Registry Messaging configuration reference

Look up configuration keys for messaging.yaml, each template version’s template.yaml, each provider package’s provider.yaml, and the operator’s runtime.yaml.

Scope

Keys follow the current grammar, which is not frozen.

messaging.yaml is the authored package: sender profiles, access profiles, and the templates and providers it uses. templates/<id>/<version>/template.yaml declares one template version’s channel, locales, and parts. providers/<id>/provider.yaml declares an HTTP provider package and its capabilities. runtime.yaml is the operator’s deployment file: listener, database, package, identity, authentication, provider connections, audit, and retention.

A schema-valid document still needs the checks messagingctl check runs, because cross-file references, template rendering, and provider scripts cannot be expressed in a schema. Configuration files describes the YAML rules and environment substitution that apply when the runtime reads runtime.yaml.

Read the tables

fields[] means an array item; providers.* means a map entry whose name you choose. Required fields inside an optional object apply when that object is present. Conditional fields depend on the selected variant or another configuration value. Accepted values list the union across variants; constraints separated by or are alternatives. A schema default applies only where that variant declares it. Not specified does not mean that every value is accepted.

• messaging.yaml Source preview, pre-1.0, 46 key paths
• templates/*/*/template.yaml Source preview, pre-1.0, 7 key paths
• providers/*/provider.yaml Source preview, pre-1.0, 15 key paths
• runtime.yaml Source preview, pre-1.0, 96 key paths

messaging.yaml

Source preview, pre-1.0

Generated from products/messaging/generated/authoring/project.schema.json. 46 key paths. Explained in docs/site/src/content/docs/reference/messaging-configuration.mdx.

