Examples

Each example is a fragment to add to your config.yaml. For the minimal required configuration, see Configuration → Minimal example.

Neo4j GDS (Graph Data Science) cluster

When running Neo4j with Graph Data Science in a cluster, queries should be directed to a secondary to avoid impacting the write leader. Add a deployment entry that points to the secondary’s address:

neo4jDeployments:
  gdscluster:
    name: "GDS Cluster (Read Replica)"
    uri: neo4j://read-replica-host:7687
    authorization:
      roleMapping:
        - role: studioAdmin
          members:
            - kind: databaseRole
              name: admin
        - role: studioCreator
          members:
            - kind: databaseRole
              name: PUBLIC

To enable data ingestion and database writes, add the write-enabled primary as a separate deployment:

neo4jDeployments:
  gdscluster:
    name: "GDS Cluster (Read Replica)"
    uri: neo4j://read-replica-host:7687
    authorization:
      roleMapping:
        - role: studioAdmin
          members:
            - kind: databaseRole
              name: admin
        - role: studioCreator
          members:
            - kind: databaseRole
              name: PUBLIC
  gdsleader:
    name: "GDS Cluster (Leader)"
    uri: neo4j://leader-host:7687
    authorization:
      roleMapping:
        - role: studioAdmin
          members:
            - kind: databaseRole
              name: admin
        - role: studioCreator
          members:
            - kind: databaseRole
              name: PUBLIC

Neo4j Infinigraph

To connect Enterprise Studio to an Infinigraph deployment, add a deployment entry pointing to the Infinigraph endpoint:

neo4jDeployments:
  infinigraph:
    name: "Infinigraph"
    uri: neo4j://infinigraph-host:7687
    authorization:
      roleMapping:
        - role: studioAdmin
          members:
            - kind: databaseRole
              name: admin
        - role: studioCreator
          members:
            - kind: databaseRole
              name: PUBLIC

Multiple deployments

You can configure as many deployments as needed. Users will see all configured deployments in the connection bar and can switch between them.

neo4jDeployments:
  production:
    name: "Production"
    uri: neo4j://prod-host:7687
    authorization:
      roleMapping:
        - role: studioAdmin
          members:
            - kind: databaseRole
              name: admin
        - role: studioCreator
          members:
            - kind: databaseRole
              name: PUBLIC
  gdsreadreplica:
    name: "GDS (Read Replica)"
    uri: neo4j://gds-replica:7687
    authorization:
      roleMapping:
        - role: studioAdmin
          members:
            - kind: databaseRole
              name: admin
        - role: studioCreator
          members:
            - kind: databaseRole
              name: PUBLIC
  infinigraph:
    name: "Infinigraph"
    uri: neo4j://infinigraph:7687
    authorization:
      roleMapping:
        - role: studioAdmin
          members:
            - kind: databaseRole
              name: admin
        - role: studioCreator
          members:
            - kind: databaseRole
              name: PUBLIC

Generative AI providers

The following examples configure the optional generative AI features described in Configuration → Generative AI. Enterprise Studio supports any endpoint that is compatible with the OpenAI Chat Completions API, so the difference between providers is the URL, how the credential is presented, and the model name. The model names below are placeholders; for what to look for in a model, see Configuration → Choosing a model.

In every example the credential is shown as my-api-key. Supply the real value through an environment variable or a Secrets Manager instead of writing it into config.yaml; see Security → Secrets management.

OpenAI

The provider is called directly and the key is sent as a bearer token:

generativeAi:
  chatCompletionProvider:
    enabled: true
    default:
      upstream:
        url: https://api.openai.com/v1/chat/completions
        apiKey: my-api-key
      model: my-model

Azure OpenAI

Use the /openai/v1 endpoint, which accepts the API key as a bearer token, so it is configured with apiKey. This also lets you read the key from a Secrets Manager with apiKeyFrom. The older api-key header endpoints are not recommended as, as they key can not be read with a Secrets Manager.

generativeAi:
  chatCompletionProvider:
    enabled: true
    default:
      upstream:
        url: https://my-resource.services.ai.azure.com/openai/v1/chat/completions
        apiKey: my-api-key
      model: my-deployment

Google Gemini

Gemini’s OpenAI-compatible endpoint accepts the API key as a bearer token, so it is configured with apiKey:

generativeAi:
  chatCompletionProvider:
    enabled: true
    default:
      upstream:
        url: https://generativelanguage.googleapis.com/v1beta/openai/chat/completions
        apiKey: my-api-key
      model: my-model

AWS Bedrock

Amazon’s OpenAI-compatible endpoint includes the region in the url and authenticates with the apiKey in the header:

generativeAi:
  chatCompletionProvider:
    enabled: true
    default:
      upstream:
        url: https://bedrock-mantle.my-region.api.aws/v1/chat/completions
        apiKey: my-api-key
      model: my-model

Gateway

Providers without an OpenAI-compatible endpoint, are reached through a gateway such as LiteLLM, Bifrost, or OpenRouter. The gateway presents the OpenAI Chat Completions API and routes on the model name, so Enterprise Studio needs no provider-specific configuration:

generativeAi:
  chatCompletionProvider:
    enabled: true
    default:
      upstream:
        url: https://openrouter.ai/api/v1/chat/completions
        apiKey: my-api-key
      model: my-model

A gateway is also the way to reach a provider with something other than an API key, such as an AWS IAM role or a Microsoft Entra ID managed identity. The gateway holds that cloud identity, and Enterprise Studio authenticates to the gateway with a key the gateway issues. See Configuration → Using a gateway for other authentication schemes.

A gateway running inside your own network may be reached over http, which keeps prompts from leaving your network:

generativeAi:
  chatCompletionProvider:
    enabled: true
    default:
      upstream:
        url: http://litellm.internal:4000/v1/chat/completions
        apiKey: my-api-key
      model: my-model

API key from a cloud Secrets Manager

Instead of a literal apiKey, resolve the key at runtime with apiKeyFrom. Enable the matching provider under secretsManager first:

secretsManager:
  gcp:
    enabled: true
    project: my-project

generativeAi:
  chatCompletionProvider:
    enabled: true
    default:
      upstream:
        url: https://api.openai.com/v1/chat/completions
        apiKeyFrom:
          secretRef:
            type: gcp
            name: nes-openai-api-key
      model: my-model

The secret payload must be the API key itself. Enterprise Studio does not parse JSON key/value objects. The same shape works with type: aws or type: azure; see Configuration → Secrets Manager.