To access Environment Administration, navigate to Administration > Environment > Environment Administration.
Environment Administration manages platform-wide settings for authentication, session management, security policies, rate limiting, file uploads, and logging. All settings apply across the entire environment.
Important: Modifying environment settings requires administrative permissions. Administrators needing access should contact their environment administrator.
General
Basic environment settings including site name, logging, and default behaviors.
Setting | Description |
|---|---|
Site Name | The name of the environment. Displays in the browser tab. Required. |
Hide Preview Bar by Default | When set to ON, this setting hides the preview bar by default across the environment. Default: OFF. |
PagerDuty Key | A PagerDuty key for alerting on failed server-side execution requests. Default: none. |
Environment Style | The style applied to the environment. Not editable from this page. |
Display Custom Login/Logout Settings for Applications | When set to ON, this setting enables custom login and logout settings for applications in the environment. Default: OFF. |
Default Module | The module loaded by default when no specific module is requested. Default: none. |
Server-Side Execution Logging
Controls logging verbosity for server-side execution. Higher verbosity levels might affect performance.
Setting | Description |
|---|---|
Server-Side Execution Request/Response Body Log | Controls how request and response bodies are logged during Server-Side Execution. Default: Do not capture request/response bodies. See options. |
Server-Side Execution Debug Log | Controls debug logging verbosity during Server-Side Execution. Default: Never capture debug logging. See options. |
No of Days to Keep Tracker Record | The number of days server-side execution tracker records are retained. Must be greater than 0. Default: 60. |
Server-Side Execution Request/Response Body Log options
Option | Description |
|---|---|
Do not capture request/response bodies | No request or response bodies are logged. |
Capture request/response bodies on failure | Request and response bodies are logged only when a failure occurs. |
Capture request/response bodies | All request and response bodies are logged. |
Server-Side Execution Debug Log options
Option | Description |
|---|---|
Never capture debug logging | Debug logging is disabled. |
Always capture debug bodies | Debug logging is always active. High verbosity can significantly increase memory usage. |
Google Tag Manager
Configure Google Tag Manager for analytics and tracking.
Setting | Description |
|---|---|
GTM Container ID | The Google Tag Manager container identifier. Default: none. |
GTM Environment Authentication | The authentication key for a specific GTM environment. Default: none. |
GTM Environment Preview | The preview token for a specific GTM environment. Default: none. |
Unqork API
Setting | Description |
|---|---|
Enable OAuth2 Password Grant | When set to ON, this setting enables the OAuth2 password grant type for API authentication. Default: OFF. |
Authentication
Configure password requirements and login behavior for the environment.
Setting | Description |
|---|---|
Disable Login Screen | When set to ON, this setting bypasses the default login screen. Default: OFF. |
Password Requirements
Setting | Description |
|---|---|
Number of Days to Enforce Password Reset | The number of days before end-users must reset their password. Must be greater than 0. Default: none (no reset enforced). |
Minimum Length | The minimum number of characters required for passwords. Must be between 12 and 64. Default: 12. |
Maximum Length | The maximum number of characters allowed for passwords. Must be between 12 and 64. Default: 64. |
Require Lowercase Letter | When set to ON, passwords must include at least one lowercase letter. Default: OFF. |
Require Uppercase Letter | When set to ON, passwords must include at least one uppercase letter. Default: OFF. |
Require Number | When set to ON, passwords must include at least one number. Default: OFF. |
Require Symbol | When set to ON, passwords must include at least one special character. Default: OFF. |
End-users cannot reuse any of their last 5 passwords.
Important: Setting a password reset window also blocks API calls using Password Grant when the window is exceeded, unless the credentials belong to a Service User.
Anonymous Access
Setting | Description |
|---|---|
Disable Anonymous Access | When set to ON, this setting prevents unauthenticated access to Express applications. Default: OFF. |
API Rate Limiting
Setting | Description |
|---|---|
Number of Requests per IP Address | The maximum number of requests allowed from a single IP address per server per 60 seconds. Must be between 100 and 1,000,000. Default: 100,000. |
Execution Limit
Controls the maximum number of iterations allowed during component and workflow execution to prevent infinite loops. An iteration is counted each time a component or workflow node executes as part of a chain—for example, a component that triggers another component repeatedly. These limits protect environment stability when logic is misconfigured.
