when omitted, the SDK resolves it from the environment (AWS_REGION) or instance metadata.-
camunda.secrets.stores.aws.<id>.path-prefixPrefix prepended, with no separator inserted, to every reference name to form the AWS secret ID (for example, prefix camunda/ plus reference db-password resolves to secret ID camunda/db-password; include the trailing separator here if one is wanted). When omitted, references map to bare secret names. Also applies to container-secret-id, since that is itself resolved as an AWS secret ID. Without container-secret-id, this prefix also filters what /v2/secrets lists: only secrets whose ID starts with it are returned, with the prefix stripped from the listed name. With container-secret-id set, listing returns the container secret's own JSON keys instead, unaffected by this prefix.-
camunda.secrets.stores.aws.<id>.batch-enabledResolve secrets via AWS's BatchGetSecretValue (fewer round-trips) instead of one GetSecretValue call per reference. Requires the secretsmanager:BatchGetSecretValue IAM action in addition to GetSecretValue. Mutually exclusive with container-secret-id: configuring both is rejected at startup.false
camunda.secrets.stores.aws.<id>.batch-sizeMaximum number of secret IDs per BatchGetSecretValue call; only has an effect when batch-enabled is set. Must be between 1 and 20, which is the AWS limit. Camunda validates this range at startup even when batching is disabled.20
camunda.secrets.stores.aws.<id>.container-secret-idInstead of one AWS secret per reference, treat every reference as a JSON key inside this one named secret. Mutually exclusive with batch-enabled: batching fetches several distinct secrets in one call, while a container secret ID means only one secret is ever fetched.-

Without container-secret-id, listing and the startup connectivity check use secretsmanager:ListSecrets, and resolving uses GetSecretValue (plus BatchGetSecretValue when batch-enabled). With container-secret-id, both listing and resolving read only the one container secret via GetSecretValue; ListSecrets is not needed.

An invalid batch-size, configuring both batch-enabled and container-secret-id, or a client build failure causes startup to fail.

An invalid region, unreachable endpoint, or invalid credentials instead produces a warning at startup. Camunda still creates the store, and the configuration error surfaces on the first resolve or list request. A secret whose value lives only in secretBinary (no string value) cannot be resolved and fails with an invalid-reference error.

In container-secret mode, the named secret's value must be a flat JSON object mapping each reference name to a JSON string value, for example {"db-password": "s3cr3t"}. Nested objects and arrays are not supported. If the value is invalid JSON or is not a JSON object, every reference fails to resolve and the list request fails.

If a key is missing or has a JSON null value, only that reference fails as not found. If a key exists but its value is not a string, only that reference fails as invalid.

GCP Secret Manager store​

Configuration for a secret store backed by GCP Secret Manager. Authentication uses the GCP Application Default Credentials chain. Secrets are always read at the latest version; pinning to a specific version is not supported.

PropertyDescriptionDefault value
camunda.secrets.stores.gcp.<id>.project-idID of the GCP project that owns the secrets. Optional when a default project can be resolved from the environment (GOOGLE_CLOUD_PROJECT), gcloud's default project, or the compute metadata server, via the Application Default Credentials chain. If none of these sources provides a project ID, startup fails. A missing project ID is a configuration error, not a transient connectivity problem.-
camunda.secrets.stores.gcp.<id>.path-prefixPrefix prepended to every reference name to form the GCP secret ID. Camunda does not insert a separator. For example, the prefix camunda- and reference db-password resolve to the secret ID camunda-db-password. Include a trailing separator in the prefix if needed. When omitted, references map to bare secret IDs. Also applies to container-secret-id, since that is itself resolved as a GCP secret ID. Must contain only [a-zA-Z0-9_-]; a prefix with any other character is rejected at startup. Without container-secret-id, this prefix also filters what /v2/secrets lists: only secrets whose ID starts with it are returned, with the prefix stripped from the listed name. With container-secret-id set, listing returns the container secret's own JSON keys instead, unaffected by this prefix.-
camunda.secrets.stores.gcp.<id>.endpointSecret Manager endpoint override, for example a regional endpoint such as secretmanager.europe-west1.rep.googleapis.com:443, or a Private Service Connect endpoint. There is no equivalent property for the AWS store: the AWS SDK picks up an endpoint override from its own environment variables, so none is exposed here, while the GCP client libraries do not, which is why this property exists. When omitted, the default global endpoint is used.-
camunda.secrets.stores.gcp.<id>.container-secret-idInstead of one GCP secret per reference, treat every reference as a JSON key inside this one named secret. Must contain only [a-zA-Z0-9_-], the same as path-prefix. When set, the combined length of path-prefix plus container-secret-id must not exceed 255 characters; exceeding it is rejected at startup.-

