Document Store configuration reference

View as Markdown

The Registry Document Store reads two files: the documents.yaml project that declares access profiles, document policies, and hooks, and the runtime.yaml an operator deploys.

Contract status

File	Kind	Status	Source
`documents.yaml`	`DocumentsProject`	Pre-1.0, may change	`products/documents/generated/project/project.schema.json`
`runtime.yaml`	`DocumentsRuntimeConfig`	Pre-1.0, may change	`products/documents/generated/runtime/runtime.schema.json`

Every mapping is closed: an unknown key is refused with its path. JSON Schema is not the acceptance path: a document these schemas accept still has to pass documentsctl check, which resolves the access profiles each policy names and checks each profile’s role against the policy that uses it. The check also refuses:

an OAuth client listed in requesterClients of two profiles (documents.project.shared-requester-client);
a profile whose principalClaim differs from another profile’s with the same actorKind (documents.project.mixed-principal-claim): every profile of one actor kind reads the subject from one claim;
a hook whose handler.destinationId the runtime configuration does not bind under destinations.hooks (documents.runtime.unbound-hook-destination, at /destinations/hooks), when the check is given both --project and --runtime-config. The runtime refuses to start with the same diagnostic at the same position, before it connects to the database, and documentsctl verification replay, which activates the same hooks, refuses with it too.

A profile’s requesterClients, requiredScopes, actorKind, and principalClaim are what an access token must match, beside the runtime’s authentication.oidc block. Access tokens lists every header and claim a token must carry.

Key paths

A key path writes a property as name, an array item as name[], and a map entry whose name you choose as name.*, as in documentPolicies.*.mandatoryRestrictions.cleanupGraceHours or destinations.hooks.*.url.

`documents.yaml`

Source preview, pre-1.0

Generated from products/documents/generated/project/project.schema.json. 48 key paths. Explained in docs/site/src/content/docs/reference/documents-configuration.mdx.