Key path	Type	Required	Accepted values	Constraints
accessProfilesWho may call the deployment, at least one profile: a project that names no caller serves none.	array	Yes	Not specified	maxItems: 256 minItems: 1
accessProfiles[]Array itemOne declared caller profile.	object	No	Not specified	None specified
accessProfiles[].actorKindThe actor kind the token must claim. Absent means any kind.	string	No	agent human service	None specified
accessProfiles[].allowDirectContent	boolean	No	Not specifiedSchema default, where declared: false	None specified
accessProfiles[].burst	integer	Yes	Not specified	format: uint32 maximum: 10000 minimum: 1
accessProfiles[].idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
accessProfiles[].maximumMessagesPerDayThe most messages the profile may submit in any 24 hours. Absent means no daily bound beyond the rate.	integer	No	Not specified	format: uint32 maximum: 10000000 minimum: 1
accessProfiles[].principalClaimsub, or the name of another string claim identifying the principal.	string	Yes	Not specified	maxLength: 512 minLength: 1 pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
accessProfiles[].requesterClientsThe OAuth clients whose tokens resolve to this profile, at least one.	array	Yes	Not specified	minItems: 1 uniqueItems: true
accessProfiles[].requesterClients[]Array itemAn identifier another system issues, written exactly as its issuer gives it.	string	No	Not specified	maxLength: 512 minLength: 1 pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
accessProfiles[].requestsPerMinute	integer	Yes	Not specified	format: uint32 maximum: 60000 minimum: 1
accessProfiles[].requiredScopesThe scopes a token must carry: unrestricted, or a list of at least one scope. Held as the listed scopes, so unrestricted is the empty list.	array | string	Yes	unrestricted	No bound or minItems: 1 uniqueItems: true
accessProfiles[].requiredScopes[]Array itemAn identifier another system issues, written exactly as its issuer gives it.	string	Conditional	Not specified	maxLength: 512 minLength: 1 pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
accessProfiles[].roleWhat a profile is for. A sender submits and reads its own messages; an operator reads and acts on every message but submits none.	string	Yes	operator sender	None specified
accessProfiles[].senderProfilesThe sender profiles a sender may select; an operator lists none.	array	No	Not specifiedSchema default, where declared: []	uniqueItems: true
accessProfiles[].senderProfiles[]Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
accessProfiles[].templatesThe templates a sender may use, by id, every declared version; an operator lists none.	array	No	Not specifiedSchema default, where declared: []	uniqueItems: true
accessProfiles[].templates[]Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
apiVersion	string	Yes	id.registrystack.org/formats/messaging/project/v1alpha1	None specified
kind	string	Yes	MessagingProject	None specified
projectThe members that name a project (CFG-ENV-6): a project's project block holds these, and may add project-wide members of the product's own. Schema name ProjectIdentity.	object	Yes	Not specified	None specified
project.idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
project.version	string	Yes	Not specified	None specified
providers	array	No	Not specified	maxItems: 256
providers[]Array itemOne declared provider, referenced by sender profiles through id.	object	No	Not specified	None specified
providers[].idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
providers[].idempotentSubmitThe provider deduplicates submissions on the idempotency key the runtime sends, so sending one message twice delivers it once. This is the one declaration of that capability: an HTTP provider's scripts see the key only when it is set, and an smtp provider may not set it.	boolean	No	Not specifiedSchema default, where declared: false	None specified
providers[].typeThe transport a provider speaks. Its endpoint and credentials are runtime configuration; only the type is project.	string	Yes	http smtp	None specified
senderProfiles	array	No	Not specified	maxItems: 256
senderProfiles[]Array itemWhat a caller selects: a channel, the provider carrying it, the sender identity, for SMS the most segments one message may use, and how the worker retries, holds, and expires its messages.	object	No	Not specified	None specified
senderProfiles[].acceptDuplicatesThe operator's explicit choice that a duplicate message is better than a missed one, which permits onUncertain: retry through a provider that does not deduplicate.	boolean	No	Not specifiedSchema default, where declared: false	None specified
senderProfiles[].channelA delivery channel.	string	Yes	email sms	None specified
senderProfiles[].defaultExpirySecondsHow long an accepted message may wait to be sent when its request names no expiresAt. Absent means [DEFAULT_EXPIRY_SECONDS].	integer	No	Not specified	format: uint32 maximum: 2592000 minimum: 60
senderProfiles[].idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
senderProfiles[].maximumSegmentsFor SMS, and only for SMS, the most segments one message may use.	integer	No	Not specified	format: uint8 maximum: 10 minimum: 1
senderProfiles[].onUncertainWhat happens when a send may have reached the provider.	string	No	hold retry Schema default, where declared: "hold"	None specified
senderProfiles[].providerA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
senderProfiles[].retryHow a send that definitely failed is retried. Absent means the defaults [SenderProfile::retry_policy] reports.	object	No	Not specified	None specified
senderProfiles[].retry.initialDelaySeconds	integer	Yes	Not specified	format: uint32 maximum: 86400 minimum: 1
senderProfiles[].retry.maximumAttempts	integer	Yes	Not specified	format: uint8 maximum: 20 minimum: 1
senderProfiles[].retry.maximumDelaySecondsAt least initialDelaySeconds.	integer	Yes	Not specified	format: uint32 maximum: 86400 minimum: 1
senderProfiles[].senderThe from address for email, the sender identifier for SMS.	string	Yes	Not specified	maxLength: 254 minLength: 1
templates	array	No	Not specified	maxItems: 256 uniqueItems: true
templates[]Array itemOne template version the project declares.	object	No	Not specified	None specified
templates[].idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
templates[].versionA version label: 1 to 32 lowercase letters, digits, dots, or hyphens, starting with a letter or digit. Quote a numeric one.	string	Yes	Not specified	maxLength: 32 minLength: 1 pattern: ^[a-z0-9][a-z0-9-]*(\.[a-z0-9-]+)*$

templates/*/*/template.yaml

Source preview, pre-1.0

Generated from products/messaging/generated/authoring/template.schema.json. 7 key paths. Explained in docs/site/src/content/docs/reference/messaging-configuration.mdx.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/messaging/template/v1alpha1	None specified
channelA delivery channel.	string	Yes	email sms	None specified
kind	string	Yes	MessagingTemplate	None specified
localesThe locales the version ships, at least one and at most 32, each with its own directory.	array	Yes	Not specified	maxItems: 32 minItems: 1 uniqueItems: true
locales[]Array item	string	No	Not specified	pattern: ^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|[0-9]{3}))?$
partsThe parts every locale renders: subject and text, and optionally html, for email; text alone for SMS.	array	Yes	Not specified	minItems: 1 uniqueItems: true
parts[]Array itemA part of a message.	string	No	html subject text	None specified