A missing project ID (above) and a client that fails to build both fail startup outright. An invalid project, unreachable endpoint, or invalid credentials instead causes the connectivity check to log a warning at startup. Camunda still creates the store, and the configuration error surfaces on the first resolve or list request.

GCP secret IDs allow only [a-zA-Z0-9_-] and are capped at 255 characters. Both path-prefix and container-secret-id contribute to secret IDs. An AWS-style camunda/ prefix contains a slash and therefore produces invalid IDs. For GCP, use a prefix such as camunda- instead.

Camunda performs the combined-length check only when container-secret-id is set. It does not validate the length of per-reference IDs in flat mode at startup, so an overlong prefix is detected only during resolution.

In container-secret mode, the named secret's value must be a flat JSON object mapping each reference name to a JSON string value, for example {"db-password": "s3cr3t"}. Nested objects and arrays are not supported: if the value is not valid JSON, or is JSON but not an object, every reference fails to resolve and listing fails outright rather than returning an empty list. If a key is absent, or present with a JSON null value, only that one reference fails, as not found; if a key's value is present but not a string, only that one reference fails, as invalid.

Secret cache​

One cache is created per configured store.

PropertyDescriptionDefault value
camunda.secrets.cache.ttlHow long a resolved secret is served from the cache before it is fetched from the store again, so a secret rotated in the store is picked up without a restart. Must be at least 1m and a whole number of minutes; a shorter or fractional value is rejected at startup.20m
camunda.secrets.cache.max-sizeMaximum number of secrets held in each store's cache. Once reached, caching another secret evicts one already held; which one is the cache implementation's choice. This limit applies to each cache independently. The maximum number of cached secret entries across all stores is the number of configured stores multiplied by this value. Must be at least 1.1000

Concurrency​

Applies only to a store whose cost scales with the number of names requested (for example, AWS Secrets Manager without batch-enabled, which issues one GetSecretValue call per name). A store that resolves a whole request in a single call, such as the file store or a store using container-secret-id, is unaffected.

PropertyDescriptionDefault value
camunda.secrets.max-concurrencyMaximum number of concurrent backend calls in flight for such a store, shared by every such store this physical tenant configures. Lower it to help stay within a provider's rate limit (for example, an AWS Secrets Manager or GCP Secret Manager API quota); the bound approximates rather than guarantees this, since a request that resolves in a single call takes no permit and isn't counted. Raising the value above what a single request can use has no further effect. Must be at least 1.max(8, 2 × available processors)

Security​

note

Physical Tenant deployments use additional cluster administrator settings under camunda.security.cluster-admin.*. For more information, see authentication and authorization for Physical Tenants.

camunda.persistent.sessions​

PropertyDescriptionDefault value
camunda.persistent.sessions.enabledLegacy name for camunda.security.session.persistent.enabled. Still supported, and mapped to the current property at startup.false

camunda.security​

PropertyDescriptionDefault value
camunda.security.id-validation-patternA Java regular expression that validates the user-defined identifiers of Identity-related entities.^[a-zA-Z0-9_@.+-]+$

camunda.security.session​

PropertyDescriptionDefault value
camunda.security.session.persistent.enabledStores session data in secondary storage so users stay logged in across cluster nodes.false
camunda.security.session.max-inactive-intervalHow long a session can go without activity before it is treated as expired. Format: ISO 8601 duration (PnDTnHnMn.nS).PT30M
camunda.security.session.heartbeat.enabledWhen disabled, any non-polling request extends the session. When enabled, only a call to the POST {basePath}/session/heartbeat endpoint extends the session, and ordinary application requests no longer count as activity.false