Key path	Type	Required	Accepted values	Constraints
`accessProfiles`The caller profiles a document policy names, by id.	object	Yes	Not specified	None specified
`accessProfiles.*`Map valueOne declared caller profile.	object	No	Not specified	`propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$`
`accessProfiles.*.actorKind`The actor kind the token must claim.	string	Yes	`human` `service`	None specified
`accessProfiles.*.institution`The institution this profile acts for. The Document Store records it as the issuing institution of every document version a caller under this profile reserves; a profile that names none records none.	string	No	Not specified	`maxLength: 512` `minLength: 1` `pattern: ^[^\u0000-\u001F\u007F-\u009F]+$`
`accessProfiles.*.principalClaimsub`, or the name of another string claim identifying the principal. Every profile of one actor kind names the same claim.	string	Yes	Not specified	`maxLength: 512` `minLength: 1` `pattern: ^[^\u0000-\u001F\u007F-\u009F]+$`
`accessProfiles.*.requesterClients`The OAuth clients whose tokens resolve to this profile; at least one.	array	Yes	Not specified	`minItems: 1` `uniqueItems: true`
`accessProfiles.*.requesterClients[]`Array itemAn identifier another system issues, written exactly as its issuer gives it.	string	No	Not specified	`maxLength: 512` `minLength: 1` `pattern: ^[^\u0000-\u001F\u007F-\u009F]+$`
`accessProfiles.*.requiredScopes`The scopes a token must carry; at least one.	array	Yes	Not specified	`minItems: 1` `uniqueItems: true`
`accessProfiles.*.requiredScopes[]`Array itemAn identifier another system issues, written exactly as its issuer gives it.	string	No	Not specified	`maxLength: 512` `minLength: 1` `pattern: ^[^\u0000-\u001F\u007F-\u009F]+$`
`accessProfiles.*.role`What a caller resolved to this profile is to a document.	string	Yes	`custodian` `recipient` `represented-principal`	None specified
`apiVersion`	string	Yes	`id.registrystack.org/formats/documents/project/v1alpha1`	None specified
`documentPolicies`The policies a document is held under, by id.	object	Yes	Not specified	None specified
`documentPolicies.*`Map valueOne document policy: who may hold, grant, and receive a document held under it, and the restrictions every such document carries.	object	No	Not specified	`propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$`
`documentPolicies.*.custodian`Who holds a document a service places for a named person: the reserving system for its institution, or that person.	string	Yes	`institution` `represented-principal`	None specified
`documentPolicies.*.custodyProfiles`Profiles that may place a document in custody under this policy.	array	Yes	Not specified	`uniqueItems: true`
`documentPolicies.*.custodyProfiles[]`Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, `_`, or `-`.	string	No	Not specified	`pattern: ^[a-z][a-z0-9_-]{0,63}$`
`documentPolicies.*.grantingProfiles`Profiles that may issue a document grant on a document they hold in custody under this policy. A system that only reserved a document for another custodian never grants on it.	array	Yes	Not specified	`uniqueItems: true`
`documentPolicies.*.grantingProfiles[]`Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, `_`, or `-`.	string	No	Not specified	`pattern: ^[a-z][a-z0-9_-]{0,63}$`
`documentPolicies.*.label`Human-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	Yes	Not specified	None specified
`documentPolicies.*.mandatoryRestrictions`The restrictions every document held under a policy carries.	object	Yes	Not specified	None specified
`documentPolicies.*.mandatoryRestrictions.allowedContentTypes`The media types a document may be declared as, matched exactly.	array	Yes	Not specified	`maxItems: 16` `minItems: 1` `uniqueItems: true`
`documentPolicies.*.mandatoryRestrictions.allowedContentTypes[]`Array itemA lowercase concrete media type `type/subtype` without parameters or wildcards, matched exactly.	string	No	Not specified	`pattern: ^[a-z0-9][a-z0-9!#$&^_.+-]{0,126}/[a-z0-9][a-z0-9!#$&^_.+-]{0,126}$`
