Configuration reference¶

You can configure the anonymization and pseudonymization rules in the anonymization.yaml config file. There is no default: the service fails to start unless AnonymizationEngineConfigPath or AnonymizationEngineConfigInline is set. See De-identification and Tools for Health Data Anonymization for details on the syntax and options.

Additionally, there are some optional configuration values that can be set as environment variables:

Environment Variable	Description	Default
`AnonymizationEngineConfigPath`	Path to the `anonymization.yaml` that contains the rules to transform the resources.	`""`
`AnonymizationEngineConfigInline`	The `anonymization.yaml` as an inline YAML string instead of a separate file. Takes precedence if both `Path` and `Inline` are set.	`""`
`Auth__Jwt__Authority`	Issuer of the OAuth 2.0 access tokens in JWT format required for protected endpoints, i.e. `$re-identify`, e.g. `https://keycloak.example.com/realms/example`. Signing keys are fetched from its OpenID Connect discovery document. If unset, protected endpoints reject every request. See Authentication.	`""`
`Auth__Jwt__Audience`	The value tokens must have in their `aud` claim. Required if `Auth__Jwt__Authority` is set.	`""`
`Auth__Jwt__MetadataAddress`	Overrides where the discovery document is fetched from, e.g. if the service reaches the issuer under an internal address.	`"{Authority}/.well-known/openid-configuration"`
`Auth__Jwt__RequireHttpsMetadata`	Whether the discovery document must be fetched over HTTPS. Only disable this for local development.	`true`
`Auth__Jwt__RequiredScope`	If set, tokens must include this scope in their `scope` (or `scp`) claim.	`""`
`Auth__Jwt__RequiredRole`	If set, tokens must include this role in their `roles` claim or in Keycloak's `realm_access.roles`.	`""`
`PseudonymizationService`	The type of pseudonymization service to use. Can be one of `gPAS`, `Vfps`, `entici`, `Mii`, `None`. Must be set to a service if the `anonymization.yaml` uses the `pseudonymize` method, otherwise an error is logged at startup and resources matching those rules fail to be processed.	`"None"`
`Metrics__Enabled`	Whether metrics in Prometheus format should be exposed on `Metrics__Port` under the `/metrics` route.	`true`
`Metrics__Port`	The port where metrics in Prometheus format should be exposed at under the `/metrics` route.	`8081`
`Kestrel__MaxRequestBodySize`	The maximum allowed size, in bytes, of an incoming HTTP request body (e.g. a large FHIR Bundle posted to `$de-identify`). Requests exceeding this are rejected with `413 Payload Too Large`. Increase this if you need to process large Bundles.	`30000000`
`SecretsDirectory`	Directory read for Docker/Kubernetes-style file-per-secret mounts: each file's name becomes a configuration key (e.g. a file named `Anonymization__CryptoHashKey` sets that value) and its content becomes the value, taking precedence over `appsettings.json`/env vars/command line if both are set. Optional - ignored if the directory doesn't exist.	`"/run/secrets"`
`Anonymization__CryptoHashKey`	Sets the key used by the `cryptoHash` method, whichever algorithm it uses. This is an alternative to setting it inside the anonymization.yaml's `parameters` section and useful to more securely set sensitive information.	`""`
`Anonymization__EncryptKey`	Sets the AES encryption key. This is an alternative to setting it inside the anonymization.yaml's `parameters` section and useful to more securely set sensitive information.	`""`
`Anonymization__KeyDerivationContext`	Derives `Anonymization__CryptoHashKey`/`Anonymization__EncryptKey` from this context instead of using them directly. See Key Derivation.	`""`
`Anonymization__ShouldAddSecurityTag`	Whether the `Resource.meta.security` element should be filled with information about the de-identification methods applied to the resource.	`true`

See appsettings.json for additional options.

Service-specific settings¶

The application supports pseudonymization using gPAS, Vfps, entici or an MII-compliant service, which can be configured via the PseudonymizationService setting. Their settings are listed on each service's page.

Settings for reading from Kafka are listed under Reading from Kafka.