camunda.security.authentication​

PropertyDescriptionDefault value
camunda.security.authentication.authentication-refresh-intervalThe interval at which the memberships (groups, roles, tenants, component authorizations) are refreshed for logged in users. Find more details in webserver and security.PT30S
camunda.security.authentication.methodThe authentication method to use. Options: basic, oidc.basic
camunda.security.authentication.unprotected-apiIf the API can be used without authentication.false

camunda.security.csrf​

PropertyDescriptionDefault value
camunda.security.csrf.enabledEnables or disables CSRF protection. Disabling CSRF protection is not recommended for production environments as it leaves your application vulnerable to cross-site request forgery attacks.true
camunda.security.csrf.cookie-http-onlySets HttpOnly on the X-CSRF-TOKEN cookie. Leave this false for browser-facing web applications, which need to read the token from JavaScript. Set it to true only if you exclusively serve API clients that read the token from response headers.false
camunda.security.csrf.ignored-path-patternsAnt-style path patterns that CSRF protection ignores, in addition to the unprotected paths and the login and logout endpoints, which are always ignored.
caution

Disabling CSRF protection is not recommended for production environments as it leaves your application vulnerable to cross-site request forgery attacks. ignored-path-patterns has the same effect for any path it matches. Scope patterns as narrowly as possible, such as a specific API endpoint that doesn't rely on session-cookie authentication, rather than a broad prefix.

camunda.security.http-headers​

PropertyDescriptionRelated HeaderDefault value
camunda.security.http-headers.cache-control.enabledEnables or disables cache prevention headers. Default values: Cache-Control: no-cache, no-store, max-age=0, must-revalidate, Pragma: no-cache, Expires: 0.Cache-Control, Pragma, Expirestrue
camunda.security.http-headers.content-security-policy.enabledEnables or disables CSP headers.Content-Security-Policytrue
camunda.security.http-headers.content-security-policy.modeSelects the built-in default policy. Options: SELF_MANAGED, SAAS, CUSTOM. policy-directives applies whenever it is set, regardless of this setting. Setting CUSTOM without also setting policy-directives sends no Content-Security-Policy header at all.Content-Security-PolicySELF_MANAGED
camunda.security.http-headers.content-security-policy.policy-directivesCustom CSP directives, applied whenever set, regardless of mode. If not set, default values applied.Content-Security-Policy
camunda.security.http-headers.content-security-policy.report-onlyEnables reporting mode without enforcing policies.Content-Security-Policy-Report-Onlyfalse
camunda.security.http-headers.content-type-options.enabledEnables or disables X-Content-Type-Options header with nosniff value.X-Content-Type-Optionstrue
camunda.security.http-headers.cross-origin-embedder-policy.valueRestricts embedded cross-origin resources. Options: REQUIRE_CORP, UNSAFE_NONE.Cross-Origin-Embedder-PolicyUNSAFE_NONE
camunda.security.http-headers.cross-origin-opener-policy.valueIsolates windows from cross-origin openers. Options: UNSAFE_NONE, SAME_ORIGIN_ALLOW_POPUPS, SAME_ORIGIN.Cross-Origin-Opener-PolicySAME_ORIGIN_ALLOW_POPUPS
camunda.security.http-headers.cross-origin-resource-policy.valueDeclares whether resources can be loaded cross-origin. Options: SAME_ORIGIN, SAME_SITE, CROSS_ORIGIN.Cross-Origin-Resource-PolicySAME_SITE
camunda.security.http-headers.frame-options.enabledEnables or disables X-Frame-Options header. Default value is SAMEORIGIN.X-Frame-Optionstrue
camunda.security.http-headers.frame-options.modeFrame options mode. Options: DENY, SAMEORIGIN.X-Frame-OptionsSAMEORIGIN
camunda.security.http-headers.hsts.enabledEnables or disables Strict-Transport-Security header.Strict-Transport-Securitytrue
camunda.security.http-headers.hsts.include-subdomainsApplies HSTS to all subdomains.Strict-Transport-Securityfalse
camunda.security.http-headers.hsts.max-age-in-secondsHSTS max age in seconds.Strict-Transport-Security31536000
camunda.security.http-headers.hsts.preloadEnables HSTS preloading.Strict-Transport-Securityfalse
camunda.security.http-headers.permissions-policy.valueRestricts access to browser capabilities.Permissions-PolicyDisables all features by default
camunda.security.http-headers.referrer-policy.valueControls referrer information sharing. See available values below.Referrer-PolicySTRICT_ORIGIN_WHEN_CROSS_ORIGIN
caution