Setting | Description |
|---|---|
Looping Limit for Component Execution | The maximum number of execution iterations for a component. Must be between 1 and 10,000. Default: 500. |
Looping Limit for Workflow Node Execution | The maximum number of execution iterations for a workflow node. Must be between 1 and 10,000. Default: 500. |
Express Session Administration
Configure how and when end-user sessions expire. Unqork manages sessions using a JWT with two embedded expiration times. The Inactivity Timeout controls how long the JWT remains valid after the last user action. The Session Timeout controls the maximum lifetime of the session regardless of activity.
Setting | Description |
|---|---|
Expire User Sessions in Express | Controls when end-user sessions end. |
Inactivity Timeout (Minutes) | The number of minutes before a JWT token expires due to inactivity. Must be between 5 and 1,440 (24 hours). Default: 240. |
Session Timeout (Minutes) | The number of minutes before a JWT refresh token expires, ending the session. Must be between 1 and 1,440 (24 hours). Default: 1,440. |
Express Content Security Policy (CSP)
Configure allowed sources for the environment's Content Security Policy. Enter comma-separated hostnames. Maximum 2,000 characters per field. For an explanation of CSP and how each source list works, see Environment Security Concepts.
Setting | Description |
|---|---|
Frame Source List | Hostnames that can load as frames in this environment. Default: none. |
Frame Ancestors List | Hostnames that can embed this environment in a frame. Default: none. |
Object Source List | Hostnames that can serve as sources for object, embed, and applet elements. Default: none. |
Image Source List | Hostnames that can serve as image sources. Default: none. |
Cross-Origin Resource Sharing (CORS)
For an explanation of CORS and when to configure it, see Environment Security Concepts.
Setting | Description |
|---|---|
Allowed Origins List | Comma-separated list of origins allowed to make cross-origin requests to the environment. Maximum 2,000 characters. Default: none. |
User Account Lockout
Configure automatic account lockout after repeated failed login attempts.
Setting | Description |
|---|---|
Maximum Number of User Login Attempts | The number of failed login attempts allowed before an account is locked. Must be between 2 and 10. Default: 5. |
User Account Lockout Duration (Minutes) | The number of minutes an account remains locked after exceeding the login attempt limit. Must be between 5 and 120. Default: 30. |
User Login Attempt Duration (Minutes) | The time window in which failed login attempts are counted. Must be between 5 and 120. Default: 30. |
End User Account Password
Configure how end-users set their account password.
Setting | Description |
|---|---|
Let User Set Password on Login | End-users set their own password on first login. An email is sent with a login link that expires in 24 hours. Recommended. Default: selected. |
Choose Password | Administrators set the password directly. Deprecated and less secure. |
Component Security
Setting | Description |
|---|---|
Disable Safe HTML Filters in Content Components | When set to ON, disables HTML sanitization in Content components. Use with caution—disabling this setting might expose end-users to cross-site scripting (XSS) risks. Default: OFF. |
Promote Translations
The Promote Translations action pushes all translation data from the current environment to a selected target environment. This action is available to environment administrators only and is accessible from the Promote Translations button in the Environment Administration page header.
Translations are stored separately from module definitions and are not included when a module is promoted through the standard promotions workflow. Administrators must promote translations independently to ensure higher environments display correct translated text.
To promote translations, complete the following:
Select Promote Translations in the Environment Administration header.
In the dialog, select the target environment from the drop-down.
Select Promote to confirm.
A success notification confirms when the promotion is complete. If the promotion takes longer than expected, it continues in the background. No action is needed.
Note: Promoting translations pushes all translations in the current environment to the target. If a higher environment has no translations table, end-users see source language text for all translated fields until a promotion is completed.
Quick Reference
Task | URL |
|---|---|
Check platform version |
|
Changelog
Date | Change |
|---|---|
2026-07-10 | Added DocsSettingsSection interactive mockups and default values to all settings. |
2026-08-11 | Added Promote Translations section (EN-7993). |
— | Initial publication. |