`documentPolicies.*.mandatoryRestrictions.cleanupGraceHours`Time between the custodian's removal request, or a rejection, and erasure of the bytes, and the length of a reservation's upload window. At least one hour, so an operator always has a window to restore from a mistaken request. Grant expiry and revocation erase nothing: they only stop a grant releasing.	integer	Yes	Not specified	`format: uint32` `maximum: 8760` `minimum: 1`
`documentPolicies.*.mandatoryRestrictions.grantExpiryHours`	integer	Yes	Not specified	`format: uint32` `maximum: 8760` `minimum: 1`
`documentPolicies.*.mandatoryRestrictions.maximumCustodianBytes`The bytes one custodian may hold under this policy, counted over every reserved or stored version not yet erased and checked at reservation.	integer	Yes	Not specified	`format: uint64` `maximum: 1099511627776` `minimum: 1`
`documentPolicies.*.mandatoryRestrictions.maximumDocumentBytes`The largest document a reservation may declare. It may not exceed the deployment ceiling `storage.maximumDocumentBytes`; the runtime refuses to start otherwise.	integer	Yes	Not specified	`format: uint64` `maximum: 1073741824` `minimum: 1`
`documentPolicies.*.mandatoryRestrictions.maximumGrantExpiryHours`	integer	Yes	Not specified	`format: uint32` `maximum: 8760` `minimum: 1`
`documentPolicies.*.recipientProfiles`Profiles a document grant may name as its recipient.	array	Yes	Not specified	`uniqueItems: true`
`documentPolicies.*.recipientProfiles[]`Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, `_`, or `-`.	string	No	Not specified	`pattern: ^[a-z][a-z0-9_-]{0,63}$`
`documentPolicies.*.representedPrincipalGrants`Whether the represented principal may issue document grants itself.	string	Yes	`permitted` `refused`	None specified
`documentPolicies.*.representedPrincipalProfile`The profile a represented principal authenticates under.	string	Yes	Not specified	`pattern: ^[a-z][a-z0-9_-]{0,63}$`
`documentPolicies.*.version`	string	Yes	Not specified	None specified
`hooks`After-commit observer hooks. A project with none omits the member.	array	No	Not specified	None specified
`hooks[]`Array itemOne after-commit observer hook.	object	No	Not specified	None specified
`hooks[].handler`Where an observer hook delivers, chosen by its `type` member: a URL destination the runtime configuration binds under `destinations.hooks`.	object	Yes	Not specified	None specified
`hooks[].handler.destinationId`A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, `_`, or `-`.	string	Yes	Not specified	`pattern: ^[a-z][a-z0-9_-]{0,63}$`
`hooks[].handler.type`	string	Yes	`url`	None specified
`hooks[].id`A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, `_`, or `-`.	string	Yes	Not specified	`pattern: ^[a-z][a-z0-9_-]{0,63}$`
`hooks[].phase`When an observer hook runs relative to the triggering transaction.	string	Yes	`after`	None specified
`hooks[].policies`The document policies whose documents the observer hears about: a change to a document held under any other policy captures nothing for it. Listing them is the operator's declaration of who may receive which documents' events.	array	Yes	Not specified	`minItems: 1` `uniqueItems: true`
`hooks[].policies[]`Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, `_`, or `-`.	string	No	Not specified	`pattern: ^[a-z][a-z0-9_-]{0,63}$`
`hooks[].projection`The fields of the trigger's projection the observer receives.	array	Yes	Not specified	`uniqueItems: true`
`hooks[].projection[]`Array itemAn identifier another system issues, written exactly as its issuer gives it.	string	No	Not specified	`maxLength: 512` `minLength: 1` `pattern: ^[^\u0000-\u001F\u007F-\u009F]+$`
`hooks[].trigger`The committed change an observer hook follows.	string	Yes	`document-grant.changed` `document-version.ready` `document-version.rejected`	None specified
`kind`	string	Yes	`DocumentsProject`	None specified
`project`The members that name a project (CFG-ENV-6): a project's `project` block holds these, and may add project-wide members of the product's own. Schema name `ProjectIdentity`.	object	Yes	Not specified	None specified
`project.id`A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, `_`, or `-`.	string	Yes	Not specified	`pattern: ^[a-z][a-z0-9_-]{0,63}$`
`project.version`	string	Yes	Not specified	None specified

