Reference

This page lists each setting path, environment variable override, default, and valid values.

Config file metadata

`version`

Table 1. version
Environment variable	`NES_version`
Description	Schema version for this Enterprise Studio configuration file.
Default value	`1`

`kind`

Table 2. kind
Environment variable	`NES_kind`
Description	Identifies the file as an Enterprise Studio configuration.
Valid values	`neo4j-enterprise-studio-config`
Default value	`neo4j-enterprise-studio-config`

assetStore

Enterprise Studio persists tool assets in a dedicated Neo4j database under assetStore.default.

`assetStore.default.uri`

Table 3. assetStore.default.uri
Environment variable	`NES_assetStore_default_uri`
Description	Neo4j deployment URI of the tools asset database (for example `neo4j://localhost:7687`).
Default value	`neo4j://localhost:7687`

`assetStore.default.database`

Table 4. assetStore.default.database
Environment variable	`NES_assetStore_default_database`
Description	Name of the database used for tool asset storage.
Default value	`storage`

`assetStore.default.authentication`

Table 5. assetStore.default.authentication
Description	Service-account authentication method the server uses to connect to the asset storage DBMS. Configure exactly one method block: `basic`, `oidc`, or `none`. When `oidc` is set, Enterprise Studio obtains a bearer token from an external identity provider via the OAuth 2.0 client-credentials grant and uses it to authenticate to the storage database. The `oidc` sub-block fields below configure the IdP request, and the Neo4j DBMS must be configured with a matching OIDC provider that trusts the IdP. Specify `none` as an empty block (`none: {}`) to connect without authentication.

`assetStore.default.authentication.basic.username`

Table 6. assetStore.default.authentication.basic.username
Environment variable	`NES_assetStore_default_authentication_basic_username`
Description	Service account username for the asset storage connection. Set exactly one of `username` or `usernameFrom`.
Default value	`null`

`assetStore.default.authentication.basic.usernameFrom.secretRef.type`

Table 7. assetStore.default.authentication.basic.usernameFrom.secretRef.type
Environment variable	`NES_assetStore_default_authentication_basic_usernameFrom_secretRef_type`
Description	Secrets Manager type used to resolve the asset storage username. Must match an enabled provider under `secretsManager`. See Configuration → Secrets Manager.
Valid values	`aws`, `azure`, `gcp`
Default value	`null`

`assetStore.default.authentication.basic.usernameFrom.secretRef.name`

Table 8. assetStore.default.authentication.basic.usernameFrom.secretRef.name
Environment variable	`NES_assetStore_default_authentication_basic_usernameFrom_secretRef_name`
Description	Secret name in the configured provider. For AWS, the Secrets Manager secret name or ARN; the value must be a plaintext `SecretString` (not key/value JSON or `SecretBinary`). For Azure, the Key Vault secret name; the secret value must be the credential string. For GCP, the Secret Manager secret ID; the version payload must be the credential string. Required when `usernameFrom` is set.
Default value	`null`

`assetStore.default.authentication.basic.password`

Table 9. assetStore.default.authentication.basic.password
Environment variable	`NES_assetStore_default_authentication_basic_password`
Description	Service account password for the asset storage connection. Set exactly one of `password` or `passwordFrom`. In production, use `passwordFrom` with a Secrets Manager when available, or the environment variable; see Security → Secrets management.
Default value	`null`

`assetStore.default.authentication.basic.passwordFrom.secretRef.type`

Table 10. assetStore.default.authentication.basic.passwordFrom.secretRef.type
Environment variable	`NES_assetStore_default_authentication_basic_passwordFrom_secretRef_type`
Description	Secrets Manager type used to resolve the asset storage password. Must match an enabled provider under `secretsManager`. See Configuration → Secrets Manager.
Valid values	`aws`, `azure`, `gcp`
Default value	`null`

`assetStore.default.authentication.basic.passwordFrom.secretRef.name`

Table 11. assetStore.default.authentication.basic.passwordFrom.secretRef.name
Environment variable	`NES_assetStore_default_authentication_basic_passwordFrom_secretRef_name`
Description	Secret name in the configured provider. For AWS, the Secrets Manager secret name or ARN; the value must be a plaintext `SecretString` (not key/value JSON or `SecretBinary`). For Azure, the Key Vault secret name; the secret value must be the credential string. For GCP, the Secret Manager secret ID; the version payload must be the credential string. Required when `passwordFrom` is set.
Default value	`null`