Setting content-security-policy.mode to CUSTOM without also setting policy-directives sends no Content-Security-Policy header at all, which leaves your application without the protection the default policy provides. Always set policy-directives when you use CUSTOM.

Default Content Security Policy​

This is default value of the Content Security Policy when enabled:

default-src 'self';
base-uri 'self';
script-src 'self' https: *.chargebee.com *.mixpanel.com ajax.cloudflare.com static.cloudflareinsights.com;
script-src-elem 'self' cdn.jsdelivr.net ;
connect-src 'self' https: *.mixpanel.com cloudflareinsights.com *.appcues.net wss://api.appcues.net cdn.jsdelivr.net;
style-src 'self' https: 'unsafe-inline' cdn.jsdelivr.net *.googleapis.com *.chargebee.com;
img-src data: 'self';
form-action 'self';
frame-ancestors 'self';
frame-src 'self' https: *.chargebee.com blob: ;
object-src 'self' blob:;
font-src 'self' data: fonts.camunda.io cdn.jsdelivr.net;
worker-src 'self' blob:;
child-src;
script-src-attr 'none'.

camunda.security.authentication.oidc​

PropertyDescriptionDefault value
camunda.security.authentication.oidc.client-idThe client ID for OIDC authentication.
camunda.security.authentication.oidc.client-secretThe client secret for OIDC authentication. Only takes effect if camunda.security.authentication.oidc.client-authentication-method is set to client_secret_basic or left default.
camunda.security.authentication.oidc.issuer-uriThe issuer URI for OIDC authentication. If set, the individual endpoints of your OIDC provider will be fetched from its well-known configuration endpoint. In this case, any individually configured token, authorization, and JWKS URIs do not take effect.
camunda.security.authentication.oidc.redirect-uriThe URI for redirects from the OIDC provider to the Orchestration Cluster after user login.http://localhost:8080/sso-callback
camunda.security.authentication.oidc.username-claimThe JWT claim that identifies a user. Extracted from a token, this claim value becomes the user's username. This setting is evaluated on any token-based access, regardless of the underlying OIDC/OAuth flow.sub
camunda.security.authentication.oidc.groups-claimThe JWT claim that contains a user's or client's groups. Expects an array of String values. If not set, groups can be managed in the Orchestration Cluster through its REST APIs.
camunda.security.authentication.oidc.client-id-claimThe JWT claim that identifies a client. Extracted from a token, this claim value becomes the client ID. This setting is evaluated on any token-based access, regardless of the underlying OIDC/OAuth flow.
camunda.security.authentication.oidc.prefer-username-claimDetermines if a token that contains both, the configured username claim and the configured client id claim, is treated as a user or a client. If set to true, it is treated as a user. If set to false, it is treated as a client.false
camunda.security.authentication.oidc.prefer-id-token-claimsIf enabled, claims are read from the ID token and the user info endpoint instead of the access token. Use this when the access token is signed by a key set that Camunda cannot reach, or does not contain the claims Camunda needs.false
camunda.security.authentication.oidc.audiencesComma-separated list of audiences to validate in the OIDC token.
camunda.security.authentication.oidc.scopeComma-separated list of scopes to request in the OIDC token.openid, profile
camunda.security.authentication.oidc.jwk-set-uriSets the OIDC provider's JWK Set URI explicitly. If set, overrides the value discovered from camunda.security.authentication.oidc.issuer-uri.
camunda.security.authentication.oidc.additional-jwk-set-urisSets additional JWK Set URIs for key resolution. Use this when your identity provider hosts signing keys at multiple JWKS endpoints (for example, separate endpoints for machine-to-machine access tokens and user session tokens). Keys are resolved from the primary jwk-set-uri first, then from each additional URI in order.
