API request filters

Phase 1 preview — pages render fixture data only; no changes are saved.

Preview only. Nothing is created, rotated, revoked or enforced from this screen, and no credential is generated. Secrets and token values are never shown.

User-agent filter

Rejects API requests whose User-Agent starts with one of the listed values (case-insensitive prefix, not a substring). With the master switch off, nothing is blocked.

Block API clients by user agent

The master switch.

Also block requests with no user agent

Has no effect unless the master switch is on. SCIM requests are exempt.

Blocked user agents

One prefix per line; blank lines are ignored. Matching is a prefix: curl/ blocks curl/8.5.0.

Cancel Saving settings is not available in Phase 1 — this screen previews the current configuration.

Controlled by the environment (read-only)

Legacy has no screen for these, and no IP allow/deny list, API switch or request-size limit exists, so none is offered.

Behaviour	Environment variable	Effective value
API rate limit	API_THROTTLE_PER_MINUTE	120 requests per minute, per user or address
Token lifetime	API_TOKEN_EXPIRATION_YEARS	15 years
CORS allowed origins	CORS_ALLOWED_ORIGINS	2 origins
Trusted proxies	APP_TRUSTED_PROXIES	Set in the environment
Trusted hosts	APP_ALLOW_INSECURE_HOSTS	Set in the environment