Data Prism

Required Environment Variables

• LOADER_PATH

  Directory Spring Boot's PropertiesLauncher scans for extension jars; already set to /app/adapters by the image, but startup still fails with MISSING_SOURCE_ADAPTER until you bind-mount a reviewed DataSourceAdapter/IdentityResolver jar there (see the -v arguments above)

• DATAPRISM_SECURITY_JWT_ISSUER

  OAuth2/OIDC issuer that mints the caller's JWT; required for every protected deployment

• DATAPRISM_SECURITY_JWT_AUDIENCE

  Expected JWT audience claim for this deployment; required for every protected deployment

• DATAPRISM_SECURITY_JWT_JWK_SET_URI

  HTTPS JWKS location used to verify caller JWTs; exactly one of this or DATAPRISM_SECURITY_JWT_ISSUER_DISCOVERY_URI is required, never both

• DATAPRISM_SECURITY_CALLER_CLAIMS_PRINCIPAL

  JWT claim name that carries the caller's principal identifier; required, must differ from the roles and investigation claims

• DATAPRISM_SECURITY_CALLER_CLAIMS_ROLES

  JWT claim name that carries the caller's roles; required, must differ from the principal and investigation claims

• DATAPRISM_SECURITY_CALLER_CLAIMS_INVESTIGATION

  JWT claim name that carries the trusted investigation/case identifier; required, must differ from the principal and roles claims

• DATAPRISM_SECURITY_POLICY_PURPOSES

  Comma-separated list of permitted purposes; at least one is required

• DATAPRISM_SECURITYPOLICY_ROLES_INVESTIGATOR

  Example only — declare DATAPRISM_SECURITYPOLICY_ROLES_<ROLE> per operator-defined role (no underscore between SECURITY and POLICY: Spring Boot's map-key enumeration under a hyphenated dataprism.security-policy.roles.<role> segment only binds the concatenated prefix, verified by binding this property directly against Spring Boot 3.5.16), a comma-separated list of known MCP tool capabilities; at least one role-to-capability mapping is required

• DATAPRISM_PRIVACY_PROFILE

  Name of the reviewed privacy profile implementation to apply; required

• DATAPRISM_PRIVACY_SCOPE_LIFETIME

  Positive duration (e.g. 8h) a privacy scope's synthetic identities remain valid; required

• DATAPRISM_PRIVACY_HMAC_KEY_KEY_ID

  Identifier of the pinned HMAC key used to derive synthetic identities; required

• DATAPRISM_PRIVACY_HMAC_KEY_ENVIRONMENT_VARIABLE

  Name of the environment variable holding the HMAC key material; exactly one of this or DATAPRISM_PRIVACY_HMAC_KEY_PROVIDER_REFERENCE is required, never both, and never a literal key value

• DATAPRISM_AUDIT_SINK

  Audit sink implementation: one of approved-sink, slf4j, hash-chained; required, never downgraded to no-op

• DATAPRISM_AUDIT_WRITER_ID

  Writer/instance identity recorded on every audit entry; required

• DATAPRISM_METRICS_SINK

  Metrics sink binding, currently only micrometer; required in production, never the framework no-op

• DATAPRISM_HAZELCAST_TOPOLOGY

  Cluster read-budget topology: embedded (shared across the cluster) or single-node (enforced per process); required, never defaulted

• DATAPRISM_SOURCES_CUSTOMER_BASE_URL

  Example only — declare DATAPRISM_SOURCES_<NAME>_BASE_URL (HTTPS) per configured source; at least one source, each with its own reviewed DataSourceAdapter bean, is required

• DATAPRISM_SOURCES_CUSTOMER_TIMEOUT

  Example only — declare DATAPRISM_SOURCES_<NAME>_TIMEOUT (positive duration) per configured source; required alongside its base URL