`assetStore.default.authentication.oidc.tokenUrl`

Table 12. assetStore.default.authentication.oidc.tokenUrl
Environment variable	`NES_assetStore_default_authentication_oidc_tokenUrl`
Description	OAuth 2.0 token endpoint of the identity provider, used when the `oidc` method is configured. Must use the `https` scheme. For Microsoft Entra ID this is `https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token`; for Keycloak it is `https://<host>/realms/<realm>/protocol/openid-connect/token`.
Default value	`null`

`assetStore.default.authentication.oidc.clientId`

Table 13. assetStore.default.authentication.oidc.clientId
Environment variable	`NES_assetStore_default_authentication_oidc_clientId`
Description	OAuth 2.0 client ID of the service principal that Enterprise Studio authenticates as. Required when the `oidc` method is configured.
Default value	`null`

`assetStore.default.authentication.oidc.clientSecret`

Table 14. assetStore.default.authentication.oidc.clientSecret
Environment variable	`NES_assetStore_default_authentication_oidc_clientSecret`
Description	OAuth 2.0 client secret of the service principal. Set exactly one of `clientSecret` or `clientSecretFrom` when the `oidc` method is configured. In production, use `clientSecretFrom` with a Secrets Manager when available, or the environment variable; see Security → Secrets management.
Default value	`null`

`assetStore.default.authentication.oidc.clientSecretFrom.secretRef.type`

Table 15. assetStore.default.authentication.oidc.clientSecretFrom.secretRef.type
Environment variable	`NES_assetStore_default_authentication_oidc_clientSecretFrom_secretRef_type`
Description	Secrets Manager type used to resolve the OIDC client secret. Must match an enabled provider under `secretsManager`. See Configuration → Secrets Manager.
Valid values	`aws`, `azure`, `gcp`
Default value	`null`

`assetStore.default.authentication.oidc.clientSecretFrom.secretRef.name`

Table 16. assetStore.default.authentication.oidc.clientSecretFrom.secretRef.name
Environment variable	`NES_assetStore_default_authentication_oidc_clientSecretFrom_secretRef_name`
Description	Secret name in the configured provider. For AWS, the Secrets Manager secret name or ARN; the value must be a plaintext `SecretString` (not key/value JSON or `SecretBinary`). For Azure, the Key Vault secret name; the secret value must be the credential string. For GCP, the Secret Manager secret ID; the version payload must be the credential string. Required when `clientSecretFrom` is set.
Default value	`null`

`assetStore.default.authentication.oidc.scopes`

Table 17. assetStore.default.authentication.oidc.scopes
Environment variable	`NES_assetStore_default_authentication_oidc_scopes`
Description	List of OAuth 2.0 scopes requested when fetching the token. Provider-specific; for Microsoft Entra ID set this to `[api://<neo4j-app-id>/.default]`. Optional - some providers (for example Keycloak in client-credentials mode) don’t require any scopes. When overriding with an environment variable, supply the value as a JSON array, for example `["openid"]`.
Default value	`null`

`assetStore.default.queryProfiling.enabled`

Table 18. assetStore.default.queryProfiling.enabled
Environment variable	`NES_assetStore_default_queryProfiling_enabled`
Description	Whether query profiling is enabled for the Storage API.
Valid values	`true` or `false`.
Default value	`false`

`assetStore.default.logs.requestLogs.enabled`

Table 19. assetStore.default.logs.requestLogs.enabled
Environment variable	`NES_assetStore_default_logs_requestLogs_enabled`
Description	Whether per-request access logs for the Storage API are enabled.
Valid values	`true` or `false`.
Default value	`true`

neo4jDeployments

End-user Neo4j deployments shown in the Enterprise Studio connection form. Substitute your deployment ID for <deployment-id> in the config path. Deployment ID must be alphanumeric (letters and digits only). In the environment variable name, use the same deployment id.