`runtime.yaml`

Source preview, pre-1.0

Generated from products/documents/generated/runtime/runtime.schema.json. 74 key paths. Explained in docs/site/src/content/docs/reference/documents-configuration.mdx.

Key path	Type	Required	Accepted values	Constraints
`apiVersion`	string	Yes	`id.registrystack.org/formats/documents/runtime/v1alpha1`	None specified
`audit`Where the audit journal is written and the key its hashes are made with.	object	Yes	Not specified	None specified
`audit.destination`Where audit entries go: a rotated `file` (the default) or `stdout`.	string	No	`file` `stdout` Schema default, where declared: `"file"`	None specified
`audit.hashKeyRef`Secret reference to the audit hash key.	string	Yes	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`audit.path`The absolute path of the active audit file, for `destination: file`.	string	No	Not specified	`pattern: ^/`
`audit.retentionDays`How many days a sealed audit file is kept, for `destination: file`; 90 when omitted.	integer	No	Not specified	`format: uint32` `maximum: 36500` `minimum: 1`
`audit.rotateBytes`The size at which the active file is sealed and a new one begun, for `destination: file`; 100 MiB when omitted.	integer	No	Not specified	`format: uint64` `maximum: 4294967295` `minimum: 1048576`
`authentication`	object	Yes	Not specified	None specified
`authentication.oidc`The OIDC issuer whose access tokens this runtime accepts, the clients it admits, and the claim carrying their scopes.	object	Yes	Not specified	None specified
`authentication.oidc.allowInsecureHttp`Permit plain HTTP beyond loopback to the configured issuer and to a JWKS URI declared in configuration. TLS remains required unless the operator explicitly accepts this transport risk.	boolean	No	Not specifiedSchema default, where declared: `false`	None specified
`authentication.oidc.allowedClients`Client identifiers whose access tokens are admitted. Required in every file; an omitted or empty list, an empty or repeated client, and `unrestricted` are refused.	array	Yes	Not specified	`minItems: 1` `uniqueItems: true`
`authentication.oidc.allowedClients[]`Array item	string	No	Not specified	`minLength: 1`
`authentication.oidc.assertionIssuers`Assertion authorities each client may exchange a subject token from, keyed by client identifier. Omitted, no assertion-issuer rule applies; written, it lists at least one client, each with at least one authority. Once a client is listed, a token it exchanged is accepted only for one of that client's declared authorities, and a client that is not listed may exchange from no authority.	object	No	Not specified	`maxProperties: 64` `minProperties: 1`
`authentication.oidc.assertionIssuers.*`Map value	array	No	Not specified	`maxItems: 16` `minItems: 1` `propertyNames.maxLength: 128` `propertyNames.minLength: 1` `propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$` `uniqueItems: true`
`authentication.oidc.assertionIssuers.*[]`Array item	string	No	Not specified	`maxLength: 512` `minLength: 1`
`authentication.oidc.audience`The audience every accepted access token must carry in `aud`.	string	Yes	Not specified	`maxLength: 512` `minLength: 1`
`authentication.oidc.issuer`Exact issuer accepted in access-token `iss` claims, an absolute `https` URL, or a plain `http` URL when `allowInsecureHttp` is set.	string	Yes	Not specified	`format: uri` `maxLength: 2048` `pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$`
`authentication.oidc.jwksSource`Where the issuer's signing keys come from. Absent reads the issuer's OpenID Connect discovery document.	object	No	Not specifiedSchema default, where declared: `{"type":"discovery"}`	None specified
`authentication.oidc.jwksSource.documentRef`An exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`authentication.oidc.jwksSource.type`	string	Yes	`discovery` `static` `uri`	None specified
`authentication.oidc.jwksSource.uri`An absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Conditional	Not specified	`format: uri` `maxLength: 2048` `pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$`
`authentication.oidc.scopeClaim`An identifier another system issues, written exactly as its issuer gives it.	string	No	Not specifiedSchema default, where declared: `"scope"`	`maxLength: 512` `minLength: 1` `pattern: ^[^\u0000-\u001F\u007F-\u009F]+$`
`cleanup`Erasure of the bytes of documents whose custodian asked for their removal.	object	Yes	Not specified	None specified
`cleanup.erasure`Whether erasure work runs. `paused` stops every erasure and the sweep of orphaned objects; a removal request still stops release at once, and lapsed uploads are still expired.	string	Yes	`active` `paused`	None specified
`contentVerification`The content verifier every document version passes before it becomes releasable.	object	Yes	Not specified	None specified