camunda.security.authentication.oidc.authorization-uriSets the OIDC provider's authorization URI explicitly. If set, overrides the value discovered from camunda.security.authentication.oidc.issuer-uri.
camunda.security.authentication.oidc.token-uriSets the OIDC provider's token URI explicitly. If set, overrides the value discovered from camunda.security.authentication.oidc.issuer-uri.
camunda.security.authentication.oidc.authorize-request-configuration.additional-parametersSets a map of additional parameters to send to your IDP during the authorzation flow.
camunda.security.authentication.oidc.end-session-endpoint-uriSets the OIDC provider's end session endpoint URI explicitly. If set, overrides the value discovered from camunda.security.authentication.oidc.issuer-uri.
camunda.security.authentication.oidc.idp-logout-enabledIf enabled, users will be logged out of the identity provider when logging out of the Orchestration Cluster.true
camunda.security.authentication.oidc.client-authentication-methodSets the client authentication method to use. Options: client_secret_basic, private_key_jwt.client_secret_basic
camunda.security.authentication.oidc.user-info-enabledIf enabled, will enrich the access token with information from the /userinfo endpoint. See section 5.3 of the OIDC specification.. Generally safe to leave true, but can be safely disabled if you do not need additional claims from this endpoint (e.g. in case you are rate-limited by your provider).true
camunda.security.authentication.oidc.user-info-uriSets the OIDC provider's user info URI explicitly. If set, overrides the value discovered from the issuer URI.
camunda.security.authentication.oidc.user-info-augmentation.enabledEnables optional enrichment of JWT claims with data from the OIDC user info endpoint.false
camunda.security.authentication.oidc.user-info-augmentation.cache-ttlHow long a successful user info response is cached. Format: ISO 8601 duration (PnDTnHnMn.nS).PT5M
camunda.security.authentication.oidc.user-info-augmentation.cache-max-sizeThe maximum number of user info responses held in the cache.10000
camunda.security.authentication.oidc.user-info-augmentation.negative-cache-ttlHow long a failed user info lookup is cached before it is retried. Format: ISO 8601 duration (PnDTnHnMn.nS).PT5S
camunda.security.authentication.oidc.clock-skewSets the allowed clock skew when validating JWT issuance and expiration. Format: ISO 8601 duration (PnDTnHnMn.nS).60S
camunda.security.authentication.oidc.id-token-algorithmSets the ID token signature algorithm.RS256
camunda.security.authentication.oidc.resourceList of resource indicators to include in token and authorization requests. Used to specify target resources as defined in RFC 8707.
camunda.security.authentication.oidc.diagnostics.enabledEnables additional diagnostic logging during the OIDC authentication flow to help identify common misconfigurations. Intended for troubleshooting only; disable in production environments.false
caution

Enabling prefer-id-token-claims changes which token's claims are trusted for authorization decisions, from the access token to the ID token and user info response. Audience semantics differ between the two: the access token's audience identifies the API it authorizes access to, while the ID token's audience identifies the client the token was issued to. Only enable this to work around an access token that Camunda cannot validate or that is missing required claims, not as a default choice.

camunda.security.authentication.oidc.assertion​

Configuration options for the client assertion used in Bearer JWT client authentication.

note

These properties apply only when camunda.security.authentication.oidc.client-authentication-method is set to private_key_jwt. The key value refers to the private key ID used to sign the client assertion JWT.