`neo4jDeployments.<deployment-id>.name`

Table 20. neo4jDeployments.deployment-id.name
Environment variable	`NES_neo4jDeployments_<deployment-id>_name`
Description	Display name shown to users in the UI for this deployment.
Default value	`null`

`neo4jDeployments.<deployment-id>.uri`

Table 21. neo4jDeployments.deployment-id.uri
Environment variable	`NES_neo4jDeployments_<deployment-id>_uri`
Description	Neo4j deployment URI of the main database used by the server. When `directClientQuery.enabled` is `false`, the URI must use the `http` or `https` scheme, since Enterprise Studio proxies all queries over HTTP. When `directClientQuery.enabled` is `true`, the URI can use any Neo4j protocol scheme (for example `bolt`, `bolt+s`, `neo4j`, `neo4j+s`, `http`, or `https`).
Default value	`null`

`neo4jDeployments.<deployment-id>.directClientQuery.enabled`

Table 22. neo4jDeployments.deployment-id.directClientQuery.enabled
Environment variable	`NES_neo4jDeployments_<deployment-id>_directClientQuery_enabled`
Description	Whether the browser client queries the main database directly instead of routing queries through the Enterprise Studio server.
Valid values	`true` or `false`.
Default value	`false`

`neo4jDeployments.<deployment-id>.directClientQuery.publicUri`

Table 23. neo4jDeployments.deployment-id.directClientQuery.publicUri
Environment variable	`NES_neo4jDeployments_<deployment-id>_directClientQuery_publicUri`
Description	Browser-reachable Neo4j URI of the main database, used when `directClientQuery.enabled` is `true`. May differ from `neo4jDeployments.<deployment-id>.uri`, which is reachable from the server.
Default value	`null`

`neo4jDeployments.<deployment-id>.authentication.basic.enabled`

Table 24. neo4jDeployments.deployment-id.authentication.basic.enabled
Environment variable	`NES_neo4jDeployments_<deployment-id>_authentication_basic_enabled`
Description	Whether end users can sign in to this deployment with username/password (`basic`) authentication.
Valid values	`true` or `false`.
Default value	`true`

`neo4jDeployments.<deployment-id>.authentication.oidc.enabled`

Table 25. neo4jDeployments.deployment-id.authentication.oidc.enabled
Environment variable	`NES_neo4jDeployments_<deployment-id>_authentication_oidc_enabled`
Description	Whether end users can sign in to this deployment with single sign-on through an OIDC identity provider.
Valid values	`true` or `false`.
Default value	`true`

`neo4jDeployments.<deployment-id>.authorization.roleMapping`

Table 26. neo4jDeployments.deployment-id.authorization.roleMapping
Environment variable	`NES_neo4jDeployments_<deployment-id>_authorization_roleMapping`
Description	Role mapping that grants Enterprise Studio roles to Neo4j database users and roles. In _config.yaml\_, define `roleMapping` as a YAML list; each entry has a `role` (`studioAdmin` or `studioCreator`) and a `members` list, where each member has a `kind` (`databaseUser` or `databaseRole`) and a `name`. When overriding with an environment variable, set `NES_neo4jDeployments_<deployment-id>_authorization_roleMapping` to the full `roleMapping` array as a JSON string. There are no separate environment variables for individual `members` or `role` values. When omitted, the role mapping defaults to granting `studioAdmin` to the Neo4j `admin` role (`databaseRole:admin`) and `studioCreator` to the Neo4j `PUBLIC` role (`databaseRole:PUBLIC`).
Example (environment variable value)	`[{"role":"studioAdmin","members":[{"kind":"databaseRole","name":"admin"}]},{"role":"studioCreator","members":[{"kind":"databaseRole","name":"PUBLIC"}]}]`
Default value	`studioAdmin granted to databaseRole:admin; studioCreator granted to databaseRole:PUBLIC`

secretsManager

Enable a provider under secretsManager, then reference secrets from assetStore with usernameFrom, passwordFrom, or clientSecretFrom. See Configuration → Secrets Manager.

`secretsManager.aws.enabled`

Table 27. secretsManager.aws.enabled
Environment variable	`NES_secretsManager_aws_enabled`
Description	Whether Enterprise Studio resolves `secretRef` values of type `aws` from AWS Secrets Manager. When `true`, `secretsManager.aws.region` is required. See Configuration → AWS Secrets Manager.
Valid values	`true`, `false`
Default value	`false`

`secretsManager.aws.region`

Table 28. secretsManager.aws.region
Environment variable	`NES_secretsManager_aws_region`
Description	AWS Region used for Secrets Manager API calls when `secretsManager.aws.enabled` is `true`.
Default value	`null`

`secretsManager.azure.enabled`

Table 29. secretsManager.azure.enabled
Environment variable	`NES_secretsManager_azure_enabled`
Description	Whether Enterprise Studio resolves `secretRef` values of type `azure` from Azure Key Vault. When `true`, `secretsManager.azure.vaultUrl` is required. See Configuration → Azure Key Vault.
Valid values	`true`, `false`
Default value	`false`