providers/*/provider.yaml

Source preview, pre-1.0

Generated from products/messaging/generated/authoring/provider.schema.json. 15 key paths. Explained in docs/site/src/content/docs/reference/messaging-configuration.mdx.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/messaging/provider/v1alpha1	None specified
capabilitiesWhat a provider can do, declared by the package. Whether it deduplicates submissions is declared once, as idempotentSubmit on the provider in messaging.yaml, where the sender profile checks read it.	object	Yes	Not specified	None specified
capabilities.maximumConcurrentRequestsThe most sends the provider accepts at once, 1 to 64. A deployment's maximumConcurrentRequests for the provider is at most this.	integer	Yes	Not specified	format: uint16 maximum: 64 minimum: 1
capabilities.ratePerSecondThe provider's documented send rate, 1 to 1000. The worker enforces it at claim time; this module only checks it.	integer	No	Not specified	format: uint32 maximum: 1000 minimum: 1
capabilities.receiptsHow a provider reports delivery after accepting a message.	string	Yes	callback none reconcile	None specified
interpretScriptPackage path of the script whose interpret(response) classifies the response. Without one, the status code decides.	string	No	Not specified	maxLength: 256 pattern: ^([a-z0-9_-][a-z0-9._-]*/)*[a-z0-9_-][a-z0-9._-]*\.rhai$
kind	string	Yes	MessagingProvider	None specified
prepareScriptPackage path of the script whose prepare(message, profile) returns the request.	string	Yes	Not specified	maxLength: 256 pattern: ^([a-z0-9_-][a-z0-9._-]*/)*[a-z0-9_-][a-z0-9._-]*\.rhai$
receiptScriptPackage path of the script whose receipt(request) reads a verified delivery callback. Required exactly when capabilities.receipts is callback.	string	No	Not specified	maxLength: 256 pattern: ^([a-z0-9_-][a-z0-9._-]*/)*[a-z0-9_-][a-z0-9._-]*\.rhai$
requestThe request shape a prepare script fills.	object	Yes	Not specified	None specified
request.headersRequest headers the prepare script may set, lowercase, at most 16. The authorization, host, content, cookie, and forwarding headers are never script-writable. Omitted, a script sets none.	array	No	Not specifiedSchema default, where declared: []	maxItems: 16 uniqueItems: true
request.headers[]Array item	string	No	Not specified	maxLength: 128 minLength: 1 pattern: ^[a-z0-9!#$%&'*+.^_`|~-]+$
request.methodThe method one send uses.	string	Yes	get post	None specified
responseHeadersResponse headers the interpret script may read, lowercase, at most 16. Omitted, a script reads none.	array	No	Not specifiedSchema default, where declared: []	maxItems: 16 uniqueItems: true
responseHeaders[]Array item	string	No	Not specified	maxLength: 128 minLength: 1 pattern: ^[a-z0-9!#$%&'*+.^_`|~-]+$