PropertyDescriptionDefault value
camunda.security.authentication.oidc.assertion.kid-sourceSource for generating the key ID. Options: CERTIFICATE, PUBLIC_KEY.PUBLIC_KEY
camunda.security.authentication.oidc.assertion.kid-digest-algorithmHash algorithm used to generate the key ID. Options: SHA256, SHA1.SHA256
camunda.security.authentication.oidc.assertion.kid-encodingKey ID encoding. Options: BASE64URL, HEX.BASE64URL
camunda.security.authentication.oidc.assertion.kid-caseKey ID case. Only applicable to HEX encoding. Options: UPPER, LOWER.

camunda.security.authentication.oidc.assertion.keystore​

Configuration of the keystore used to build the client assertion for Bearer JWT client authentication.

note

These properties apply only when camunda.security.authentication.oidc.client-authentication-method is set to private_key_jwt.

PropertyDescriptionDefault value
camunda.security.authentication.oidc.assertion.keystore.pathPath to the PKCS12 keystore.
camunda.security.authentication.oidc.assertion.keystore.passwordKeystore password.
camunda.security.authentication.oidc.assertion.keystore.key-aliasAlias of the private key to be used to sign the client assertion.
camunda.security.authentication.oidc.assertion.keystore.key-passwordPassword of the private key.

camunda.security.authentication.providers.oidc​

Configuration options to connect to multiple identity providers.

note

<provider-id> is a unique, user-defined identifier. All properties that share the same <provider-id> belong to the same identity provider configuration.

PropertyDescriptionDefault value
camunda.security.authentication.providers.oidc.<provider-id>.client-nameThe client name for OIDC authentication.
camunda.security.authentication.providers.oidc.<provider-id>.client-idThe client ID for OIDC authentication.
camunda.security.authentication.providers.oidc.<provider-id>.client-secretThe client secret for OIDC authentication. Only takes effect if camunda.security.authentication.providers.oidc.[provider-id].client-authentication-method is set to client_secret_basic or left default.
camunda.security.authentication.providers.oidc.<provider-id>.issuer-uriThe issuer URI for OIDC authentication, it is required and identifies the identity provider that issues tokens for this configuration. If set, the individual endpoints of your OIDC provider will be fetched from its well-known configuration endpoint.
camunda.security.authentication.providers.oidc.<provider-id>.redirect-uriThe URI for redirects from the OIDC provider to the Orchestration Cluster after user login.http://localhost:8080/sso-callback
camunda.security.authentication.providers.oidc.<provider-id>.audiencesComma-separated list of audiences to validate in the OIDC token.
camunda.security.authentication.providers.oidc.<provider-id>.scopeComma-separated list of scopes to request in the OIDC token.openid, profile
camunda.security.authentication.providers.oidc.<provider-id>.jwk-set-uriSets the OIDC provider's JWK Set URI explicitly. This will override the well-known configuration's value.
camunda.security.authentication.providers.oidc.<provider-id>.additional-jwk-set-urisSets additional JWK Set URIs for key resolution. Use this when your identity provider hosts signing keys at multiple JWKS endpoints (for example, separate endpoints for machine-to-machine access tokens and user session tokens). Keys are resolved from the primary jwk-set-uri first, then from each additional URI in order.
camunda.security.authentication.providers.oidc.<provider-id>.authorization-uriSets the OIDC provider's authorization URI explicitly. This will override the well-known configuration's value.
camunda.security.authentication.providers.oidc.<provider-id>.token-uriSets the OIDC provider's token URI explicitly. This will override the well-known configuration's value.
camunda.security.authentication.providers.oidc.<provider-id>.client-authentication-methodSets the client authentication method to use. Options: client_secret_basic, private_key_jwt.client_secret_basic
camunda.security.authentication.providers.oidc.<provider-id>.resourceList of resource indicators to include in token and authorization requests. Used to specify target resources as defined in RFC 8707.