`secretsManager.azure.vaultUrl`

Table 30. secretsManager.azure.vaultUrl
Environment variable	`NES_secretsManager_azure_vaultUrl`
Description	Azure Key Vault URI (for example `https://contoso.vault.azure.net/`) when `secretsManager.azure.enabled` is `true`.
Default value	`null`

`secretsManager.gcp.enabled`

Table 31. secretsManager.gcp.enabled
Environment variable	`NES_secretsManager_gcp_enabled`
Description	Whether Enterprise Studio resolves `secretRef` values of type `gcp` from Google Cloud Secret Manager. When `true`, `secretsManager.gcp.project` is required. See Configuration → Google Cloud Secret Manager.
Valid values	`true`, `false`
Default value	`false`

`secretsManager.gcp.project`

Table 32. secretsManager.gcp.project
Environment variable	`NES_secretsManager_gcp_project`
Description	Google Cloud project ID used for Secret Manager API calls when `secretsManager.gcp.enabled` is `true`.
Default value	`null`

tools

`tools.dashboards.enabled`

Table 33. tools.dashboards.enabled
Environment variable	`NES_tools_dashboards_enabled`
Description	Whether the Dashboards tool is shown in the Enterprise Studio UI.
Valid values	`true` or `false`.
Default value	`true`

`tools.bloom.enabled`

Table 34. tools.bloom.enabled
Environment variable	`NES_tools_bloom_enabled`
Description	Whether the Bloom tool is shown in the Enterprise Studio UI.
Valid values	`true` or `false`.
Default value	`true`

`tools.query.enabled`

Table 35. tools.query.enabled
Environment variable	`NES_tools_query_enabled`
Description	Whether the Query tool is shown in the Enterprise Studio UI.
Valid values	`true` or `false`.
Default value	`true`

license

`license.path`

Table 36. license.path
Environment variable	`NES_license_path`
Description	Filesystem path to the Enterprise license file.
Default value	`licenses/nes.license`

server

`server.port`

Table 37. server.port
Environment variable	`NES_server_port`
Description	HTTP port the Enterprise Studio server listens on.
Default value	`8080`

When running in Docker with environment-variable-only configuration, explicitly set NES_server_port=8080. The default may not be applied if no config.yaml is mounted.

`server.https.enabled`

Table 38. server.https.enabled
Environment variable	`NES_server_https_enabled`
Description	Whether the Enterprise Studio web listener serves HTTPS on `server.port`. When `false`, the server uses plain HTTP. When `true`, configure `server.https.certificates` and place certificate files on disk; see Security → TLS. Outbound trust to Neo4j is configured separately; see Binary deployment. Enterprise Studio reads HTTPS settings only at startup; restart the server after changes.
Valid values	`true` or `false`.
Default value	`false`

`server.contentSecurityPolicyHeader`

Table 39. server.contentSecurityPolicyHeader
Environment variable	`NES_server_contentSecurityPolicyHeader`
Description	Content-Security-Policy header value for static assets served by the server. If omitted, a default policy is applied automatically. Set to an empty string (`""`) to disable the header entirely.
Default value	The default policy shown below is applied when this setting is omitted. `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com/; img-src 'self' data: blob:; media-src 'self' data: blob:; connect-src 'self' ws: wss: http: https:; worker-src 'self' blob:; child-src 'self' blob:; form-action 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'`

`server.https.certificates.baseDirectory`

Table 40. server.https.certificates.baseDirectory
Environment variable	`NES_server_https_certificates_baseDirectory`
Description	Directory for TLS certificate files when `server.https.enabled` is `true`, relative to the installation home unless an absolute path is set.
Default value	`certificates/https`

`server.https.certificates.privateKey`

Table 41. server.https.certificates.privateKey
Environment variable	`NES_server_https_certificates_privateKey`
Description	Private key filename within `server.https.certificates.baseDirectory`. Must be an unencrypted PKCS#8 PEM file (`BEGIN PRIVATE KEY`).
Default value	`private.key`

`server.https.certificates.publicCertificate`

Table 42. server.https.certificates.publicCertificate
Environment variable	`NES_server_https_certificates_publicCertificate`
Description	Public certificate filename within `server.https.certificates.baseDirectory`.
Default value	`public.crt`

mapTiles

`mapTiles.enabled`

Table 43. mapTiles.enabled
Environment variable	`NES_mapTiles_enabled`
Description	Whether map tiles are served by the Enterprise Studio server for use by the Dashboards map visualization. By default, the Neo4j PMTiles provider tiles.neo4j.io/current/planet.pmtiles is used. Set to `false` to disable maps entirely; this is recommended for air-gapped deployments without outbound internet access where no self-hosted tile provider is configured.
Valid values	`true` or `false`
Default value	`true`

To serve a custom basemap instead of the default Neo4j PMTiles provider, configure mapTiles.customTilesProvider. The block has three parts: format (the tile data shape), upstream (where to fetch the tiles — exactly one of http or file), and output (what the proxy returns to the browser). When the whole block is omitted, the bundled Neo4j PMTiles dataset is served.