`contentVerification.attemptTimeoutMilliseconds`The longest one verification attempt may run, body included. Omitted, 10000.	integer	Conditional	Not specifiedSchema default, where declared: `10000`	`format: uint64` `maximum: 60000` `minimum: 100`
`contentVerification.authorizationRef`An exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`contentVerification.policyId`Non-secret identity of the external scanner and its rules generation.	string	Conditional	Not specified	`maxLength: 128` `minLength: 1` `pattern: ^[\x21-\x7E]+$`
`contentVerification.type`	string	Yes	`disabled` `http`	None specified
`contentVerification.url`The URL the content is posted to. It is `https`; `http` is accepted only for a loopback host, for local development.	string	Conditional	Not specified	`format: uri` `maxLength: 2048` `pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$`
`database`The PostgreSQL connection a stateful runtime uses. Both URLs are secret references and may name the same secret.	object	Yes	Not specified	None specified
`database.migrationUrlRef`Secret reference to the migration connection URL.	string	Yes	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`database.runtimeUrlRef`Secret reference to the least-privileged runtime connection URL.	string	Yes	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`database.testOnlyPlaintext`Allow a plaintext connection. Refused outside test builds.	boolean	No	Not specifiedSchema default, where declared: `false`	None specified
`database.trustedRootCertificateRef`Secret reference to a PEM root certificate the connection trusts. Absent, the connection trusts the platform's root certificates.	string	No	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`destinations`Where the project's hooks deliver, by destination id.	object	No	Not specified	None specified
`destinations.hooks`Logical URL hook destinations. The project names only these ids; the URL, signing key, and delivery budget stay deployment-owned. At most 128 are bound, each keyed by a local identifier.	object	No	Not specifiedSchema default, where declared: `{}`	`maxProperties: 128`
`destinations.hooks.*`Map valueOne URL hook destination a runtime signs and sends hook deliveries to: the URL, the HMAC-SHA256 key reference, and the delivery budget. The outbound policy is fixed: `registry-platform-hooks` activates it with no private address range and no client certificate. A runtime whose destinations need either configures its own full outbound policy instead.	object	No	Not specified	`propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$`
`destinations.hooks.*.attemptTimeoutMilliseconds`How long one delivery attempt may take, from 100 through 10000 milliseconds.	integer	No	Not specifiedSchema default, where declared: `5000`	`format: uint32` `maximum: 10000` `minimum: 100`
`destinations.hooks.*.hmacSha256KeyRef`An exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Yes	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`destinations.hooks.*.maximumAttempts`How many delivery attempts one event gets, from 1 through 20.	integer	No	Not specifiedSchema default, where declared: `8`	`format: uint8` `maximum: 20` `minimum: 1`
`destinations.hooks.*.url`An https URL, or http on 127.0.0.1, localhost, or [::1], without a query or fragment.	string	Yes	Not specified	`format: uri` `maxLength: 2048` `pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$`
`identity`Optional in the type so a missing block gets a refusal naming the key to add; the document requires it.	object	Yes	Not specified	None specified
`identity.databaseId`A local identifier: a lowercase letter, then up to 63 lowercase letters, digits, `_`, or `-`.	string	Yes	Not specified	`pattern: ^[a-z][a-z0-9_-]{0,63}$`
`kind`	string	Yes	`DocumentsRuntimeConfig`	None specified
`listener`The listener of a runtime that declares its TLS termination and network exposure.	object	Yes	Not specified	None specified
`listener.bind`Socket address the runtime listens on, written host:port with an IP address host ([addr]:port for IPv6).	string	Yes	Not specified	`maxLength: 128` `minLength: 1`
`listener.networkExposure`The operator-declared private network placement of an HTTP listener.	string	No	`container-private` `private-address` Schema default, where declared: `"private-address"`	None specified
`listener.tlsTermination`Declares the trusted transport boundary for a runtime's plaintext HTTP listener. Production listeners require operator-controlled upstream TLS termination; direct plaintext is limited to the explicit loopback-only development mode.	string	Yes	`development-loopback` `operator-controlled-upstream`	None specified
`package`The package a runtime serves: `root` is the absolute package directory, and `expectedDigest`, when set, pins the package digest the runtime must find there. The package digest is the digest of the package's `SHA256SUMS` file; see [`crate::package`].	object	Yes	Not specified	None specified