runtime.yaml

Source preview, pre-1.0

Generated from products/messaging/generated/runtime/runtime.schema.json. 96 key paths. Explained in docs/site/src/content/docs/reference/messaging-configuration.mdx.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/messaging/runtime/v1alpha1	None specified
auditWhere the audit journal is written and the key its hashes are made with.	object	Yes	Not specified	None specified
audit.destinationWhere audit entries go: a rotated file (the default) or stdout.	string	No	file stdout Schema default, where declared: "file"	None specified
audit.hashKeyRefSecret reference to the audit hash key.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
audit.pathThe absolute path of the active audit file, for destination: file.	string	No	Not specified	pattern: ^/
audit.retentionDaysHow many days a sealed audit file is kept.	integer	No	Not specified	format: uint32 maximum: 36500 minimum: 1
audit.rotateBytesThe size at which the active file is sealed and a new one begun.	integer	No	Not specified	format: uint64 maximum: 4294967295 minimum: 1048576
authentication	object	Yes	Not specified	None specified
authentication.oidcThe OIDC issuer whose access tokens this runtime accepts, the clients it admits, and the claim carrying their scopes.	object	Yes	Not specified	None specified
authentication.oidc.allowInsecureHttpPermit plain HTTP beyond loopback to the configured issuer and to a JWKS URI declared in configuration. TLS remains required unless the operator explicitly accepts this transport risk.	boolean	No	Not specifiedSchema default, where declared: false	None specified
authentication.oidc.allowedClientsClient identifiers whose access tokens are admitted. Required in every file; an omitted or empty list, an empty or repeated client, and unrestricted are refused.	array	Yes	Not specified	minItems: 1 uniqueItems: true
authentication.oidc.allowedClients[]Array item	string	No	Not specified	minLength: 1
authentication.oidc.assertionIssuersAssertion authorities each client may exchange a subject token from, keyed by client identifier. Omitted, no assertion-issuer rule applies; written, it lists at least one client, each with at least one authority. Once a client is listed, a token it exchanged is accepted only for one of that client's declared authorities, and a client that is not listed may exchange from no authority.	object	No	Not specified	maxProperties: 64 minProperties: 1
authentication.oidc.assertionIssuers.*Map value	array	No	Not specified	maxItems: 16 minItems: 1 propertyNames.maxLength: 128 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$ uniqueItems: true
authentication.oidc.assertionIssuers.*[]Array item	string	No	Not specified	maxLength: 512 minLength: 1
authentication.oidc.audienceThe audience every accepted access token must carry in aud.	string	Yes	Not specified	maxLength: 512 minLength: 1
authentication.oidc.issuerExact issuer accepted in access-token iss claims, an absolute https URL, or a plain http URL when allowInsecureHttp is set.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
authentication.oidc.jwksSourceWhere the issuer's signing keys come from. Absent reads the issuer's OpenID Connect discovery document.	object	No	Not specifiedSchema default, where declared: {"type":"discovery"}	None specified
authentication.oidc.jwksSource.documentRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
authentication.oidc.jwksSource.type	string	Yes	discovery static uri	None specified
authentication.oidc.jwksSource.uriAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Conditional	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
authentication.oidc.scopeClaim	string	No	Not specifiedSchema default, where declared: "scope"	None specified
databaseThe PostgreSQL connection a stateful runtime uses. Both URLs are secret references and may name the same secret.	object	Yes	Not specified	None specified
database.migrationUrlRefSecret reference to the migration connection URL.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
database.runtimeUrlRefSecret reference to the least-privileged runtime connection URL.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
database.testOnlyPlaintextAllow a plaintext connection. Refused outside test builds.	boolean	No	Not specifiedSchema default, where declared: false	None specified
database.trustedRootCertificateRefSecret reference to a PEM root certificate the connection trusts. Absent, the connection trusts the platform's root certificates.	string	No	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
identityThe logical database identity this deployment owns. It is independent of the connection URL and PostgreSQL database name.	object	Yes	Not specified	None specified
identity.databaseId	string	Yes	Not specified	maxLength: 256 minLength: 1
kind	string	Yes	MessagingRuntimeConfig	None specified
listenerThe listener of a runtime that declares its TLS termination and network exposure.	object	Yes	Not specified	None specified
listener.bindSocket address the runtime listens on, written host:port with an IP address host ([addr]:port for IPv6).	string	Yes	Not specified	maxLength: 128 minLength: 1
listener.networkExposureThe operator-declared private network placement of an HTTP listener.	string	No	container-private private-address Schema default, where declared: "private-address"	None specified
listener.tlsTerminationDeclares the trusted transport boundary for a runtime's plaintext HTTP listener. Production listeners require operator-controlled upstream TLS termination; direct plaintext is limited to the explicit loopback-only development mode.	string	Yes	development-loopback operator-controlled-upstream	None specified
metricsListenerThe listener of a runtime that declares no TLS or exposure settings.	object	No	Not specified	None specified