Client assertion settings are configured per identity provider. Each provider supports the same client assertion properties described in Client assertion configuration and Keystore Client assertion configuration, applied within the scope of the corresponding <provider-id>.

camunda.security.authorizations​

PropertyDescriptionDefault value
camunda.security.authorizations.enabledEnables authorization checks for Orchestration Cluster resources.true

camunda.security.initialization.authorizations​

PropertyDescriptionDefault value
camunda.security.initialization.authorizations.[0].ownerTypeThe owner type to assign to this authorization.
camunda.security.initialization.authorizations.[0].ownerIdThe owner ID to assign to this authorization.
camunda.security.initialization.authorizations.[0].resourceTypeThe resource type that this authorization applies to.
camunda.security.initialization.authorizations.[0].resourceIdThe resource ID that this authorization applies to.
camunda.security.initialization.authorizations.[0].permissionsPermissions to assign to this authorization. The available permissions vary by resource type.

camunda.security.initialization.default-roles​

PropertyDescriptionDefault value
camunda.security.initialization.default-roles.<role>.clients.[0]Clients assigned to the <role> role.
camunda.security.initialization.default-roles.<role>.groups.[0]Groups assigned to the <role> role.
camunda.security.initialization.default-roles.<role>.mappingrules.[0]Mapping rules assigned to the <role> role.
camunda.security.initialization.default-roles.<role>.users.[0]Users assigned to the <role> role.

camunda.security.initialization.groups​

PropertyDescriptionDefault value
camunda.security.initialization.groups.[0].groupIdThe ID of this group.
camunda.security.initialization.groups.[0].nameThe name of this group.
camunda.security.initialization.groups.[0].descriptionThe description of this group.
camunda.security.initialization.groups.[0].clientsThe clients assigned to this group.
camunda.security.initialization.groups.[0].mappingRulesThe mapping rules assigned to this group.
camunda.security.initialization.groups.[0].usersThe users assigned to this group.

camunda.security.initialization.roles​

PropertyDescriptionDefault value
camunda.security.initialization.roles.[0].roleIdThe ID of this role.
camunda.security.initialization.roles.[0].nameThe name of this role.
camunda.security.initialization.roles.[0].descriptionThe description of this role.
camunda.security.initialization.roles.[0].clientsThe clients assigned to this role.
camunda.security.initialization.roles.[0].groupsThe groups assigned to this role.
camunda.security.initialization.roles.[0].mappingRulesThe mapping rules assigned to this role.
camunda.security.initialization.roles.[0].usersThe users assigned to this role.

camunda.security.initialization.tenants​

PropertyDescriptionDefault value
camunda.security.initialization.tenants.[0].tenantIdThe ID of this tenant.
camunda.security.initialization.tenants.[0].nameThe name of this tenant.
camunda.security.initialization.tenants.[0].descriptionThe description of this tenant.
camunda.security.initialization.tenants.[0].clientsThe clients assigned to this tenant.
camunda.security.initialization.tenants.[0].groupsThe groups assigned to this tenant.
camunda.security.initialization.tenants.[0].mappingRulesThe mapping rules assigned to this tenant.
camunda.security.initialization.tenants.[0].rolesThe roles assigned to this tenant.
camunda.security.initialization.tenants.[0].usersThe users assigned to this tenant.

camunda.security.initialization.users​

PropertyDescriptionDefault value
camunda.security.initialization.users.[0].emailThe email address of the first user.
camunda.security.initialization.users.[0].nameThe name of the first user.
camunda.security.initialization.users.[0].passwordThe password of the first user.
camunda.security.initialization.users.[0].usernameThe username of the first user.

camunda.security.initialization.mappingrules​

PropertyDescriptionDefault value
camunda.security.initialization.mappingrules.[0].claim-nameThe claim of the first mapping rule.
camunda.security.initialization.mappingrules.[0].claim-valueThe claim's value of the first mapping rule.
camunda.security.initialization.mappingrules.[0].mapping-rule-idThe id of the first mapping rule.

camunda.security.multi-tenancy​

PropertyDescriptionDefault value
camunda.security.multi-tenancy.api-enabledEnables the multi-tenancy API and UI independently from multi-tenancy checks.true
camunda.security.multi-tenancy.checks-enabledEnables multi-tenancy checks. This requires the API to be protected.false

camunda.security.transport-layer-security.cluster​

PropertyDescriptionDefault value
camunda.security.transport-layer-security.cluster.enabled

Enables TLS authentication for internal cluster (broker-to-broker) communication.

false
camunda.security.transport-layer-security.cluster.certificate-chain-path

Sets the path to the certificate chain file.

camunda.security.transport-layer-security.cluster.certificate-private-key-path

Sets the path to the private key file location.

camunda.security.transport-layer-security.cluster.key-store.file-path

Configures the keystore file containing both the certificate chain and the private key. Currently only supports PKCS12 format.