`mapTiles.customTilesProvider.format.type`

Table 44. mapTiles.customTilesProvider.format.type
Environment variable	`NES_mapTiles_customTilesProvider_format_type`
Description	Tile data format of the custom provider. Required when `customTilesProvider` is configured. `raster`: raster XYZ tiles. The upstream URL must contain the placeholder template `{z}/{x}/{y}`. Served over `upstream.http` only. `pmtiles`: a single-file PMTiles dataset with no placeholders. Served over `upstream.http` or `upstream.file`.
Valid values	`raster` or `pmtiles`
Default value	`null`

`mapTiles.customTilesProvider.format.tileSize`

Table 45. mapTiles.customTilesProvider.format.tileSize
Environment variable	`NES_mapTiles_customTilesProvider_format_tileSize`
Description	Edge length, in pixels, of one raster tile (usually `256`, or `512` for high-density "@2x" tiles). Only valid when `format.type` is `raster`.
Default value	`256`

`mapTiles.customTilesProvider.upstream.http.url`

Table 46. mapTiles.customTilesProvider.upstream.http.url
Environment variable	`NES_mapTiles_customTilesProvider_upstream_http_url`
Description	URL of the upstream tile provider, proxied through the Enterprise Studio server. For `raster` format, the URL must contain the placeholder template `{z}/{x}/{y}`. For `pmtiles` format, it must be a single-file URL with no placeholders. Set exactly one of `upstream.http` or `upstream.file`.
Default value	`null`

`mapTiles.customTilesProvider.upstream.http.headers`

Table 47. mapTiles.customTilesProvider.upstream.http.headers
Environment variable	`NES_mapTiles_customTilesProvider_upstream_http_headers`
Description	Map of HTTP headers forwarded to the upstream provider on every request — used for API keys or bearer tokens the provider requires. When overriding with an environment variable, set the value to a JSON object, for example `{"X-API-Key":"…"}`.
Default value	`null`

`mapTiles.customTilesProvider.upstream.file.path`

Table 48. mapTiles.customTilesProvider.upstream.file.path
Environment variable	`NES_mapTiles_customTilesProvider_upstream_file_path`
Description	Absolute filesystem path to a single PMTiles file served by the proxy. Only valid for `pmtiles` format. Set exactly one of `upstream.http` or `upstream.file`.
Default value	`null`

`mapTiles.customTilesProvider.output.corsAllowOrigin`

Table 49. mapTiles.customTilesProvider.output.corsAllowOrigin
Environment variable	`NES_mapTiles_customTilesProvider_output_corsAllowOrigin`
Description	Value sent in the `Access-Control-Allow-Origin` response header for the reverse-proxied `/map-tiles` requests. Set to a specific origin (for example, `https://studio.example.com`) to restrict tile access to your own domain when the tile provider requires it.
Default value	`*`

`mapTiles.customTilesProvider.output.attributionLabel`

Table 50. mapTiles.customTilesProvider.output.attributionLabel
Environment variable	`NES_mapTiles_customTilesProvider_output_attributionLabel`
Description	Attribution label rendered in the map. Required for compliance with most tile providers' terms of service.
Default value	`null`

`mapTiles.customTilesProvider.output.attributionUrl`

Table 51. mapTiles.customTilesProvider.output.attributionUrl
Environment variable	`NES_mapTiles_customTilesProvider_output_attributionUrl`
Description	URL linked from the attribution label rendered in the map.
Default value	`null`

logs

`logs.level`

Table 52. logs.level
Environment variable	`NES_logs_level`
Description	Log level for general server logs.
Valid values	One of `debug`, `info`, `warn`, or `error`.
Default value	`info`

`logs.format`

Table 53. logs.format
Environment variable	`NES_logs_format`
Description	Log output format; `json` is recommended for production.
Valid values	One of `json` or `pretty`.
Default value	`json`