metricsListener.bindSocket address the runtime listens on, written host:port with an IP address host ([addr]:port for IPv6).	string	Yes	Not specified	maxLength: 128 minLength: 1
packageThe package a runtime serves: root is the absolute package directory, and expectedDigest, when set, pins the package digest the runtime must find there. The package digest is the digest of the package's SHA256SUMS file; see [crate::package].	object	Yes	Not specified	None specified
package.expectedDigestsha256: label of the package digest, the digest of the package's SHA256SUMS file. When set, the runtime refuses to start on any other package.	string	No	Not specified	pattern: ^sha256:[0-9a-f]{64}$
package.rootAbsolute path of the package directory.	string	Yes	Not specified	pattern: ^/
providersThe runtime half of each package provider, by provider id: where the provider is and how the runtime authenticates to it. A package provider with no entry has no transport, and its messages fail with provider-unconfigured.	object	No	Not specified	None specified
providers.*Map valueOne provider's runtime half. The package declares the provider's type, and for an http provider its scripts; the two halves must name the same type.	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
providers.*.acknowledgeQueryStringContentRequired, and only allowed, when the package sends with get: the message content travels in the query string, where provider access logs keep it.	boolean	Conditional	Not specifiedSchema default, where declared: false	None specified
providers.*.allowedPrivateCidrsFor smtp: Exact RFC 1918, CGNAT, or unique-local networks the relay may resolve into. Every other non-public address is refused. For http: Exact RFC 1918, CGNAT, or unique-local networks an https provider may resolve into, for an in-country gateway on a private network. Every other non-public address is refused. Omitted, the provider may resolve only to public addresses.	array	No	Not specifiedSchema default, where declared: []	maxItems: 16
providers.*.allowedPrivateCidrs[]Array item	string	No	Not specified	None specified
providers.*.attemptTimeoutMillisecondsFor smtp: How long one attempt may take, from 1000 to 60000 milliseconds; omitted, 30000. For http: One send's whole budget in milliseconds: resolution, connection, request, and response.	integer	Conditional	Not specifiedSchema default, where declared: 30000	format: uint64 maximum: 60000 minimum: 1000 or format: uint64 maximum: 10000 minimum: 1
providers.*.authenticationFor smtp: The credential pair the relay authenticates, as secret: references. For http: How a send authenticates to the provider, chosen by type. The credential is added by Rust after the prepare script returns; no script ever sees it.	object	Conditional	Not specified	None specified
providers.*.authentication.accessKeyIdRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.authentication.assumedLifetimeSecondsThe lifetime assumed, in seconds, when the token response carries no expires_in. Omitted, expires_in is required.	integer	Conditional	Not specified	format: uint64 maximum: 86400 minimum: 10
providers.*.authentication.audience	string	Conditional	Not specified	None specified
providers.*.authentication.clientIdRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.authentication.clientSecretRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.authentication.credentialPlacementWhere the client secret travels. The token request carries it in the form body; basic-header is refused until the substrate can place it there.	string	Conditional	basic-header form-body	None specified
providers.*.authentication.headerName	string	Conditional	Not specified	None specified
providers.*.authentication.maximumCacheSecondsThe longest a fetched token is reused, in seconds.	integer	Conditional	Not specified	format: uint64 maximum: 86400 minimum: 10
providers.*.authentication.parameterName	string	Conditional	Not specified	None specified
providers.*.authentication.passwordRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.authentication.region	string	Conditional	Not specified	None specified
providers.*.authentication.resource	string	Conditional	Not specified	None specified
providers.*.authentication.scheme	string	Conditional	Not specified	None specified
providers.*.authentication.scope	string	Conditional	Not specified	None specified
providers.*.authentication.secretAccessKeyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.authentication.service	string	Conditional	Not specified	None specified
providers.*.authentication.sessionTokenRefThe session token for temporary credentials. Omitted, the request is signed without one.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.authentication.tokenEndpointAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Conditional	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
providers.*.authentication.tokenRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.authentication.type	string	Conditional	aws-sigv4 basic none oauth2-client-credentials static-api-key static-api-key-query static-authorization	None specified
providers.*.authentication.usernameRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.authentication.valueRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.baseUrlThe provider's origin and path prefix, ending in /. Every request target a script returns is relative to it and stays under it. https in production; http only to a loopback host.	string	Conditional	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
providers.*.callbackVerifierHow the provider's delivery callbacks are authenticated. Required exactly when the package declares receipts: callback.	object	Conditional	Not specified	None specified
