Configure system configuration

Connected System configuration variables hold non-auth deployment parameters — tenant ids, base URLs, feature flags, and portal-collected values — resolved at upload and surfaced in the dataplane Configuration tab.

Prerequisites

<systemKey>-system.json scaffolded
Configure authentication complete (auth secrets stay in authentication.credential.security, not duplicated here)
Builder help topic connectedSystemUi when handing off to the UI

Where it lives

Layer	Location
Configuration entries	`<systemKey>-system.json` → `configuration[]`
Deploy resolution	`env.template` and upload pipeline merge `{{NAME}}` placeholders
UI	Connected System Configuration tab (`?tab=configuration`)

Manifest section: system.configuration. Each item requires name, value, location, and required.

Builder MCP


Manifest section	`system.configuration`
UI tab	Configuration (`?tab=configuration`)
Help topics	`section`, `connectedSystemUi`, `repairRules`
Repair hooks	env.template sync via `repair`

How to set

Separate auth from configuration — vendor tokens and OAuth secrets belong under authentication. Use configuration for tenant scope, API base overrides, and operator-entered text fields.
Add configuration rows with uppercase name keys and literal or template value:

{
  "configuration": [
    {
      "name": "BASE_URL",
      "value": "https://api.example.com",
      "location": "variable",
      "required": true
    },
    {
      "name": "TENANT_ID",
      "value": "{{TENANT_ID}}",
      "location": "variable",
      "required": true,
      "portalInput": {
        "field": "text",
        "label": "Tenant identifier",
        "placeholder": "Your vendor tenant id"
      }
    }
  ]
}

Use location: variable for deploy-time parameters and keyvault only when the platform resolves vault-backed values (not raw secrets in committed JSON).
Align env.template — repair regenerates template entries from configuration and authentication security kv paths:

aifabrix repair <systemKey>
aifabrix validate <systemKey>

Upload and confirm UI — non-secret authentication.credential.variables and configuration values publish pre-filled; operators add only missing secrets in Authentication.

Defaults and examples

Practice	Reason
Uppercase `name` keys	Matches deploy and env.template conventions
`portalInput` on operator fields	Reduces re-entry after upload
Avoid secrets in `configuration`	Auth block owns credential storage
Repair after manual JSON edits	Keeps env.template and deploy JSON aligned

CIP steps and Business Entity configuration[] are separate — system configuration defines variables; entity configuration overrides values per Business Entity. See Configure entity configuration.

Validate

aifabrix validate <systemKey>
aifabrix upload <systemKey> --probe

Open Configuration on the Connected System detail page and confirm published values match manifest intent.

Common mistakes

Mistake	Fix
API key in `configuration`	Move to `authentication.credential.security`
Missing `required: true` on tenant fields	Fail fast at upload instead of runtime
Stale `env.template`	Run `aifabrix repair <systemKey>`
Duplicate auth variables	Remove auth-only names from `configuration`

Documentation Index