'./cluster.jks'
camunda.security.transport-layer-security.cluster.key-store.password

Configures the keystore password.

${CLUSTER_KEY_STORE_PW}

spring.profiles​

PropertyDescriptionDefault value
spring.profiles.activeNote: This property will be deprecated as additional authentication methods become available.consolidated-auth

System​

camunda​

PropertyDescriptionDefault value
camunda.mode

Defines the launch mode for Camunda. Use this setting to activate or deactivate features. Valid, non-null values are:

  • all-in-one
  • broker
  • gateway
Values are case-insensitive. If you set this to null, launch modes are disabled and behavior is defined by the active profiles and configuration properties.

null
camunda.insecure

Controls whether security and authentication layers are enabled when you launch the application using camunda.mode. This affects the Gateway (embedded or dedicated), authentication, and authorization. Use this only for development and local testing. Do not use it in production.

false

camunda.webapps​

camunda.webapps.operate​

PropertyDescriptionDefault value
camunda.webapps.operate.enabled

Controls whether Operate is enabled in the Orchestration Cluster.

true
camunda.webapps.operate.ui-enabled

Controls whether the Operate UI is enabled.

true

camunda.webapps.tasklist​

PropertyDescriptionDefault value
camunda.webapps.tasklist.enabled

Controls whether Tasklist is enabled in the Orchestration Cluster.

true
camunda.webapps.tasklist.ui-enabled

Controls whether the Tasklist UI is enabled.

true

camunda.webapps.identity​

PropertyDescriptionDefault value
camunda.webapps.identity.enabled

Controls whether Identity is enabled in the Orchestration Cluster.

true
camunda.webapps.identity.ui-enabled

Controls whether the Identity UI is enabled.

true

camunda.system​

PropertyDescriptionDefault value
camunda.system.cpu-thread-count

Controls the number of non-blocking CPU threads to be used

Warning: You should never specify a value that is larger than the number of physical cores available.

Good practice is to leave 1–2 cores for IO threads and the operating system (it has to run somewhere).

For example, when running Zeebe on a machine which has 4 cores, a good value would be 2.

2
camunda.system.io-thread-count

Controls the number of IO threads to be used.

These threads are used for workloads that write data to disk. While writing, these threads are blocked which means that they yield the CPU.

2
camunda.system.clock-controlled

Controls whether the system clock or mutable one.

If enabled, time progression can be controlled programmatically for testing purposes.

false

camunda.system.restore​

PropertyDescriptionDefault value
camunda.system.restore.validate-configControls whether the restore process validates its configuration (and restore setup) before running.true
camunda.system.restore.ignore-files-in-targetControls which files/folders are ignored when the restore app validates that the Zeebe data directory is “empty enough” before restoring. The property is a list type.[“lost+found”, “directory-initialized.json”]

camunda.system.actor.idle​

PropertyDescriptionDefault value
camunda.system.actor.idle.max-spins

The maximum number of busy-wait spins that an idle actor thread will perform before transitioning to a different idle state in Camunda's actor system.

null
camunda.system.actor.idle.max-yields

The maximum number of yield operations that an idle actor thread will perform before transitioning to the next idle state in Camunda's actor system.

null
camunda.system.actor.idle.max-park-period

The maximum duration that an idle actor thread will remain in the parked state in Camunda's actor system.

null

camunda.system.upgrade​

PropertyDescriptionDefault value
camunda.system.upgrade.enable-version-check

Controls whether the version compatibility check is enforced during migration.

Use this to test migration logic with snapshot or alpha versions.

The default value is true, which means you cannot migrate to incompatible versions such as SNAPSHOT or alpha.

true