providers.*.callbackVerifier.encodingHow an hmac-sha256-body tag is encoded in its header.	string	Conditional	base64 hex	None specified
providers.*.callbackVerifier.headerThe header carrying the signature.	string	Conditional	Not specified	maxLength: 128 minLength: 1 pattern: ^[!#$%&'*+.^_`|~0-9A-Za-z-]+$
providers.*.callbackVerifier.secretRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.callbackVerifier.tokenRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.callbackVerifier.type	string	Conditional	hmac-sha1-url-form hmac-sha256-body path-token	None specified
providers.*.callbackVerifier.urlThe external callback URL the provider was given and signs, as it was given: scheme, host, any port, and path, without a query or fragment. The route appends the request's own query string. A proxy may rewrite what the runtime receives, so the runtime never reconstructs this URL from the request.	string	Conditional	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$ pattern: ^https?://[^/?#]+/[^?#]*$
providers.*.hostThe relay's DNS name or IP literal. It is resolved once per attempt and is the name TLS verifies the relay's certificate against.	string	Conditional	Not specified	None specified
providers.*.maximumConcurrentRequestsThe most sends this deployment has in flight to the provider, at most the package's declared capabilities.maximumConcurrentRequests.	integer	Conditional	Not specified	format: uint16 maximum: 64 minimum: 1
providers.*.maximumResponseBytesThe largest response body read, at most 1 MiB.	integer	Conditional	Not specified	format: uint64 maximum: 1048576 minimum: 1
providers.*.portDefaults to 587 for starttls and 465 for implicit; required for development-loopback.	integer	Conditional	Not specified	format: uint16 maximum: 65535 minimum: 1
providers.*.redirectsRedirect handling. A provider redirect is never followed.	string	Conditional	deny	None specified
providers.*.tlsHow the connection to the relay is protected.	string	Conditional	development-loopback implicit starttls	None specified
providers.*.tlsTrustProfileThe operator-declared trust bundle the provider's certificate may chain to, by its name under tlsTrustProfiles. Its roots are trusted in addition to the system roots, not instead of them. The runtime resolves the name to PEM and passes it to [HttpProviderSettings::activate].	string	Conditional	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
providers.*.trustedRootCertificateRefA PEM root certificate trusted in addition to the public web roots, for a relay behind a private certificate authority.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
providers.*.type	string	Yes	http smtp	None specified
retentionRetention periods the retention sweep enforces. Every value is deployment configuration: a jurisdiction's retention schedule approves the deployed numbers, and the audit journal records them at startup.	object	No	Not specified	None specified
retention.payloadRetentionDaysHow long a message's rendered payload and recipient contact are kept, from 1 to 30 days.	integer	No	Not specifiedSchema default, where declared: 7	format: uint16 maximum: 30 minimum: 1
retention.receiptRetentionDaysHow long a submission receipt stays replayable under its idempotency key, from one day to the record period and at most 365 days.	integer	No	Not specifiedSchema default, where declared: 7	format: uint16 maximum: 365 minimum: 1
retention.recordRetentionDaysHow long the content-free message record is kept, at least as long as the payload and at most ten years.	integer	No	Not specifiedSchema default, where declared: 90	format: uint16 maximum: 3650 minimum: 1
secretProvidersThe secret providers a runtime enables. A reference is resolved only by a provider declared here: secret:file/name under file.root, and secret:env/NAME only when environment: {} is present.	object	Yes	Not specified	None specified
secretProviders.environmentEnables secret:env/NAME references, read from the process environment. Declared as an empty mapping: environment: {}.	object	Conditional	Not specified	None specified
secretProviders.fileEnables secret:file/name references, read from files under root.	object	Conditional	Not specified	None specified
secretProviders.file.rootAbsolute directory holding one file per secret. Each file must be a regular file owned by the runtime user, mode 0400 or 0600, with exactly one hard link.	string	Conditional	Not specified	pattern: ^/ and, where a rule elsewhere applies pattern: ^/
tlsTrustProfilesNamed PEM bundles an http provider's tlsTrustProfile trusts in addition to the system roots, at most 64.	object	No	Not specified	maxProperties: 64
tlsTrustProfiles.*Map valueA PEM bundle of one or more certificate authorities, held in the secret provider so it is read under the same file checks as every credential.	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
tlsTrustProfiles.*.bundleRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$

Check commands

Every file Registry Messaging reads has a command that checks it offline, with no service running. Each prints the diagnostics, JSON output, and exit codes that Check a file before you deploy it describes.

Format and files	Check command
Messaging project messaging.yaml	messagingctl check --project <project>
Messaging template version templates/*/*/template.yaml	messagingctl check --project <project>
Messaging HTTP provider package providers/*/provider.yaml	messagingctl check --project <project>
Messaging runtime configuration runtime.yaml runtime.example.yaml	messagingctl check --project <project> --runtime-config <file>
Messaging template data schema templates/*/*/schema.json	None

Next

• Author a Messaging package to change templates and sender profiles.
• Registry Messaging API contract for routes, limits, and problem codes.
• Deploy Registry Messaging to write and check runtime.yaml.