`package.expectedDigestsha256:` label of the package digest, the digest of the package's `SHA256SUMS` file. When set, the runtime refuses to start on any other package.	string	No	Not specified	`pattern: ^sha256:[0-9a-f]{64}$`
`package.root`Absolute path of the package directory.	string	Yes	Not specified	`pattern: ^/`
`retention`Retention periods, in days. A jurisdiction's retention schedule approves the deployed values; the bounds only keep a typo from becoming a policy.	object	No	Not specified	None specified
`retention.hookPayloadRetentionDays`	integer	No	Not specifiedSchema default, where declared: `7`	`format: uint32` `maximum: 30` `minimum: 1`
`retention.receiptRetentionDays`	integer	No	Not specifiedSchema default, where declared: `7`	`format: uint32` `maximum: 365` `minimum: 1`
`secretProviders`The secret providers a runtime enables. A reference is resolved only by a provider declared here: `secret:file/name` under `file.root`, and `secret:env/NAME` only when `environment: {}` is present.	object	Yes	Not specified	None specified
`secretProviders.environment`Enables `secret:env/NAME` references, read from the process environment. Declared as an empty mapping: `environment: {}`.	object	Conditional	Not specified	None specified
`secretProviders.file`Enables `secret:file/name` references, read from files under `root`.	object	Conditional	Not specified	None specified
`secretProviders.file.root`Absolute directory holding one file per secret. Each file must be a regular file owned by the runtime user, mode 0400 or 0600, with exactly one hard link.	string	Conditional	Not specified	`pattern: ^/` and, where a rule elsewhere applies `pattern: ^/`
`storage`Where document version bytes are held.	object	Yes	Not specified	None specified
`storage.accessKeyIdRef`An exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`storage.attemptTimeoutMilliseconds`The longest one request may run, body included. Omitted, 10000.	integer	Conditional	Not specifiedSchema default, where declared: `10000`	`format: uint64` `maximum: 60000` `minimum: 100`
`storage.bucket`The bucket name: lowercase letters, digits, `-` and `.`.	string	Conditional	Not specified	`maxLength: 63` `minLength: 3`
`storage.caBundleRef`PEM CA bundle for the service. Omitted, the platform's trusted roots verify it.	string	Conditional	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`storage.maximumDocumentBytes`The deployment ceiling on one document version; a policy's mandatory restriction may only be lower. Omitted, 16 MiB.	integer	No	Not specifiedSchema default, where declared: `16777216`	`format: uint64` `maximum: 16777216` `minimum: 1` or `format: uint64` `maximum: 67108864` `minimum: 1`
`storage.pathStyle`Address the bucket as a path under `url` rather than as a host name. Omitted, `true`.	boolean	Conditional	Not specifiedSchema default, where declared: `true`	None specified
`storage.region`The signing region: lowercase letters, digits and `-`.	string	Conditional	Not specified	`maxLength: 64` `minLength: 1`
`storage.secretAccessKeyRef`An exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`storage.sessionTokenRef`An exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	`pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}\|secret:file/[a-z][a-z0-9._-]{0,127})$`
`storage.type`	string	Yes	`database` `s3`	None specified
`storage.url`The service's base URL, with no path. It is `https`; `http` is accepted only for a loopback host, for local development.	string	Conditional	Not specified	`format: uri` `maxLength: 2048` `pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$`
`transfers`How long one upload or download may take: a floor, plus an allowance for every mebibyte the document carries. A transfer still running at its deadline is cut off and lets go of its bytes.	object	No	Not specified	None specified
`transfers.mebibyteAllowanceSeconds`The time added for every started mebibyte of the document.	integer	No	Not specifiedSchema default, where declared: `8`	`format: uint32` `maximum: 600` `minimum: 1`
`transfers.minimumDeadlineSeconds`The deadline of the smallest transfer.	integer	No	Not specifiedSchema default, where declared: `60`	`format: uint32` `maximum: 3600` `minimum: 1`

Check commands

Both files have a command that checks them offline, with no service, database, or secret. Each prints the diagnostics, JSON output, and exit codes that Check a file before you deploy it describes.

Format and files	Check command
Document Store project `documents.yaml`	`documentsctl check --project <project>`
Document Store runtime configuration `runtime.yaml` `runtime.example.yaml`	`documentsctl check --project <project> --runtime-config <file>`

Document Store API